---
summary: "mcp-ts-core ^0.9.9 → ^0.9.13: 413 body cap, HTTP session-init gate, quieter 401/403/400/404 logging, GET /mcp surfaces keywords; landing.requireAuth explicit; plugin metadata scaffolded"
breaking: false
security: false
---

# 2.5.2 — 2026-05-28

## Changed

- **`@cyanheads/mcp-ts-core`** ^0.9.9 → ^0.9.13 — framework adoption picks up four releases:
  - **`MCP_HTTP_MAX_BODY_BYTES`** — new configurable inbound body cap on the HTTP MCP endpoint (default 1 MiB); oversized requests rejected with 413 before any parsing or session allocation.
  - **HTTP session-init gate** — stateful HTTP mode now returns 400 on requests arriving without an `Mcp-Session-Id` header before the session is established.
  - **Quieter expected-error logging** — 401, 403, 400, and 404 HTTP errors now log at `warning` level without stack traces, reducing noise in error logs.
  - **`GET /mcp` keywords** — `package.json` `keywords` now surface on the status JSON alongside `name`, `version`, and `description`.
- **`landing.requireAuth: false`** — added to `createApp()` to explicitly opt the landing page into full inventory serving; required because 0.9.13 changed the default to auth-gated when `MCP_AUTH_MODE` is `jwt` or `oauth`.
- **`manifest.json`** — `repository`, `homepage`, and `license` fields added.
- **`.claude-plugin/`** and **`.codex-plugin/`** — plugin metadata files scaffolded for Claude Code and Codex discovery.

## Dependencies

- `@cyanheads/mcp-ts-core` ^0.9.9 → ^0.9.13
- `@biomejs/biome` ^2.4.15 → ^2.4.16
- `@cloudflare/workers-types` ^4.20260526.1 → ^4.20260529.1