@cyanheads/pubchem-mcp-server 0.6.2 → 0.6.4

package/changelog/0.3.x/0.3.0.md

@@ -0,0 +1,31 @@
+---
+summary: "Fix silent data loss in pubchem_get_compound_safety (precautionary statements) and pubchem_get_compound_details (FDA pharmacological classification), both parsing PubChem's real shapes; add a maxSynonyms cap; correct the server assay-routing instructions; adopt mcp-ts-core ^0.10.10; clear 8 transitive security advisories"
+breaking: false
+security: true
+---
+
+# 0.3.0 — 2026-06-30
+
+## Added
+
+- **`maxSynonyms`** — `pubchem_get_compound_details` gains an integer input (1–100, default 20) that caps the synonyms returned per compound, with a new optional **`synonymsTotal`** output reporting the full count before truncation. The structured surface was previously uncapped (697 synonyms for aspirin) and disagreed with `format()`'s 20-item view; both now share the head-of-list cap, preserving PubChem's relevance ordering. Mirrors the existing `maxDescriptions`/`descriptionsTotal` pattern. ([#24](https://github.com/cyanheads/pubchem-mcp-server/issues/24))
+
+## Changed
+
+- **Server `instructions`** — the target-centric routing hint pointed `pubchem_search_assays` (→ AIDs) into `pubchem_get_bioactivity`, which takes a compound `cid`, not AIDs. Reworded to the two real paths: assays-for-a-target chains `search_assays` → `pubchem_get_summary` (`entityType: assay`) per AID, and compound-active-against-a-target calls `get_bioactivity` with a `cid` plus `targetGeneId`/`targetAccession`. ([#25](https://github.com/cyanheads/pubchem-mcp-server/issues/25))
+
+## Fixed
+
+- **`pubchem_get_compound_safety` precautionary statements** — always returned `[]`. PubChem deposits precautionary statements as a single comma-separated P-code list (codes only, no descriptive text), which the `Pxxx: text` parser matched on neither shape. A dedicated `parsePrecautionaryCodes()` splits the list into code-only entries, preserving combined `Pxxx+Pyyy` (and triple) codes and stripping the terminal Oxford "and"; `format()` renders a bare code when no text is present. No standard P-statement text is fabricated. ([#22](https://github.com/cyanheads/pubchem-mcp-server/issues/22))
+- **`pubchem_get_compound_details` FDA pharmacological classification** — `fdaClasses` and `fdaMechanisms` were always `[]` while MeSH classes and ATC codes in the same response parsed, because the parser gated every string on a `Pharmacological Classes:` prefix PubChem never emits. Now parses PubChem's two real shapes — individual (`<Type> [TAG] - <Name>`) and combined (`<Name> [TAG]; …`) — bucketing `EPC` → `fdaClasses` and `MoA` → `fdaMechanisms` (CS/PE have no output field). ([#23](https://github.com/cyanheads/pubchem-mcp-server/issues/23))
+
+## Security
+
+- Clears the 8 transitive advisories `bun audit` flagged on 0.2.4 (2 high, 6 moderate) — notably the high-severity `vite` `server.fs.deny` bypass and `hono` CORS reflecting any origin with credentials — via the lockfile re-resolve: `hono` `4.12.26 → 4.12.27`, `vite` `8.0.14 → 8.1.2`, and `js-yaml` `3.14.2 → 3.15.0` (merge-key quadratic DoS). All transitive — this server declares no direct dependency on them — and `bun audit` now reports no vulnerabilities.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` `^0.10.9 → ^0.10.10` — adopts the in-framework js-yaml v4 → v5 migration (preserves YAML 1.1 load semantics; not breaking for this server, which doesn't install js-yaml directly).
+- `@biomejs/biome` `^2.5.0 → ^2.5.1`
+- `@types/node` `^26.0.0 → ^26.0.1`
+- Lockfile re-resolve also refreshed other transitive packages; the security-relevant bumps are listed under Security.

package/changelog/0.3.x/0.3.1.md

@@ -0,0 +1,19 @@
+---
+summary: "Validate CID-shaped structure queries and blank/non-numeric target queries in pubchem_search_compounds and pubchem_search_assays before the upstream call; surface identifier-mode partial-batch misses and CID collisions via a new unresolvedIdentifiers field; add an empty-result notice to pubchem_get_compound_xrefs"
+breaking: false
+security: false
+---
+
+# 0.3.1 — 2026-07-03
+
+## Fixed
+
+- **`pubchem_search_compounds`** — structure/similarity searches with `queryType: "cid"` accepted non-CID-shaped strings and forwarded them to PubChem, producing a raw upstream 400 instead of a typed error. Now validates the query is a positive integer before the call, throwing `invalid_cid_query` with recovery guidance. ([#26](https://github.com/cyanheads/pubchem-mcp-server/issues/26))
+- **`pubchem_search_assays`** — a blank or whitespace-only `targetQuery` was treated as a meaningful (empty) search instead of an invalid input. Now rejects blank/whitespace `targetQuery` (`blank_target_query`) and non-numeric `geneid` queries (`invalid_geneid_query`) before the upstream call. ([#26](https://github.com/cyanheads/pubchem-mcp-server/issues/26))
+- **`pubchem_search_compounds` identifier mode** — a partial-batch miss (some identifiers resolve, others don't) was silently dropped: `results` held only the hits, with no signal of which inputs failed. Now returns an optional **`unresolvedIdentifiers`** output field plus an enrichment notice naming the misses; an identifier resolving to an already-claimed CID emits a collision notice, and the CID's echoed identifier is now the first requester in input order (previously last-write-wins). ([#29](https://github.com/cyanheads/pubchem-mcp-server/issues/29))
+- **`pubchem_get_compound_xrefs`** — returned bare empty arrays for both a nonexistent CID and a real compound with none of the requested xref types, with no way to tell them apart. Now emits an enrichment notice when every requested xref type returns zero IDs, pointing at CID verification. ([#30](https://github.com/cyanheads/pubchem-mcp-server/issues/30))
+
+## Dependencies
+
+- `@biomejs/biome` `^2.5.1 → ^2.5.2`
+- `@types/node` `^26.0.1 → ^26.1.0`

package/changelog/0.4.x/0.4.0.md

@@ -0,0 +1,15 @@
+---
+summary: "Add maxAtoms/maxBonds/includeRawSdf output controls with truncation disclosure to pubchem_get_compound_3d_structure; frame upstream free text (descriptions, synonyms, interaction statements, GHS text, raw SDF) as delimited data in content[] to neutralize markdown-structure injection across six tools"
+breaking: false
+security: false
+---
+
+# 0.4.0 — 2026-07-03
+
+## Added
+
+- **`pubchem_get_compound_3d_structure`** — optional `maxAtoms`/`maxBonds` cap the atom/bond preview (default 200 each); `includeRawSdf` opts into the full raw SDF past a 500-line safe default. `atomCount`/`bondCount` always report the full totals; capping surfaces via a new `truncated`/`shownAtoms`/`shownBonds`/`atomCap`/`bondCap`/`shownSdfLines` enrichment block with a recovery notice. ([#28](https://github.com/cyanheads/pubchem-mcp-server/issues/28))
+
+## Changed
+
+- **Output-boundary hardening** — upstream free text (descriptions, synonyms, lineage, interaction statements, assay names, GHS hazard/precautionary statement text, raw SDF) is now framed as delimited data in `content[]` via new `inlineData`/`quoteData`/`fencedData` helpers, neutralizing markdown-structure injection from PubChem-controlled strings. Applied to `pubchem_get_compound_details`, `pubchem_get_summary`, `pubchem_get_compound_interactions`, `pubchem_get_compound_3d_structure` (SDF fencing), `pubchem_get_bioactivity`, and `pubchem_get_compound_safety`. `structuredContent` is unchanged — raw values pass through verbatim. ([#27](https://github.com/cyanheads/pubchem-mcp-server/issues/27))

package/changelog/0.4.x/0.4.1.md

@@ -0,0 +1,12 @@
+---
+summary: "Decode GHS precautionary (P-code) statements to standard text via a new lookup table in pubchem_get_compound_safety; append the asserted uM unit to target-kind activity values in pubchem_get_compound_interactions"
+breaking: false
+security: false
+---
+
+# 0.4.1 — 2026-07-03
+
+## Changed
+
+- **`pubchem_get_compound_safety`** — precautionary (P-code) statements now decode to standard UN GHS Rev. 10 Annex 3 text via a new `PRECAUTIONARY_STATEMENTS` table (mirrors the existing `PICTOGRAM_LABELS` pattern); `statement` was previously always `""`. Codes with no Rev. 10 text (free-fill placeholders, deleted codes) still fall back to `""`. ([#31](https://github.com/cyanheads/pubchem-mcp-server/issues/31))
+- **`pubchem_get_compound_interactions`** — target-kind activity values now carry the asserted `uM` unit (e.g. `"Ki = 0.0005 uM"`), grounded in PubChem's documented micromolar deposit convention; previously unitless. ([#32](https://github.com/cyanheads/pubchem-mcp-server/issues/32))

package/changelog/0.4.x/0.4.2.md

@@ -0,0 +1,41 @@
+---
+summary: "Distinguish nonexistent CIDs from no-data compounds in pubchem_get_compound_safety; mark undecoded GHS P-codes explicitly; drop the dead severity field from pubchem_get_compound_interactions; fix two GHS-statement parsing bugs; adopt mcp-ts-core ^0.11.0"
+breaking: false
+security: false
+---
+
+# 0.4.2 — 2026-07-28
+
+## Added
+
+- **`bunfig.toml`** — `minimumReleaseAge` (3-day supply-chain guard against freshly published package versions, excluded for `@cyanheads/mcp-ts-core`) and the Socket install scanner (`@socketsecurity/bun-security-scanner`), scanning every package before install.
+- **`scripts/clean-mcpb.ts` / `scripts/lint-packaging.ts`** — the `.mcpb` bundle strip now also removes platform-specific native binding entries (e.g. `@duckdb/node-bindings-*`), alongside the existing agent-doc strip, so a bundle built on one platform doesn't silently ship a binding that only runs there.
+- **`.github/SECURITY.md`**, **`.github/FUNDING.yml`**, **`.gitattributes`** — repo governance and hygiene files vendored from the mcp-ts-core scaffold.
+
+## Changed
+
+- **`pubchem_get_compound_safety`** — CID lookups now report a `status` of `ok`, `no_ghs_data`, or `cid_not_found` instead of a single `hasData` boolean; the notice and rendered text lead with CID-verification guidance for unrecognized CIDs, separately from the no-classification case for compounds that exist. `pubchem://compound/{cid}/safety` carries the same discriminator. ([#42](https://github.com/cyanheads/pubchem-mcp-server/issues/42))
+- **`pubchem_get_compound_safety`** — precautionary statement entries now carry a `decoded` boolean; a P-code absent from the static lookup table (free-fill placeholder or decoder-coverage gap) renders as `(not decoded)` instead of a bare or blank statement. ([#34](https://github.com/cyanheads/pubchem-mcp-server/issues/34))
+- **`scripts/devcheck.ts`** outdated check — no longer flags peer-dependency rows or versions held back by `minimumReleaseAge`; only packages actually behind their declared range fail the gate.
+- **`scripts/check-dependency-specifiers.ts`** — the floating-specifier check now also scans `package.json`'s `overrides` section.
+- `package.json` `author` field and the `LICENSE` copyright line reformatted to match the current scaffold convention.
+
+## Removed
+
+- **`pubchem_get_compound_interactions`** — dropped the `severity` field from the output schema, type, and formatter. No fetch path (`getDrugDrugInteractions`, `getDrugFoodInteractions`, `getTargetInteractions`) ever populated it, and the underlying `drugbankddi` SDQ collection has no severity-bearing column to project. ([#43](https://github.com/cyanheads/pubchem-mcp-server/issues/43))
+
+## Fixed
+
+- **GHS hazard/precautionary parsing** — `parseCodedStatement` no longer drops statements carrying a depositor-agreement percentage (`H319 (100%): ...`) or asterisk marker (`H370 **: ...`) between the code and separator, and now accepts subcategory-suffixed codes (`H350i`, `H360D`, `H361fd`) as distinct entries instead of failing the match.
+- **GHS precautionary code parsing** — `parsePrecautionaryCodes` now scans the list for P-code shapes instead of matching each comma-split token against an anchored pattern; the anchored form silently dropped whichever code PubChem's trailing prose ("click each P-code to see the statement") was glued to, most often the final code (P501, the disposal statement).
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` `^0.10.10 → ^0.11.0`
+- `typescript` `^6.0.3 → ^7.0.2`
+- `@biomejs/biome` `^2.5.2 → 2.5.5` (pinned exact)
+- `@types/node` `^26.1.0 → 26.1.1` (pinned exact)
+- `tsc-alias` `^1.8.17 → ^1.9.1`
+- `vitest` `^4.1.9 → ^4.1.10`
+- `ignore` `^7.0.5 → ^7.0.6`
+- `@socketsecurity/bun-security-scanner` added `^1.1.2`

package/changelog/0.4.x/0.4.3.md

@@ -0,0 +1,18 @@
+---
+summary: "Fix content[] truncation that hid data structuredContent already returned; fix assay/taxonomy field mapping in pubchem_get_summary; remove implementation and audience leaks from tool/resource descriptions"
+breaking: false
+security: false
+---
+
+# 0.4.3 — 2026-07-28
+
+## Changed
+
+- **`pubchem_get_compound_xrefs`**, **`pubchem_get_summary`**, **`pubchem_get_compound_details`** — `format()` no longer re-slices arrays that `structuredContent` already returns in full; xref IDs, gene/taxonomy synonyms and lineage, and MeSH classes now render completely instead of stopping at 20/10/3 items with a `(+N more)` note. ([#37](https://github.com/cyanheads/pubchem-mcp-server/issues/37))
+- **`pubchem_get_compound_details`**, **`pubchem_get_summary`** — MeSH classes render one per line and synonym/lineage/array fields join on `" | "` instead of `"; "`/`", "`, so a value carrying its own comma or semicolon (CAS-inverted names, MeSH scope notes) can't be misread as an entry boundary.
+- **Tool and resource descriptions** — removed reader-naming ("the model can reason over"), internal API-call-count framing ("one extra API call", "efficiently batches"), and maintainer shorthand ("mirrors pubchem_*") from `get-compound-3d-structure`, `get-compound-details`, and all 6 resource definitions; `pubchem://compound/{cid}/image` now states its fixed 300x300 output instead of implying tool-equivalent sizing. ([#35](https://github.com/cyanheads/pubchem-mcp-server/issues/35))
+
+## Fixed
+
+- **`pubchem_get_summary`** — assay summaries now read substance counts from `SIDCountAll`/`SIDCountActive` instead of keys PubChem's `assay/aid/{aid}/summary` endpoint never emits (`NumberOfSubstances`, `TotalSIDCount`, `ActiveSidCount`, `ActiveCount`), so `numSubstances`/`numActive` populate instead of silently omitting. ([#39](https://github.com/cyanheads/pubchem-mcp-server/issues/39))
+- **`pubchem_get_summary`** — taxonomy summaries now flatten the `RankedLineage` object (most-inclusive-first, blank ranks dropped) into `lineage`, and map the top-level `Synonym` array into `synonyms`; both previously read nonexistent keys (`Lineage`, `ParentTaxList`) and stayed empty. ([#39](https://github.com/cyanheads/pubchem-mcp-server/issues/39))

package/changelog/0.5.x/0.5.0.md

@@ -0,0 +1,24 @@
+---
+summary: "Bound pubchem_search_compounds fast searches with PubChem's MaxRecords instead of pulling the full match set, reporting a totalFoundAtLeast floor when saturated; add offset pagination to pubchem_get_bioactivity. Breaking: outputSchema.required changes on both tools."
+breaking: true
+security: false
+---
+
+# 0.5.0 — 2026-07-28
+
+## Migration
+
+| Tool | `outputSchema.required` before | After |
+|:--|:--|:--|
+| `pubchem_search_compounds` | `results`, `searchType`, `totalFound` | `totalFound` drops out of `required` (now optional). A caller reading it unconditionally must handle its absence — check the new optional `totalFoundAtLeast` instead, populated when a bounded search (`formula`/`substructure`/`superstructure`/`similarity`) saturated its cap and the exact count is unknowable. `identifier` searches are unbounded and always report an exact `totalFound`. |
+| `pubchem_get_bioactivity` | 8 entries | Gains `offset` (9 entries). Additive and always populated on success, so no existing reader breaks — but the advertised schema changes. |
+
+## Added
+
+- **`pubchem_get_bioactivity`** — `offset` input paginates past the first page of filtered assay results, applied after `outcomeFilter`/`targetGeneId`/`targetAccession` and before the `maxResults` slice. Enrichment gains `offset` (now required) and an optional `nextOffset` to pass into the next call; an offset past the end of the filtered set returns an empty page with a notice instead of erroring. ([#33](https://github.com/cyanheads/pubchem-mcp-server/issues/33))
+
+## Changed
+
+- **`pubchem_search_compounds`** — formula, substructure, superstructure, and similarity searches now bound the upstream request with PubChem's `MaxRecords` parameter (`maxResults + 1`) instead of pulling the entire match set; a benzoic-acid substructure query that previously moved a 16.2 MB, 1,000,000-CID upstream payload now moves 316 bytes, cutting latency from 8.7s to 1.1s. `identifier` searches (name/SMILES/InChIKey) are unbounded and unaffected. See Migration for the `totalFound`/`totalFoundAtLeast` output change. ([#41](https://github.com/cyanheads/pubchem-mcp-server/issues/41))
+- **`pubchem://compound/{cid}/bioactivity`** resource description now points at the new `offset` input instead of only mentioning `outcomeFilter`/target filtering.
+- **`.dockerignore`**, **`vitest.config.ts`**, **`.github/ISSUE_TEMPLATE/bug_report.yml`**, **`.github/ISSUE_TEMPLATE/feature_request.yml`** — realigned to the current mcp-ts-core scaffold: `.agents` added to the Docker ignore list, `vitest.config.ts` adopts Vitest 4 `projects` (an `unit` project today, commented-out `smoke`/`fuzz`/`integration` slots for later), and both issue templates gained secondary-label guidance and dropped the `@cyanheads/` scope from their descriptions.

package/changelog/0.5.x/0.5.1.md

@@ -0,0 +1,24 @@
+---
+summary: "Add offset pagination to pubchem_get_compound_xrefs and pubchem_search_assays; add synonymOffset/descriptionOffset paging plus PUG View fan-out disclosure to pubchem_get_compound_details; fix README overclaims on synonym coverage and bioactivity paging."
+breaking: false
+security: false
+---
+
+# 0.5.1 — 2026-07-28
+
+## Added
+
+- **`pubchem_get_compound_xrefs`** — `offset` input paginates past the first page of each requested xref type; enrichment gains `offset` (required) and an optional `nextOffset`. `nextOffset`'s stride comes from a returned page's length rather than from `maxPerType`, which accepts a non-integer value that would otherwise produce a `nextOffset` the tool's own `offset` validator rejects. ([#38](https://github.com/cyanheads/pubchem-mcp-server/issues/38))
+- **`pubchem_search_assays`** — `offset` input mirrors the paging added to `pubchem_get_bioactivity` in 0.5.0; enrichment gains `offset` (required) and an optional `nextOffset`. ([#38](https://github.com/cyanheads/pubchem-mcp-server/issues/38))
+- **`pubchem_get_compound_details`** — `synonymOffset` and `descriptionOffset` inputs page each compound's synonym/description list at a shared batch-wide offset; enrichment gains optional `synonymOffset`/`nextSynonymOffset` and `descriptionOffset`/`nextDescriptionOffset`. ([#38](https://github.com/cyanheads/pubchem-mcp-server/issues/38))
+- **`pubchem_get_compound_details`** — the PUG View fan-out cap (10 CIDs per call, for `includeDescription`/`includeClassification`) is now disclosed via enrichment: `enrichedCids` and `skippedCids` list which CIDs were and weren't fetched, with a notice explaining a skipped CID's absent description means "not requested," not "PubChem has none." Previously only logged, never surfaced to the caller. ([#40](https://github.com/cyanheads/pubchem-mcp-server/issues/40))
+
+## Changed
+
+- **`pubchem_get_compound_xrefs`**, **`pubchem_search_assays`**, **`pubchem_get_compound_details`** — tool/input descriptions and `format()` output reworded from "capped"/"truncated" to page-relative language ("this page", "past this page") now that offset paging exists alongside the existing caps.
+- **`pubchem://compound/{cid}/xrefs`** resource description now mentions `pubchem_get_compound_xrefs`'s `offset` paging.
+- **README** — dropped the "all known synonyms" overclaim (synonyms are paged, not exhaustive), clarified the synonym/description paging behavior, and reworded the bioactivity bullet to mention `offset` instead of implying a hard 100-result cap.
+
+## Fixed
+
+- **`pubchem_get_compound_xrefs`** — the empty-result notice previously fired whenever every requested type's returned page was empty, which misfired when an `offset` simply ran past the data; it now distinguishes a genuinely empty compound (`totalAvailable === 0` for every type) from an offset past the end (a dedicated notice naming the largest available total).

package/changelog/0.5.x/0.5.2.md

@@ -0,0 +1,21 @@
+---
+summary: "Add offset pagination to pubchem_search_compounds and pubchem_get_compound_interactions, completing #38; switch the interactions SDQ query to a select projection for exact per-kind totals."
+breaking: false
+security: false
+---
+
+# 0.5.2 — 2026-07-28
+
+## Added
+
+- **`pubchem_search_compounds`** — `offset` input (0–10000) pages CIDs past `maxResults`; enrichment gains `offset` (required) and an optional `nextOffset`. Identifier-mode paging re-slices the already-resolved CID set; the bounded formula/substructure/superstructure/similarity searches widen the upstream record window to `offset + maxResults + 1` to reach a page, so deep pages cost progressively more upstream. ([#38](https://github.com/cyanheads/pubchem-mcp-server/issues/38))
+- **`pubchem_get_compound_interactions`** — `offset` input (0–2147483646, the upstream `start` cursor's signed-32-bit ceiling) pages each requested kind past `maxEntries`. Output gains a `paging` array (one entry per resolved kind: `kind`, `returnedCount`, `totalRecords`, optional `nextOffset`, `truncated`); enrichment gains `offset` (required) and `nextOffset` (reported only when exactly one requested kind still has records remaining — with more than one, read `paging[].nextOffset` instead). ([#38](https://github.com/cyanheads/pubchem-mcp-server/issues/38))
+
+## Changed
+
+- **`pubchem_search_compounds`** — tool/input descriptions and notices reworded from "raise maxResults" to offset-paging language; an empty page now distinguishes "nothing matched" from "the offset ran past the matches" and names the bound to page back inside.
+- **`pubchem_get_compound_interactions`**'s `target` kind switched its SDQ query from a `download` to a `select` projection, returning an exact per-kind `totalRecords` in the same round trip instead of inferring a floor from a saturated window. A side effect: some rows that rendered their activity value in exponential notation under `download` (e.g. `1e-06`) now render as a plain decimal (`0.000001`) — the underlying number is unchanged, with no precision or trailing-zero loss.
+- **`pubchem_get_compound_interactions`**'s `fetchSdq` now also treats a `status.error` inside a 2xx SDQ response body as a rejection, alongside the existing non-2xx handling, so a malformed query can't read as an empty page if SDQ ever wraps a rejection in a 200.
+- **README** — documents both tools' new `offset` ceilings and the interactions tool's per-kind paging.
+
+Completes [#38](https://github.com/cyanheads/pubchem-mcp-server/issues/38).

package/changelog/0.6.x/0.6.0.md

@@ -0,0 +1,15 @@
+---
+summary: "Constrain four per-page cap inputs to integers, rejecting fractional values that were previously silently floored or forwarded upstream."
+breaking: true
+security: false
+---
+
+# 0.6.0 — 2026-07-28
+
+## Changed
+
+- **`pubchem_get_compound_xrefs`**'s `maxPerType`, **`pubchem_search_assays`**'s `maxResults`, **`pubchem_get_bioactivity`**'s `maxResults`, and **`pubchem_search_compounds`**'s `maxResults` now advertise `integer` instead of an unconstrained `number`. All nine cap inputs across the server (these four plus the already-integer `maxSynonyms`, `maxDescriptions`, `maxAtoms`, `maxBonds`, `maxEntries`) now advertise `integer` consistently. ([#44](https://github.com/cyanheads/pubchem-mcp-server/issues/44))
+
+**Migration:** a call passing a fractional value to any of the four inputs above now fails input validation instead of succeeding. Previously, `pubchem_get_compound_xrefs.maxPerType`, `pubchem_search_assays.maxResults`, and `pubchem_get_bioactivity.maxResults` silently floored a fractional cap via `Array.prototype.slice`, returning fewer results than the schema implied without any error. `pubchem_search_compounds.maxResults` is a narrower case: for formula, substructure, superstructure, and similarity searches the handler derives the upstream record window directly from this input, so a fractional value previously reached PubChem verbatim and the call already failed — with an upstream HTTP 400 rather than a local validation error. For that one input the change moves an existing failure earlier and makes it legible; for the other three it is a new rejection where a call previously succeeded. Round every value passed to these four inputs to a whole number before calling.
+
+Completes [#44](https://github.com/cyanheads/pubchem-mcp-server/issues/44).

package/changelog/0.6.x/0.6.1.md

@@ -0,0 +1,40 @@
+---
+summary: "Adopts mcp-ts-core ^0.12.3 and MCP SDK v2 — tool arguments are strict and the advertised schemas change shape — and three tools gain a top-level `truncated` flag in their enrichment."
+breaking: false
+security: false
+---
+
+# 0.6.1 — 2026-08-21
+
+Every wire-level change below comes from the framework bump; no tool's own input or output contract changed.
+
+## Added
+
+- **`truncated`** — a required boolean in the enrichment of `pubchem_get_compound_xrefs`, `pubchem_get_compound_interactions`, and `pubchem_get_compound_details`, stating at the top level that the response is not the whole set. The per-item detail stays where it was (`xrefs[].truncated`, `paging[].truncated`, `compounds[].synonymsTotal`); on `pubchem_get_compound_details` the flag also covers the PUG View fan-out cap, so a response with skipped CIDs reads as incomplete even when no list was paged.
+- **`.github/CONTRIBUTING.md`** and **`.github/CODE_OF_CONDUCT.md`** — community-health files from the mcp-ts-core scaffold.
+
+## Changed
+
+- **Tool arguments are strict.** An argument key a tool does not declare is rejected by name instead of being silently stripped, and every advertised `inputSchema` carries `additionalProperties: false`. Root level only — a nested object still strips.
+- **The advertised `outputSchema` declares the error envelope.** Success fields become optional and `error` is declared, so a client that validates `structuredContent` without checking `isError` no longer rejects an error result with `-32602`.
+- **Advertised JSON Schema is 2020-12**, not draft-07.
+- **`ctx.log` output reaches the client** as `notifications/message`, gated by the client's `logging/setLevel`.
+- **The Docker build stage is pinned to `$BUILDPLATFORM`** ([cyanheads/mcp-ts-core#370](https://github.com/cyanheads/mcp-ts-core/issues/370)). Bun 1.4.0's JavaScriptCore aborts under QEMU, so the cross-architecture half of a multi-arch build failed on an arm64 host; the stage emits platform-independent JavaScript and only `dist/` is copied forward, so building it natively is equivalent.
+- **Bun pins move to 1.4.0** — both `Dockerfile` stages and `packageManager`. `engines.bun` stays `>=1.3.0`.
+- **The production Docker install omits optional peers** — `--omit=peer` on both the `bun install` and the OpenTelemetry `bun add`, so the runtime image no longer carries the framework's opt-in tiers.
+- **`tsconfig.json` typechecks `tests/`.** It now covers `src/` and `tests/` with `noEmit`, and `tsconfig.build.json` carries the emit path (`rootDir: src`).
+- **Security reports route to `security@caseyjhand.com`** (`.github/SECURITY.md`).
+- **`PubChemClient`** raises its two SDQ failures through the `serviceUnavailable()` factory instead of constructing `McpError` directly.
+- Internal tooling tracked the framework: `scripts/lint-packaging.ts` checks `@modelcontextprotocol/server` as the runtime-critical path, and `scripts/lint-mcp.ts` dropped its task-definition branch.
+
+## Fixed
+
+- **`bun run tree` honors directory-only gitignore patterns.** `.claude/` and its siblings were listed in `docs/tree.md` despite being ignored — `ignore` reads a trailing slash off the tested path, which `isIgnored` never supplied.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` `^0.11.0 → ^0.12.3` — MCP SDK v2: the framework now builds on `@modelcontextprotocol/server` `^2.0.0` in place of `@modelcontextprotocol/sdk` `^1.x`
+- `@biomejs/biome` `2.5.5 → 2.5.9`
+- `@types/node` `26.1.1 → 26.2.0`
+- `tsc-alias` `^1.9.1 → ^1.9.2`
+- `vitest` `^4.1.10 → ^4.1.11`

package/changelog/0.6.x/0.6.2.md

@@ -0,0 +1,29 @@
+---
+summary: "Framework adoption and HTTP retry handling"
+breaking: false
+security: false
+---
+
+# 0.6.2 — 2026-09-13
+
+## Changed
+
+- **HTTP deployments default to stateless sessions** in the published server metadata and example configuration; PubChem tools do not require multi-request session state.
+- **Framework development skills moved to `framework-skills/`** with package checks, contributor links, and generated tree documentation updated for the new location.
+- **Empty and whole-value placeholder environment variables now resolve as unset** through `@cyanheads/mcp-ts-core`, so optional values remain absent and defaulted values use their schema defaults.
+- **Invalid tool arguments return a structured `InvalidParams` error** through the framework's current JSON-RPC error path.
+- **Project metadata and local gates track the current framework templates**, including plugin validation, issue forms, Bun 1.4 support, and Vitest 5.
+
+## Fixed
+
+- **PubChem HTTP retries honor framework retry classification**: an upstream 500 retries once, while a 501 marked `retryable: false` fails immediately.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.12.3 → ^0.13.0
+- `zod` ^4.4.3 → ^4.6.1
+- `@biomejs/biome` 2.5.9 → 2.5.13
+- `@types/node` 26.2.0 → 26.5.1
+- `ignore` ^7.0.6 → ^7.0.9
+- `tsc-alias` ^1.9.2 → ^1.9.4
+- `vitest` ^4.1.11 → ^5.0.0

package/changelog/0.6.x/0.6.3.md

@@ -0,0 +1,40 @@
+---
+summary: "Adopts mcp-ts-core through 0.13.6: input aliases on four tools, a declared stateless session mode, structured argument-rejection errors, and CodeQL fixes for regex backtracking and an upstream URL leak in error data."
+breaking: false
+security: true
+---
+
+# 0.6.3 — 2026-09-19
+
+## Added
+
+- **`sessionMode: 'stateless'` declared in `src/index.ts`** — with `MCP_SESSION_MODE` unset the HTTP transport serves stateless; an exported `MCP_SESSION_MODE` value still overrides the declaration.
+- **`GET /.well-known/mcp.json` reports the resolved session mode** under `_meta["io.github.cyanheads.mcp-ts-core/sessionMode"]`.
+- **`inputAliases` on four tools** — `pubchem_search_assays` accepts `query`/`target` for `targetQuery`, `pubchem_get_compound_xrefs` accepts `maxResults` for `maxPerType`, `pubchem_get_compound_interactions` accepts `maxResults` for `maxEntries`, and `pubchem_get_bioactivity` accepts `geneId`/`accession` for `targetGeneId`/`targetAccession`. Advertised `inputSchema` is unchanged.
+
+## Changed
+
+- **A rejected tool argument answers `-32602`** with `data.reason: "invalid_arguments"`, a `data.recovery.hint` naming the accepted keys, and a matching `Recovery:` line in `content[0].text`.
+- **`thrownBy: 'service'`** on the `cid_not_found` and `no_3d_structure` error contract reasons, which the service layer raises.
+- **`.env.example` and the README config table now match the current framework scaffold** — session mode, resumability, body cap, public URL, and memory settings; the port comment corrected to `3010`.
+- **CLAUDE.md gains an `AGENTS.md` twin** and documents the gated release-PR flow; both files, plus `changelog/`, now ship in the npm package.
+- **CodeQL workflow added** (`.github/workflows/codeql.yml`) — the one GitHub Actions workflow this server carries; local gates cover the rest.
+- **22 framework skills and 6 dev scripts re-synced** from `@cyanheads/mcp-ts-core` 0.13.1–0.13.6.
+
+## Fixed
+
+- **`untrusted-text`'s inline escaping covers a lone backslash**, so an upstream `\*` cannot re-arm as a live `*` after escaping, and a SMILES stereo bond (`C/C=C\C`) no longer ends its line as a CommonMark hard break.
+- **GHS statement parsing (`parseCodedStatement`) matches an annotated code in linear time** — a code followed by a long run of `*` no longer backtracks exponentially; the same statements still parse.
+
+## Security
+
+- **Upstream PubChem error data no longer carries the request URL**, which echoed the caller's own query (a name, SMILES string, or SDQ blob). The message still names PubChem and the HTTP status, and `data.fault` still carries PubChem's parsed fault text.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.13.0 → ^0.13.6
+- `zod` ^4.6.1 → ^4.6.5
+- `@biomejs/biome` 2.5.13 → 2.5.14
+- `@types/node` 26.5.1 → 26.6.1
+- `tsc-alias` ^1.9.4 → ^1.9.5
+- `vitest` ^5.0.0 → ^5.0.1

package/changelog/0.6.x/0.6.4.md

@@ -0,0 +1,23 @@
+---
+summary: "pubchem_search_compounds names each mode's required fields and rejects a blank formula or query before calling PubChem, failed PubChem requests log their URL server-side, and integer inputs advertise minimum: 1 instead of exclusiveMinimum."
+breaking: false
+security: false
+---
+
+# 0.6.4 — 2026-09-24
+
+## Added
+
+- **Failed PubChem requests log the request URL server-side** ([#50](https://github.com/cyanheads/pubchem-mcp-server/issues/50)) — one module `logger` line per failure after any retry, carrying `url`, `method`, and the HTTP `status` and `fault` or the error message: `debug` for a 404, `warning` for any other non-2xx, a network error, a 30 s timeout, or an SDQ rejection inside a 2xx. The client-facing `error.data` still carries no URL.
+
+## Fixed
+
+- **`pubchem_search_compounds` `searchType` names each mode's required fields** ([#45](https://github.com/cyanheads/pubchem-mcp-server/issues/45)) — identifier needs `identifierType` + `identifiers`, formula needs `formula`, substructure/superstructure/similarity need `query` + `queryType`. The input root stays a flat object.
+- **A whitespace-only `formula` or `query` fails as `missing_formula` / `missing_structure_args`** before any PubChem request, instead of returning unrelated compounds or an upstream HTTP 500. A padded formula such as `" C9H8O4 "` still resolves.
+- **Integer inputs use `.min(1)` instead of `.positive()`** ([#51](https://github.com/cyanheads/pubchem-mcp-server/issues/51)) — ten inputs across seven tools now advertise `minimum: 1` rather than a numeric `exclusiveMinimum`, which Microsoft Copilot Studio fails to parse; accepted values are unchanged. The six resource templates' `cid`/`aid` params match.
+- **README VS Code install badge** URL-encodes the `/` in `@cyanheads/pubchem-mcp-server`.
+
+## Dependencies
+
+- `@socketsecurity/bun-security-scanner` ^1.1.2 → ^1.1.3
+- `@types/node` 26.6.1 → 26.6.2

package/changelog/template.md

@@ -0,0 +1,151 @@
+---
+# FORMAT REFERENCE — do not edit. Copy this file to
+# `changelog/<major.minor>.x/<version>.md` (e.g. `changelog/0.8.x/0.8.6.md`)
+# to author a new release. Set that file's H1 to `# <version> — YYYY-MM-DD`
+# with a concrete date.
+
+# Required. One-line GitHub Release-style headline. 350 character cap — a
+# ceiling, not a target. Default short and scannable. Don't pad, don't stitch
+# unrelated changes with commas/semicolons into an inventory — pick the one
+# headline the release is about. Quotes required: unquoted YAML treats
+# `: ` inside the value as a key separator and fails GitHub's strict parser.
+summary: ""
+
+# Set `true` when consumers must change code to upgrade: API removals,
+# signature changes, config renames, behavior changes that break existing
+# usage. Flagged as `Breaking` in the rollup.
+breaking: false
+
+# Set `true` ONLY for a security fix in THIS project's own source code — a
+# vulnerability or hardening in code you ship. A dependency or transitive CVE
+# bump is routine maintenance, NOT a security release: record it under
+# `## Dependencies` (with the advisory ID) and leave this `false`. When true,
+# pairs with the `## Security` section below and flags `Security` in the rollup.
+security: false
+
+# Optional free-form notes for maintenance agents processing this release.
+# Not rendered in CHANGELOG — consumed by agents running `maintenance` on
+# downstream servers. ADOPTION STEPS ONLY — new files to create, fields to
+# populate, one-time migration steps. Never a second rendering of the body:
+# if a body bullet already says it, name the bullet's symbol instead of
+# re-explaining. Omit the field entirely when there's nothing to say.
+# agent-notes: |
+#   <instructions for downstream maintenance agents>
+---
+
+# <version> — YYYY-MM-DD
+
+<!--
+  AUTHORING GUIDE — applies to the new per-version file you create from this
+  template.
+
+  Audience: someone scanning release notes to decide what affects them. Lead
+  each bullet with the symbol or concept name in **bold** so they can skip
+  what's irrelevant and zoom in on what's not.
+
+  Tone: terse, fact-dense, not verbose. Bullet shape: **symbol** + what
+  changed + at most one consumer-facing caveat. One sentence by default, two
+  when the second carries weight — a bullet past ~40 words or three sentences
+  is wrong. The depth lives one hop away: the linked issue carries the why,
+  the commit diff carries the how. The changelog names what changed and what
+  a consumer does about it; a reader who wants mechanism opens the link.
+
+  Model length on THIS guide, never on the previous entry — entries modeled
+  on entries compound.
+
+  Cut (each has shipped as a wall of text; these are the cruft):
+  - History/justification narration — how the bug worked, why the old
+    behavior was wrong. One short clause at most; the issue carries the story.
+  - Design-rationale defense — "chosen over Y because…", "guarding the
+    getter is not enough…". That is the author arguing with a reviewer;
+    reviewers read the PR, not the changelog.
+  - Defensive unchanged-clauses — "X is unchanged", "byte-identical to
+    <prev>". Keep one only where its absence would cause a real misread,
+    as a short parenthetical.
+  - Edge-case inventories — marker lists, not-flagged lists, escape tables.
+    Tests and the issue carry those.
+  - Mechanism walkthroughs (JSDoc, CLAUDE.md/AGENTS.md, or the relevant
+    skill own those), ceremonial framings ("This release introduces…"),
+    backwards-compat paragraphs, file-by-file test enumerations. Prefer
+    code/symbol names over English re-explanations.
+
+  Verified ≠ included: the every-claim-verified-from-the-diff rule bounds
+  the TRUTH of what you write, never the AMOUNT.
+
+  Example — same fact, right size:
+
+    TOO LONG: **`fetchWithTimeout`'s `timeoutMs` bounds the whole exchange**
+    (#341). `fetch` resolves once headers arrive and the deadline was
+    cleared as the helper returned, so a peer that answered promptly and
+    then stalled the stream held the request open indefinitely. A 2xx
+    carrying a body now comes back as a passthrough wrapper that disarms
+    the deadline when the body closes, errors, or is cancelled; …
+    [+90 more words of mechanism and edge cases]
+
+    RIGHT: **`fetchWithTimeout`'s `timeoutMs` now bounds the whole
+    exchange, not just the headers** (#341). A stalled body aborts with
+    the same `Timeout` error; the returned `Response` is a wrapper, so
+    identity assertions (`toBe(response)`) no longer hold.
+
+  Narrative intro: skip by default. Add one short sentence only when the
+  release theme genuinely needs framing the bullets can't carry. When many
+  bullets share one upgrade consequence, state it ONCE — intro line or
+  agent-notes — never per bullet.
+
+  Sections: Keep a Changelog order — Added, Changed, Deprecated, Removed,
+  Fixed, Security. Include only sections with entries; delete the rest
+  (including the commented-out scaffolding below). Don't ship empty headers.
+
+  Include: every distinct fact a reader needs to adopt or audit the release —
+  new exports, signatures, lint rule IDs, env vars, breaking changes, version
+  bumps on shipped skills. Nothing more.
+
+  Links: link issues, PRs, docs, or skills where they help a reader jump to
+  context. Once per item per entry — don't re-link the same issue in summary,
+  narrative, and bullet. Skip links for inline symbol names; code spans speak
+  for themselves.
+
+  Issue/PR URLs: use full URLs. GitHub's bare `#NN` auto-link only resolves
+  inside its own UI, not in npm reads or local editors.
+
+      [#38](https://github.com/cyanheads/mcp-ts-core/issues/38)   ← issue
+      [#42](https://github.com/cyanheads/mcp-ts-core/pull/42)     ← PR
+
+  Verify numbers exist before linking (`gh issue view NN`, `gh pr view NN`).
+  Never speculate on a future number — `#42` for an upcoming PR silently
+  resolves to whatever real item already owns 42, and timeline previews pull
+  in that unrelated item's metadata.
+
+  TAG ANNOTATIONS — the annotated tag body renders as the GitHub Release body
+  via `gh release create --notes-from-tag`. It is a condensed digest of this
+  entry, never a copy, and its format is owned by the `release-and-publish`
+  skill (step 4, "Create the annotated tag"): a short subject line without the
+  version, flat headline bullets — no Keep-a-Changelog section headers, no
+  gates line — at most one deps line, issue backlinks, and the changelog link
+  last. In release-PR mode the `git-wrapup` skill authors those bullets as the
+  PR body's `## Changes` and the tag copies them.
+-->
+
+## Added
+
+-
+
+## Changed
+
+-
+
+<!-- ## Deprecated
+
+- -->
+
+<!-- ## Removed
+
+- -->
+
+## Fixed
+
+-
+
+<!-- ## Security
+
+- -->

package/dist/index.js

@@ -11,6 +11,10 @@ import { initPubChemClient } from './services/pubchem/pubchem-client.js';
 await createApp({
     name: 'pubchem-mcp-server',
     title: 'pubchem-mcp-server',
+    /** No tool gates on `ctx.requestInput`, so nothing here needs a session to survive
+     * between round trips. Declared in code rather than left to `MCP_SESSION_MODE` so a
+     * deployment that never sets the variable still serves statelessly. */
+    sessionMode: 'stateless',
     tools: allToolDefinitions,
     resources: allResourceDefinitions,
     instructions: "Use the pubchem_* tools to query PubChem's chemical database. Compounds are addressed by CID, assays by AID. Most flows start at `pubchem_search_compounds` (name, SMILES, InChIKey, formula, substructure, superstructure, or 2D similarity → CIDs), then call per-CID tools for details, safety, image, cross-references, bioactivity, interactions (drug-drug/drug-food/target), or 3D structure. To find assays for a biological target, chain `pubchem_search_assays` (gene/protein → AIDs) into `pubchem_get_summary` (`entityType: assay`) per AID; to check whether a compound is active against a target, call `pubchem_get_bioactivity` with a `cid` plus `targetGeneId`/`targetAccession`. `pubchem_get_summary` covers assay/gene/protein/taxonomy entity lookups. Compound and assay records are also exposed as URI-addressable resources (e.g. `pubchem://compound/{cid}`, `pubchem://assay/{aid}`).",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,SAAS,CAAC;IACd,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,oBAAoB;IAC3B,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,sBAAsB;IACjC,YAAY,EACV,q3BAAq3B;IACv3B,OAAO,EAAE;QACP,OAAO,EACL,+FAA+F;QACjG,QAAQ,EAAE,iDAAiD;QAC3D,KAAK,EAAE;YACL,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/E;gBACE,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,IAAI;aACf;SACF;KACF;IACD,KAAK;QACH,iBAAiB,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,SAAS,CAAC;IACd,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,oBAAoB;IAC3B;;2EAEuE;IACvE,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,sBAAsB;IACjC,YAAY,EACV,q3BAAq3B;IACv3B,OAAO,EAAE;QACP,OAAO,EACL,+FAA+F;QACjG,QAAQ,EAAE,iDAAiD;QAC3D,KAAK,EAAE;YACL,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/E;gBACE,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,gDAAgD;gBACtD,QAAQ,EAAE,IAAI;aACf;SACF;KACF;IACD,KAAK;QACH,iBAAiB,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/resources/definitions/assay.resource.js

@@ -10,7 +10,7 @@ export const assayResource = resource('pubchem://assay/{aid}', {
     description: 'Summary for a PubChem BioAssay by AID — name, description, source, protocol, and substance counts.',
     mimeType: 'application/json',
     params: z.object({
-        aid: z.coerce.number().int().positive().describe('PubChem Assay ID.'),
+        aid: z.coerce.number().int().min(1).describe('PubChem Assay ID.'),
     }),
     async handler(params) {
         const client = getPubChemClient();

package/dist/mcp-server/resources/definitions/assay.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"assay.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/assay.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,uBAAuB,EAAE;IAC7D,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,oGAAoG;IACtG,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KACtE,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM;QAClB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,kCAAkC,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"assay.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/assay.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,uBAAuB,EAAE;IAC7D,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,oGAAoG;IACtG,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KAClE,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM;QAClB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,kCAAkC,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/resources/definitions/compound-bioactivity.resource.js

@@ -11,7 +11,7 @@ export const compoundBioactivityResource = resource('pubchem://compound/{cid}/bi
     description: 'Bioassay activity profile for a PubChem compound by CID. Returns up to 25 assays; use pubchem_get_bioactivity to filter by outcome or molecular target, raise the cap, and page through the rest with offset.',
     mimeType: 'application/json',
     params: z.object({
-        cid: z.coerce.number().int().positive().describe('PubChem Compound ID.'),
+        cid: z.coerce.number().int().min(1).describe('PubChem Compound ID.'),
     }),
     async handler(params) {
         const client = getPubChemClient();

package/dist/mcp-server/resources/definitions/compound-bioactivity.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"compound-bioactivity.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/compound-bioactivity.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gGAAgG;AAChG,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,sCAAsC,EAAE;IAC1F,IAAI,EAAE,8BAA8B;IACpC,WAAW,EACT,+MAA+M;IACjN,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACzE,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM;QAClB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtE,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"compound-bioactivity.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/compound-bioactivity.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gGAAgG;AAChG,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,sCAAsC,EAAE;IAC1F,IAAI,EAAE,8BAA8B;IACpC,WAAW,EACT,+MAA+M;IACjN,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACrE,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM;QAClB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACtE,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;SACpC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/mcp-server/resources/definitions/compound-image.resource.js

@@ -9,7 +9,7 @@ export const compoundImageResource = resource('pubchem://compound/{cid}/image',
     description: 'A 2D structure diagram (PNG, 300x300) for a PubChem compound by CID. Use pubchem_get_compound_image to choose the image size.',
     mimeType: 'image/png',
     params: z.object({
-        cid: z.coerce.number().int().positive().describe('PubChem Compound ID.'),
+        cid: z.coerce.number().int().min(1).describe('PubChem Compound ID.'),
     }),
     output: z.object({
         base64: z.string().describe('Base64-encoded PNG image data.'),

package/dist/mcp-server/resources/definitions/compound-image.resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"compound-image.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/compound-image.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,gCAAgC,EAAE;IAC9E,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,+HAA+H;IACjI,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACzE,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC9D,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM;QAClB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,MAAM,EAAE,IAAI;QACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAA4B,CAAC;QAChD,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"compound-image.resource.js","sourceRoot":"","sources":["../../../../src/mcp-server/resources/definitions/compound-image.resource.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,gCAAgC,EAAE;IAC9E,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,+HAA+H;IACjI,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACrE,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;KAC9D,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,MAAM;QAClB,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,mFAAmF;IACnF,MAAM,CAAC,MAAM,EAAE,IAAI;QACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAA4B,CAAC;QAChD,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;CACF,CAAC,CAAC"}