@qase/mcp-server 1.1.8 → 2.0.1

package/CHANGELOG.md

@@ -5,6 +5,44 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.1]
+
+### Added
+
+- **`qase_external_issue_link`** — Link or unlink test cases and test runs to issues in an external tracker (Jira Cloud / Jira Server), wrapping `POST /v1/case/{code}/external-issue/attach`, `.../detach`, and `POST /v1/run/{code}/external-issue`. A case can hold several links; a run holds one, and detaching clears it. ([#64](https://github.com/qase-tms/qase-mcp-server/issues/64))
+- **`qase_get`** now requests external issue links for cases and runs by default (`include=external_issues` / `include=external_issue`), so a link created via `qase_external_issue_link` can be verified without leaving the MCP client. The new `include` parameter overrides the default; if a deployment rejects the value, the request is retried without it. ([#65](https://github.com/qase-tms/qase-mcp-server/issues/65))
+
+- **`qase_case_bulk_create`** — Create up to 100 test cases in a single request, restoring the bulk creation that v1 offered as `bulk_create_cases`. Unlike the v1 tool it normalises enum labels per case, so `priority: "high"` works the same as in `qase_case_upsert`.
+
+### Fixed
+
+- `qase_discover_tools` no longer skips activation when the `activate` argument is omitted. Tool handlers receive raw MCP arguments, so the schema default never applied and matched tools stayed hidden from the client's tool list.
+
+## [2.0.0]
+
+### Breaking Changes
+
+- **All 83 v1 tool names have been removed.** The tool set has been consolidated from 83 tools to 29. See [docs/migration.md](docs/migration.md) for a complete v1→v2 tool mapping table.
+- Response format is now compact JSON with null values stripped (no indentation). This reduces token usage but changes the raw string format of responses.
+
+### Added
+
+- **`qase_project_context`** — Bootstrap tool that fetches project details, suites, milestones, environments, custom fields, and users in a single call. Result is cached for 5 minutes (tenant-safe two-tier cache: in-memory + optional Redis).
+- **`qase_get`** — Universal entity getter for all entity types (`case`, `suite`, `run`, `result`, `plan`, `defect`, `milestone`, `environment`, `shared_step`, `shared_parameter`, `configuration`, `attachment`, `author`, `user`, `custom_field`). Supports field projection via the `fields` parameter.
+- **`qql_search`** / **`qql_help`** — Unified QQL search across all entity types (retained from v1 with identical interface).
+- **Composite tool `qase_ci_report`** — Reports CI/CD test results in one call: creates a run, bulk-records results, and optionally completes the run. Replaces the 3–4 step `create_run → create_results_bulk → complete_run` workflow.
+- **Composite tool `qase_triage_defect`** — Creates a defect from a test failure and optionally links it to failed result hashes. Streamlines triage workflows.
+- **Composite tool `qase_regression_run`** — Sets up a regression run in one call. Accepts case selection by suite IDs, explicit case IDs, or plan ID.
+- **`qase_api`** — Escape hatch for direct Qase REST API access. Allows calling any endpoint not covered by the named tools.
+- **Upsert+delete tools** for all major entities: `qase_case_upsert`, `qase_case_delete`, `qase_suite_upsert`, `qase_suite_delete`, `qase_run_upsert`, `qase_run_complete`, `qase_run_delete`, `qase_result_record`, `qase_result_delete`, `qase_plan_upsert`, `qase_plan_delete`, `qase_defect_upsert`, `qase_defect_delete`, `qase_milestone_upsert`, `qase_milestone_delete`, `qase_environment_upsert`, `qase_environment_delete`, `qase_shared_step_upsert`, `qase_shared_step_delete`, `qase_attachment_upload`, `qase_attachment_delete`.
+- **HTTP keep-alive, automatic retry, and in-flight request deduplication** in the API client layer.
+- **Tenant-safe two-tier cache** — in-memory LRU cache with optional Redis L2. Cache keys are scoped per-tenant (token hash + API domain) eliminating the cross-tenant data leak present in v1.
+- **OAuth 2.1 support (streamable-http transport)** — the server proxies authorization, token, and dynamic client registration to the Qase authorization server, and verifies access-token JWTs locally against the upstream JWKS before forwarding them to the Qase API. Legacy opaque api-tokens continue to work. Protected-resource metadata is served per RFC 9728. This powers the hosted Qase MCP, available as the official **Qase Test Management** connector in Claude's directory (see the README).
+
+### Fixed
+
+- **Security: cross-tenant cache data leak eliminated.** v1 cached responses globally; v2 scopes every cache key to the authenticated tenant.
+
 ## [1.1.6]
 
 ### Added