cf-mcp 0.18.0 → 0.20.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4161d3091e34024cc73f40437b755e9c08b9ed4679e642caf3578dbf24e4eae0
-  data.tar.gz: 7ca49f9aba9d0cb13e9cfd1c738848792a162a1fb2d97c1413bd713eb9e268a6
+  metadata.gz: aa1835b909429755f2b06a50b6db8d973c68445f879413974b7b28863b6bce06
+  data.tar.gz: 6a110d101e27e125763506715bed2a92b973e9cecd709bd17a69c7088fb5e55f
 SHA512:
-  metadata.gz: 40f8ce2d39d0816d8e0acdd75922a7cf77935dccf4c4a8be3e14084e9cb09ef21ea73beb6ff8d454eae372a22ec542e557137d5e539a8e2671f291f88d8ba005
-  data.tar.gz: 271d54107c00a36dc2bb2245265d22709752bed02ae5388dc6c8e5ed98ed09f2ba400d070f58d2f5f111ad5c24c6d3c83dde655c84b621bb6f99044aa0ab90e8
+  metadata.gz: e450154e426288754d99ee28a63e4b3fa99d2394600ab8519df3f0d584844b2428f64a1c62d106053f3f3826ace1d4e4beeadd6d9f45e0100b2d7bcc3717db69
+  data.tar.gz: 7fd889d1f4ae36abed48cb84048efa8debf22a4c97d198c2d12745ad095589a3ab02feeb5c2c1d4d3221f33a38069c363214f3142b7c56bcbf0c30e04d790f54

data/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.0] - 2026-09-19
+
+### Added
+
+- `CF_MCP_ALLOWED_HOSTS` environment variable (comma-separated) to allow extra `Host` header values on the HTTP endpoint; set to `cf-mcp.fly.dev` in `fly.toml`
+- Support MCP protocol version 2026-07-28: stateless requests carrying their version in `_meta`, and the `server/discover` method
+- Allow the `MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` headers in CORS preflight responses
+
+### Changed
+
+- **BREAKING:** Raised the minimum supported Ruby from 3.2 to 3.3 (`required_ruby_version` and the Standard Ruby target); 3.2 reached end of life on 2026-03-31; CI now also runs against Ruby 3.3
+- Updated `mcp` from 0.25.0 to 1.5.1
+- Updated `puma` from 7.2.1 to 8.0.2 (the gemspec constraint is now `~> 8.0`) and `rubyzip` from 3.6.0 to 3.7.0
+- Removed the `2025-03-26` protocol pin; clients using the `initialize` handshake now negotiate up to 2025-11-25
+- The web UI now calls tools through the stateless 2026-07-28 protocol
+- The web UI shows both the modern and the legacy handshake protocol versions
+- Bump Ruby to 4.0.7 in `.ruby-version`, the Dockerfile, and the CI matrix
+- Bumped GitHub Actions: `actions/checkout` to v7 and `actions/cache` to v6
+- Added least-privilege permissions, PR concurrency cancellation and a job timeout to the CI workflow, and Dependabot for GitHub Actions and Bundler
+
+### Fixed
+
+- HTTP endpoint rejected all non-loopback requests with `403 Invalid Host header` since `mcp` 0.25 enabled DNS-rebinding protection, breaking the hosted server
+
+## [0.19.0] - 2026-09-15
+
+### Added
+
+- Show the Cute Framework revision (git commit SHA) being served at startup and on the dashboard, linked to the commit on GitHub
+- Print progress while parsing header files, when running in a terminal
+
+### Changed
+
+- Updated dependencies, including `mcp` from 0.22.0 to 0.25.0
+
+### Fixed
+
+- `--root` now accepts a Cute Framework project root (as documented) and auto-descends into its `include/` directory; previously this scanned unrelated files and skipped topic indexing entirely
+
 ## [0.17.2] - 2026-02-10
 
 ### Changed
@@ -293,6 +332,9 @@ This version was prepared but never released. Changes rolled into 0.17.2.
   - `cf_list_category` - List items by category
   - `cf_get_details` - Get full documentation by name
 
+[Unreleased]: https://github.com/pusewicz/cf-mcp/compare/v0.20.0...HEAD
+[0.20.0]: https://github.com/pusewicz/cf-mcp/compare/v0.19.0...v0.20.0
+[0.19.0]: https://github.com/pusewicz/cf-mcp/compare/v0.18.0...v0.19.0
 [0.17.2]: https://github.com/pusewicz/cf-mcp/compare/v0.17.0...v0.17.2
 [0.17.1]: https://github.com/pusewicz/cf-mcp/compare/v0.17.0...v0.17.1
 [0.17.0]: https://github.com/pusewicz/cf-mcp/compare/v0.16.2...v0.17.0

data/Manifest.txt

@@ -6,7 +6,6 @@ Rakefile
 config.ru
 config/puma.rb
 exe/cf-mcp
-exe/cf-mcp-wrapper
 lib/cf/mcp.rb
 lib/cf/mcp/cli.rb
 lib/cf/mcp/downloader.rb

data/README.md

@@ -63,6 +63,12 @@ Then launch the inspector and connect using Streamable HTTP transport to:
 http://localhost:9292/http
 ```
 
+When serving under a non-loopback hostname, allow it via `CF_MCP_ALLOWED_HOSTS` (comma-separated), otherwise requests are rejected with `403 Invalid Host header`:
+
+```bash
+CF_MCP_ALLOWED_HOSTS=mcp.example.com cf-mcp http --root /path/to/cute_framework
+```
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/Rakefile

@@ -9,7 +9,7 @@ require "standard/rake"
 
 desc "Generate Manifest.txt from git ls-files"
 task :manifest do
-  ignore_patterns = %w[bin/ Gemfile .gitignore test/ .github/ .standard.yml cf-mcp.gemspec .ruby-version CLAUDE.md AGENTS.md fly.toml Procfile Dockerfile .dockerignore .claude/ .mcp.json]
+  ignore_patterns = %w[bin/ Gemfile .gitignore test/ .github/ .standard.yml cf-mcp.gemspec .ruby-version CLAUDE.md AGENTS.md fly.toml Procfile Dockerfile .dockerignore .claude/ .mcp.json .serena/]
 
   files = IO.popen(%w[git ls-files -z], chdir: __dir__, err: IO::NULL) do |ls|
     ls.readlines("\x0", chomp: true)

data/lib/cf/mcp/cli.rb

@@ -97,8 +97,9 @@ module CF
           warn "Indexed #{count} topics from: #{path}" if event == :topics_indexed
         end
         warn "Indexed #{index.stats[:total]} items (#{index.stats[:functions]} functions, #{index.stats[:structs]} structs, #{index.stats[:enums]} enums)"
+        warn "Cute Framework revision: #{builder.revision}" if builder.revision
 
-        server = Server.new(index)
+        server = Server.new(index, revision: builder.revision)
         server.run_stdio
       end
 

data/lib/cf/mcp/downloader.rb

@@ -15,6 +15,8 @@ module CF
 
       class DownloadError < StandardError; end
 
+      attr_reader :sha
+
       def initialize(download_dir: DEFAULT_DOWNLOAD_DIR)
         @download_dir = download_dir
       end
@@ -30,6 +32,7 @@ module CF
         # Check if cache is valid
         stored_sha = read_sha_metadata(sha_file)
         latest_sha = fetch_latest_sha
+        @sha = latest_sha
 
         if stored_sha && latest_sha && stored_sha == latest_sha
           if File.directory?(include_path) && !Dir.empty?(include_path)

data/lib/cf/mcp/index_builder.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
 
+require "open3"
+
 module CF
   module MCP
     class IndexBuilder
       DEFAULT_HEADERS_PATH = File.expand_path("~/Work/GitHub/pusewicz/cute_framework/include")
 
-      attr_reader :headers_path
+      attr_reader :headers_path, :revision
 
       def initialize(root: nil, download: false)
         @headers_path = resolve_headers_path(root: root, download: download)
@@ -41,20 +43,45 @@ module CF
       private
 
       def resolve_headers_path(root:, download:)
-        return root if root
-        return ENV["CF_HEADERS_PATH"] if ENV["CF_HEADERS_PATH"]
+        if root
+          @revision = detect_git_revision(root)
+          nested_include = File.join(root, "include")
+          return File.directory?(nested_include) ? nested_include : root
+        end
+
+        if (env_path = ENV["CF_HEADERS_PATH"])
+          @revision = detect_git_revision(env_path)
+          return env_path
+        end
 
         if download
           warn "Downloading Cute Framework headers from GitHub..."
           downloader = Downloader.new
           path = downloader.download_and_extract
+          @revision = downloader.sha
           warn "Downloaded headers to: #{path}"
           return path
         end
 
+        @revision = detect_git_revision(DEFAULT_HEADERS_PATH)
         DEFAULT_HEADERS_PATH
       end
 
+      # Detects the current git commit SHA for a local Cute Framework checkout.
+      # `path` may be the repo root or any subdirectory within it (e.g. include/) -
+      # git walks up to find the enclosing repository either way.
+      def detect_git_revision(path)
+        return nil unless File.directory?(path)
+
+        stdout, _stderr, status = Open3.capture3("git", "-C", path, "rev-parse", "--short", "HEAD")
+        return nil unless status.success?
+
+        sha = stdout.strip
+        sha.empty? ? nil : sha
+      rescue Errno::ENOENT
+        nil
+      end
+
       def find_topics_path(headers_path)
         # If headers_path is .../cute_framework/include, topics is at .../cute_framework/docs/topics
         base = File.dirname(headers_path)

data/lib/cf/mcp/parser.rb

@@ -32,6 +32,7 @@ module CF
       def parse_directory(path)
         items = []
         Dir.glob(File.join(path, "**/*.h")).each do |header_file|
+          warn "Parsing #{header_file}" if $stderr.isatty
           items.concat(parse_file(header_file))
         end
         items

data/lib/cf/mcp/server.rb

@@ -5,12 +5,14 @@ require "mcp"
 module CF
   module MCP
     class Server
-      attr_reader :server, :index
+      attr_reader :server, :index, :revision
+
+      CUTE_FRAMEWORK_COMMIT_URL_TEMPLATE = "https://github.com/RandyGaul/cute_framework/commit/%{revision}"
 
       CORS_HEADERS = {
         "access-control-allow-origin" => "*",
         "access-control-allow-methods" => "GET, POST, DELETE, OPTIONS",
-        "access-control-allow-headers" => "Content-Type, Accept, Mcp-Session-Id",
+        "access-control-allow-headers" => "Content-Type, Accept, MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Session-Id",
         "access-control-expose-headers" => "Mcp-Session-Id"
       }.freeze
 
@@ -30,21 +32,32 @@ module CF
           warn "Indexed #{count} topics from: #{path}" if event == :topics_indexed
         end
         warn "Indexed #{index.stats[:total]} items (#{index.stats[:functions]} functions, #{index.stats[:structs]} structs, #{index.stats[:enums]} enums)"
+        warn "Cute Framework revision: #{builder.revision}" if builder.revision
 
-        new(index).rack_app
+        new(index, revision: builder.revision).rack_app
       end
 
-      PROTOCOL_VERSION = "2025-03-26"
+      # Modern clients carry their version on every request (no handshake); legacy
+      # clients negotiate through `initialize`. Both track the SDK rather than pinning.
+      MODERN_PROTOCOL_VERSION = ::MCP::Configuration::LATEST_MODERN_PROTOCOL_VERSION
+      LEGACY_PROTOCOL_VERSION = ::MCP::Configuration::LATEST_HANDSHAKE_PROTOCOL_VERSION
       WEBSITE_URL = ENV.fetch("FLY_APP_NAME", nil) ? "https://#{ENV["FLY_APP_NAME"]}.fly.dev" : "https://cf-mcp.fly.dev"
       PUBLIC_DIR = File.join(__dir__, "public")
+      ALLOWED_HOSTS_ENV = "CF_MCP_ALLOWED_HOSTS"
+
+      # Comma-separated list of extra Host header values the HTTP transport accepts
+      # (the MCP SDK only allows loopback hosts by default).
+      def self.allowed_hosts_from_env(env = ENV)
+        env.fetch(ALLOWED_HOSTS_ENV, "").split(",").map(&:strip).reject(&:empty?)
+      end
 
-      def initialize(index)
+      def initialize(index, revision: nil, allowed_hosts: self.class.allowed_hosts_from_env)
         @index = index
+        @revision = revision
+        @allowed_hosts = allowed_hosts
 
-        configuration = ::MCP::Configuration.new(protocol_version: PROTOCOL_VERSION)
         @server = ::MCP::Server.new(
           name: "cf-mcp",
-          configuration:,
           version: CF::MCP::VERSION,
           icons: [
             ::MCP::Icon.new(src: "#{WEBSITE_URL}/favicon.svg", mime_type: "image/svg+xml", sizes: ["any"]),
@@ -78,7 +91,7 @@ module CF
       def rack_app
         require "rack"
 
-        http_transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server, stateless: true)
+        http_transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server, stateless: true, allowed_hosts: @allowed_hosts)
         @server.transport = http_transport
 
         landing_page = build_landing_page
@@ -189,7 +202,10 @@ module CF
         ->(index, tool_classes) {
           context = TemplateContext.new(
             version: CF::MCP::VERSION,
-            protocol_version: PROTOCOL_VERSION,
+            modern_protocol_version: MODERN_PROTOCOL_VERSION,
+            legacy_protocol_version: LEGACY_PROTOCOL_VERSION,
+            revision: @revision,
+            revision_url: @revision && format(CUTE_FRAMEWORK_COMMIT_URL_TEMPLATE, revision: @revision),
             stats: index.stats,
             categories: index.categories.sort,
             topics: index.topics_ordered.map { |t| {name: t.name, brief: t.brief} },
@@ -213,11 +229,14 @@ module CF
       class TemplateContext
         TEMPLATES_DIR = File.join(__dir__, "templates")
 
-        attr_reader :version, :protocol_version, :stats, :categories, :topics, :tools, :tool_schemas_json
+        attr_reader :version, :modern_protocol_version, :legacy_protocol_version, :revision, :revision_url, :stats, :categories, :topics, :tools, :tool_schemas_json
 
-        def initialize(version:, protocol_version:, stats:, categories:, topics:, tools:, tool_schemas_json:)
+        def initialize(version:, modern_protocol_version:, legacy_protocol_version:, revision:, revision_url:, stats:, categories:, topics:, tools:, tool_schemas_json:)
           @version = version
-          @protocol_version = protocol_version
+          @modern_protocol_version = modern_protocol_version
+          @legacy_protocol_version = legacy_protocol_version
+          @revision = revision
+          @revision_url = revision_url
           @stats = stats
           @categories = categories
           @topics = topics
@@ -248,7 +267,10 @@ module CF
 
         def js_content
           js = File.read(File.join(TEMPLATES_DIR, "script.js"))
-          js.sub("TOOL_SCHEMAS_PLACEHOLDER", @tool_schemas_json)
+          # Substitute the scalar placeholders first so injected content can't collide with them
+          js.sub("PROTOCOL_VERSION_PLACEHOLDER", @modern_protocol_version.to_json)
+            .sub("CLIENT_VERSION_PLACEHOLDER", @version.to_json)
+            .sub("TOOL_SCHEMAS_PLACEHOLDER", @tool_schemas_json)
             .sub("CATEGORIES_PLACEHOLDER", categories_json)
             .sub("TOPICS_PLACEHOLDER", topics_json)
             .sub("CHANGELOG_PLACEHOLDER", changelog_json)

data/lib/cf/mcp/templates/index.erb

@@ -53,8 +53,14 @@
     </tr>
     <tr>
       <th>Protocol Version</th>
-      <td><%= protocol_version %></td>
+      <td><%= modern_protocol_version %> <small>(legacy handshake up to <%= legacy_protocol_version %>)</small></td>
     </tr>
+    <% if revision %>
+    <tr>
+      <th>Cute Framework Revision</th>
+      <td><a href="<%= h(revision_url) %>"><%= h(revision) %></a></td>
+    </tr>
+    <% end %>
   </table>
 
   <h2>Endpoints</h2>

data/lib/cf/mcp/templates/script.js

@@ -8,6 +8,8 @@ const TOOLS = TOOL_SCHEMAS_PLACEHOLDER;
 const CATEGORIES = CATEGORIES_PLACEHOLDER;
 const TOPICS = TOPICS_PLACEHOLDER;
 const CHANGELOG = CHANGELOG_PLACEHOLDER;
+const PROTOCOL_VERSION = PROTOCOL_VERSION_PLACEHOLDER;
+const CLIENT_VERSION = CLIENT_VERSION_PLACEHOLDER;
 
 // Helper to render topic options (used in multiple places)
 const renderTopicOptions = () =>
@@ -38,13 +40,24 @@ function useMcpToolCall() {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
-          'Accept': 'application/json, text/event-stream'
+          'Accept': 'application/json, text/event-stream',
+          'MCP-Protocol-Version': PROTOCOL_VERSION,
+          'Mcp-Method': 'tools/call',
+          'Mcp-Name': toolName
         },
         body: JSON.stringify({
           jsonrpc: '2.0',
           id: Date.now(),
           method: 'tools/call',
-          params: { name: toolName, arguments: args }
+          params: {
+            name: toolName,
+            arguments: args,
+            _meta: {
+              'io.modelcontextprotocol/protocolVersion': PROTOCOL_VERSION,
+              'io.modelcontextprotocol/clientCapabilities': {},
+              'io.modelcontextprotocol/clientInfo': { name: 'cf-mcp-dashboard', version: CLIENT_VERSION }
+            }
+          }
         })
       });
 

data/lib/cf/mcp/version.rb

@@ -2,6 +2,6 @@
 
 module CF
   module MCP
-    VERSION = "0.18.0"
+    VERSION = "0.20.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-mcp
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.20.0
 platform: ruby
 authors:
 - Piotr Usewicz
@@ -29,28 +29,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.6'
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '8.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '8.0'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -99,7 +99,6 @@ email:
 - piotr@layer22.com
 executables:
 - cf-mcp
-- cf-mcp-wrapper
 extensions: []
 extra_rdoc_files: []
 files:
@@ -111,7 +110,6 @@ files:
 - config.ru
 - config/puma.rb
 - exe/cf-mcp
-- exe/cf-mcp-wrapper
 - lib/cf/mcp.rb
 - lib/cf/mcp/cli.rb
 - lib/cf/mcp/downloader.rb
@@ -163,14 +161,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: MCP server providing documentation tools for Cute Framework
 test_files: []

data/exe/cf-mcp-wrapper

@@ -1,8 +0,0 @@
-#!/bin/bash
-source /opt/homebrew/share/chruby/chruby.sh
-
-PROJECT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-chruby "$(cat "$PROJECT_DIR/.ruby-version")"
-
-export BUNDLE_GEMFILE="$PROJECT_DIR/Gemfile"
-exec "$PROJECT_DIR/exe/cf-mcp" "$@"