All notable changes to mcp will be documented here.
The format is based on Keep a Changelog.
- fix(core): reject dot segments in API request paths (#470)
- fix(deps): override vulnerable transitive deps flagged by pnpm audit (#469)
- feat(tokens): accept an org allowlist in create_token (#457)
- feat(ferrfleet-mcp): add marketplace import and connector tools (#446)
- feat(ferrfleet-mcp): list GitHub installations and create the GitHub connector (#445)
- feat(ferrfleet-mcp): list and set repository bindings of an agent (#444)
- feat(ferrfleet-mcp): add list_runner_pools and runner_pool_id on update_agent (#442)
- feat(ferrfleet-mcp): add create_agent tool (#440)
- fix(ferrfleet-mcp): accept the org ids FerrLabs issues (#435)
- feat(ferrfleet-mcp): choose the organization per tool call (#430)
- feat(ferrfleet): send x-ferrfleet-org header when FERRFLEET_ORG_ID is set (#429)
- feat(ferrvault-api-mcp): add create_ferrvault_vault and create_ferrvault_environment tools (#427)
- feat(mcp): update_agent and org token tools (#428)
- feat(vault): add secret copy and service token tools to @ferrvault/api-mcp (#424)
- feat(vault): add secret request tools to @ferrvault/api-mcp (#422)
- feat(vault): add @ferrvault/api-mcp for the FerrVault product API (#421)
- feat(lens): add the @ferrlens/mcp server (#412)
- fix(mcp): extract fetch_docs content from the docs article and cache pages (#410)
- fix: restore the node 22 engines floor (#411)
- fix(track)!: prefix the FerrTrack issue and project list tools (#408)
- feat(core): add a --version flag to every server (#406)
- fix(mcp): send invite_org_member to the invitations endpoint (#407)
- feat(growth): upload media through the MCP (#405)
- fix(growth): expose form destinations and stop sending an ignored submissions limit (#404)
- feat(growth): add blog post, email template and media tools (#398)
- fix(growth): send get_analytics_summary's window as range_days (#401)
- feat(growth): add site admin tools and fix get_form (#399)
- feat(growth): add funnel, realtime, heatmap, tracking and contact tools (#397)
- feat(growth): add page-level and bulk SEO audit tools (#396)
- fix(transport)!: take the OAuth resource from FERRLABS_MCP_PUBLIC_URL and parse Host headers properly (#387)
- fix(release): drop the pnpm flags that pnpm 12 rejects (#386)
- feat(mcp): expose resources and prompts alongside the tools (#358)
- fix(track,growth): negotiate the API contract by date header instead of a v1 prefix (#355)
- feat(core): cap tool responses instead of dumping the whole payload into the context (#336)
- fix(mcp): refuse to mint an API token unless the operator opted into the transcript exposure (#334)
- fix(core): release the listener and the per-request server both transports leaked (#333)
- fix(core): stop leaking credentials through baseUrl, redirects and shared token state (#331)
- perf(ci): cancel superseded pull request runs (#328)
- fix(fleet): negotiate the API contract by date header instead of a v1 prefix (#323)
- fix(docker): build mcp-core before the workspace install injects it (#322)
- refactor!: move product sub-MCPs to their product npm scope (#319)
- fix(deps): pin fast-uri, hono, nanoid and qs above their advisories (#321)
- fix(docker): injecte les paquets du workspace dans l'image au lieu d'un lien mort (#265)
- fix(ci): accorde pull-requests write au job appelant les reusables (#260)
- feat!: appelle l'API FerrLabs à la racine, sans préfixe /v1 (#233)
- fix(ci): repair renovate-rebase.yml truncated by the pin sweep (#218)
- fix(ci): move pnpm overrides to workspace and patch hono (#209)
- fix(transport): harden HTTP transport CORS, bind, host, and body size (#188)
- fix(http): add timeout and redirect control to outbound fetch calls (#186)
- fix(server): read MCP server version from package.json at runtime (#183)
- feat(mcp): admin tools — org/members/teams/billing/sessions/profile + gets/updates (#165)
- fix(http): emit RFC 6749 OAuth error body on 401 so mcp-remote can authenticate (#164)
- feat(mcp): round out CRUD across vault, track, growth sub-MCPs (#150)
- fix(mcp-core): port-fallback works on EADDRINUSE (was async-reject vs sync try/catch) (#153)
- fix(mcp-core): handle CORS preflight so browser clients can authenticate (#148)
- fix(mcp-track): hit api.ferrtrack.com with real route shapes; add project tools (#147)
- feat(mcp): broaden sub-MCP tool surfaces across vault, track, growth, fleet (#145)
- fix(mcp-core): clear persisted token + cache on 401 and retry OAuth on next call (#139)
- fix(http): point OAuth discovery at api.ferrlabs.com (auth.ferrlabs.com is the SPA, not metadata) (#136)
- feat(http): OAuth protected-resource discovery — 401 + WWW-Authenticate triggers client OAuth flow (#128)
- feat: add @ferrlabs/mcp-track, @ferrlabs/mcp-growth, @ferrlabs/mcp-fleet sub-MCPs (#127)
- feat(workspace)!: split MCP into pnpm workspace with shared mcp-core + sub-MCPs (#126)
- fix(http): return 404 on unknown session-id so clients can re-init transparently (#125)
- fix(api-client): forward token via Authorization Bearer too + surface non-JSON errors (#124)
- fix(docker): reuse node:alpine's built-in UID 1000 user (no addgroup conflict) (#123)
- fix(docker): pin app user to UID 1000 so K8s runAsNonRoot validates (#122)
- fix(docker): disable husky postinstall in Dockerfile build (no .git in context) (#121)
- feat(transport): dual-transport — stdio default + Streamable HTTP for hosted use (#120)
- fix(auth): use rundll32 on Windows to avoid cmd & parsing breaking the OAuth URL (#119)
- feat(auth): OAuth 2.0 loopback PKCE flow + persistence (closes #113) (#117)
- feat(auth): OAuth 2.0 loopback PKCE flow on first authenticated tool call — the MCP opens
auth.ferrlabs.comin the user's browser, captures the callback on a loopback port, and persists the token. No more manualFERRLABS_API_TOKENpaste for desktop users (#113) - feat(auth): token persistence per OS conventions (
%APPDATA%\ferrlabs\mcp\token.jsonon Windows,~/.config/ferrlabs/mcp/token.jsonon Linux,~/Library/Application Support/...on macOS). File mode0600on Unix. - feat(auth): new env knobs —
FERRLABS_AUTH_URL(override auth host),FERRLABS_MCP_NO_OAUTH=1(disable OAuth fallback for CI),FERRLABS_MCP_TOKEN_PATH(override persistence path),FERRLABS_MCP_NO_PERSIST=1(in-memory only) FERRLABS_API_TOKENstill works and short-circuits the OAuth dance — safe to keep in CI configs
- feat(license)!: relicense from MIT to MPL-2.0 to match FerrFlow (#116)
- feat!: rename package from
@ferrflow/mcpto@ferrlabs/mcp(#111) - feat!: default
API_URLis nowhttps://api.ferrlabs.com(washttps://api.ferrflow.com) (#111) - feat!: prefer
FERRLABS_API_TOKEN;FERRFLOW_API_TOKENaccepted as a fallback for one release (#111) - feat!: authenticated endpoint paths now use the
/v1prefix to match the unified FerrLabs API router (#111) - feat!:
revoke_tokenswitched fromPOST /tokens/{id}/revoketoDELETE /v1/auth/tokens/{id}(#111) - feat!: drop FerrFlow CLI-specific tools —
dry_run,validate_config,read_config,read_changelog,list_release_tags,record_eventremoved. They required either a local FerrFlow CLI install or HMAC-signed payloads the MCP doesn't produce. The MCP is now platform-focused; product-specific docs are reachable viafetch_docs. (#111)
- feat(tools): add
list_orgsandlist_projects(FerrLabs organizations + projects) (#111) - feat(tools): add
list_vaults(FerrVault — secrets management) (#111) - feat(tools): add
list_issues(FerrTrack — issue tracker) (#111) - feat(tools): add
list_subscriptions(per-product subscription status) (#111) - feat(tools): add
fetch_docs(product, slug)— fetch documentation/marketing pages from any FerrLabs product site (ferrflow, ferrvault, ferrtrack, ferrgrowth, ferrfleet, ferrlens, ferrlabs) (#111)
- fix(ci): downgrade release.yml pnpm action v6->v5 + FERRFLOW_TOKEN fallback (#94)
- fix(ci): downgrade pnpm/action-setup v6 -> v5 with pinned version (#93)
- fix(ci): rebrand GHCR + GitHub URLs from ferrflow-org to ferrlabs (#91)
- feat(tools): add validate_config tool (#67)
- feat: publish @ferrflow/mcp to npm on release (#64)
- chore!: remove Docker and HTTP transport, stdio only (#58)
- feat(tools): add dry_run tool (#55)
- feat(tools): add dry_run tool (#55)
- feat: add stdio transport for local usage (#52)
- feat(tools): add read_changelog tool (#49)
- feat(tools): add list_release_tags tool (#46)
- fix(ci): trigger Docker builds on tag creation and use v* tag format (#29)
- feat: add read_config tool (#24)
- feat: initial release
- feat(config): migrate ferrflow config from TOML to JSON
- feat: add Dockerfile and Docker build to CI
- feat: add CI with FerrFlow release action
- feat: initialize MCP server with project templates
- fix: add /health endpoint for K8S readiness probe
- fix: add @types/node for HTTP server types
- fix: use HTTP transport and push latest tag
- fix: pin FerrFlow action to @v0
- feat: initial release
- feat(config): migrate ferrflow config from TOML to JSON
- feat: add Dockerfile and Docker build to CI
- feat: add CI with FerrFlow release action
- feat: initialize MCP server with project templates
- fix: add /health endpoint for K8S readiness probe
- fix: add @types/node for HTTP server types
- fix: use HTTP transport and push latest tag
- fix: pin FerrFlow action to @v0