@cognium/mcp-server 0.1.5 → 0.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,29 @@ All notable changes to `@cognium/mcp-server` are documented in this file.
|
|
|
4
4
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
|
|
5
5
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
+
## [0.1.7] - 2026-09-14
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
- Adopts `circle-ir@4.9.14`. No MCP tool, schema, or response-shape changes.
|
|
11
|
+
|
|
12
|
+
### Consumer Impact
|
|
13
|
+
|
|
14
|
+
Inherits the finding-count changes in `circle-ir@4.9.14`, which move in **both**
|
|
15
|
+
directions — new CWE-78 on `ProcessBuilder` shell wrappers (#351), a CWE-668 becoming a
|
|
16
|
+
CWE-89 on try-with-resources JDBC (#350), and fewer `xss` / `log_injection` findings where
|
|
17
|
+
a source variable's name merely appeared inside a string literal at the sink (#353), plus
|
|
18
|
+
fewer `plugin_param` sources from never-written map keys (#346). A rescan against an
|
|
19
|
+
existing baseline will show movement that is not a regression; see the `circle-ir`
|
|
20
|
+
changelog for the measured numbers.
|
|
21
|
+
|
|
22
|
+
## [0.1.6] - 2026-09-11
|
|
23
|
+
|
|
24
|
+
### Changed
|
|
25
|
+
- Adopts `circle-ir@4.9.13`. No MCP tool, schema, or response-shape changes.
|
|
26
|
+
|
|
27
|
+
### Consumer Impact
|
|
28
|
+
- **Finding counts move in both directions.** Tool responses gain `blocking-main-thread` rows for inline Express/Koa route handlers and `path_traversal` rows where a containment guard falls through without rejecting; they lose C# `path_traversal` (canonicalize-then-contain), C# `ssrf` (constant `BaseAddress` with a relative path), Java/Python `log_injection` (CRLF strip in a helper) and C# `ldap_injection` / `xpath_injection` / `command_injection` / `sql_injection` where an allowlist character strip is applied (circle-ir #272, which merged after the release tag was cut but is present in the published `circle-ir@4.9.13`). Severity tiers are unchanged this release.
|
|
29
|
+
|
|
7
30
|
## [0.1.5] - 2026-09-10
|
|
8
31
|
|
|
9
32
|
### Changed
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cognium/mcp-server",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.7",
|
|
4
4
|
"description": "Model Context Protocol server exposing the circle-ir SAST engine as structured tools for LLM agents (Claude Desktop, Claude Code, Cursor, cognium-ai).",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -63,7 +63,7 @@
|
|
|
63
63
|
},
|
|
64
64
|
"dependencies": {
|
|
65
65
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
66
|
-
"circle-ir": "4.9.
|
|
66
|
+
"circle-ir": "4.9.14",
|
|
67
67
|
"yaml": "^2.8.3",
|
|
68
68
|
"zod": "^3.23.8"
|
|
69
69
|
},
|