---
summary: Bump @cyanheads/mcp-ts-core 0.7.0 → 0.7.6, resync 7 skills and 1 script (+ 1 new), adopt 0.7.4 form-client safety guidance in CLAUDE.md/AGENTS.md checklist
breaking: false
---

# 2.4.2 — 2026-04-27

Maintenance release — no functional code changes in `src/`. Six framework patches adopted across the 0.7.0 → 0.7.6 range; this server doesn't exercise any of the reshaped surfaces (no auth strategy, no landing page, no LLM provider), so the security/landing fixes apply automatically and the rest is documentation + skill/script bookkeeping.

## Changed

- **Framework bump: `@cyanheads/mcp-ts-core` 0.7.0 → 0.7.6.** Non-breaking per upstream. Security hardening from [0.7.1](https://github.com/cyanheads/mcp-ts-core/issues/61) (loopback-only Origin guard default, validated landing bearer, raw payload removed from completion logs) applies automatically — this server runs `MCP_AUTH_MODE=none` and has no landing-page customization, so no code action. Stricter `format-parity` numeric normalization from [0.7.3](https://github.com/cyanheads/mcp-ts-core/issues/58) — devcheck passes against this server's `format()` outputs.
- **Skills resynced from framework.** Version-bumped: `api-linter` 1.1 → 1.2, `maintenance` 1.5 → 1.7, `release-and-publish` 2.1 → 2.2, `setup` 1.5 → 1.6. Force-synced (content drift, version unbumped): `api-utils` (SSRF guard reframed as best-effort with DNS-rebinding caveat per [0.7.3](https://github.com/cyanheads/mcp-ts-core/issues/60)), `field-test` and `design-mcp-server` (description-leak audit categories — implementation details / meta-coaching / consumer-aware phrasing — per [0.7.5](https://github.com/cyanheads/mcp-ts-core/issues/74)).
- **Scripts resynced from framework.** `scripts/devcheck.ts` picked up the new "Framework Antipatterns" check step from [0.7.2](https://github.com/cyanheads/mcp-ts-core/issues/68); `scripts/check-framework-antipatterns.ts` is the new step's runner. Three SDK-coupling rules scan `src/` — clean on first run.
- **`CLAUDE.md` / `AGENTS.md` adopted 0.7.4 form-client safety guidance.** Optional-fields checklist line now names the `z.union([z.literal(''), z.string().regex(...).describe(...)])` alternative for cases where regex/length constraints matter enough to surface in JSON Schema; literal variants are exempt from `describe-on-fields` per [cyanheads/mcp-ts-core#67](https://github.com/cyanheads/mcp-ts-core/issues/67).
- **Dependency updates.** `@cyanheads/mcp-ts-core` ^0.7.0 → ^0.7.6 (production); `@cloudflare/workers-types` ^4.20260424.1 → ^4.20260426.1 and `repomix` ^1.13.1 → ^1.14.0 (dev).