@dpesch/mantisbt-mcp-server 1.16.0 → 1.18.0

package/CHANGELOG.md

@@ -11,6 +11,36 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [1.18.0] – 2026-11-09
+
+### Deprecated
+
+- The default of `response` in `update_issue` and `create_issue` changes from `"full"` to `"short"` in 2.0.0. Callers that rely on the whole issue in the response should pass `response: "full"` explicitly.
+
+### Added
+
+- `update_issue` and `create_issue`: optional `response` parameter. `"short"` returns only what confirms the change instead of the whole issue with description, notes and history (#8598) — for `update_issue` `id`, `summary`, `status`, `resolution`, `updated_at`, `view_url` and the changed fields (custom fields and edited notes narrowed to the changed entries, an appended note to `id` and `view_url`); for `create_issue` `id`, `summary`, `project`, `category`, `status`, `handler`, `created_at` and `view_url`. On a fresh demo issue that is 529 instead of 4,046 characters; on an issue with many notes the gap is far larger. The default stays `"full"`.
+- `get_version`: `mcp_server` now also contains `commit` (short hash of the build, `-dirty` with uncommitted changes) and `built_at` (build time), so an outdated build shows even when its version number is right (#8547).
+
+### Fixed
+
+- The server reported the version from `package.json` at runtime, not the one its code was built from — in the MCP handshake, `get_version`, `get_mcp_version`, the startup log and the HTTP `/health` endpoint. Between a version bump and `npm run build`, a local install therefore claimed the new version while running the old code (#8547). The build now writes `dist/build-info.json`, and the server reads its version from there. Only the release build in CI reports a plain version; every other build — a local `npm run build`, `npm run dev`, code run from `src/` — is marked `-dev`, e.g. `1.18.0-dev`. `npm publish` refuses any build that is not the release build of the package version (`prepublishOnly`). The npm package was not affected: it is always built right before publishing.
+- `list_issues`: the client-side filters `status`, `assigned_to`, `reporter_id`, `updated_after`/`updated_before` and `created_after`/`created_before` returned an empty list when `select` did not contain the field they read (`status`, `handler`, `reporter`, `updated_at`, `created_at`). The `select` projection removed the field before the filter ran, so every issue failed it — silently, without an error (#8597). The fields a filter needs are now fetched as well and removed again after filtering, so the response still holds exactly the selected fields. `group_by` was not affected.
+
+---
+
+## [1.17.0] – 2026-11-03
+
+### Added
+
+- Search benchmark: an exact-first measure for identifier queries (do all issues that contain the identifier lead the top 10?), a new `compound` query type for identifiers such as `CVE-2026-1234`, and fixed cases from `BENCHMARK_EXACT` that print their ranking.
+
+### Changed
+
+- Semantic search: `search_issues` lists every issue that contains an identifier from the query as a whole — an order number, a CVE, a version, a code name such as `MANTIS_SEARCH_DIR` or `getEmbeddingSignature` — before all issues that do not. The combined ranking found such issues, but put issues in between that were only close by meaning, often short ones (#8545). A query for `CVE-2026-1234` no longer counts an issue with another CVE of 2026 as a near match, and `1.15` does not match `1.15.2`. Identifiers are recognised by their form (underscore, inner capital, letters with digits, five or more digits, or words joined by `-` `.` `:` `/` with a digit), so plain words and short numbers such as "Android 15" keep the combined ranking; an identifier found in more than 20 issues does as well. Measured on 7,742 issues: for a rare identifier, all issues containing it now lead the top 10 in 97 % of the queries instead of 72 %; for a compound identifier such as `7.0.0-1014-azure` in 98 % instead of 11 %, and such a query finds its issue among the top 10 in 98 % instead of 64 %. Titles, sentences and paraphrases stay level or gain slightly. No index rebuild is needed.
+
+---
+
 ## [1.16.0] – 2026-11-02
 
 ### Added

package/README.de.md

@@ -156,8 +156,8 @@ Veraltete Tools gehören immer zur gleichen Gruppe wie ihr Ersatz – eine Grupp
 | `get_issue` | Ein Issue per `id` oder mehrere per `ids` (1–50) in einem Aufruf abrufen – genau eines von beiden angeben; mit `ids` lautet die Antwort `{ issues, requested, found, failed }`, nicht zugängliche IDs liefern `null` an ihrer Position; optionales `select` zur Feldauswahl |
 | `get_issues` | **Veraltet:** stattdessen `get_issue` mit `ids` verwenden – wird in 2.0.0 entfernt |
 | `list_issues` | Issues nach Projekt, Status, Autor u.v.m. filtern; optionales `select` für Feldprojektion und `status` für clientseitige Statusfilterung – kanonische englische Statusnamen (z.B. `"new"`, `"resolved"`) werden per ID abgeglichen und funktionieren damit sprachunabhängig auf lokalisierten Installationen; `group_by` (`"status"`, `"handler"`, `"priority"`, `"category"`) liefert statt einer Issue-Liste Zählwerte pro Gruppe – alle Filter greifen weiterhin, `page`, `page_size` und `select` werden ignoriert |
-| `create_issue` | Neues Issue anlegen; `severity` und `priority` müssen kanonische englische Namen sein (z.B. `minor`, `major`, `normal`, `high`) – `get_issue_schema` aufrufen, um alle gültigen Werte und deren lokalisierte Bezeichnungen zu sehen; optionaler `handler`-Parameter akzeptiert einen Benutzernamen als Alternative zu `handler_id` (wird gegen die Projektmitglieder aufgelöst); optionales `custom_fields` zum Setzen benutzerdefinierter Felder |
-| `update_issue` | Bestehendes Issue bearbeiten; Enum-Felder (`status`, `priority`, `severity`, `resolution`, `reproducibility`) akzeptieren kanonische englische Namen, lokalisierte Namen oder numerische IDs – der Server löst Namen automatisch zu IDs auf; unterstützt `custom_fields` sowie einen optionalen `note`-Parameter, der im selben Aufruf eine Notiz anhängt; `fields` darf entfallen, wenn nur `add_monitors`, `remove_monitors` oder `note` angegeben werden; mit `add_monitors` / `remove_monitors` (Arrays von Login-Namen) können Beobachter hinzugefügt oder entfernt werden – die Antwort enthält einen `monitors`-Schlüssel mit der aktuellen und der geänderten Beobachterliste; mit `fields.notes` lassen sich bestehende Notizen per ID bearbeiten (Notiz-ID aus `get_issue`) |
+| `create_issue` | Neues Issue anlegen; `severity` und `priority` müssen kanonische englische Namen sein (z.B. `minor`, `major`, `normal`, `high`) – `get_issue_schema` aufrufen, um alle gültigen Werte und deren lokalisierte Bezeichnungen zu sehen; optionaler `handler`-Parameter akzeptiert einen Benutzernamen als Alternative zu `handler_id` (wird gegen die Projektmitglieder aufgelöst); optionales `custom_fields` zum Setzen benutzerdefinierter Felder; `response: "short"` liefert statt des ganzen Issues nur dessen Kernfelder (Standard `"full"`, ab 2.0.0 `"short"`) |
+| `update_issue` | Bestehendes Issue bearbeiten; Enum-Felder (`status`, `priority`, `severity`, `resolution`, `reproducibility`) akzeptieren kanonische englische Namen, lokalisierte Namen oder numerische IDs – der Server löst Namen automatisch zu IDs auf; unterstützt `custom_fields` sowie einen optionalen `note`-Parameter, der im selben Aufruf eine Notiz anhängt; `fields` darf entfallen, wenn nur `add_monitors`, `remove_monitors` oder `note` angegeben werden; mit `add_monitors` / `remove_monitors` (Arrays von Login-Namen) können Beobachter hinzugefügt oder entfernt werden – die Antwort enthält einen `monitors`-Schlüssel mit der aktuellen und der geänderten Beobachterliste; mit `fields.notes` lassen sich bestehende Notizen per ID bearbeiten (Notiz-ID aus `get_issue`); `response: "short"` liefert statt des ganzen Issues mit Notizen und Historie nur die Kernfelder und die geänderten Felder (Standard `"full"`, ab 2.0.0 `"short"`) |
 | `delete_issue` | Issue löschen |
 
 ### Notizen
@@ -220,13 +220,13 @@ Die semantische Suche versteht die *Bedeutung* einer Anfrage, nicht nur ihre Sti
 - *„Performance-Probleme auf der Checkout-Seite"* – liefert verwandte Meldungen unabhängig von der verwendeten Terminologie
 - *„doppelte Einträge in der Rechnungsliste"* – erkennt auch Issues, die als „zweifach angezeigt", „dupliziert" o.ä. beschrieben sind
 
-Das Embedding-Modell (~80 MB) läuft vollständig **offline** – kein OpenAI-Key, keine externe API. Es wird beim ersten Start einmalig heruntergeladen und lokal gecacht. Issues werden bei jedem Serverstart inkrementell indexiert (nur neue und geänderte Issues werden neu verarbeitet). Starten mehrere Client-Sitzungen gleichzeitig einen Server, synchronisiert nur einer davon den gemeinsamen Index. Das Modell wird bei der ersten Nutzung geladen und nach 10 Minuten ohne Einbetten wieder entladen, damit ruhende Sitzungen seinen Speicher (~0,9 GB pro Serverprozess) nicht dauerhaft belegen. Lange Beschreibungen werden in bis zu 8 Abschnitte geteilt, damit auch Details weiter unten gefunden werden; der Index enthält dadurch etwa 1,7 Vektoren pro Issue (rund 115 MB bei 7.700 Issues), die jeder Serverprozess mit aktivierter Suche im Speicher hält. Die Rangfolge berücksichtigt zusätzlich exakte Stichworttreffer, sodass eine Suche nach einem Bezeichner, Fehlercode oder einer Versionsnummer die Issues findet, die ihn enthalten.
+Das Embedding-Modell (~80 MB) läuft vollständig **offline** – kein OpenAI-Key, keine externe API. Es wird beim ersten Start einmalig heruntergeladen und lokal gecacht. Issues werden bei jedem Serverstart inkrementell indexiert (nur neue und geänderte Issues werden neu verarbeitet). Starten mehrere Client-Sitzungen gleichzeitig einen Server, synchronisiert nur einer davon den gemeinsamen Index. Das Modell wird bei der ersten Nutzung geladen und nach 10 Minuten ohne Einbetten wieder entladen, damit ruhende Sitzungen seinen Speicher (~0,9 GB pro Serverprozess) nicht dauerhaft belegen. Lange Beschreibungen werden in bis zu 8 Abschnitte geteilt, damit auch Details weiter unten gefunden werden; der Index enthält dadurch etwa 1,7 Vektoren pro Issue (rund 115 MB bei 7.700 Issues), die jeder Serverprozess mit aktivierter Suche im Speicher hält. Die Rangfolge berücksichtigt zusätzlich exakte Stichworttreffer, sodass eine Suche nach einem Bezeichner, Fehlercode oder einer Versionsnummer die Issues findet, die ihn enthalten – und alle Issues, die eine solche Kennung vollständig enthalten, vor allen anderen auflistet, sofern die Kennung nicht in mehr als 20 Issues vorkommt.
 
 Aktivierung mit `MANTIS_SEARCH_ENABLED=true`.
 
 | Tool | Beschreibung |
 |---|---|
-| `search_issues` | Natürlichsprachige Suche über alle indizierten Issues – kombiniert semantische Ähnlichkeit mit Stichwortsuche (BM25), damit auch exakte Begriffe wie Bezeichner oder Fehlercodes gefunden werden; liefert Top-N-Ergebnisse mit der Cosine-Similarity als `score`, sortiert nach der kombinierten Rangfolge; optionales `select` (kommagetrennte Feldnamen) reichert jedes Ergebnis mit den angeforderten Issue-Feldern an; optionales `highlight` (boolean, Standard `false`) fügt je Ergebnis ein `highlights`-Feld mit keyword-basierten Ausschnitten aus `summary` und `description` hinzu (Treffer werden in `**fett**` dargestellt) |
+| `search_issues` | Natürlichsprachige Suche über alle indizierten Issues – kombiniert semantische Ähnlichkeit mit Stichwortsuche (BM25), damit auch exakte Begriffe wie Bezeichner oder Fehlercodes gefunden werden; Issues, die eine Kennung aus der Anfrage enthalten (Auftragsnummer, CVE, Version, Code-Bezeichner), stehen vorn; liefert Top-N-Ergebnisse mit der Cosine-Similarity als `score`, sortiert nach der kombinierten Rangfolge; optionales `select` (kommagetrennte Feldnamen) reichert jedes Ergebnis mit den angeforderten Issue-Feldern an; optionales `highlight` (boolean, Standard `false`) fügt je Ergebnis ein `highlights`-Feld mit keyword-basierten Ausschnitten aus `summary` und `description` hinzu (Treffer werden in `**fett**` dargestellt) |
 | `rebuild_search_index` | Suchindex aufbauen oder aktualisieren; `full: true` löscht und baut ihn vollständig neu |
 | `get_search_index_status` | **Veraltet:** stattdessen `get_metadata` (Feld `search_index`) verwenden – wird in 2.0.0 entfernt |
 
@@ -251,7 +251,7 @@ npm install sqlite-vec better-sqlite3
 | Tool | Beschreibung |
 |---|---|
 | `get_metadata` | Gecachte Metadaten abrufen: `detail: "summary"` (Standard) liefert Projekt-/Tag-Zählwerte und Benutzer-/Versions-/Kategorie-Zählwerte je Projekt; `detail: "full"` liefert den vollständigen rohen Cache; `refresh: true` lädt alle Daten zuerst von MantisBT nach; mit aktivierter semantischer Suche enthält die Antwort zusätzlich einen `search_index`-Block |
-| `get_version` | Version dieses MCP-Servers und der verbundenen MantisBT-Installation in einer Antwort; `check_latest` (Standard `true`) vergleicht MantisBT mit dem neuesten GitHub-Release; `mantis` enthält `error`, wenn MantisBT nicht erreichbar ist |
+| `get_version` | Version dieses MCP-Servers und der verbundenen MantisBT-Installation in einer Antwort; der Server-Teil nennt zusätzlich Commit und Build-Zeitpunkt (Anhang `-dev`, wenn es kein veröffentlichter Release ist); `check_latest` (Standard `true`) vergleicht MantisBT mit dem neuesten GitHub-Release; `mantis` enthält `error`, wenn MantisBT nicht erreichbar ist |
 | `get_issue_schema` | Gültige `select`-Felder (`fields`, `fields_source`) und Enum-Werte (`enums`: severity, status, priority, resolution, reproducibility) für diesen MantisBT-Server in einer Antwort; optionale `project_id` schränkt die Feldermittlung ein – vor `create_issue` / `update_issue` oder beim Aufbau eines `select`-Strings verwenden |
 | `get_issue_fields` | **Veraltet:** stattdessen `get_issue_schema` verwenden – wird in 2.0.0 entfernt |
 | `get_issue_enums` | **Veraltet:** stattdessen `get_issue_schema` verwenden; die Ressource `mantis://enums` bleibt – wird in 2.0.0 entfernt |
@@ -341,9 +341,11 @@ npm test             # Tests ausführen (vitest)
 npm run test:watch   # Tests im Watch-Modus
 npm run test:coverage # Coverage-Report
 npm run benchmark    # Token-Benchmark gegen eine Live-MantisBT-Instanz (siehe Token-Verbrauch oben)
-npm run benchmark:search # Such-Trefferquote auf einem bestehenden Index (MANTIS_SEARCH_DIR), Vektor vs. hybrid
+npm run benchmark:search # Such-Trefferquote und Exakt-Treffer-Reihenfolge auf einem bestehenden Index (MANTIS_SEARCH_DIR), Vektor vs. hybrid
 ```
 
+`benchmark:search` liest optional handgeschriebene Umschreibungen (`BENCHMARK_PARAPHRASES`) und feste Fälle mit erwarteter Rangfolge (`BENCHMARK_EXACT`); die Dateiformate stehen am Anfang von `scripts/benchmark-search.ts`.
+
 ## Lizenz
 
 MIT – siehe [LICENSE](LICENSE)

package/README.md

@@ -156,8 +156,8 @@ Deprecated tools always belong to the same group as their replacement — disabl
 | `get_issue` | Retrieve an issue by `id`, or several by `ids` (1–50) in one call — pass exactly one; with `ids` returns `{ issues, requested, found, failed }`, missing or inaccessible IDs give `null` at their position; optional `select` for field projection |
 | `get_issues` | **Deprecated:** use `get_issue` with `ids` instead — will be removed in 2.0.0 |
 | `list_issues` | Filter issues by project, status, author, and more; optional `select` for field projection and `status` for client-side status filtering — canonical English status names (e.g. `"new"`, `"resolved"`) are matched by ID, making the filter language-independent on localized installations; `group_by` (`"status"`, `"handler"`, `"priority"`, `"category"`) returns counts per group instead of an issue list — all filters still apply, `page`, `page_size`, and `select` are ignored |
-| `create_issue` | Create a new issue; `severity` and `priority` must be canonical English names (e.g. `minor`, `major`, `normal`, `high`) — call `get_issue_schema` to see all valid values and their localized labels; optional `handler` parameter accepts a username as alternative to `handler_id` (resolved against project members); optional `custom_fields` to set custom field values |
-| `update_issue` | Update an existing issue; enum fields (`status`, `priority`, `severity`, `resolution`, `reproducibility`) accept canonical English names, localized names, or numeric IDs — the server resolves names to IDs automatically; supports `custom_fields` and an optional `note` parameter that appends a note in the same call; `fields` may be omitted when only `add_monitors`, `remove_monitors`, or `note` are given; use `add_monitors` / `remove_monitors` (arrays of login names) to add or remove watchers — the response includes a `monitors` key with the current and changed monitor lists; use `fields.notes` to edit existing notes by ID (note ID from `get_issue`) |
+| `create_issue` | Create a new issue; `severity` and `priority` must be canonical English names (e.g. `minor`, `major`, `normal`, `high`) — call `get_issue_schema` to see all valid values and their localized labels; optional `handler` parameter accepts a username as alternative to `handler_id` (resolved against project members); optional `custom_fields` to set custom field values; `response: "short"` returns only the core fields of the new issue instead of the whole issue (default `"full"`, changes to `"short"` in 2.0.0) |
+| `update_issue` | Update an existing issue; enum fields (`status`, `priority`, `severity`, `resolution`, `reproducibility`) accept canonical English names, localized names, or numeric IDs — the server resolves names to IDs automatically; supports `custom_fields` and an optional `note` parameter that appends a note in the same call; `fields` may be omitted when only `add_monitors`, `remove_monitors`, or `note` are given; use `add_monitors` / `remove_monitors` (arrays of login names) to add or remove watchers — the response includes a `monitors` key with the current and changed monitor lists; use `fields.notes` to edit existing notes by ID (note ID from `get_issue`); `response: "short"` returns only the core fields and the changed ones instead of the whole issue with notes and history (default `"full"`, changes to `"short"` in 2.0.0) |
 | `delete_issue` | Delete an issue |
 
 ### Notes
@@ -220,13 +220,13 @@ Semantic search understands the *meaning* behind a query, not just its keywords.
 - *"performance problems on the checkout page"* — surfaces related reports regardless of the exact terminology used
 - *"duplicate entries in the invoice list"* — catches issues described as "shown twice", "double records", etc.
 
-The embedding model (~80 MB) runs entirely **offline** — no OpenAI key, no external API. It is downloaded once on first start and cached locally. Issues are indexed incrementally on every server start (only new and updated issues are re-indexed). When several client sessions start a server at the same time, only one of them syncs the shared index. The model is loaded on first use and unloaded again after 10 minutes without embedding, so idle sessions do not hold on to its memory (~0.9 GB per server process). Long descriptions are split into up to 8 chunks so that details further down are found as well; the index then holds about 1.7 vectors per issue (around 115 MB for 7,700 issues), which every server process with search enabled keeps in memory. The ranking also takes exact keyword matches into account, so a query for an identifier, error code or version number finds the issues that contain it.
+The embedding model (~80 MB) runs entirely **offline** — no OpenAI key, no external API. It is downloaded once on first start and cached locally. Issues are indexed incrementally on every server start (only new and updated issues are re-indexed). When several client sessions start a server at the same time, only one of them syncs the shared index. The model is loaded on first use and unloaded again after 10 minutes without embedding, so idle sessions do not hold on to its memory (~0.9 GB per server process). Long descriptions are split into up to 8 chunks so that details further down are found as well; the index then holds about 1.7 vectors per issue (around 115 MB for 7,700 issues), which every server process with search enabled keeps in memory. The ranking also takes exact keyword matches into account, so a query for an identifier, error code or version number finds the issues that contain it — and lists all issues containing such an identifier as a whole before any others, unless it occurs in more than 20 issues.
 
 Activate with `MANTIS_SEARCH_ENABLED=true`.
 
 | Tool | Description |
 |---|---|
-| `search_issues` | Natural language search over all indexed issues — combines semantic similarity with keyword matching (BM25), so exact terms such as identifiers or error codes are found as well; returns top-N results with the cosine similarity as `score`, ordered by the combined ranking; optional `select` (comma-separated field names) enriches each result with the requested issue fields; optional `highlight` (boolean, default `false`) adds a `highlights` field per result with keyword-matched excerpts from `summary` and `description` (matched terms shown in `**bold**`) |
+| `search_issues` | Natural language search over all indexed issues — combines semantic similarity with keyword matching (BM25), so exact terms such as identifiers or error codes are found as well; issues containing an identifier from the query (order number, CVE, version, code name) come first; returns top-N results with the cosine similarity as `score`, ordered by the combined ranking; optional `select` (comma-separated field names) enriches each result with the requested issue fields; optional `highlight` (boolean, default `false`) adds a `highlights` field per result with keyword-matched excerpts from `summary` and `description` (matched terms shown in `**bold**`) |
 | `rebuild_search_index` | Build or update the search index; `full: true` clears and rebuilds from scratch |
 | `get_search_index_status` | **Deprecated:** use `get_metadata` (field `search_index`) instead — will be removed in 2.0.0 |
 
@@ -251,7 +251,7 @@ npm install sqlite-vec better-sqlite3
 | Tool | Description |
 |---|---|
 | `get_metadata` | Retrieve cached metadata: `detail: "summary"` (default) returns project/tag counts and per-project user/version/category counts; `detail: "full"` returns the complete raw cache; `refresh: true` re-fetches from MantisBT first; with semantic search enabled the response also contains a `search_index` block |
-| `get_version` | Version of this MCP server and of the connected MantisBT installation in one response; `check_latest` (default `true`) compares MantisBT with the latest GitHub release; `mantis` holds `error` when MantisBT cannot be reached |
+| `get_version` | Version of this MCP server and of the connected MantisBT installation in one response; the server part also names the commit and build time (`-dev` suffix unless it is a published release); `check_latest` (default `true`) compares MantisBT with the latest GitHub release; `mantis` holds `error` when MantisBT cannot be reached |
 | `get_issue_schema` | Valid `select` fields (`fields`, `fields_source`) and enum values (`enums`: severity, status, priority, resolution, reproducibility) for this MantisBT server in one response; optional `project_id` scopes the field discovery — use before `create_issue` / `update_issue` or when building a `select` string |
 | `get_issue_fields` | **Deprecated:** use `get_issue_schema` instead — will be removed in 2.0.0 |
 | `get_issue_enums` | **Deprecated:** use `get_issue_schema` instead; the resource `mantis://enums` stays — will be removed in 2.0.0 |
@@ -341,9 +341,11 @@ npm test             # Run tests (vitest)
 npm run test:watch   # Run tests in watch mode
 npm run test:coverage # Coverage report
 npm run benchmark    # Token benchmark against a live MantisBT (see Token usage above)
-npm run benchmark:search # Search recall on an existing index (MANTIS_SEARCH_DIR), vectors vs. hybrid
+npm run benchmark:search # Search recall and exact-first order on an existing index (MANTIS_SEARCH_DIR), vectors vs. hybrid
 ```
 
+`benchmark:search` optionally reads hand-written paraphrases (`BENCHMARK_PARAPHRASES`) and fixed cases with an expected ranking (`BENCHMARK_EXACT`); the file formats are described at the top of `scripts/benchmark-search.ts`.
+
 ## License
 
 MIT – see [LICENSE](LICENSE)

package/dist/build-info.js

@@ -0,0 +1,17 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Reads build-info.json, which scripts/write-build-info.mjs writes next to the
+ * compiled code. The version thus belongs to the code that runs, even when
+ * package.json was bumped after the build (#8547). Code run straight from
+ * src/ (tests, tsx) has no build: it reports package.json's version as -dev.
+ */
+export function loadBuildInfo(codeDir) {
+    try {
+        return JSON.parse(readFileSync(join(codeDir, 'build-info.json'), 'utf-8'));
+    }
+    catch {
+        const pkg = JSON.parse(readFileSync(join(codeDir, '..', 'package.json'), 'utf-8'));
+        return { version: `${pkg.version}-dev` };
+    }
+}

package/dist/build-info.json

@@ -0,0 +1,5 @@
+{
+  "version": "1.18.0",
+  "commit": "65fcaba",
+  "built_at": "2026-11-09T13:22:17.570Z"
+}

package/dist/deprecation.js

@@ -1,4 +1,7 @@
-/** Major version in which deprecated tools are removed (see versioning rules in CLAUDE.md). */
+/**
+ * Next major version: deprecated tools are removed and announced default
+ * changes take effect (see versioning rules in CLAUDE.md).
+ */
 export const REMOVAL_VERSION = '2.0.0';
 /**
  * First line of the description of a deprecated tool. Keeping the wording in

package/dist/index.js

@@ -3,9 +3,9 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { createServer } from 'node:http';
-import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { join, dirname } from 'node:path';
+import { dirname } from 'node:path';
+import { loadBuildInfo } from './build-info.js';
 import { getConfig, getStartupConfig, assertHttpAuthConfigured } from './config.js';
 import { MantisClient } from './client.js';
 import { VersionHintService, setGlobalVersionHint } from './version-hint.js';
@@ -15,12 +15,10 @@ import { filterToolRegistration } from './toolsets.js';
 import { registerPrompts } from './prompts/index.js';
 import { registerResources } from './resources/index.js';
 // ---------------------------------------------------------------------------
-// Read version from package.json
+// Version of the running build (dist/build-info.json, see build-info.ts)
 // ---------------------------------------------------------------------------
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const packageJson = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
-const version = packageJson.version;
+const build = loadBuildInfo(dirname(fileURLToPath(import.meta.url)));
+const version = build.version;
 // ---------------------------------------------------------------------------
 // Bootstrap
 // ---------------------------------------------------------------------------
@@ -57,7 +55,7 @@ async function createMcpServer(transport) {
         client,
         cache,
         versionHint,
-        version,
+        build,
         uploadDir: startupConfig.uploadDir,
         transport,
         searchIndexStatus,

package/dist/search/highlight.js

@@ -4,7 +4,7 @@
  * Note: highlights are keyword-based (lexical), not semantic.
  * A result may have no highlighted terms even if it is semantically relevant.
  */
-function escapeRegex(term) {
+export function escapeRegex(term) {
     return term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 function combinedPattern(terms, flags) {

package/dist/search/lexical.js

@@ -6,6 +6,7 @@
 // keyword ranking. Built in memory from the summaries and descriptions the
 // vector index already stores — no extra API calls.
 // ---------------------------------------------------------------------------
+import { escapeRegex } from './highlight.js';
 // Standard BM25 parameters.
 const K1 = 1.2;
 const B = 0.75;
@@ -15,7 +16,48 @@ const SUMMARY_WEIGHT = 2;
 export function tokenize(text) {
     return (text.toLowerCase().match(/[\p{L}\p{N}_]+/gu) ?? []).filter(word => word.length >= 2);
 }
+// An identifier (#8545) found in more issues than this is no longer specific
+// enough to put all of them first; the fused ranking decides instead. Keeps
+// common tokens such as UTF-8 from taking over a search. The rare identifiers
+// of the search benchmark occur in at most 8 issues, well below the cap.
+const MAX_EXACT_MATCHES = 20;
+// Words, or words joined by - . : / (CVE-2026-1234, 7.0.0-1014-azure).
+const COMPOUND = /[\p{L}\p{N}_]+(?:[-.:/][\p{L}\p{N}_]+)*/gu;
+function looksLikeIdentifier(word) {
+    return word.includes('_') // MANTIS_SEARCH_DIR, _resizeTimer
+        || /\p{Ll}\p{Lu}/u.test(word) // ScrollViewHelper
+        || (word.length >= 4 && /\p{L}/u.test(word) && /\p{N}/u.test(word)) // host01
+        || /^\p{N}{5,}$/u.test(word); // 202699999
+}
+/**
+ * Identifiers in a search query: order numbers, CVEs, versions, code names.
+ * Plain words, short numbers ("Android 15") and hyphenated words without
+ * digits ("Play-Store-Hinweis") are none.
+ */
+export function identifiers(query) {
+    const found = new Map();
+    for (const match of query.match(COMPOUND) ?? []) {
+        // A compound with a digit is one identifier; otherwise each word counts alone.
+        const candidates = /[-.:/]/.test(match) && /\p{N}/u.test(match)
+            ? [match]
+            : match.split(/[-.:/]/).filter(looksLikeIdentifier);
+        for (const candidate of candidates) {
+            if (!found.has(candidate.toLowerCase()))
+                found.set(candidate.toLowerCase(), candidate);
+        }
+    }
+    return [...found.values()];
+}
+/**
+ * Matches the identifier as a whole: not inside a longer word, and not as the
+ * start or end of a longer number or version (1.15 is not in 1.15.2), while a
+ * word may continue with a hyphen (ScrollViewHelper in ScrollViewHelper-Bridge).
+ */
+export function wholeIdentifier(identifier) {
+    return new RegExp(`(?<![\\p{L}\\p{N}_])(?<!\\p{N}[-.:/])${escapeRegex(identifier)}(?![\\p{L}\\p{N}_])(?![-.:/]\\p{N})`, 'iu');
+}
 export class LexicalIndex {
+    documents;
     // Postings in compressed sparse rows: the documents of term t are
     // docs[offsets[t] .. offsets[t + 1]], with their term frequencies in tfs.
     // Typed arrays keep 340,000 postings (7,700 issues) at about 7 MB instead of
@@ -28,6 +70,7 @@ export class LexicalIndex {
     lengths;
     avgLength;
     constructor(documents) {
+        this.documents = documents;
         this.ids = Uint32Array.from(documents, doc => doc.id);
         this.lengths = new Uint32Array(documents.length);
         const counts = documents.map((doc, index) => {
@@ -85,4 +128,33 @@ export class LexicalIndex {
         }
         return new Map([...byDoc].map(([doc, score]) => [this.ids[doc], score]));
     }
+    /**
+     * Per document id, how many identifiers of the query it contains as a whole
+     * (#8545); documents without one are absent. Candidates come from the
+     * postings of the identifier's rarest word, the text check decides.
+     */
+    exactMatches(query) {
+        const counts = new Map();
+        const frequency = (term) => this.offsets[term + 1] - this.offsets[term];
+        for (const identifier of identifiers(query)) {
+            const terms = tokenize(identifier).map(word => this.termIds.get(word));
+            if (terms.length === 0 || terms.some(term => term === undefined))
+                continue;
+            const rarest = terms.reduce((a, b) => (frequency(a) <= frequency(b) ? a : b));
+            const pattern = wholeIdentifier(identifier);
+            const matches = [];
+            for (let at = this.offsets[rarest]; at < this.offsets[rarest + 1]; at++) {
+                const doc = this.documents[this.docs[at]];
+                if (pattern.test(doc.summary) || pattern.test(doc.description ?? ''))
+                    matches.push(doc.id);
+                if (matches.length > MAX_EXACT_MATCHES)
+                    break;
+            }
+            if (matches.length > MAX_EXACT_MATCHES)
+                continue;
+            for (const id of matches)
+                counts.set(id, (counts.get(id) ?? 0) + 1);
+        }
+        return counts;
+    }
 }

package/dist/search/store.js

@@ -107,11 +107,19 @@ export class VectraStore {
         // Reciprocal Rank Fusion of the vector ranking and the keyword ranking.
         this.lexical ??= new LexicalIndex([...this.items.values()].map(item => ({ id: item.id, ...item.metadata })));
         const keywordRank = new Map([...this.lexical.scores(queryText)].sort((a, b) => b[1] - a[1]).map(([id], rank) => [id, rank]));
+        // Issues containing an identifier of the query as a whole come first
+        // (#8545): a search for an order number or a CVE lists all its issues
+        // before any that merely resemble the query.
+        const exact = this.lexical.exactMatches(queryText);
         const fused = results.map((result, vectorRank) => {
             const rank = keywordRank.get(result.id);
-            return { result, fused: 1 / (RRF_K + vectorRank) + (rank === undefined ? 0 : 1 / (RRF_K + rank)) };
+            return {
+                result,
+                exact: exact.get(result.id) ?? 0,
+                fused: 1 / (RRF_K + vectorRank) + (rank === undefined ? 0 : 1 / (RRF_K + rank)),
+            };
         });
-        fused.sort((a, b) => b.fused - a.fused);
+        fused.sort((a, b) => b.exact - a.exact || b.fused - a.fused);
         return fused.slice(0, topN).map(f => f.result);
     }
     async getItem(id) {

package/dist/search/tools.js

@@ -49,6 +49,8 @@ export function registerSearchTools(server, client, store, embedder, lockDir) {
             'by combining semantic similarity with keyword matching, so exact terms such as identifiers, ' +
             'error codes or version numbers are found as well. "score" is the semantic similarity; results ' +
             'are ordered by the combined ranking, so a keyword match can precede a higher score. ' +
+            'Issues that contain an identifier from the query as a whole (order number, CVE, version, ' +
+            'code name such as MANTIS_SEARCH_DIR) are listed before all others, unless the identifier is common. ' +
             'The search index must be populated first via rebuild_search_index.',
         inputSchema: z.object({
             query: z.string().describe('Natural language search query'),

package/dist/tools/index.js

@@ -30,5 +30,5 @@ export function registerAllTools(server, deps) {
     registerConfigTools(server, client, cache);
     registerMetadataTools(server, client, cache, deps.searchIndexStatus);
     registerTagTools(server, client);
-    registerVersionTools(server, client, deps.versionHint, deps.version);
+    registerVersionTools(server, client, deps.versionHint, deps.build);
 }

package/dist/tools/issues.js

@@ -9,7 +9,7 @@ import { fetchIssueEnumsWithCache } from './config.js';
 import { postNote, noteEditsSchema, prepareNoteEdits, verifyNoteEdits } from './notes.js';
 import { applyMonitorChanges } from './monitors.js';
 import { firstIssue } from '../issue-envelope.js';
-import { deprecationNote } from '../deprecation.js';
+import { deprecationNote, REMOVAL_VERSION } from '../deprecation.js';
 function errorText(msg) {
     const vh = getVersionHint();
     vh?.triggerLatestVersionFetch();
@@ -74,6 +74,37 @@ function makeIssueFilter({ status, assigned_to, reporter_id, dateFilter }) {
         olderThanUpdatedAfter: (issue) => updatedAfterMs !== undefined && issue.updated_at !== undefined && new Date(issue.updated_at).getTime() <= updatedAfterMs,
     };
 }
+// response: "short" for create_issue / update_issue (#8598) — the fields that
+// confirm what happened, instead of the whole issue with notes and history.
+const responseSchema = z.enum(['short', 'full']).default('full').describe(`"full" (default): the whole issue as MantisBT returns it, including description, notes and history. ` +
+    `"short": only the fields that confirm the change — far fewer tokens. The default changes to "short" in ${REMOVAL_VERSION}.`);
+const SHORT_CREATE_FIELDS = ['id', 'summary', 'project', 'category', 'status', 'handler', 'created_at', 'view_url'];
+const SHORT_UPDATE_FIELDS = ['id', 'summary', 'status', 'resolution', 'updated_at', 'view_url'];
+/** Returns only the given top-level fields of an object (those it has). */
+function pickFields(obj, fields) {
+    return Object.fromEntries(Object.entries(obj).filter(([key]) => fields.includes(key)));
+}
+/**
+ * Short update_issue result: the core fields plus every changed field. Custom
+ * fields and notes are narrowed to the entries that were changed.
+ */
+function shortUpdatedIssue(issue, changes) {
+    const short = pickFields(issue, [...SHORT_UPDATE_FIELDS, ...Object.keys(changes)]);
+    const { custom_fields: changedCustomFields, notes: editedNotes } = changes;
+    if (short.custom_fields && changedCustomFields) {
+        short.custom_fields = short.custom_fields.filter(({ field }) => changedCustomFields.some(c => c.field.id === field.id || c.field.name === field.name));
+    }
+    if (short.notes && editedNotes) {
+        short.notes = short.notes.filter(n => editedNotes.some(e => e.id === n.id));
+    }
+    return short;
+}
+/** Returns the issue without the given top-level fields. */
+function omitFields(issue, fields) {
+    if (fields.length === 0)
+        return issue;
+    return Object.fromEntries(Object.entries(issue).filter(([key]) => !fields.includes(key)));
+}
 // Worker-pool: runs `fn` over all `items` with at most `concurrency` in-flight at once.
 // nextIndex is only incremented inside microtasks, so the ++ is safe without a lock.
 async function runWithConcurrency(items, concurrency, fn) {
@@ -115,14 +146,21 @@ export function registerIssueTools(server, client, cache) {
      * the current page once MantisBT's newest-first order shows the rest is
      * older than updated_after. Returns truncated when maxPages ended the scan
      * before either happened.
+     *
+     * select is the caller's projection. The filter reads its fields from each
+     * issue, so a select that omits them would fail every issue (#8597): they
+     * are fetched as well and removed again before onMatch sees the issue.
      */
-    async function scanMatchingIssues(params, filter, pageSize, maxPages, onMatch) {
+    async function scanMatchingIssues(params, select, filter, pageSize, maxPages, onMatch) {
+        const selected = select?.split(',').map(f => f.trim()).filter(Boolean);
+        const extraFields = selected ? filter.fields.filter(f => !selected.includes(f)) : [];
+        const fetchSelect = selected && [...selected, ...extraFields].join(',');
         for (let page = 1; page <= maxPages; page++) {
-            const issues = (await client.get('issues', { ...params, page, page_size: pageSize })).issues ?? [];
+            const issues = (await client.get('issues', { ...params, select: fetchSelect, page, page_size: pageSize })).issues ?? [];
             let stopAfterBatch = false;
             for (const issue of issues) {
                 if (filter.matches(issue)) {
-                    if (onMatch(issue) === false)
+                    if (onMatch(omitFields(issue, extraFields)) === false)
                         return { truncated: false };
                 }
                 else if (filter.olderThanUpdatedAfter(issue)) {
@@ -139,10 +177,9 @@ export function registerIssueTools(server, client, cache) {
      * the fields grouping and filters need.
      */
     async function groupIssues(groupBy, params, filter) {
-        const select = [...new Set(['id', groupBy, ...filter.fields])].join(',');
         const groups = new Map();
         let total = 0;
-        const { truncated } = await scanMatchingIssues({ ...params, select }, filter, GROUP_BY_PAGE_SIZE, GROUP_BY_MAX_PAGES, issue => {
+        const { truncated } = await scanMatchingIssues(params, `id,${groupBy}`, filter, GROUP_BY_PAGE_SIZE, GROUP_BY_MAX_PAGES, issue => {
             const ref = issue[groupBy];
             const key = ref?.id ?? null;
             let group = groups.get(key);
@@ -300,7 +337,7 @@ Use "select" to fetch only some fields, e.g. select: "notes" for just the notes
             const MAX_API_PAGES = 10; // hard cap: scan at most 500 issues
             const neededTotal = page * page_size; // need this many matches to serve page N
             const matching = [];
-            const { truncated } = await scanMatchingIssues(baseParams, filter, API_PAGE_SIZE, MAX_API_PAGES, issue => {
+            const { truncated } = await scanMatchingIssues(baseParams, select, filter, API_PAGE_SIZE, MAX_API_PAGES, issue => {
                 matching.push(issue);
                 return matching.length < neededTotal;
             });
@@ -324,7 +361,7 @@ Use "select" to fetch only some fields, e.g. select: "notes" for just the notes
     // ---------------------------------------------------------------------------
     server.registerTool('create_issue', {
         title: 'Create Issue',
-        description: `Create a new MantisBT issue. Returns the full created issue object including the assigned id, summary, status, priority, severity, category, reporter, created_at, and view_url.
+        description: `Create a new MantisBT issue. Returns the full created issue object including the assigned id, summary, status, priority, severity, category, reporter, created_at, and view_url. With response: "short" only id, summary, project, category, status, handler, created_at and view_url (default "full"; it changes to "short" in ${REMOVAL_VERSION}).
 
 Required fields: summary, description, project_id, category. All other fields are optional with sensible defaults (priority: "normal", severity: "minor").
 
@@ -353,13 +390,14 @@ For the handler, prefer the username field (resolved server-side) over handler_i
             reproducibility: z.string().optional().describe('How reliably the issue reproduces. Canonical English names: always, sometimes, random, have not tried, unable to reproduce, N/A. Use get_issue_schema to see localized labels.'),
             view_state: z.enum(['public', 'private']).optional().describe('Visibility of the issue: "public" (visible to all, default) or "private" (restricted to higher-access users).'),
             custom_fields: z.array(customFieldEntry).optional().describe('Custom field values: [{field: {id|name}, value: "<string>"}]. Use get_issue_schema or get_metadata to discover available custom fields per project.'),
+            response: responseSchema,
         }),
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
             idempotentHint: false,
         },
-    }, async ({ summary, description, project_id, category, priority, severity, handler_id, handler, version, target_version, fixed_in_version, steps_to_reproduce, additional_information, reproducibility, view_state, custom_fields }) => {
+    }, async ({ summary, description, project_id, category, priority, severity, handler_id, handler, version, target_version, fixed_in_version, steps_to_reproduce, additional_information, reproducibility, view_state, custom_fields, response }) => {
         // Resolve handler username to handler_id when only a name is given
         let resolvedHandlerId = handler_id;
         if (resolvedHandlerId === undefined && handler !== undefined) {
@@ -425,19 +463,22 @@ For the handler, prefer the username field (resolved server-side) over handler_i
             const partial = firstIssue(raw) ?? raw;
             let issue = partial;
             if (!('summary' in partial)) {
-                // Older MantisBT returned only { id: N } — fetch the full issue.
+                // Older MantisBT returned only { id: N } — fetch the issue (only the
+                // short fields when those are all that is returned).
                 // Suppress GET errors: the issue was already created.
                 try {
-                    const fetched = await client.get(`issues/${partial.id}`);
+                    const select = response === 'short' ? SHORT_CREATE_FIELDS.filter(f => f !== 'view_url').join(',') : undefined;
+                    const fetched = await client.get(`issues/${partial.id}`, { select });
                     issue = firstIssue(fetched) ?? partial;
                 }
                 catch {
                     // unable to fetch details — return minimal object
                 }
             }
-            const baseUrl = await client.getBaseUrl();
+            const enriched = enrichIssue(issue, await client.getBaseUrl());
+            const result = response === 'short' ? pickFields(enriched, SHORT_CREATE_FIELDS) : enriched;
             return {
-                content: [{ type: 'text', text: JSON.stringify(enrichIssue(issue, baseUrl), null, 2) }],
+                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
             };
         }
         catch (error) {
@@ -495,6 +536,8 @@ Use the optional "note" parameter to append a note in the same call (e.g. the re
 
 Use "add_monitors" / "remove_monitors" (lists of MantisBT login names) to change who watches the issue — "fields" may be omitted then. The response contains "monitors" with added/removed/not_monitoring and the current monitor list. Adding or removing other users requires the monitor_add_others_bug_threshold / monitor_delete_others_bug_threshold access level.
 
+The response is the updated issue. With response: "short" it holds only id, summary, status, resolution, updated_at, view_url and the fields that were changed (custom_fields and notes narrowed to the changed entries; an appended note as { id, view_url }) — use it for routine changes. Default is "full"; it changes to "short" in ${REMOVAL_VERSION}.
+
 Steps run in order: fields, monitors, note. Once one step succeeded, a later failure is reported inline ("notes_error" when a note edit was not applied, "monitors_error", "note_error") instead of failing the call — do not retry the steps that went through. Only if every requested step failed is the call an error.`,
         inputSchema: z.object({
             id: z.coerce.number().int().positive().describe('Numeric issue ID to update'),
@@ -503,6 +546,7 @@ Steps run in order: fields, monitors, note. Once one step succeeded, a later fai
             dry_run: z.preprocess(coerceBool, z.boolean().optional()).describe('If true, return the patch payload that would be sent without actually updating the issue. Useful for previewing changes before committing them.'),
             note: z.string().min(1).optional().describe('Optional note text appended after a successful update (e.g. reason for a status change). Replaces a separate add_note call.'),
             note_view_state: z.enum(['public', 'private']).default('public').describe('Visibility of the appended note: "public" (default) or "private". Only used when "note" is set.'),
+            response: responseSchema,
             fields: z.preprocess((v) => {
                 if (typeof v !== 'string')
                     return v;
@@ -537,7 +581,7 @@ Steps run in order: fields, monitors, note. Once one step succeeded, a later fai
             destructiveHint: false,
             idempotentHint: false,
         },
-    }, async ({ id, fields, dry_run, note, note_view_state, add_monitors, remove_monitors }) => {
+    }, async ({ id, fields, dry_run, note, note_view_state, add_monitors, remove_monitors, response: responseMode }) => {
         const fieldChanges = fields ?? {};
         const hasFields = Object.keys(fieldChanges).length > 0;
         const hasMonitorChanges = add_monitors !== undefined || remove_monitors !== undefined;
@@ -574,9 +618,10 @@ Steps run in order: fields, monitors, note. Once one step succeeded, a later fai
                         }],
                 };
             }
+            const short = responseMode === 'short';
             const patched = hasFields ? await patchIssueFields(id, patchFields) : undefined;
             const response = patched
-                ? { ...patched }
+                ? (short ? shortUpdatedIssue(patched, fieldChanges) : { ...patched })
                 : { id, view_url: buildIssueViewUrl(await client.getBaseUrl(), id) };
             // MantisBT skips note edits it does not apply without an error, so the
             // response is checked.
@@ -614,7 +659,8 @@ Steps run in order: fields, monitors, note. Once one step succeeded, a later fai
             }
             if (note !== undefined) {
                 try {
-                    response['note'] = await postNote(client, id, note, note_view_state);
+                    const posted = await postNote(client, id, note, note_view_state);
+                    response['note'] = short ? pickFields(posted, ['id', 'view_url']) : posted;
                     succeeded = true;
                 }
                 catch (noteError) {

package/dist/tools/version.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { coerceBool } from '../coerce.js';
 import { parseVersion, compareVersions } from '../version-hint.js';
 import { deprecationNote } from '../deprecation.js';
-export function registerVersionTools(server, client, versionHint, mcpVersion) {
+export function registerVersionTools(server, client, versionHint, build) {
     /**
      * Installed MantisBT version (X-Mantis-Version header), optionally compared
      * with the latest MantisBT release on GitHub.
@@ -40,7 +40,9 @@ export function registerVersionTools(server, client, versionHint, mcpVersion) {
     server.registerTool('get_version', {
         title: 'Get Versions',
         description: `Return the version of this mantisbt-mcp-server and of the connected MantisBT installation in one response:
-{ mcp_server: { version }, mantis: { installed_version, latest_version?, status?, github_note? } }
+{ mcp_server: { version, commit?, built_at? }, mantis: { installed_version, latest_version?, status?, github_note? } }
+
+mcp_server describes the running build: version ends in "-dev" unless it is a published release; commit is the short hash it was built from ("-dirty" with uncommitted changes), built_at the ISO-8601 build time.
 
 The MantisBT version is read from the X-Mantis-Version response header. With check_latest (default: true) it is compared against the latest MantisBT release on GitHub (outbound HTTPS request, up to 5 seconds); status is "up-to-date", "update-available", "newer-than-release" or "unknown". If MantisBT cannot be reached, mantis contains "error" instead and mcp_server is still returned.`,
         inputSchema: z.object({ check_latest: checkLatestSchema }),
@@ -54,7 +56,7 @@ The MantisBT version is read from the X-Mantis-Version response header. With che
             error: error instanceof Error ? error.message : String(error),
         }));
         return {
-            content: [{ type: 'text', text: JSON.stringify({ mcp_server: { version: mcpVersion }, mantis }, null, 2) }],
+            content: [{ type: 'text', text: JSON.stringify({ mcp_server: build, mantis }, null, 2) }],
         };
     });
     // ---------------------------------------------------------------------------
@@ -70,7 +72,7 @@ The MantisBT version is read from the X-Mantis-Version response header. With che
             idempotentHint: true,
         },
     }, async () => ({
-        content: [{ type: 'text', text: JSON.stringify({ version: mcpVersion }, null, 2) }],
+        content: [{ type: 'text', text: JSON.stringify({ version: build.version }, null, 2) }],
     }));
     // ---------------------------------------------------------------------------
     // get_mantis_version

package/docs/cookbook.de.md

@@ -779,6 +779,47 @@ Löst ein Issue auf und schließt es. **Immer beide Felder** `status` und `resol
 
 ---
 
+### Kurze Antwort statt des ganzen Issues
+
+Standardmäßig geben `update_issue` und `create_issue` das ganze Issue zurück, mit Beschreibung, Notizen und Historie – bei einem lebhaften Issue mehrere tausend Token. Mit `response: "short"` kommt nur zurück, was die Änderung bestätigt.
+
+**Tool:** `update_issue` (bei `create_issue` genauso)
+
+**Parameter:**
+- `response` – _(optional)_ `"full"` (Standard) oder `"short"`. In 2.0.0 wird `"short"` zum Standard.
+
+**Request:**
+
+```json
+{
+  "id": 1042,
+  "fields": {
+    "status": { "name": "resolved" },
+    "resolution": { "id": 20 }
+  },
+  "note": "Behoben in Commit abc123.",
+  "response": "short"
+}
+```
+
+**Response:**
+
+```json
+{
+  "id": 1042,
+  "summary": "Login schlägt auf iOS fehl",
+  "status": { "id": 80, "name": "resolved", "label": "erledigt" },
+  "resolution": { "id": 20, "name": "fixed", "label": "erledigt" },
+  "updated_at": "2026-11-09T13:21:00+01:00",
+  "view_url": "https://mantis.example.com/view.php?id=1042",
+  "note": { "id": 4957, "view_url": "https://mantis.example.com/view.php?id=1042#bugnote4957" }
+}
+```
+
+`update_issue` liefert `id`, `summary`, `status`, `resolution`, `updated_at`, `view_url` und jedes geänderte Feld; `custom_fields` und `notes` (Änderungen über `fields.notes`) sind auf die geänderten Einträge beschränkt, eine angehängte Notiz auf `id` und `view_url`. `monitors` und die `*_error`-Schlüssel erscheinen wie bei `"full"`. `create_issue` liefert `id`, `summary`, `project`, `category`, `status`, `handler`, `created_at` und `view_url`.
+
+---
+
 ### Benutzerdefinierte Felder setzen
 
 Schreibt Custom-Field-Werte beim Anlegen oder Aktualisieren. Dasselbe `custom_fields`-Format funktioniert bei `create_issue` und `update_issue` (dort innerhalb von `fields`).
@@ -1684,7 +1725,7 @@ Gibt die Anzahl der indizierten Issues, die Gesamtanzahl der Issues und den Zeit
 
 ### Nach Bedeutung suchen
 
-Findet Issues, die einem natürlichsprachigen Suchbegriff semantisch ähnlich sind, kombiniert mit einer Stichwortsuche, damit auch exakte Begriffe (Bezeichner, Fehlercodes, Versionsnummern) gefunden werden. Gibt Issue-IDs und Relevanz-Scores zurück. `score` ist die semantische Ähnlichkeit; die Reihenfolge folgt der kombinierten Rangfolge, ein Ergebnis mit exaktem Stichworttreffer kann also vor einem mit höherem `score` stehen.
+Findet Issues, die einem natürlichsprachigen Suchbegriff semantisch ähnlich sind, kombiniert mit einer Stichwortsuche, damit auch exakte Begriffe (Bezeichner, Fehlercodes, Versionsnummern) gefunden werden. Gibt Issue-IDs und Relevanz-Scores zurück. `score` ist die semantische Ähnlichkeit; die Reihenfolge folgt der kombinierten Rangfolge, ein Ergebnis mit exaktem Stichworttreffer kann also vor einem mit höherem `score` stehen. Issues, die eine Kennung aus der Anfrage vollständig enthalten – eine Auftragsnummer, eine CVE, eine Version, einen Code-Bezeichner wie `MANTIS_SEARCH_DIR` –, stehen vor allen anderen, es sei denn, die Kennung kommt in mehr als 20 Issues vor.
 
 **Tool:** `search_issues`
 
@@ -1712,7 +1753,38 @@ Findet Issues, die einem natürlichsprachigen Suchbegriff semantisch ähnlich si
 ]
 ```
 
-> **Hinweis:** Die semantische Suche gibt die top-N ähnlichsten Issues zurück – vollständige Treffergarantie besteht nicht. Sie eignet sich nicht für Abfragen wie »alle Issues zu Thema X auflisten«.
+> **Hinweis:** Die semantische Suche gibt die top-N ähnlichsten Issues zurück – vollständige Treffergarantie besteht nicht. Sie eignet sich nicht für Abfragen wie »alle Issues zu Thema X auflisten«. Ausnahme ist die Suche nach einer seltenen Kennung: Die Issues, die sie enthalten, stehen vorn (siehe unten), mit ausreichend großem `top_n` werden also alle aufgelistet.
+
+---
+
+### Nach einer Kennung suchen
+
+Eine Suche nach einer Auftragsnummer, einer CVE, einer Version oder einem Code-Bezeichner listet alle Issues, die sie vollständig enthalten, vor allen anderen Ergebnissen. Kennungen werden an ihrer Form erkannt: ein Unterstrich, ein Großbuchstabe mitten im Wort, Buchstaben mit Ziffern, fünf oder mehr Ziffern oder mit `-` `.` `:` `/` verbundene Teile mit einer Ziffer. `1.15` trifft nicht `1.15.2`, und `CVE-2026-1234` trifft nicht `CVE-2026-12345`. Gewöhnliche Wörter und kurze Zahlen behalten die kombinierte Rangfolge, ebenso eine Kennung, die in mehr als 20 Issues vorkommt.
+
+**Tool:** `search_issues`
+
+**Request:**
+
+```json
+{
+  "query": "CVE-2026-1234",
+  "top_n": 5
+}
+```
+
+**Response:**
+
+```json
+[
+  { "id": 2210, "score": 0.58, "view_url": "https://mantis.example.com/view.php?id=2210" },
+  { "id": 2211, "score": 0.47, "view_url": "https://mantis.example.com/view.php?id=2211" },
+  { "id": 2084, "score": 0.65, "view_url": "https://mantis.example.com/view.php?id=2084" },
+  { "id": 1977, "score": 0.63, "view_url": "https://mantis.example.com/view.php?id=1977" },
+  { "id": 2150, "score": 0.61, "view_url": "https://mantis.example.com/view.php?id=2150" }
+]
+```
+
+Die Issues 2210 und 2211 enthalten `CVE-2026-1234` und stehen vorn, obwohl Issue 2084 den höheren `score` hat.
 
 ---
 
@@ -2313,7 +2385,7 @@ Gibt die Version dieses mantisbt-mcp-servers und der verbundenen MantisBT-Instal
 
 ```json
 {
-  "mcp_server": { "version": "1.15.0" },
+  "mcp_server": { "version": "1.18.0", "commit": "9ebef4c", "built_at": "2026-11-09T12:00:00.000Z" },
   "mantis": {
     "installed_version": "2.27.0",
     "latest_version": "2.27.1",
@@ -2324,6 +2396,8 @@ Gibt die Version dieses mantisbt-mcp-servers und der verbundenen MantisBT-Instal
 
 Mögliche Werte für `status`: `up-to-date`, `update-available`, `newer-than-release`, `unknown`. Mit `check_latest: false` den GitHub-Vergleich überspringen.
 
+`mcp_server` beschreibt den laufenden Build, nicht die aktuelle `package.json`: `version` ist die Version, aus der gebaut wurde, `commit` der kurze Commit-Hash (mit `-dirty`, wenn es nicht committete Änderungen gab), `built_at` der Build-Zeitpunkt. Nur ein veröffentlichter Release meldet eine reine Versionsnummer; ein lokaler Build, `npm run dev` oder Code direkt aus `src/` meldet z. B. `1.18.0-dev`. Ohne Git fehlt `commit`; Code direkt aus `src/` hat weder `commit` noch `built_at`.
+
 > **Veraltet:** `get_mcp_version` und `get_mantis_version` werden in 2.0.0 entfernt – stattdessen `get_version` wie oben gezeigt verwenden.
 
 ---

package/docs/cookbook.md

@@ -779,6 +779,47 @@ Changes the status and appends a note explaining the change — in one `update_i
 
 ---
 
+### Get a short response instead of the whole issue
+
+By default `update_issue` and `create_issue` return the whole issue, including description, notes and history — several thousand tokens on a busy issue. With `response: "short"` you get only what confirms the change.
+
+**Tool:** `update_issue` (works the same way for `create_issue`)
+
+**Parameters:**
+- `response` — _(optional)_ `"full"` (default) or `"short"`. The default changes to `"short"` in 2.0.0.
+
+**Request:**
+
+```json
+{
+  "id": 1042,
+  "fields": {
+    "status": { "name": "resolved" },
+    "resolution": { "id": 20 }
+  },
+  "note": "Fixed in commit abc123.",
+  "response": "short"
+}
+```
+
+**Response:**
+
+```json
+{
+  "id": 1042,
+  "summary": "Login fails on iOS",
+  "status": { "id": 80, "name": "resolved", "label": "resolved" },
+  "resolution": { "id": 20, "name": "fixed", "label": "fixed" },
+  "updated_at": "2026-11-09T13:21:00+01:00",
+  "view_url": "https://mantis.example.com/view.php?id=1042",
+  "note": { "id": 4957, "view_url": "https://mantis.example.com/view.php?id=1042#bugnote4957" }
+}
+```
+
+`update_issue` returns `id`, `summary`, `status`, `resolution`, `updated_at`, `view_url` and every field you changed; `custom_fields` and `notes` (edits via `fields.notes`) are narrowed to the entries you changed, an appended note to `id` and `view_url`. `monitors` and the `*_error` keys appear as with `"full"`. `create_issue` returns `id`, `summary`, `project`, `category`, `status`, `handler`, `created_at` and `view_url`.
+
+---
+
 ### Set custom fields
 
 Writes custom field values on create or update. The same `custom_fields` format works for both `create_issue` and `update_issue` (inside `fields`).
@@ -1684,7 +1725,7 @@ Returns the number of indexed issues, total issue count, and the timestamp of th
 
 ### Search by meaning
 
-Finds issues semantically similar to a natural language query, combined with keyword matching so that exact terms (identifiers, error codes, version numbers) are found as well. Returns issue IDs and relevance scores. `score` is the semantic similarity; the order follows the combined ranking, so a result with an exact keyword match can come before one with a higher `score`.
+Finds issues semantically similar to a natural language query, combined with keyword matching so that exact terms (identifiers, error codes, version numbers) are found as well. Returns issue IDs and relevance scores. `score` is the semantic similarity; the order follows the combined ranking, so a result with an exact keyword match can come before one with a higher `score`. Issues that contain an identifier from the query as a whole — an order number, a CVE, a version, a code name such as `MANTIS_SEARCH_DIR` — are listed before all others, unless the identifier occurs in more than 20 issues.
 
 **Tool:** `search_issues`
 
@@ -1712,7 +1753,38 @@ Finds issues semantically similar to a natural language query, combined with key
 ]
 ```
 
-> **Note:** Semantic search returns the top-N most similar issues — it does not guarantee exhaustive recall. It is not suitable for "find all issues about X" census queries.
+> **Note:** Semantic search returns the top-N most similar issues — it does not guarantee exhaustive recall. It is not suitable for "find all issues about X" census queries. The exception is a query for a rare identifier: the issues that contain it come first (see below), so with a large enough `top_n` they are all listed.
+
+---
+
+### Search for an identifier
+
+A query for an order number, a CVE, a version or a code name lists every issue that contains it as a whole before all other results. Identifiers are recognised by their form: an underscore, a capital inside the word, letters with digits, five or more digits, or parts joined by `-` `.` `:` `/` with a digit. `1.15` does not match `1.15.2`, and `CVE-2026-1234` does not match `CVE-2026-12345`. Plain words and short numbers keep the combined ranking, as does an identifier that occurs in more than 20 issues.
+
+**Tool:** `search_issues`
+
+**Request:**
+
+```json
+{
+  "query": "CVE-2026-1234",
+  "top_n": 5
+}
+```
+
+**Response:**
+
+```json
+[
+  { "id": 2210, "score": 0.58, "view_url": "https://mantis.example.com/view.php?id=2210" },
+  { "id": 2211, "score": 0.47, "view_url": "https://mantis.example.com/view.php?id=2211" },
+  { "id": 2084, "score": 0.65, "view_url": "https://mantis.example.com/view.php?id=2084" },
+  { "id": 1977, "score": 0.63, "view_url": "https://mantis.example.com/view.php?id=1977" },
+  { "id": 2150, "score": 0.61, "view_url": "https://mantis.example.com/view.php?id=2150" }
+]
+```
+
+Issues 2210 and 2211 contain `CVE-2026-1234` and come first, although issue 2084 has the higher `score`.
 
 ---
 
@@ -2313,7 +2385,7 @@ Returns the version of this mantisbt-mcp-server and of the connected MantisBT in
 
 ```json
 {
-  "mcp_server": { "version": "1.15.0" },
+  "mcp_server": { "version": "1.18.0", "commit": "9ebef4c", "built_at": "2026-11-09T12:00:00.000Z" },
   "mantis": {
     "installed_version": "2.27.0",
     "latest_version": "2.27.1",
@@ -2324,6 +2396,8 @@ Returns the version of this mantisbt-mcp-server and of the connected MantisBT in
 
 Possible values for `status`: `up-to-date`, `update-available`, `newer-than-release`, `unknown`. Set `check_latest: false` to skip the GitHub comparison.
 
+`mcp_server` describes the running build, not the current `package.json`: `version` is the version it was built from, `commit` the short commit hash (with `-dirty` if there were uncommitted changes), `built_at` the build time. Only a published release reports a plain version; a local build, `npm run dev` or code run straight from `src/` reports e.g. `1.18.0-dev`. Without git, `commit` is left out; code run from `src/` has neither `commit` nor `built_at`.
+
 > **Deprecated:** `get_mcp_version` and `get_mantis_version` will be removed in 2.0.0 — use `get_version` as shown above.
 
 ---

package/docs/examples.de.md

@@ -201,10 +201,14 @@ Die semantische Suche versteht die *Bedeutung* deiner Frage – nicht nur einzel
 
 ### Exakte Begriffe
 
-Die Suche berücksichtigt auch exakte Stichwörter, daher funktionieren Bezeichner, Fehlercodes und Versionsnummern ebenfalls als Suchanfrage.
+Die Suche berücksichtigt auch exakte Stichwörter, daher funktionieren Bezeichner, Fehlercodes und Versionsnummern ebenfalls als Suchanfrage. Issues, die die Kennung enthalten, stehen vorn.
 
 > »Welche Issues erwähnen `MANTIS_SEARCH_DIR`?«
 
+> »Finde alle Issues zu `CVE-2026-1234`.«
+
+Wie Kennungen erkannt werden: [Cookbook – Nach einer Kennung suchen](cookbook.de.md#nach-einer-kennung-suchen).
+
 > »Finde Issues zum Fehler `ERR_CERT_DATE_INVALID`.«
 
 ---

package/docs/examples.md

@@ -201,10 +201,14 @@ Semantic search understands the *meaning* of your question — not just keywords
 
 ### Exact terms
 
-The search also matches exact keywords, so identifiers, error codes and version numbers work as queries too.
+The search also matches exact keywords, so identifiers, error codes and version numbers work as queries too. Issues that contain the identifier come first.
 
 > "Which issues mention `MANTIS_SEARCH_DIR`?"
 
+> "Find all issues about `CVE-2026-1234`."
+
+How identifiers are recognised: [Cookbook — Search for an identifier](cookbook.md#search-for-an-identifier).
+
 > "Find issues about the error `ERR_CERT_DATE_INVALID`."
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dpesch/mantisbt-mcp-server",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "mcpName": "io.github.dpesch/mantisbt-mcp-server",
   "description": "MCP server for MantisBT REST API – read and manage bug tracker issues",
   "author": "Dominik Pesch",
@@ -32,10 +32,11 @@
   },
   "type": "module",
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && node scripts/write-build-info.mjs",
     "typecheck": "tsc --noEmit",
     "start": "node dist/index.js",
-    "dev": "tsc -p tsconfig.build.json --watch",
+    "dev": "node scripts/write-build-info.mjs && tsc -p tsconfig.build.json --watch",
+    "prepublishOnly": "node scripts/check-release-build.mjs",
     "dev:start": "npm run typecheck && npm run build && node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.dpesch/mantisbt-mcp-server",
   "title": "MantisBT MCP Server",
   "description": "MantisBT MCP server – manage issues, notes, files, tags, and relationships. With semantic search.",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@dpesch/mantisbt-mcp-server",
-      "version": "1.16.0",
+      "version": "1.18.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"