@cognium/mcp-server 0.1.2 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +18 -8
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -4,18 +4,28 @@ All notable changes to `@cognium/mcp-server` are documented in this file.
|
|
|
4
4
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
|
|
5
5
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
-
## [0.1.
|
|
7
|
+
## [0.1.4] - 2026-09-10
|
|
8
8
|
|
|
9
|
-
###
|
|
9
|
+
### Changed
|
|
10
|
+
- Adopts `circle-ir@4.9.11`, which carries five taint-precision fixes: C# object-carried SQL no longer reports one vulnerability three times, derived taint aliases no longer leak across methods, C# sibling parameters on a signature line are no longer co-tainted, `RegExp.prototype.exec` no longer matches the command-injection sink, and Python `re.compile` no longer matches the code-injection sink. No MCP tool, schema, or response-shape changes.
|
|
11
|
+
|
|
12
|
+
## [0.1.3] - 2026-09-02
|
|
13
|
+
|
|
14
|
+
### Changed
|
|
10
15
|
|
|
11
|
-
- `
|
|
12
|
-
|
|
16
|
+
- Bump the `circle-ir` dependency to `4.9.10`, which drops the Rust `format!`
|
|
17
|
+
format_string false positive (#294 part 1) and fixes the http_param/http_query
|
|
18
|
+
→ xxe finding-reach-map false negative (#282).
|
|
13
19
|
|
|
14
|
-
|
|
20
|
+
## [0.1.2] - 2026-08-31
|
|
21
|
+
|
|
22
|
+
### Added
|
|
15
23
|
|
|
16
|
-
-
|
|
17
|
-
|
|
18
|
-
|
|
24
|
+
- Record the MIT `LICENSE` in the repository package directory and bump the
|
|
25
|
+
version to match the published `latest` tag. Every published tarball
|
|
26
|
+
(`0.1.0`, `0.1.1`, `0.1.2`) already includes the license text; `0.1.1` was
|
|
27
|
+
an intermediate republish left over from an interrupted publish, and `0.1.2`
|
|
28
|
+
is the current `latest`.
|
|
19
29
|
|
|
20
30
|
## [0.1.0] - 2026-07-15
|
|
21
31
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cognium/mcp-server",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.4",
|
|
4
4
|
"description": "Model Context Protocol server exposing the circle-ir SAST engine as structured tools for LLM agents (Claude Desktop, Claude Code, Cursor, cognium-ai).",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -63,7 +63,7 @@
|
|
|
63
63
|
},
|
|
64
64
|
"dependencies": {
|
|
65
65
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
66
|
-
"circle-ir": "4.9.
|
|
66
|
+
"circle-ir": "4.9.11",
|
|
67
67
|
"yaml": "^2.8.3",
|
|
68
68
|
"zod": "^3.23.8"
|
|
69
69
|
},
|