@christopher_dondici/mcp-gen 2.1.2

package/CHANGELOG.md

@@ -0,0 +1,217 @@
+# Changelog
+
+Todas as mudanças notáveis do projeto serão documentadas neste arquivo.
+
+## [2.1.2] - Prepared for release (2026-09-17)
+
+### Packaging & Distribution
+
+- `@christopher_dondici/mcp-gen` 2.1.2 prepared for release; not yet published to npm
+- Scoped npm name after rejection of `mcp-gen` for similarity to `mcpgen`; version, `mcp-gen` binary and repository unchanged
+- Public scoped publication configured; CI and release install and validate the scoped tarball before publication
+- Build, packaging, CI, and dependency fixes only; no new runtime features
+- Portable template copy (`fs.cpSync`) replacing Windows-only `xcopy`
+- Versioned `package-lock.json` enabling `npm ci`
+- Package `files` allowlist + `prepack` build so tarballs are complete
+- Release workflow gates `npm publish` on `HAS_NPM_TOKEN` env instead of `secrets` in `if`
+- New CI workflow: typecheck, tests, build, `npm pack` and tarball install smoke test on push/PR
+- Dependency updates: fast-uri 3.1.8, hono 4.13.8, js-yaml 4.3.2, qs 6.16.0
+- Package and lockfile versions aligned to 2.1.2; repository URL normalized to the official `git+https` format
+- English/Portuguese READMEs and `RELEASE_NOTES.md` aligned with 2.1.2 preparation, source quick start, and conditional npm installation; 2.1.1 history preserved
+
+---
+
+## [2.1.1] - 2026-08-07
+
+### 🛡️ MCP Security & Lint Layer (New)
+
+- **Security scanning** (`mcp-gen security <path>`): Scans generated MCP projects for:
+  - Raw credential detection (API keys, tokens, secrets, JWTs, AWS keys, etc.)
+  - `authContext` contract validation (scoped metadata vs raw credentials)
+  - Tool policy enforcement (TTL, spend limits, revocation, audit logging)
+- **Lint checks**: Naming conventions, empty descriptions, TODO/FIXME in generated code, incremental marker balance, schema completeness
+- **JSON output** (`--json`) for CI/CD integration
+- **Fail-on-warn** (`--fail-on-warn`) for strict pipelines
+- **Interactive mode** support in CLI
+- **Library API exports**: `scanProject`, `formatReport`, `SecurityRule`, `SecurityReport`
+- **11 new tests** covering credential scanning, authContext validation, incremental markers, project scanning, report formatting
+
+### 🔧 Generated Template Improvements
+
+- **TypeScript**: Enhanced `RAW_CREDENTIAL_KEYS` + `TOOL_POLICIES` with per-tool policies, `requireSecurity` helper
+- **Python**: Complete authContext validation with `require_security`, raw credential blocking
+- **Go**: Full security layer with `RAW_CREDENTIAL_KEYS` map, `TOOL_POLICIES` struct, `hasRawCredentialKey`, `requireSecurity`
+
+---
+
+## [2.1.0] - 2026-08-07
+
+### 🚀 Major Features
+
+- **Go target (new language)**: Generate MCP servers using `mark3labs/mcp-go` with full parity — `main.go`, `models.go`, `client.go`, `go.mod`, `README.md`, `Dockerfile`, GitHub Actions CI.
+- **HTTP mode (`--http`)**: Generated handlers call the **real API** over HTTP (`fetch` / `httpx` / `net/http`) instead of returning example stubs. Controlled by `--http` flag or `--env-file` for credential injection.
+- **Library API (programmatic usage)**: Export `generate`, `validateSpec`, `parseOpenAPI`, `extractHandlers`, `injectHandlers`, `listKnownSpecs`, `fetchSpecToCwd` + all types from `src/index.ts`.
+- **Rich `validate` command**: Detailed warnings for tool-name collisions, missing examples, unsupported schemas, duplicate operations, etc.
+- **Parser v3**: Full `$ref` resolution in parameters & requestBody; header/cookie params included; real enum union types (TypeScript `type X = "a" | "b"`, Python `Literal`, Go `type X = string` + `var` constants); unique tool names with collision suffixes; reserved-word sanitization (`new`, `delete`, `class`, etc. → `new_`).
+- **Safe description escaping**: Central `escapeText` helper prevents template injection/breakage from arbitrary OpenAPI descriptions.
+- **CLI version sync**: Single source of truth in `package.json`; CLI reads version at runtime.
+- **Interactive HTTP prompts**: When `--http` is used without `--env-file`, prompts ask for BASE_URL and TOKEN.
+
+### 🐛 Fixes
+
+- Tool-name collisions resolved with unique `_<hash>` suffixes
+- Reserved words in tool names sanitized
+- `$ref` in parameters/requestBody no longer silently skipped
+- Header/cookie parameters now included in tool signatures
+- Enums emitted as real union types (not loose `string`)
+- Descriptions with special chars (quotes, newlines) no longer break templates
+- Go `mcp.PropertyOption` API corrected (`mcp.Description`, `mcp.Required`)
+- Python `_call_api` made `async` (was sync with `async with`)
+
+### 📚 Documentation
+
+- README updated with Go target, `--http` mode, library API, authContext contract, programmatic usage
+- CHANGELOG v2.1.0 entry
+
+### ⚠️ Known Limitations
+
+- OpenAPI v2 (Swagger) not supported — v3.x only
+- `oneOf`/`anyOf`/`discriminator` generate union types but no runtime validation
+- Streaming/resources/prompts not yet implemented
+
+---
+
+## [2.0.0] - 2026-05-11
+
+### 🎉 Major Release 2.0
+
+Este é o release v2.0.0 de `mcp-gen` — uma versão completa e estável compilada de 7 semanas de desenvolvimento, pronta para produção.
+
+### ✨ Features
+
+- **OpenAPI v3 Parser**: Suporte completo a OpenAPI v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.1.0
+  - `oneOf`, `anyOf`, `discriminator` support
+  - Schema validation com `@apidevtools/swagger-parser`
+  - JSON e YAML inputs
+
+- **Code Generation**
+  - TypeScript: ESM com tipos completos
+  - Python: FastMCP com Pydantic v2
+  - Incremental generation com marcadores `@@mcp-gen:start/end`
+  - Preservação de código customizado entre regenerações
+
+- **CLI & Tools**
+  - 4 comandos principais: `generate`, `validate`, `init`, `watch`
+  - CLI interativa com `inquirer`
+  - Registry pré-configurado com 10+ APIs públicas
+  - Support para plugins customizados
+  - Watch mode com polling de URLs
+
+- **API Registry**
+  - Stripe Payment API
+  - GitHub REST API
+  - Slack Web API
+  - OpenAI API
+  - Petstore (exemplo)
+  - Twilio Communications API
+  - Shopify Admin API
+  - Kubernetes API
+  - DigitalOcean API
+  - Azure Resource Manager API
+
+- **Deployment Ready**
+  - Dockerfile gerado automaticamente
+  - GitHub Actions CI/CD template
+  - package.json / requirements.txt configurados
+  - tsconfig.json / Python environment ready
+
+### 🐛 Fixes
+
+- Remoção de dependências desnecessárias
+- Melhor tratamento de erros no parser
+- Validação mais robusta de specs inválidas
+- Tratamento correto de parâmetros opcionais
+
+### 📚 Documentation
+
+- README completo com quick start
+- Documentação em Português (README.pt-BR.md)
+- CLI help com exemplos
+- Guia de plugins
+- Roadmap transparente
+
+### ⚠️ Known Limitations
+
+- OpenAPI v2 (Swagger) não suportado — apenas v3.x
+- `oneOf` / `anyOf` com múltiplos níveis pode ter edge cases
+- Copy templates no Windows requer `xcopy` (já configurado)
+- Performance: Specs muito grandes (>50MB) podem ser lentas
+
+### 🔧 Technical Details
+
+- Node.js 20+ requerido
+- Handlebars v4.7+ para templating
+- MCP SDK v1.0.0+
+- Testes com Jest
+- TypeScript 5.4+
+
+### 📦 Versioning
+
+A partir de `v1.0.0-rc.1`:
+- Versão RC: `v1.0.0-rc.N`
+- Versão final: `v1.0.0`
+- npm tag: `@rc` para release candidates, `@latest` para stable
+
+Publicado em npm como:
+```bash
+npm install mcp-gen@rc          # v1.0.0-rc.1
+npm install mcp-gen@latest      # Quando v1.0.0 for lançado
+```
+
+### 🙏 Thanks
+
+- Comunidade MCP por feedback
+- Anthropic pelos docs e SDK
+- OpenAPI initiative pela spec
+- Contribuidores early testers
+
+### 📖 For RC Testing
+
+Se você está testando a RC, por favor:
+
+1. **Report Issues**: Use [GitHub Issues](https://github.com/ChristopherDond/MCP-Generator/issues)
+2. **Share Feedback**: [Discussions](https://github.com/ChristopherDond/MCP-Generator/discussions)
+3. **Try Examples**: Rode `mcp-gen init --from stripe --generate -o ./stripe-mcp`
+4. **Test Registry**: Experimente diferentes APIs
+
+### 🚀 Next Steps (RC → v1.0.0)
+
+Planejado para RC.2 e beyond:
+
+- [ ] Plugin system com melhor documentação
+- [ ] Suporte a OpenAPI v3.1 discriminator melhorado
+- [ ] Mais templates (Go, Rust, outros?)
+- [ ] Performance improvements
+- [ ] Integração com ferramentas populares
+- [ ] Type inference melhorado para complex schemas
+
+---
+
+## [0.1.0] - 2026-04-01
+
+### Initial Development
+
+Project initialization com conceito básico.
+
+---
+
+## Versioning
+
+Seguimos [Semantic Versioning](https://semver.org/):
+- **MAJOR.MINOR.PATCH** para releases estáveis
+- **MAJOR.MINOR.PATCH-rc.N** para release candidates
+- **MAJOR.MINOR.PATCH-alpha.N** para alpha versions
+
+## How to Contribute
+
+Veja [CONTRIBUTING.md](./CONTRIBUTING.md) (quando criado) ou abra uma discussion em GitHub Issues.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Christopher Dondici
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,439 @@
+# MCP-Generator
+
+> **Also available in:** [Português (Versão em Português)](README.pt-BR.md)
+
+Generate MCP servers from OpenAPI specs.
+
+> **Status**: `@christopher_dondici/mcp-gen` 2.1.2 is prepared for release and has not been published to npm. This release includes build, packaging, CI, and dependency fixes, with no new runtime features. Use the source quick start below. See [release notes](RELEASE_NOTES.md) (PT-BR).
+
+`mcp-gen` turns an OpenAPI v3 spec into an MCP server in **TypeScript**, **Python**, or **Go**. It maps each route to a tool, generates typed models (including enums, oneOf/anyOf), and keeps custom code when you regenerate.
+
+## Quick start
+
+With Git, Node.js 20+ and npm 9+ installed, run:
+
+```bash
+git clone https://github.com/ChristopherDond/MCP-Generator.git
+cd MCP-Generator
+npm ci
+npm run build
+node dist/cli/index.js --version
+```
+
+Generate a server from a local spec:
+
+```bash
+node dist/cli/index.js generate -i examples/petstore.yaml -l typescript -o ./my-server
+```
+
+Validate a spec without generating files:
+
+```bash
+node dist/cli/index.js validate -i examples/petstore.yaml
+```
+
+Run these commands from the repository root on `main`. The build and packaging fixes are part of 2.1.2. Generation writes a scaffold; it does not install dependencies, build, or start the generated server.
+
+Run the interactive CLI if you prefer prompts:
+
+```bash
+npm run dev
+```
+
+## What it does
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant CLI
+    participant Parser
+    participant Generator
+    participant Output
+
+    User->>CLI: mcp-gen generate --input api.yaml --lang go
+    CLI->>Parser: validate and parse OpenAPI v3 (JSON or YAML)
+    Parser->>Generator: internal AST (tools, models, examples)
+    Generator->>Output: render Handlebars templates
+    Output-->>User: TypeScript, Python, or Go MCP server project
+```
+
+Each route becomes an MCP tool with:
+
+- typed input from parameters (path, query, header, cookie, body) and request bodies
+- example responses from the spec
+- enum / oneOf / anyOf / discriminator schema support
+- real HTTP client mode (`--http`) that calls the actual API
+- scaffolded authContext checks for scoped metadata and credential-like argument keys; review before deployment
+- optional incremental code preservation
+
+## Requirements
+
+- Node.js 20+
+- npm 9+ (the source quick start uses the repository lockfile)
+- Git to clone the repository
+- (Optional) Python 3.8+ for Python projects
+- (Optional) Go 1.22+ for Go projects
+
+## Local installation and command shorthand
+
+Use the source build in [Quick start](#quick-start) while npm publication remains unverified. Once version 2.1.2 is published and its availability on npm is confirmed, you can install it with `npm install -g @christopher_dondici/mcp-gen@2.1.2`.
+Throughout this README, `mcp-gen` is shorthand for `node dist/cli/index.js` from the repository root. For example, `mcp-gen validate -i examples/petstore.yaml` means `node dist/cli/index.js validate -i examples/petstore.yaml`.
+
+Optionally, run `npm link` from the repository root after building to make the `mcp-gen` command point to your local checkout. This changes npm's global links; it does not download a published `@christopher_dondici/mcp-gen` package. The npm package name changed because `mcp-gen` was rejected for similarity to `mcpgen`; the command remains `mcp-gen`.
+
+To install a locally produced tarball without publishing:
+
+```bash
+npm install ./christopher_dondici-mcp-gen-2.1.2.tgz
+./node_modules/.bin/mcp-gen --version
+./node_modules/.bin/mcp-gen validate -i node_modules/@christopher_dondici/mcp-gen/examples/petstore.yaml
+```
+
+## CLI
+
+### Commands
+
+- `mcp-gen generate` or `mcp-gen g` creates a server from a spec.
+- `mcp-gen validate` or `mcp-gen v` checks a spec with detailed warnings (name collisions, missing examples, unsupported schemas).
+- `mcp-gen init` downloads a known public spec and can generate a project.
+- `mcp-gen watch` watches a file or URL and regenerates on changes.
+
+### Generate
+
+```bash
+mcp-gen generate -i ./api/openapi.yaml -l typescript -o ./my-server
+mcp-gen generate -i ./api/openapi.yaml -l python -o ./my-server
+mcp-gen generate -i ./api/openapi.yaml -l go -o ./my-server
+```
+
+**Useful flags:**
+
+- `--force`, `-f` overwrites existing files.
+- `--incremental` keeps code between `@@mcp-gen:start` and `@@mcp-gen:end`.
+- `--http` generates handlers that **call the real API** over HTTP instead of returning example stubs.
+- `--env-file <path>` embeds TOKEN/BASE_URL from a .env-style file into the generated client.
+- `--name <name>` sets the server name.
+- `--server-version <version>` sets the server version.
+- `--plugin <path>` loads a plugin module or folder (can be repeated).
+
+### Validate (v2.1+)
+
+```bash
+mcp-gen validate -i ./api/openapi.yaml
+```
+
+Outputs a rich report:
+
+```
+Spec is valid
+  Tools: 12  Models: 8  Base URL: https://api.example.com
+
+  2 warning(s):
+  ⚠ Tool name collision resolved: "get_users" appears 2x (unique suffixes added)
+  ⚠ 3 tool(s) have no example response: get_users_id, delete_user, patch_user
+```
+
+### Security and lint (v2.1.1)
+
+```bash
+node dist/cli/index.js security -p ./my-server
+node dist/cli/index.js security -p ./my-server --fail-on-warn
+```
+
+Scans generated files for credential-like patterns, authorization-related identifiers, naming, descriptions, and incremental markers. `--json` prints a JSON report, but the CLI also prints a header; stdout is not a pure JSON document. Errors cause exit code 1; `--fail-on-warn` also fails on warnings. This is static analysis, not a security guarantee.
+
+### Init
+
+`init` uses the built-in registry:
+
+```bash
+mcp-gen init --from list
+mcp-gen init --from stripe
+mcp-gen init --from stripe --generate -o ./stripe-mcp
+```
+
+Available registry keys:
+
+| Key | Description |
+|-----|-------------|
+| `stripe` | Stripe Payment API |
+| `github` | GitHub REST API |
+| `slack` | Slack Web API |
+| `openai` | OpenAI API |
+| `petstore` | Swagger Petstore example |
+| `twilio` | Twilio Communications API |
+| `shopify` | Shopify Admin API |
+| `kubernetes` | Kubernetes API |
+| `digitalocean` | DigitalOcean API |
+| `azure` | Azure Resource Manager API |
+
+### Watch
+
+```bash
+mcp-gen watch -i ./api/openapi.yaml -o ./my-server
+mcp-gen watch -i https://example.com/spec.json --interval 60000
+```
+
+For URL inputs, `--interval <ms>` controls the polling interval. `--once` runs generation once and exits after the first change.
+
+## Plugins
+
+Plugins can override templates and register extra Handlebars helpers.
+
+Basic structure:
+
+- `templates/typescript/...`, `templates/python/...`, or `templates/go/...` for `.hbs` template overrides
+- `index.js` that exports `registerHandlebars(handlebars)` for custom helpers
+
+Example:
+
+```bash
+mcp-gen generate -i ./api/openapi.yaml --plugin ./my-plugin
+mcp-gen watch -i ./api/openapi.yaml --plugin ./my-plugin
+```
+
+Plugin templates override core templates when they use the same path under `templates/<lang>/`.
+
+## Generated project structure
+
+**TypeScript:**
+
+```
+my-server/
+├── src/
+│   ├── server.ts        # MCP server — tool definitions + handlers
+│   ├── models.ts        # TypeScript interfaces from OpenAPI schemas (enums, unions)
+│   └── client.ts        # HTTP client (used in --http mode)
+├── .github/
+│   └── workflows/
+│       └── ci.yml
+├── Dockerfile
+├── package.json
+├── tsconfig.json
+└── README.md
+```
+
+**Python:**
+
+```
+my-server/
+├── server.py            # FastMCP server — tool definitions + handlers
+├── models.py            # Pydantic models from OpenAPI schemas (enums, unions)
+├── requirements.txt
+├── .github/
+│   └── workflows/
+│       └── ci.yml
+├── Dockerfile
+└── README.md
+```
+
+**Go (new in v2.1):**
+
+```
+my-server/
+├── main.go              # MCP server using mark3labs/mcp-go
+├── models.go            # Go types from OpenAPI schemas (enums, unions)
+├── client.go            # HTTP client (used in --http mode)
+├── go.mod
+├── .github/
+│   └── workflows/
+│       └── ci.yml
+├── Dockerfile
+└── README.md
+```
+
+---
+
+## Connect to Claude Desktop
+
+**TypeScript:**
+
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "command": "node",
+      "args": ["/absolute/path/to/my-server/dist/server.js"]
+    }
+  }
+}
+```
+
+**Python:**
+
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "command": "python",
+      "args": ["/absolute/path/to/my-server/server.py"]
+    }
+  }
+}
+```
+
+**Go:**
+
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "command": "go",
+      "args": ["run", "/absolute/path/to/my-server/main.go"]
+    }
+  }
+}
+```
+
+Restart Claude Desktop. Your API tools appear automatically.
+
+---
+
+## Security & `authContext` Contract
+
+The generated tools expect **scoped authorization metadata** (not raw credentials):
+
+```json
+{
+  "tokenId": "tok_abc123",
+  "principal": "user:42",
+  "expiresAt": "2026-05-11T14:00:00Z",
+  "allowedTools": ["get_orders"],
+  "endpointAllowlist": ["GET /orders"],
+  "spendLimitUsd": 5,
+  "spendUsedUsd": 1.2,
+  "revoked": false,
+  "requestId": "req_01J..."
+}
+```
+
+The scaffold blocks arguments like `token`, `authorization`, `api_key`, `client_secret`, `password`, `secret` by default.
+
+**Quick example (env var):**
+
+```bash
+# Linux / macOS
+export TOKEN=your_api_key_here
+
+# Windows (PowerShell)
+$env:TOKEN='your_api_key_here'
+```
+
+For advanced integrations and management, consider Cohesivity.ai as a backend for auth, storage, and revocation policies.
+
+---
+
+## Implement handlers
+
+Generated files return spec examples by default. Replace stubs with real logic.
+
+**TypeScript** (`src/server.ts`):
+
+```typescript
+case "get_users_id": {
+  // @@mcp-gen:start:get_users_id
+  const user = await db.users.findById(args.id);
+  return { content: [{ type: "text", text: JSON.stringify(user) }] };
+  // @@mcp-gen:end:get_users_id
+}
+```
+
+**Python** (`server.py`):
+
+```python
+@mcp.tool()
+async def get_users_id(id: float, auth_context: dict | None = None) -> Any:
+    # @@mcp-gen:start:get_users_id
+    user = await db.users.find_by_id(id)
+    return user
+    # @@mcp-gen:end:get_users_id
+```
+
+**Go** (`main.go`):
+
+```go
+s.AddTool(get_users_idTool, func(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+    // @@mcp-gen:start:get_users_id
+    return jsonSerialize(jsonExample(`{"id": 1, "name": "Alice"}`))
+    // @@mcp-gen:end:get_users_id
+})
+```
+
+Code between `@@mcp-gen:start` and `@@mcp-gen:end` markers is preserved when you re-run `generate --incremental`.
+
+---
+
+## Programmatic API (Library Mode)
+
+With the local tarball installed, import the scoped package as shown below. From the repository root after building, use `"./dist/index.js"` instead; neither approach requires npm publication.
+
+```typescript
+import { generate, validateSpec, parseOpenAPI } from "@christopher_dondici/mcp-gen";
+
+const result = await generate({
+  input: "./api/openapi.yaml",
+  lang: "typescript",
+  out: "./my-server",
+  force: true,
+  incremental: false,
+  http: false,
+});
+
+const validation = await validateSpec("./api/openapi.yaml");
+console.log(validation.tools, validation.models, validation.warnings);
+```
+
+---
+
+## Development
+
+```bash
+npm test
+npx tsc --noEmit
+
+# TypeScript example
+node dist/cli/index.js generate --input examples/petstore.json --out /tmp/ts-test --force
+
+# Python example
+node dist/cli/index.js generate --input examples/petstore.yaml --lang python --out /tmp/py-test --force
+
+# Go example
+node dist/cli/index.js generate --input examples/petstore.json --lang go --out /tmp/go-test --force
+
+# HTTP mode (real API calls)
+node dist/cli/index.js generate --input examples/petstore.json --lang typescript --out /tmp/ts-http --force --http
+
+# Incremental example
+node dist/cli/index.js generate --input examples/petstore.json --out /tmp/ts-test --incremental
+```
+
+---
+
+## Roadmap
+
+| Stage | Status | Scope |
+|-------|--------|-------|
+| Existing features | Implemented | CLI, OpenAPI v3 parser, TypeScript/Python generation, incremental generation, interactive mode, spec registry, plugins |
+| v2.1.0 | Tagged | Go target, HTTP mode, enums, header/cookie params, library API, rich validate |
+| v2.1.1 | Tagged | Static security/lint scanning and Go server template checks; TypeScript/Python templates unchanged from v2.1.0 |
+| v2.1.2 | Prepared for release | Portable template copy, lockfile, package allowlist, prepack build, corrected release workflow, CI tarball smoke test, dependency updates |
+| Distribution | Unverified | npm publication of 2.1.2 must be confirmed before registry installation; pip publication is not established. Python is a generation target, not a pip installation path for this CLI |
+| Future | Planned | Streaming/resources/prompts, OpenAPI v2, more registries |
+
+---
+
+## Known limitations
+
+- OpenAPI v2 (Swagger) is not supported — v3.x only
+- `oneOf` / `anyOf` / `discriminator` schemas generate union types but no runtime validation
+- Security/lint scanning uses static text patterns and can produce false positives or miss issues. A passing report does not guarantee security or verify runtime authorization, revocation, spending, or audit logging
+- Generated authorization checks are scaffolding, not a complete security backend; review and test them before deployment
+- Streaming/resources/prompts are not implemented
+
+The `copy-templates` fix included in 2.1.2 uses Node.js `fs.cpSync` on Windows, Linux, and macOS; it no longer requires `cp` or `xcopy`. CI currently runs on Ubuntu only.
+
+---
+
+## License
+
+MIT © 2026 - Christopher D.