@runpod/mcp-server 4.0.0 → 4.1.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @runpod/mcp-server
 
+## 4.1.0
+
+### Minor Changes
+
+- 1d049b6: Serve the official Runpod plugin's guides and concept graph: `list-guides`, `read-guide`, `lookup-concept` and `search-concepts`, plus each guide as a `runpod://guides/` resource, from the `@runpod/plugin-knowledge` package.
+- 09a565a: `list-templates` now returns 20 templates per page by default instead of the
+  full list. Follow `nextCursor` to see the rest.
+
+  Resync the vendored v2 OpenAPI spec with production. Adds five account-secret
+  tools (`list-secrets`, `get-secret`, `create-secret`, `update-secret`,
+  `delete-secret`) and refreshes the schemas for pods, endpoints, templates,
+  registries, and clusters — most visibly the `cursor`/`limit` query parameters
+  and `pagination` response block the API now serves on its list endpoints.
+
+  `list-endpoints` and `list-templates` now page on the server: `limit` and
+  `cursor` go to the API, and `pagination` returns its `nextCursor` and
+  `hasNextPage` plus `returned`. `list-endpoints` drops the old client-side
+  `total`, `offset`, and `truncated` fields, which only counted one server page.
+  Requires `@runpod/typescript-api-sdk` 0.2.0.
+
+### Patch Changes
+
+- 531ecb0: Serve MCP tool annotations. Every tool now advertises `readOnlyHint`,
+  `destructiveHint`, `idempotentHint`, and `openWorldHint` in `tools/list`:
+  generated tools derive them from the HTTP method they wrap, so they cannot
+  drift from the spec, with generator-config overrides for operations that delete
+  through a POST or PUT (`pod-action`, `update-ssh-keys`), and the curated
+  overlay declares them per tool. Hosts can
+  auto-approve reads and gate deletions, cancels, and queue purges on a human.
+
 ## 4.0.0
 
 ### Major Changes

package/README.md

@@ -140,24 +140,9 @@ Endpoints are image-based — pass an image and a GPU pool (a `pool` value from
 
 See [`docs/configuration.md`](docs/configuration.md) for host overrides, private image pull (registry credentials vs ECR delegation), and large-output handling.
 
-## The tool surface
-
-Hosted and local serve the same surface, with one deliberate exception: **68
-tools** (51 generated from the v2 OpenAPI spec + 17 curated) on both, plus the
-four hosted-only ALP tools — `report_feedback`, `save_to_journal`,
-`ask_question`, and `read_journal`, which returns the calling account's own
-journal and nobody else's — for **72 hosted**. Those four need storage credentials the
-npm package cannot hold, so local stdio never registers them and they are
-simply absent from `tools/list` (see
-[`docs/agent-learning-protocol.md`](docs/agent-learning-protocol.md)). Both
-transports also serve the ten Runpod task playbooks as MCP resources under
-`runpod://skills/`. New API endpoints become
-tools by regeneration, not by hand-writing code. Start with
-[specgen/DESIGN.md](specgen/DESIGN.md) for a progressive walkthrough, and
-[specgen/README.md](specgen/README.md) for the regeneration workflow and
-drift gates.
-
-Upgrading from 3.x: eight tools follow their spec operationIds (e.g.
+## Upgrading from 3.x
+
+Eight tools follow their spec operationIds (e.g.
 `create-container-registry-auth` → `create-registry`, `get-billing` →
 `list-billing`) and `start-pod`/`stop-pod`/`restart-pod` fold into
 `pod-action` with an `action` argument. The full old→new map is
@@ -169,7 +154,7 @@ v2-only; `RUNPOD_REST_VERSION` and the v1 fallback are retired.
 This server acts with the full permissions of the supplied API key.
 
 - Never share your API key.
-- Be deliberate with destructive tools.
+- Be deliberate with destructive tools. Every tool carries MCP annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) derived from the operation it wraps, so a host can auto-approve reads and gate `delete-pod` or `purge-endpoint-queue` on a human.
 - Each request authenticates with its own caller-supplied token, which is forwarded to the Runpod API and **never persisted server-side**. The server never holds a credential of its own and never shares one across users.
 
 ## Local development
@@ -196,6 +181,8 @@ pnpm test    # offline unit suite — no network or API key required
 pnpm build
 ```
 
+Tools are generated from the vendored v2 OpenAPI spec rather than hand-written: see [specgen/DESIGN.md](specgen/DESIGN.md) for the walkthrough and [specgen/README.md](specgen/README.md) for the regeneration workflow and drift gates.
+
 This project uses [changesets](https://github.com/changesets/changesets) for versioning and npm publishing; every PR with user-facing changes needs a changeset. See `CLAUDE.md` and `docs/context.md` for full contributor guidance, architecture, and the test suite.
 
 ## License