---
summary: "@cyanheads/mcp-ts-core ^0.9.7 → ^0.9.13; HTTP body cap, session-init gate, quieter auth error logging, ValidationError codes, dep refresh"
breaking: false
security: false
---

# 0.1.4 — 2026-05-28

## Changed

- **`@cyanheads/mcp-ts-core`** ^0.9.7 → ^0.9.13 — picks up HTTP transport hardening and DX improvements (see below).
- **HTTP body cap** — oversized inbound requests rejected with `413` before the SDK parses the body; configurable via `MCP_HTTP_MAX_BODY_BYTES` (default 1 MiB).
- **HTTP session-init gate** — stateful HTTP mode now returns `400` for requests arriving without an `Mcp-Session-Id` header, preventing uninitialized sessions from being minted on first contact.
- **Auth error log noise** — expected client errors (401, 403, 400, 404) logged at `warning` level instead of full error-pipeline with stack traces.
- **`GET /mcp` keywords** — `package.json` `keywords` surfaced on the HTTP status endpoint alongside `name`, `version`, and `description`.
- **`landing.requireAuth: false`** — server opts in to serving the full tool/resource/prompt inventory on the public HTTP endpoint regardless of auth mode.
- **Error codes** — `openstates_search_bills`, `openstates_get_bill`, and `openstates_get_legislators_by_location` corrected from `InvalidParams` → `ValidationError` for client-input errors.

## Dependency bumps

- `@cyanheads/mcp-ts-core` ^0.9.7 → ^0.9.13
- `@biomejs/biome` ^2.4.7 → ^2.4.16
- `@types/node` ^25.6.0 → ^25.9.1
- `tsc-alias` ^1.8.16 → ^1.8.17
- `typescript` ^5.9.3 → ^6.0.3
- `vitest` ^4.1.0 → ^4.1.7