osv advisory mcp server changelog

https://raw.githubusercontent.com/cyanheads/osv-advisory-mcp-server/HEAD/AGENTS.md

− **Version:** 0.4.1− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.18`− **Engines:** Bun ≥1.4.0, Node ≥24.0.0−     .default(10000)− > **This server has no required env vars.** OSV.dev is fully public and keyless. `OSV_REQUEST_TIMEOUT_MS`, `OSV_BATCH_CONCURRENCY`, and `OSV_QUERY_MAX_PAGES` are optional positive values with defaults of 10000 ms, 10, and 10. Invalid values fail startup rather than silently defaulting.+ **Version:** 0.5.1+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.22`+ **Engines:** Bun ≥1.4.4, Node ≥24.0.0+     .default(40000)+   batchServeOverCap: z+     .stringbool({ truthy: ['true'], falsy: ['false'], case: 'sensitive' })+     .default(true),+     batchServeOverCap: 'OSV_BATCH_SERVE_OVER_CAP',+ > **This server has no required env vars.** OSV.dev is public and keyless. `OSV_REQUEST_TIMEOUT_MS`, `OSV_BATCH_CONCURRENCY`, and `OSV_QUERY_MAX_PAGES` default to 40000 ms, 10, and 10. `OSV_BATCH_SERVE_OVER_CAP` defaults to `true` and accepts only `true` or `false`. Invalid values fail startup.+ Package, commit and batch queries have one 50-second operation deadline, distinct from caller cancellation. A batch cursor advances only through fully hydrated pages, including during field retrieval. A `/results` page preserves the active row's checkpoint and identifies the first unread row with `page.nextOffset`. Field retrieval repeats the same input cursor on resumed package and commit queries. Batch submission remainders use `summary.nextInputOffset`, while field pages address only the proc+       ecosystem-catalog.ts              # Canonical ecosystem names and base-name case normalization

version

0.5.0 → 0.5.1

env_vars

OSV_REQUEST_TIMEOUT_MS, OSV_BATCH_CONCURRENCY, OSV_QUERY_MAX_PAGES, MCP_LOG_LEVEL → OSV_REQUEST_TIMEOUT_MS, OSV_BATCH_CONCURRENCY, OSV_QUERY_MAX_PAGES, MCP_LOG_LEVEL, OSV_BATCH_SERVE_OVER_CAP

version

0.4.1 → 0.5.0

https://raw.githubusercontent.com/cyanheads/osv-advisory-mcp-server/HEAD/AGENTS.md

− **Version:** 0.3.0− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`− **MCP SDK:** `@modelcontextprotocol/server` ^2.3.1− Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool. `bun run list-skills` prints the full registry. The directory is deliberately not `skills/`: Claude Code and Codex auto-load a plugin's root `skills/`, so a server that ships `.claude-plugin/` or `.codex-plugin/` would hand these development skills to every agent that installs it. Keep `skills/` free for skills meant f− | `bun run lint:packaging` | Packaging surface checks — `server.json`/`manifest.json` env-var parity (run by devcheck) |− `bun run bundle` produces a `.mcpb` extension bundle for one-click install in Claude Desktop. The pack step is followed by `scripts/clean-mcpb.ts`, which prunes dev dependencies (`mcpb clean`) and strips two classes of `node_modules/**` content that root-anchored `.mcpbignore` patterns cannot reach: dependency-shipped agent docs (`framework-skills/`, `skills/`, `.claude/`, `.agents/`, `SKILL.md`) and platform-specific native bindings, which would otherwise lock the bundle to the platform it was + **Version:** 0.4.1+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.18`+ **MCP SDK:** `@modelcontextprotocol/server` ^2.4.0+ Two skill trees serve different readers. `framework-skills/` holds development skills synced from the framework; read the matching skill directly or run `bun run list-skills`. Root `skills/` holds the published `osv-advisory-guide` for agents auditing dependencies and retrieving advisory pages. It ships through plugins, npm, MCPB, and Docker, and `createApp({ skills: 'skills' })` serves it over MCP. Keep development skills out of that tree.+ | `add-skill` | Author a published root `skills/` guide for agents calling the server — gates, identifier chains, validation, and delivery |+ | `bun run lint:packaging` | Packaging surface checks — env-var parity, MCPB exclusions, plugins, and published skills (run by devcheck) |+ Root `plugin.json` and `mcp.json` carry the Agent Plugins 1.0.0 manifest and stdio connection. Keep both client overlays; Codex reads forwarded variables through `.codex-plugin/plugin.json`'s `mcpServers` pointer. Root `skills/` must stay in npm `files`, Docker, and MCPB, and pass `lint:packaging`.+ `bun run bundle` produces a stdio-only `.mcpb` for Claude Desktop. Root-anchored `.mcpbignore` patterns exclude source, tests, docs, caches, logs, development skills, and plugin manifests; root `skills/` ships deliberately. After packing, `scripts/clean-mcpb.ts` prunes dev dependencies, package-root agent docs, platform-specific native bindings, node-gyp intermediate output, and build-only framework files. It preserves compiled native addons and SDK runtime directories such as `dist/ext/skills/`+ - [ ] Root `plugin.json` and `mcp.json` match package metadata and the Codex overlay's fixed stdio environment; client overlays remain in place+ - [ ] Published `skills/` passes packaging validation and every gate and identifier claim is verified against tool behavior

• + osv-advisory-guide

version

0.3.0 → 0.4.1

https://raw.githubusercontent.com/cyanheads/osv-advisory-mcp-server/HEAD/AGENTS.md

− **Version:** 0.2.0− **Zod:** ^4.6.5−     .describe('Max OSV pages followed per package in package and batch queries before marking results truncated.'),+ **Version:** 0.3.0+ **Zod:** ^4.6.7+     .describe('Max OSV pages followed per package or commit before marking results truncated.'),+       package-identifier.ts             # PURL parsing and OSV package coordinates+       package-input.ts                  # Tuple and PURL input schemas+         osv-query-commit.tool.ts        # osv_query_commit — full Git commit vulnerability lookup

• + osv_query_commit

version

0.2.0 → 0.3.0

https://raw.githubusercontent.com/cyanheads/osv-advisory-mcp-server/HEAD/AGENTS.md

− **Version:** 0.1.16− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.14`− **MCP SDK:** `@modelcontextprotocol/server` ^2.2.0−     .describe('Max OSV pages osv_query_package follows before marking results truncated.'),− | `devcheck` | Lint, format, typecheck, audit |+ **Version:** 0.2.0+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`+ **MCP SDK:** `@modelcontextprotocol/server` ^2.3.1+     .describe('Max OSV pages followed per package in package and batch queries before marking results truncated.'),+       response-pages.ts                 # Bounded replies and stateless JSON-pointer pages

version

0.1.16 → 0.2.0

https://raw.githubusercontent.com/cyanheads/osv-advisory-mcp-server/HEAD/AGENTS.md

− **Version:** 0.1.15− **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.6`− **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0− **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable?, severity?, thrownBy? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, linter enforces conformance against the handler body. `recovery` is required (≥ 5 words, lint-validated) — the single source of truth for the agent's next move. Pass `ctx.recoveryFor('reaso−   if (!item) throw ctx.fail('no_match', `No item ${input.id}`, ctx.recoveryFor('no_match'));− **Every release goes through a gated release PR** — `git-wrapup`'s "Release PR mode", mode `gated`. Three separate runs, never one: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the changelog entry plus a gates section); `release-pr-review` reviews and fixes on that branch (each fix an ordinary commit on top of the stack, pushed plainly — nothing already pushed is ever rewritten, so `main` keeps the record of w+ **Version:** 0.1.16+ **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.14`+ **MCP SDK:** `@modelcontextprotocol/server` ^2.2.0+ **Recommended: typed error contract.** Declare `errors: [{ reason, code, when, recovery, retryable?, severity?, thrownBy? }]` on `tool()` / `resource()` to receive `ctx.fail(reason, …)` typed against the reason union. TypeScript catches typos at compile time, `data.reason` is auto-populated for observability, linter enforces conformance against the handler body. `recovery` is required (≥ 5 words, lint-validated) — the single source of truth for the agent's next move. The framework puts it on the+   if (!item) throw ctx.fail('no_match', `No item ${input.id}`);+ **Every release goes through a gated release PR** — `git-wrapup`'s "Release PR mode", mode `gated`. Three separate runs, never one: `git-wrapup` lands the commit stack on `release/<version>`, pushes it, and opens the PR (title = the release commit subject, body = the release digest: theme line, `## Changes`, `## Gates`, changelog link last); `release-pr-review` reviews and fixes on that branch (each fix an ordinary commit on top of the stack, pushed plainly — nothing already pushed is ever rewri

version

0.1.15 → 0.1.16