---
summary: "mcp-ts-core ^0.12.3 adopts MCP SDK v2 on the wire — strict tool inputs, JSON Schema 2020-12, an outputSchema declaring the error envelope, and protocol revision 2026-07-28 — plus discovery cache hints and a stateless session pin"
breaking: false
security: false
---

# 0.7.2 — 2026-08-24

## Added

- **`cacheHints` on the five static discovery methods** — `tools/list`, `prompts/list`, `resources/list`, `resources/templates/list`, and `server/discover` advertise a 1-hour `public` TTL. `resources/read` is left unset: every resource proxies live FEC data.
- **`.github/CONTRIBUTING.md` and `.github/CODE_OF_CONDUCT.md`** — how to file, how to tell a server bug from a framework bug, and the conduct policy.
- **`MCP_SESSION_MODE` in the README env table**, matching the `stateless` the published container already pins. `.env.example` documents that pin plus `MCP_PUBLIC_URL`, `MCP_HTTP_RESUMABILITY*`, and `MCP_LOG_RATE_LIMIT_*`.

## Changed

- **Tool inputs are strict** — an unrecognized argument key is rejected by name (`Unrecognized key: "cyle"`) instead of being silently dropped. All 12 tools take flat inputs, so this applies at the root of every one.
- **Advertised `inputSchema` / `outputSchema` are JSON Schema 2020-12**, not draft-07, and carry `additionalProperties: false`.
- **The advertised `outputSchema` declares the error envelope** — a client validating `structuredContent` without checking `isError` stops rejecting error results.
- **Protocol revision 2026-07-28 is served on every HTTP endpoint** alongside the 2025 revisions. `resources: { subscribe: true }` is advertised and backed, `ctx.log` also emits `notifications/message` to the client, and `transport.sessionMode` reports the resolved mode rather than `auto`.
- **`OpenFecService` passes the handler `Context` straight to `fetchWithTimeout` and `withRetry`** — `Context extends RequestContext` as of mcp-ts-core 0.12.0, so the local `toRequestContext` adapter is deleted.
- **Docker stages move to `oven/bun:1.4.0`.** The build stage pins `--platform=$BUILDPLATFORM` — it emits platform-independent JavaScript and Bun's JSC aborts under QEMU — and both production installs add `--omit=peer`.
- **`tsconfig.json` typechecks `src/` and `tests/` with `noEmit`; `tsconfig.build.json` emits from `src/` only.** `tests/` had never been typechecked: 20 suites now build mock contexts against each definition's `errors[]` contract via `createMockContext({ errors })` and narrow `format()` blocks through a local text helper instead of casting, dropping ~168 `ctx as unknown as Context` casts. Test count is unchanged at 510.
- **`devcheck.config.json`** — `outdated.allowlist` emptied; no package is held any more.
- **Framework files re-synced** — 25 skills under `skills/` (mirrored to `.claude/skills/`), `scripts/lint-mcp.ts`, `scripts/lint-packaging.ts`, `scripts/tree.ts`, and `changelog/template.md`. Both issue forms gain secondary-label guidance and `assignees: ["cyanheads"]`.

## Fixed

- **`bun run tree` honors directory-only gitignore patterns again** — `ignore` needs the trailing slash to tell a directory from a file of the same name, so `.claude/` was rendering into `docs/tree.md`.
- **`.github/SECURITY.md`** routes vulnerability reports to `security@caseyjhand.com`.

## Dependencies

- `@cyanheads/mcp-ts-core` ^0.11.0 → ^0.12.3 (nine releases; the SDK swap from `@modelcontextprotocol/sdk` to `@modelcontextprotocol/server` is framework-internal — this server never imported the SDK)
- `@biomejs/biome` ^2.5.5 → ^2.5.10
- `@types/node` ^26.1.1 → 26.2.0 (repinned exact, matching the framework)
- `tsc-alias` ^1.9.1 → ^1.9.2
- `vitest` ^4.1.10 → ^4.1.11
- `packageManager` bun@1.3.14 → bun@1.4.0
- Re-resolving stale transitive lockfile entries takes `bun audit` from 33 advisories to 0 — `hono`, `fast-uri`, `ip-address`, `js-yaml`, `nanoid`, `postcss`, `vite`, `brace-expansion`. No first-party code was involved.