# Changelog

All notable changes to [SpotDraft MCP](https://github.com/spotdraft/spotdraft-mcp) are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Version numbers match the npm package [`@spotdraft/spotdraft-mcp`](https://www.npmjs.com/package/@spotdraft/spotdraft-mcp).

## [Unreleased]

## [0.2.0] - 2026-03-25

### Added

- **Write tools** (opt-in only): `upload_contract_version`, `send_contract_to_counterparties`, `create_contract_approvals`, `add_contract_comment`. Enable with `SD_MCP_ENABLE_WRITE` (`true` / `1` / `yes`) or HTTP query `enable_write=true`. Disabled clients receive `403` / `WRITE_DISABLED` ([#38](https://github.com/spotdraft/spotdraft-mcp/pull/38)).
- **Datadog APM** integration (`dd-trace`) with serverless-init–friendly Docker setup ([#28](https://github.com/spotdraft/spotdraft-mcp/pull/28)).

### Changed

- SpotDraft API requests now send the caller **User-Agent** from the MCP request ([#33](https://github.com/spotdraft/spotdraft-mcp/pull/33)).
- Docker base image switched to **`node:20-slim`** for glibc compatibility with Datadog init ([#31](https://github.com/spotdraft/spotdraft-mcp/pull/31)).

### Fixed

- **`Enforce-User-Scoping`** header added to SpotDraft API calls for both Basic Auth and OAuth flows ([#35](https://github.com/spotdraft/spotdraft-mcp/pull/35)).
- **HTTP/OAuth**: per-request MCP transport and cached **`TokenVerifier`** to avoid shared mutable transport state ([#30](https://github.com/spotdraft/spotdraft-mcp/pull/30)).
- Dependency **vulnerability** remediation ([#32](https://github.com/spotdraft/spotdraft-mcp/pull/32)).

### Security

- **Dependency overrides** for transitive packages: Hono stack, `@hono/node-server`, `express-rate-limit`, `minimatch`, and MCP inspector `ajv` resolution ([#39](https://github.com/spotdraft/spotdraft-mcp/pull/39)).

### Documentation

- **`get_contract_list`**: documented **`contract_id`** filter ([#36](https://github.com/spotdraft/spotdraft-mcp/pull/36)).

---

## [0.1.0] - 2026-02-11

First **0.1.x** line on npm: dependency refresh, removal of unused `commander`, and the feature set below.

### Added

- **Stdio** (default) and **HTTP** server modes (`--http`): `/health`, **`POST /mcp`** for MCP; **`GET` / `DELETE` on `/mcp`** return **405** ([#24](https://github.com/spotdraft/spotdraft-mcp/pull/24)).
- **[MCP Authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)**-style **OAuth 2.0** (JWT + JWKS) alongside existing **Basic Auth** (`clientId:clientSecret` as Bearer) ([#23](https://github.com/spotdraft/spotdraft-mcp/pull/23)). **`/.well-known/oauth-protected-resource`** when OAuth env vars are set.
- **Contract** tools: list (filters, sort, status, query params), download link, status, activity log, approvals, key pointers, text content; **templates**; **counter parties**; **workspace facets**; **contract types** and **key pointers** listings.
- **User impersonation / scoping** support via configuration and API headers ([#6](https://github.com/spotdraft/spotdraft-mcp/pull/6), [#15](https://github.com/spotdraft/spotdraft-mcp/pull/15)).
- **Docker** image and **CI/CD** workflows for container builds and environment promotion.

### Changed

- **Project layout** refactored under `src/` (handlers, auth, tools, servers) ([#16](https://github.com/spotdraft/spotdraft-mcp/pull/16)).
- README trimmed for public use ([#27](https://github.com/spotdraft/spotdraft-mcp/pull/27)).

### Fixed

- OAuth: **token issuer** configurable separately from authorization server URL ([#25](https://github.com/spotdraft/spotdraft-mcp/pull/25)).
- Contract **content** tool base URL ([#9](https://github.com/spotdraft/spotdraft-mcp/pull/9)).

---

## Earlier 0.0.x history

Pre-**0.1.0** releases on npm used **0.0.3**–**0.0.7** with incremental additions (HTTP/Docker, metadata filtering, contract list enhancements, facets, internal token support, etc.). See `git log` for full detail.