@cognium/mcp-server 0.1.5 → 0.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/package.json +2 -2
package/CHANGELOG.md CHANGED
@@ -4,6 +4,14 @@ All notable changes to `@cognium/mcp-server` are documented in this file.
4
4
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
5
5
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6
6
 
7
+ ## [0.1.6] - 2026-09-11
8
+
9
+ ### Changed
10
+ - Adopts `circle-ir@4.9.13`. No MCP tool, schema, or response-shape changes.
11
+
12
+ ### Consumer Impact
13
+ - **Finding counts move in both directions.** Tool responses gain `blocking-main-thread` rows for inline Express/Koa route handlers and `path_traversal` rows where a containment guard falls through without rejecting; they lose C# `path_traversal` (canonicalize-then-contain), C# `ssrf` (constant `BaseAddress` with a relative path) and Java/Python `log_injection` (CRLF strip in a helper). Severity tiers are unchanged this release.
14
+
7
15
  ## [0.1.5] - 2026-09-10
8
16
 
9
17
  ### Changed
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cognium/mcp-server",
3
- "version": "0.1.5",
3
+ "version": "0.1.6",
4
4
  "description": "Model Context Protocol server exposing the circle-ir SAST engine as structured tools for LLM agents (Claude Desktop, Claude Code, Cursor, cognium-ai).",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
@@ -63,7 +63,7 @@
63
63
  },
64
64
  "dependencies": {
65
65
  "@modelcontextprotocol/sdk": "^1.29.0",
66
- "circle-ir": "4.9.12",
66
+ "circle-ir": "4.9.13",
67
67
  "yaml": "^2.8.3",
68
68
  "zod": "^3.23.8"
69
69
  },