@cyanheads/brapi-mcp-server 0.5.3 → 0.5.4

package/CLAUDE.md

@@ -1,7 +1,7 @@
 # Agent Protocol
 
 **Server:** brapi-mcp-server
-**Version:** 0.5.3
+**Version:** 0.5.4
 **Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -318,8 +318,9 @@ Available skills:
 | `api-context` | Context interface, logger, state, progress |
 | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
 | `api-services` | LLM, Speech, Graph services |
+| `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
 | `api-testing` | createMockContext, test patterns |
-| `api-utils` | Formatting, parsing, security, pagination, scheduling |
+| `api-utils` | Formatting, parsing, security, pagination, scheduling, telemetry helpers |
 | `api-workers` | Cloudflare Workers runtime |
 
 When you complete a skill's checklist, check the boxes and add a completion timestamp at the end (e.g., `Completed: 2026-03-11`).

package/Dockerfile

@@ -4,7 +4,7 @@
 # This stage installs all dependencies (including dev), builds the TypeScript
 # source code into JavaScript, and prepares the production assets.
 # ==============================================================================
-FROM oven/bun:1 AS build
+FROM oven/bun:1.3 AS build
 
 WORKDIR /usr/src/app
 
@@ -28,7 +28,7 @@ RUN bun run build
 # application. It uses a slim base image and only includes production
 # dependencies and build artifacts.
 # ==============================================================================
-FROM oven/bun:1-slim AS production
+FROM oven/bun:1.3-slim AS production
 
 WORKDIR /usr/src/app
 

package/README.md

@@ -7,7 +7,7 @@
 
 <div align="center">
 
-[![npm](https://img.shields.io/npm/v/@cyanheads/brapi-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/brapi-mcp-server) [![Version](https://img.shields.io/badge/Version-0.5.3-blue.svg?style=flat-square)](./CHANGELOG.md) [![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-259?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
+[![npm](https://img.shields.io/npm/v/@cyanheads/brapi-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/brapi-mcp-server) [![Version](https://img.shields.io/badge/Version-0.5.4-blue.svg?style=flat-square)](./CHANGELOG.md) [![Framework](https://img.shields.io/badge/Built%20on-@cyanheads/mcp--ts--core-259?style=flat-square)](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^1.29.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/)
 
 [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![TypeScript](https://img.shields.io/badge/TypeScript-^6.0.3-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.3.11-blueviolet.svg?style=flat-square)](https://bun.sh/) [![Status](https://img.shields.io/badge/Status-Beta-yellow.svg?style=flat-square)](./CHANGELOG.md)
 
@@ -17,7 +17,7 @@
 
 ## Tools
 
-22 tools grouped by shape — connection tools bootstrap a session, `find_*` tools return a summarized page plus distributions and spill overflow rows into a canvas dataframe that any agent can query or hand off by ID, `get_*` tools fetch a single record with companion counts, plus pedigree walking, an embedded SQL workspace over spilled rows (DuckDB-backed), file export for human handoff, an additive write surface for observations, and raw passthrough escape hatches.
+22 tools grouped by shape — connection tools bootstrap a session, `find_*` tools return a summarized page plus distributions and spill overflow rows into a canvas dataframe that agents on the same session can query or hand off by ID, `get_*` tools fetch a single record with companion counts, plus pedigree walking, an embedded SQL workspace over spilled rows (DuckDB-backed), file export for human handoff, an additive write surface for observations, and raw passthrough escape hatches.
 
 ### Orient
 
@@ -108,7 +108,7 @@ Within one (tenant, session), dataframes act as a self-cleaning shared notebook:
 
 **Default (isolated) shape.** Under `MCP_AUTH_MODE=none` + HTTP stateful (the default), each MCP session carves its own connection state and its own canvas. Two researchers connected to the same host don't see each other's `brapi_connect` aliases, exchanged SGN/OAuth tokens, or spilled `df_<uuid>` rows. Stdio always behaves as one session (single-process, no concurrency).
 
-**Legacy shared-workspace shape.** Set `BRAPI_SESSION_ISOLATION=false` for cross-session collaboration in one tenant — multiple MCP sessions then share connection state and one default canvas, the way pre-0.6 deployments behaved. Useful when planning, analysis, and writeup agents run as separate MCP clients but operate as one researcher on shared upstream credentials.
+**Shared-workspace shape.** Set `BRAPI_SESSION_ISOLATION=false` for cross-session collaboration in one tenant — multiple MCP sessions then share connection state and one default canvas, the way pre-0.5.3 deployments behaved. Useful when planning, analysis, and writeup agents run as separate MCP clients but operate as one researcher on shared upstream credentials.
 
 **On privileged data.** The `df_<uuid>` name is a capability token within a canvas — not row-level access control. Anyone holding the name within the same (tenant, session) bucket can read its rows. Under default isolation, that bucket is one MCP session. Under `BRAPI_SESSION_ISOLATION=false`, the bucket widens to the whole tenant (all callers under `auth=none`, or one user's sessions under `jwt`/`oauth`). Treat dataframe names like authenticated share links — pass within the bucket, not externally. The 24h TTL caps blast radius; the provenance trail (originating tool, baseUrl, query) supports audit. Belt-and-braces: `brapi_dataframe_describe` requires an explicit `dataframe` name on shared-trust HTTP (no list-all enumeration), and `brapi_dataframe_query` rejects system-catalog reads (`information_schema`, `pg_catalog`, `sqlite_master`, `duckdb_*`) — so a caller without a known `df_<uuid>` name can't fish through either surface.
 
@@ -181,7 +181,7 @@ MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
 
 No env vars are required — the six built-in aliases (`bti-cassava`, `bti-sweetpotato`, `bti-breedbase-demo`, `t3-wheat`, `t3-oat`, `t3-barley`) resolve out-of-the-box, and agents can connect to any other BrAPI v2 URL at runtime via `brapi_connect`. **For credentialed servers, prefer env vars over agent input** so passwords / tokens / API keys stay out of the LLM context — see [Per-alias credentials](#per-alias-credentials).
 
-**Prerequisites:** [Bun v1.3.11+](https://bun.sh/) or Node.js v22+. [`@duckdb/node-api`](https://www.npmjs.com/package/@duckdb/node-api) is a required dependency — supported on Linux/macOS/Windows × x64 plus Linux/macOS arm64 (no Windows arm64; no Cloudflare Workers).
+**Prerequisites:** [Bun v1.3.11+](https://bun.sh/) or Node.js v24+. [`@duckdb/node-api`](https://www.npmjs.com/package/@duckdb/node-api) is a required dependency — supported on Linux/macOS/Windows × x64 plus Linux/macOS arm64 (no Windows arm64; no Cloudflare Workers).
 
 ---
 
@@ -212,7 +212,7 @@ Every variable is optional.
 | `BRAPI_CANVAS_MAX_ROWS` / `BRAPI_CANVAS_QUERY_TIMEOUT_MS` | Per-query response row cap and wall-clock timeout for `brapi_dataframe_query`. | `10000` / `30000` |
 | `MCP_TRANSPORT_TYPE` / `MCP_HTTP_PORT` / `MCP_SESSION_MODE` | Transport (`stdio` \| `http`), HTTP port, session mode (`stateful` \| `stateless` \| `auto`). | `stdio` / `3010` / `auto` |
 | `MCP_AUTH_MODE` / `MCP_LOG_LEVEL` / `STORAGE_PROVIDER_TYPE` / `OTEL_ENABLED` | Auth mode (`none` \| `jwt` \| `oauth`), log level, storage backend, OpenTelemetry. | `none` / `info` / `in-memory` / `false` |
-| `BRAPI_SESSION_ISOLATION` | When `true`, scope ServerRegistry connection state and the CanvasBridge default canvas to `ctx.sessionId` (HTTP stateful/auto). Concurrent callers under `MCP_AUTH_MODE=none` operate in isolated workspaces. Set `false` for the legacy shared-workspace collaboration model. No effect on stdio. | `true` |
+| `BRAPI_SESSION_ISOLATION` | When `true`, scope ServerRegistry connection state and the CanvasBridge default canvas to `ctx.sessionId` (HTTP stateful/auto). Concurrent callers under `MCP_AUTH_MODE=none` operate in isolated workspaces. Set `false` for the shared-workspace collaboration model. No effect on stdio. | `true` |
 
 Per-alias overrides follow the `BRAPI_<ALIAS>_*` pattern — see [`.env.example`](./.env.example) for every override and inline comments.
 
@@ -295,7 +295,7 @@ docker build -t brapi-mcp-server .
 docker run --rm -p 3010:3010 brapi-mcp-server
 ```
 
-Defaults to HTTP transport, stateful session mode (engages `mcp-session-id` lifecycle and hijack protection), logs to `/var/log/brapi-mcp-server`. OTel peer deps are installed by default — `--build-arg OTEL_ENABLED=false` to omit.
+Defaults to HTTP transport, stateful session mode (engages the `mcp-session-id` lifecycle — precondition for `BRAPI_SESSION_ISOLATION=true`; hijack protection requires layering `MCP_AUTH_MODE=jwt|oauth` on top), logs to `/var/log/brapi-mcp-server`. OTel peer deps are installed by default — `--build-arg OTEL_ENABLED=false` to omit.
 
 ### Deployment shapes
 
@@ -305,13 +305,13 @@ Defaults to HTTP transport, stateful session mode (engages `mcp-session-id` life
 |:------|:---------|:----------|:---------|
 | **Per-session (default)** | `MCP_AUTH_MODE=none` + HTTP stateful + `BRAPI_SESSION_ISOLATION=true` | Each MCP session carves its own connection state and canvas. Concurrent HTTP callers don't see each other's aliases, exchanged tokens, or `df_<uuid>` rows. | Multi-user host without SSO. Default for institutional / public deployment under shared-trust auth. |
 | **Per-user credentials** | `MCP_AUTH_MODE=jwt` or `oauth` (+ HTTP stateful) | Each user's JWT `tid` claim carves a tenant. Sessions sub-scope inside each tenant when isolation is on. Cross-user spillover impossible at the framework level. | Multi-user host with institutional SSO (Shibboleth, Okta, etc.) — strongest separation. |
-| **Shared workspace (legacy)** | `MCP_AUTH_MODE=none` + `BRAPI_SESSION_ISOLATION=false` | All callers in one tenant share connection state and one canvas. Possession of a `df_<uuid>` name = full read/write across the workspace. | Solo, lab, or hosting where every caller is one researcher running parallel agents on shared upstream credentials. |
+| **Shared workspace** | `MCP_AUTH_MODE=none` + `BRAPI_SESSION_ISOLATION=false` | All callers in one tenant share connection state and one canvas. Possession of a `df_<uuid>` name = full read/write across the workspace. | Solo, lab, or hosting where every caller is one researcher running parallel agents on shared upstream credentials. |
 
 **Shape selection guide:**
 
 - **Multi-user public/institutional HTTP, no SSO.** Use the per-session default. Each researcher's stateful HTTP session is isolated even though they all resolve to `tenantId='default'`.
-- **Multi-user with institutional SSO.** Layer JWT or OAuth on top of per-session: `MCP_AUTH_MODE=jwt` (HS256, `MCP_AUTH_SECRET_KEY`) or `oauth` (JWKS, `OAUTH_ISSUER_URL` + `OAUTH_AUDIENCE`). Each user's `tid` carves a tenant; `BRAPI_SESSION_ISOLATION=true` then sub-scopes inside it for users running parallel sessions.
-- **One researcher, parallel agents.** If multiple agents (planner, analyst, writeup) connect as separate MCP clients but should share one workspace, set `BRAPI_SESSION_ISOLATION=false` and rely on shared trust. This is the legacy shape.
+- **Multi-user with institutional SSO.** `MCP_AUTH_MODE=jwt` (HS256, `MCP_AUTH_SECRET_KEY`) or `oauth` (JWKS, `OAUTH_ISSUER_URL` + `OAUTH_AUDIENCE`). Each user's `tid` claim carves a tenant — the outer scope. `BRAPI_SESSION_ISOLATION=true` (default) then sub-scopes inside each tenant for users running parallel sessions, and JWT/OAuth identity binding gives real session-hijack protection on top.
+- **One researcher, parallel agents.** If multiple agents (planner, analyst, writeup) connect as separate MCP clients but should share one workspace, set `BRAPI_SESSION_ISOLATION=false` and rely on shared trust. This is the shared-workspace shape.
 - **Stdio.** Always one session; isolation is moot. The flag has no effect.
 
 **Belt-and-braces under shared trust.** Even with `BRAPI_SESSION_ISOLATION=false`, `brapi_dataframe_describe` requires an explicit `dataframe` name on HTTP (no list-all enumeration), and `brapi_dataframe_query` rejects system-catalog reads (`information_schema`, `pg_catalog`, `sqlite_master`, `duckdb_*`). The dataframe name is the capability token; possession proves it.

package/changelog/0.5.x/0.5.4.md

@@ -0,0 +1,25 @@
+---
+summary: "Patch maintenance — drop misleading 'legacy' label from the shared-workspace shape; adopt framework 0.8.19 (engines bump, Docker base 1.3, api-telemetry skill)."
+breaking: false
+---
+
+# 0.5.4 — 2026-05-08
+
+## Changed
+
+- **Engines bumped:** `node >=22.0.0 → >=24.0.0`, `bun >=1.2.0 → >=1.3.0` — tracks the `@cyanheads/mcp-ts-core` 0.8.19 floor.
+- **Dockerfile base:** `oven/bun:1 → oven/bun:1.3` (build and slim-runtime stages).
+- **README prerequisite line:** Node.js v22+ → v24+.
+- **`scripts/build-changelog.ts` synced** — adds optional `security: boolean` frontmatter; pairs with the `## Security` body section to render a `🛡️ Security` badge in the rollup. Existing per-version files stay valid (the field defaults to `false`).
+- **`changelog/template.md` synced** (pristine reference) — bold-the-symbol bullet style, Keep-a-Changelog section order, scaffolded Deprecated / Removed / Security sections (commented out by default).
+- **`CLAUDE.md` / `AGENTS.md` skill table** — added `api-telemetry`; `api-utils` description now mentions telemetry helpers.
+- **Skills resynced from `@cyanheads/mcp-ts-core@0.8.19`** — `api-telemetry` (NEW v1.0; full OTel catalog of spans, metrics, completion-log fields, env config, cardinality rules), `api-utils` 2.1 → 2.2, `maintenance` 2.0 → 2.1 (Phase C now also resyncs pristine reference files), `report-issue-framework` 1.5 → 1.6, `report-issue-local` 1.4 → 1.5, `setup` 1.6 → 1.7. Phase B mirrored into `.claude/skills/` and `.agents/skills/`.
+
+## Fixed
+
+- **Dropped misleading "legacy" label from the shared-workspace deployment shape** — `README.md` table row + env-var description + multi-agent workflows section, `src/services/canvas-bridge/canvas-bridge.ts` comments, `tests/services/server-registry.test.ts` test comment. The shape (`MCP_AUTH_MODE=none + BRAPI_SESSION_ISOLATION=false`) remains a first-class supported deployment mode — only non-default since 0.5.3.
+
+## Dependencies
+
+- **`@cyanheads/mcp-ts-core` `^0.8.17 → ^0.8.19`** — `ctx.auth.token` reaches handlers ([#121](https://github.com/cyanheads/mcp-ts-core/issues/121); not used by this server), new `api-telemetry` skill, `security: boolean` changelog frontmatter, hono `^4.12.18` security floor, OTel SDK `^0.217.0`, engines + Docker base bumps.
+- **`@types/node` `^25.6.0 → ^25.6.2`**.

package/changelog/template.md

@@ -1,41 +1,71 @@
 ---
-# FORMAT REFERENCE — this file is never edited, never moved, never renamed.
-#
-# At release time, author a new per-version file at:
-#   changelog/<major.minor>.x/<version>.md   (e.g. changelog/0.1.x/0.1.0.md)
-# using this file's frontmatter and section layout as the starting point.
-# Set that new file's H1 to `# <version> — YYYY-MM-DD` with a concrete date.
-
-# Required. One-line headline describing the release. Max 250 chars. No markdown.
-# This line is what the CHANGELOG.md rollup shows — write it like a GitHub Release title.
+# FORMAT REFERENCE — do not edit. Copy this file to
+# `changelog/<major.minor>.x/<version>.md` (e.g. `changelog/0.8.x/0.8.6.md`)
+# to author a new release. Set that file's H1 to `# <version> — YYYY-MM-DD`
+# with a concrete date.
+
+# Required. One-line GitHub Release-style headline. ~250 character soft cap.
+# Default short and scannable. Don't pad, don't stitch unrelated changes with
+# semicolons — pick the headline. Quotes required: unquoted YAML treats `: `
+# inside the value as a key separator and fails GitHub's strict parser.
 summary: ""
 
-# Set to `true` only if this release has breaking changes (API removals, signature
-# changes, config renames, anything that requires consumer code changes on update).
-# Flagged as ⚠️ Breaking in the rollup.
+# Set `true` when consumers must change code to upgrade: API removals,
+# signature changes, config renames, behavior changes that break existing
+# usage. Flagged as `Breaking` in the rollup.
 breaking: false
+
+# Set `true` if this release contains any security fix. Pairs with the
+# `## Security` section below. Flagged as `Security` in the rollup so
+# users can triage upgrade urgency at a glance.
+security: false
 ---
 
 # <version> — YYYY-MM-DD
 
 <!--
-  FORMAT REFERENCE — do not edit this file. It exists so the per-version file
-  structure has a single copy-source. Create new release notes at
-  `changelog/<major.minor>.x/<version>.md` using this layout.
+  AUTHORING GUIDE — applies to the new per-version file you create from this
+  template.
+
+  Audience: someone scanning release notes to decide what affects them. Lead
+  each bullet with the symbol or concept name in **bold** so they can skip
+  what's irrelevant and zoom in on what's not.
+
+  Tone: terse, fact-dense, not verbose. Default to one sentence per bullet —
+  name the symbol, state what changed, stop. Use a second sentence only when
+  it carries weight. If a bullet feels long, it is.
+
+  Cut: mechanism walkthroughs (those belong in JSDoc, AGENTS.md, or the
+  relevant skill), ceremonial framings ("This release introduces…",
+  backwards-compat paragraphs), file-by-file test enumerations, internal
+  implementation notes. Prefer code/symbol names over English re-explanations.
+
+  Narrative intro: skip by default. Add one short sentence only when the
+  release theme genuinely needs framing the bullets can't carry.
+
+  Sections: Keep a Changelog order — Added, Changed, Deprecated, Removed,
+  Fixed, Security. Include only sections with entries; delete the rest
+  (including the commented-out scaffolding below). Don't ship empty headers.
 
-  Optional narrative intro — 1-3 sentences framing the release theme. Delete if not needed.
+  Include: every distinct fact a reader needs to adopt or audit the release —
+  new exports, signatures, lint rule IDs, env vars, breaking changes, version
+  bumps on shipped skills. Nothing more.
 
-  Linking issues/PRs: use full URLs so the link works everywhere (GitHub web UI,
-  npm/node_modules reads, local editors). GitHub's bare `#NN` auto-link only
-  resolves inside its own UI.
+  Links: link issues, PRs, docs, or skills where they help a reader jump to
+  context. Once per item per entry — don't re-link the same issue in summary,
+  narrative, and bullet. Skip links for inline symbol names; code spans speak
+  for themselves.
 
-    [#12](https://github.com/<owner>/<repo>/issues/12)   ← issue
-    [#17](https://github.com/<owner>/<repo>/pull/17)     ← PR
+  Issue/PR URLs: use full URLs. GitHub's bare `#NN` auto-link only resolves
+  inside its own UI, not in npm reads or local editors.
 
-  Only link numbers you've verified exist (via `gh issue view NN` or
-  `gh pr view NN`). Never speculate on a future number — `#17` for "my
-  upcoming PR" will quietly resolve to whatever real item already owns 17,
-  and GitHub timeline previews will pull in that unrelated item's title.
+      [#38](https://github.com/cyanheads/mcp-ts-core/issues/38)   ← issue
+      [#42](https://github.com/cyanheads/mcp-ts-core/pull/42)     ← PR
+
+  Verify numbers exist before linking (`gh issue view NN`, `gh pr view NN`).
+  Never speculate on a future number — `#42` for an upcoming PR silently
+  resolves to whatever real item already owns 42, and timeline previews pull
+  in that unrelated item's metadata.
 -->
 
 ## Added
@@ -46,6 +76,18 @@ breaking: false
 
 -
 
+<!-- ## Deprecated
+
+- -->
+
+<!-- ## Removed
+
+- -->
+
 ## Fixed
 
 -
+
+<!-- ## Security
+
+- -->

package/dist/services/canvas-bridge/canvas-bridge.d.ts

@@ -65,7 +65,7 @@ export declare class CanvasBridge {
      * folds the session ID in, so concurrent HTTP sessions in the same tenant
      * end up on distinct canvases. When isolation is disabled or no session ID
      * is available (stdio, stateless HTTP without opt-in), falls back to the
-     * legacy per-tenant shared canvas.
+     * tenant-shared canvas.
      */
     getInstance(ctx: Context): Promise<CanvasInstance>;
     /**

package/dist/services/canvas-bridge/canvas-bridge.js

@@ -38,9 +38,9 @@ function asRequestContext(ctx) {
 /**
  * State keys holding the default canvasId (opaque 10-char token).
  *
- * `DEFAULT_CANVAS_KEY` keys the per-tenant default canvas — the legacy
- * shared workspace; used for stdio, stateless HTTP without opt-in, and any
- * deployment where `BRAPI_SESSION_ISOLATION=false`.
+ * `DEFAULT_CANVAS_KEY` keys the per-tenant default canvas — the
+ * tenant-shared workspace; used for stdio, stateless HTTP without opt-in,
+ * and any deployment where `BRAPI_SESSION_ISOLATION=false`.
  *
  * `SESSION_CANVAS_PREFIX` keys per-session canvases when isolation is on
  * and `ctx.sessionId` is present. Each session gets its own canvas and
@@ -87,7 +87,7 @@ export class CanvasBridge {
      * folds the session ID in, so concurrent HTTP sessions in the same tenant
      * end up on distinct canvases. When isolation is disabled or no session ID
      * is available (stdio, stateless HTTP without opt-in), falls back to the
-     * legacy per-tenant shared canvas.
+     * tenant-shared canvas.
      */
     async getInstance(ctx) {
         const key = this.defaultCanvasKey(ctx);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cyanheads/brapi-mcp-server",
   "mcpName": "io.github.cyanheads/brapi-mcp-server",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "A collaborative BrAPI v2.1 workspace for multi-agent research via MCP. Search studies, germplasm, genotypes, & more - across Breedbase, T3, Sweetpotatobase, & any BrAPI v2-compliant server.",
   "author": "Casey Hand @cyanheads (https://github.com/cyanheads/brapi-mcp-server#readme)",
   "type": "module",
@@ -63,21 +63,21 @@
   },
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=22.0.0",
-    "bun": ">=1.2.0"
+    "node": ">=24.0.0",
+    "bun": ">=1.3.0"
   },
   "packageManager": "bun@1.3.11",
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@cyanheads/mcp-ts-core": "^0.8.17",
+    "@cyanheads/mcp-ts-core": "^0.8.19",
     "@duckdb/node-api": "^1.5.2-r.1",
     "pino-pretty": "^13.1.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.14",
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.6.2",
     "depcheck": "^1.4.7",
     "ignore": "^7.0.5",
     "tsc-alias": "^1.8.17",

package/server.json

@@ -6,14 +6,14 @@
     "url": "https://github.com/cyanheads/brapi-mcp-server",
     "source": "github"
   },
-  "version": "0.5.3",
+  "version": "0.5.4",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/brapi-mcp-server",
       "runtimeHint": "bun",
-      "version": "0.5.3",
+      "version": "0.5.4",
       "packageArguments": [
         { "type": "positional", "value": "run" },
         { "type": "positional", "value": "start:stdio" }
@@ -49,7 +49,7 @@
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@cyanheads/brapi-mcp-server",
       "runtimeHint": "bun",
-      "version": "0.5.3",
+      "version": "0.5.4",
       "packageArguments": [
         { "type": "positional", "value": "run" },
         { "type": "positional", "value": "start:http" }