---
summary: "Adopt `rateLimited()` error factory; document `MCP_PUBLIC_URL`; refresh bundled skills from mcp-ts-core 0.6"
breaking: false
---

# 2.3.5 — 2026-04-23

### Changed

- **`rateLimited` error factory adoption** — `clinical-trials-service.ts` now throws via `rateLimited()` (new in mcp-ts-core 0.6) instead of constructing `new McpError(JsonRpcErrorCode.RateLimited, ...)` directly on the 429 exhaustion path. Same wire behavior, tighter call site.
- **`.env.example`** — Documented `MCP_PUBLIC_URL` (public origin when the server runs behind a TLS-terminating proxy), exposed by framework 0.6.

### Dependencies

- Upgraded `@cyanheads/mcp-ts-core` from `^0.5.3` to `^0.6.10`. Brings: `rateLimited()` error factory, `MCP_PUBLIC_URL` auth-origin override, refreshed skill content, and the `api-linter` reference doc.
- Bumped devDeps: `@cloudflare/workers-types`, `@types/bun`, `@vitest/coverage-istanbul`, `vite`, `vitest`.

### Chores

- **New skills synced from framework** — `api-linter` (1.0) and `release-and-publish` (2.0) added to `skills/`. `release-and-publish` wired into `CLAUDE.md` / `AGENTS.md` Publishing section as the canonical post-wrapup ship path.
- **Skill sync** — Refreshed bundled skills: `add-app-tool`, `add-prompt`, `add-resource`, `add-service`, `add-tool`, `api-context`, `api-services` (+ `graph`/`llm`/`speech` refs), `api-utils` (+ `formatting`/`parsing`/`security` refs), `design-mcp-server`, `field-test`, `maintenance`, `polish-docs-meta` (+ `package-meta`/`readme` refs), `setup`.