@stabgan/openrouter-mcp-multimodal 4.5.0 → 4.5.1

package/README.md

@@ -313,7 +313,7 @@ Use get_video_status with video_id "vid_abc123" and save_path "./river.mp4"
 ```
 src/
 ├── index.ts                    # Entry, env validation, graceful shutdown
-├── tool-handlers.ts            # 11 tools (annotated) + dispatch
+├── tool-handlers.ts            # 14 tools (annotated) + dispatch
 ├── model-cache.ts              # TTL + in-flight coalescing
 ├── openrouter-api.ts           # REST client (chat + /videos)
 ├── errors.ts                   # Closed ErrorCode enum
@@ -338,6 +338,60 @@ src/
     └── validate-model.ts       # Model existence check
 ```
 
+## Design Principles & Research
+
+v4.5.0's design draws from three threads of research and industry guidance. Rather than building in isolation, every feature ties to a cited source so decisions can be re-examined later.
+
+### MCP-first design principles
+
+We follow [Phil Schmid's production guide for MCP servers](https://www.philschmid.de/mcp-best-practices) (Jan 2026), which argues that an MCP server is "a user interface for AI agents, not a REST API wrapper":
+
+- **Outcomes, not operations.** Our tools like `analyze_image` and `generate_video` encapsulate a whole workflow (fetch, validate, invoke, save) rather than exposing raw OpenRouter primitives.
+- **Flattened arguments.** Top-level primitives with enums (`aspect_ratio`, `image_size`), no deeply nested configuration blobs. The one nested object (`provider`) is required by OpenRouter's routing schema.
+- **Descriptions are context.** Every tool description includes "Fails when:" and "Works with:" sections (see next section for the research backing).
+- **Curated surface.** 14 tools total. Each is a distinct outcome; no "helper" tools that exist only for internal composition.
+
+Apigene's ["12 Rules for Production MCP Deployment"](https://apigene.ai/blog/mcp-best-practices) (March 2026) guided the error-handling posture: structured errors with `suggestions` and `retry_after_seconds` on `_meta` beat raw error strings the agent has to interpret.
+
+### MCP 2025-06-18 spec compliance
+
+- **Structured outputs.** `validate_model`, `get_model_info`, `search_models`, `rerank_documents`, and `health_check` emit [`structuredContent` with `outputSchema`](https://modelcontextprotocol.io/specification/2025-06-18/server/tools#output-schema), per §5.2.6-7. Agents can validate responses typefully.
+- **Progress notifications.** `generate_video` emits [`notifications/progress`](https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/progress) on every poll tick when the client passes a `progressToken` in `_meta`. Progress values are guaranteed strictly monotonic per spec.
+- **Tool annotations.** Every tool carries `title` + `readOnlyHint` + `destructiveHint` + `idempotentHint` + `openWorldHint` so clients can render appropriate UI affordances.
+
+### Research-backed tool-design decisions
+
+These papers shaped specific v4.5.0 choices:
+
+| Finding | Source | How it shaped v4.5.0 |
+| :--- | :--- | :--- |
+| Failure-mode docs and inter-tool relationships measurably improve tool-selection accuracy | [Schlapbach, *Convergence of SGD & MCP*](https://arxiv.org/abs/2602.18764) (Feb 2026) | Every tool description has explicit "Fails when:" (ErrorCode triggers) and "Works with:" (related tools). |
+| Tool-call success drops with parameter count and schema complexity | [Fu et al., *ROSBag MCP Server*](https://arxiv.org/abs/2511.03497) (Nov 2025) | `generate_video_from_image` is a narrower image-to-video wrapper around `generate_video` — fewer params, higher hit rate. |
+| Indirect prompt injection via tool-returned content is a real attack vector | [Zhao et al., *ClawGuard*](https://arxiv.org/abs/2604.11790) (Apr 2026) · [Yu et al., *Defense via Tool Result Parsing*](https://arxiv.org/abs/2601.04795) (Jan 2026) | `analyze_image` / `analyze_audio` / `analyze_video` tag their output `_meta.content_is_untrusted: true`. Downstream agents know to treat that text as data, not instructions. |
+| Provider-level tool-calling variance is large and persists across providers for the same model | [OpenRouter Auto Exacto announcement](https://openrouter.ai/announcements/auto-exacto) (Mar 2026) | `chat_completion` documents the `:exacto` model suffix alongside `:nitro` / `:floor`. 80-88% error reduction on top tool-calling models. |
+| LLM JSON defects compound at scale | [OpenRouter Response Healing](https://openrouter.ai/announcements/response-healing-reduce-json-defects-by-80percent) (Dec 2025) | Structured outputs + outputSchema declarations give clients a parseable contract. (Response-healing plugin itself is opt-in on OpenRouter's side.) |
+| MCP servers are vulnerable to preference-manipulation and tool-poisoning attacks | [Wang et al., *MPMA*](https://arxiv.org/abs/2505.11154) (May 2025) · [Turgut & Gümüş, *CASCADE*](https://arxiv.org/abs/2604.17125) (Apr 2026) | Tool descriptions audited for injection surface; audit logging (`logger.audit()`) captures every paid-op invocation with a prompt preview for forensics. |
+
+### OpenRouter platform parity
+
+v4.5.0 surfaces platform features shipped between Q4 2025 and Q2 2026:
+
+- [Response caching via `X-OpenRouter-Cache`](https://openrouter.ai/announcements/response-caching) (Apr 2026): zero tokens billed on identical request cache hits, 80-300ms latency.
+- [Web search plugin](https://openrouter.ai/announcements/introducing-web-search-via-the-api) (Jan 2025): Exa-backed, enabled via `online: true`.
+- [Reasoning tokens](https://openrouter.ai/announcements/reasoning-tokens-for-thinking-models) (Jan 2025): DeepSeek R1 / Gemini Thinking / Opus 4.7 chain-of-thought via `include_reasoning: true`.
+- [Auto Exacto](https://openrouter.ai/announcements/auto-exacto) (Mar 2026): on-by-default for tool-calling; `:exacto` suffix for all other requests.
+- [Rerank endpoint](https://openrouter.ai/announcements/april-release-spotlight) (Apr 2026): Cohere + Fireworks via the new `rerank_documents` tool.
+- [Prompt caching with `cache_control`](https://openrouter.ai/docs/guides/best-practices/prompt-caching): Anthropic Claude 10x / Gemini 2.5+ 4x savings on repeated input media via `cache_input: true` on analyze_* tools.
+- [Zero completion token insurance](https://openrouter.ai/announcements/never-pay-for-empty-ai-responses-again) (Mar 2025): automatic, no opt-in needed.
+
+### Security posture
+
+- **Path sandbox.** All file writes (`save_path`) and reads (`input_images`, frame images) go through `resolveSafeOutputPath` / `resolveSafeInputPath`, which reject traversal escapes. Legacy bypass: `OPENROUTER_ALLOW_UNSAFE_PATHS=1`.
+- **SSRF blocklist.** Loopback, private, link-local, multicast, 6to4, Teredo, ORCHID, and IPv4-mapped IPv6 all rejected at the fetch layer.
+- **Audit logging.** `logger.audit()` emits a JSON line at level=audit for every `generate_video`, `generate_audio`, and `generate_image` call. Bypasses `OPENROUTER_LOG_LEVEL` so unintended spend is always traceable. 80-char prompt preview is the hard PII boundary.
+- **Structured errors.** Closed `_meta.code` taxonomy means agents switch on failure modes without regex-parsing free text. Rate-limit errors include `retry_after_seconds` derived from `Retry-After` headers.
+- **No credential leakage.** `OPENROUTER_API_KEY` is read once at startup, passed to the SDK, and never echoed in logs, tool responses, or error messages. Fatal-error logging whitelists fields explicitly (name / message / trimmed stack) — no raw error objects. Verified by an independent bug-hunter audit (Apr 2026).
+
 ## Development
 
 ```bash

package/dist/index.js

@@ -5,14 +5,30 @@ config(); // Load .env file if present
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ToolHandlers } from './tool-handlers.js';
+import { logger } from './logger.js';
+import { SERVER_VERSION } from './version.js';
 const DEFAULT_MODEL = 'nvidia/nemotron-nano-12b-v2-vl:free';
-// Exit on fatal errors to prevent silent zombie processes (issue #5)
+// Exit on fatal errors to prevent silent zombie processes (issue #5).
+// We log an explicit whitelist of fields rather than the raw error object
+// to avoid ever echoing sensitive SDK internals (request bodies, auth
+// headers) in a future version. Defense-in-depth against a changed
+// APIError.toString() in openai-node.
+function logFatal(kind, err) {
+    const e = err;
+    logger.error('fatal', {
+        kind,
+        name: e?.name ?? 'unknown',
+        msg: e?.message ?? String(err),
+        // Stack traces are developer-only — trim to avoid unbounded log lines.
+        stack: e?.stack?.split('\n').slice(0, 10).join('\n'),
+    });
+}
 process.on('uncaughtException', (err) => {
-    console.error('[Fatal]', err);
+    logFatal('uncaughtException', err);
     process.exit(1);
 });
 process.on('unhandledRejection', (err) => {
-    console.error('[Fatal]', err);
+    logFatal('unhandledRejection', err);
     process.exit(1);
 });
 const apiKey = process.env.OPENROUTER_API_KEY;
@@ -21,8 +37,8 @@ if (!apiKey) {
     process.exit(1);
 }
 const defaultModel = process.env.OPENROUTER_DEFAULT_MODEL || process.env.DEFAULT_MODEL || DEFAULT_MODEL;
-const server = new Server({ name: 'openrouter-multimodal-server', version: '4.0.1' }, { capabilities: { tools: {} } });
-server.onerror = (error) => console.error('[MCP Error]', error);
+const server = new Server({ name: 'openrouter-multimodal-server', version: SERVER_VERSION }, { capabilities: { tools: {} } });
+server.onerror = (error) => logFatal('mcpError', error);
 new ToolHandlers(server, apiKey, defaultModel);
 process.on('SIGINT', async () => {
     await server.close();

package/dist/model-cache.d.ts

@@ -12,10 +12,23 @@ export declare class ModelCache {
     private static instance;
     private models;
     private fetchedAt;
+    /**
+     * Separate from `fetchedAt`: set whenever we successfully CALL the
+     * fetcher (even if the response happens to be empty). Used by
+     * `isValid()` so a successful-but-empty fetch still counts as "fresh"
+     * and we don't hot-loop re-fetching the upstream.
+     */
+    private populatedAt;
     private inflight;
     static getInstance(): ModelCache;
     isValid(): boolean;
     setModels(models: OpenRouterModelRecord[]): void;
+    /**
+     * Force the cache back into an uninitialized state. Used by tests that
+     * need to assert `ensureFresh()` actually calls the fetcher. Also useful
+     * for ops (`health_check --reset`) if we ever expose such a knob.
+     */
+    reset(): void;
     /**
      * Populate the cache using `fetcher` if stale, coalescing concurrent callers
      * so only one request hits the upstream API per stale window. Callers that

package/dist/model-cache.js

@@ -10,16 +10,36 @@ export class ModelCache {
     static instance;
     models = {};
     fetchedAt = 0;
+    /**
+     * Separate from `fetchedAt`: set whenever we successfully CALL the
+     * fetcher (even if the response happens to be empty). Used by
+     * `isValid()` so a successful-but-empty fetch still counts as "fresh"
+     * and we don't hot-loop re-fetching the upstream.
+     */
+    populatedAt = 0;
     inflight = null;
     static getInstance() {
         return (ModelCache.instance ??= new ModelCache());
     }
     isValid() {
-        return Object.keys(this.models).length > 0 && Date.now() - this.fetchedAt < getCacheTtlMs();
+        const fresh = Date.now() - this.populatedAt < getCacheTtlMs();
+        return this.populatedAt > 0 && fresh;
     }
     setModels(models) {
         this.models = Object.fromEntries(models.map((m) => [m.id, m]));
         this.fetchedAt = Date.now();
+        this.populatedAt = this.fetchedAt;
+    }
+    /**
+     * Force the cache back into an uninitialized state. Used by tests that
+     * need to assert `ensureFresh()` actually calls the fetcher. Also useful
+     * for ops (`health_check --reset`) if we ever expose such a knob.
+     */
+    reset() {
+        this.models = {};
+        this.fetchedAt = 0;
+        this.populatedAt = 0;
+        this.inflight = null;
     }
     /**
      * Populate the cache using `fetcher` if stale, coalescing concurrent callers

package/dist/tool-handlers/health-check.js

@@ -20,7 +20,10 @@ export async function handleHealthCheck(_request, apiClient, modelCache) {
         errorMessage = err instanceof Error ? err.message : String(err);
     }
     const modelsCached = modelCache.isValid() ? modelCache.size() : 0;
-    const ok = apiKeyValid && modelsCached > 0;
+    // `ok` means the API was reachable and the key was accepted. An empty
+    // catalog counts as success (the API just returned no models) — callers
+    // branch on `models_cached` if they care about the count.
+    const ok = apiKeyValid;
     return buildStructuredResult({
         ok,
         server_version: SERVER_VERSION,

package/dist/tool-handlers/openrouter-errors.d.ts

@@ -14,5 +14,9 @@ import { type ToolErrorResult } from '../errors.js';
  *   2. Message heuristics for common OpenRouter strings (credits, ZDR,
  *      "model does not exist", content policy, etc.).
  *   3. Default to INTERNAL to avoid leaking raw shapes.
+ *
+ * When the error carries a `Retry-After` header (on 429 / 503) we populate
+ * `_meta.retry_after_seconds` so agents can back off intelligently. We
+ * also attach canonical `suggestions[]` for common cases.
  */
-export declare function classifyUpstreamError(err: unknown, _contextMessage?: string): ToolErrorResult;
+export declare function classifyUpstreamError(err: unknown, contextMessage?: string): ToolErrorResult;

package/dist/tool-handlers/openrouter-errors.js

@@ -5,6 +5,29 @@
  * don't drift.
  */
 import { ErrorCode, toolError } from '../errors.js';
+function extractRetryAfterSeconds(err) {
+    if (typeof err !== 'object' || err === null)
+        return undefined;
+    const e = err;
+    const getHeader = (h) => {
+        if (!h)
+            return null;
+        if (typeof h === 'object' && typeof h.get === 'function') {
+            return h.get('retry-after') ?? null;
+        }
+        const rec = h;
+        return rec['retry-after'] ?? rec['Retry-After'] ?? null;
+    };
+    const raw = getHeader(e.headers) ?? getHeader(e.response?.headers);
+    if (!raw)
+        return undefined;
+    const n = Number(raw);
+    if (Number.isFinite(n) && n >= 0)
+        return n;
+    // Retry-After can also be an HTTP-date; return undefined for those (caller
+    // can still retry on its own backoff schedule).
+    return undefined;
+}
 function extractStatus(err) {
     if (typeof err !== 'object' || err === null)
         return undefined;
@@ -49,43 +72,78 @@ function extractMessage(err) {
  *   2. Message heuristics for common OpenRouter strings (credits, ZDR,
  *      "model does not exist", content policy, etc.).
  *   3. Default to INTERNAL to avoid leaking raw shapes.
+ *
+ * When the error carries a `Retry-After` header (on 429 / 503) we populate
+ * `_meta.retry_after_seconds` so agents can back off intelligently. We
+ * also attach canonical `suggestions[]` for common cases.
  */
-export function classifyUpstreamError(err, _contextMessage) {
-    const msg = extractMessage(err);
+export function classifyUpstreamError(err, contextMessage) {
+    const rawMsg = extractMessage(err);
     const status = extractStatus(err);
-    const lower = msg.toLowerCase();
-    const fullMsg = msg;
+    const lower = rawMsg.toLowerCase();
+    // Prefix every user-visible message with the handler context when the
+    // caller supplied one (e.g. `rerank`, `generate_video.submit`). Makes
+    // server-side triage possible without digging through logs.
+    const fullMsg = contextMessage ? `${contextMessage}: ${rawMsg}` : rawMsg;
+    const retryAfterSeconds = extractRetryAfterSeconds(err);
     // Explicit credit / balance signals.
     if (lower.includes('insufficient balance') ||
         lower.includes('insufficient credits') ||
         lower.includes('requires more credits') ||
         lower.includes('requires at least') ||
         status === 402) {
-        return toolError(ErrorCode.UPSTREAM_REFUSED, fullMsg, { status, reason: 'credits' });
+        return toolError(ErrorCode.UPSTREAM_REFUSED, fullMsg, { status, reason: 'credits' }, {
+            suggestions: [
+                'Top up credits at https://openrouter.ai/settings/credits',
+                'Switch to a free-tier model (append :free to the slug)',
+            ],
+        });
     }
     // Zero Data Retention.
     if (lower.includes('zdr') || lower.includes('zero data retention')) {
-        return toolError(ErrorCode.ZDR_INCOMPATIBLE, fullMsg, { status });
+        return toolError(ErrorCode.ZDR_INCOMPATIBLE, fullMsg, { status }, {
+            suggestions: [
+                'Pick a provider that supports your ZDR policy',
+                'Set provider.data_collection: "allow" to bypass the restriction',
+            ],
+        });
     }
     // Model lookup failures.
     if (lower.includes('model') &&
         (lower.includes('does not exist') || lower.includes('not found') || lower.includes('invalid model'))) {
-        return toolError(ErrorCode.MODEL_NOT_FOUND, fullMsg, { status });
+        return toolError(ErrorCode.MODEL_NOT_FOUND, fullMsg, { status }, {
+            suggestions: [
+                'Use search_models to discover valid model ids',
+                'Use validate_model to pre-flight a model id',
+            ],
+        });
     }
     // Content policy / moderation — surface as UPSTREAM_REFUSED so callers can distinguish from 5xx.
     if (lower.includes('content policy') || lower.includes('moderation') || lower.includes('refused')) {
-        return toolError(ErrorCode.UPSTREAM_REFUSED, fullMsg, { status, reason: 'policy' });
+        return toolError(ErrorCode.UPSTREAM_REFUSED, fullMsg, { status, reason: 'policy' }, {
+            suggestions: ['Rephrase the prompt', 'Try a different provider via provider.order'],
+        });
     }
     // Rate-limit specific.
     if (status === 429 || lower.includes('rate limit')) {
-        return toolError(ErrorCode.UPSTREAM_REFUSED, fullMsg, { status, reason: 'rate_limit' });
+        return toolError(ErrorCode.UPSTREAM_REFUSED, fullMsg, { status, reason: 'rate_limit' }, {
+            suggestions: [
+                retryAfterSeconds !== undefined
+                    ? `Wait ${retryAfterSeconds}s and retry`
+                    : 'Wait and retry with exponential backoff',
+                'Append :nitro to the model slug to route to a faster provider',
+            ],
+            retry_after_seconds: retryAfterSeconds,
+        });
     }
     // Timeouts (AbortError from `AbortSignal.timeout`).
     if (lower.includes('timed out') ||
         lower.includes('timeout') ||
         lower.includes('aborted') ||
         (err instanceof Error && err.name === 'AbortError')) {
-        return toolError(ErrorCode.UPSTREAM_TIMEOUT, fullMsg, { status });
+        return toolError(ErrorCode.UPSTREAM_TIMEOUT, fullMsg, { status }, {
+            suggestions: ['Retry', 'Raise max_wait_ms or max_tokens'],
+        });
     }
     // Anything in the 4xx band that isn't covered above — user supplied a bad request.
     if (typeof status === 'number' && status >= 400 && status < 500) {
@@ -93,7 +151,10 @@ export function classifyUpstreamError(err, _contextMessage) {
     }
     // 5xx / network errors.
     if (typeof status === 'number' && status >= 500) {
-        return toolError(ErrorCode.UPSTREAM_HTTP, fullMsg, { status });
+        return toolError(ErrorCode.UPSTREAM_HTTP, fullMsg, { status }, {
+            suggestions: ['Retry after a brief delay', 'Check https://status.openrouter.ai'],
+            retry_after_seconds: retryAfterSeconds,
+        });
     }
     return toolError(ErrorCode.UPSTREAM_HTTP, fullMsg);
 }

package/dist/tool-handlers.js

@@ -20,16 +20,29 @@ function wrapToolArgs(a) {
 function buildProgressHook(server, progressToken) {
     if (progressToken === undefined)
         return undefined;
+    // MCP `notifications/progress` REQUIRES `progress` to be strictly
+    // monotonically increasing within a single progressToken. OpenRouter
+    // returns `progress: 0..100` on some ticks and omits it on others, so
+    // we anchor on a per-hook attempt counter and use the upstream number
+    // only as an informational `message`. This guarantees monotonicity
+    // regardless of what the upstream does (drops, duplicates, decreases).
+    //
+    // See MCP spec 2025-06-18 utilities/progress §Behavior Requirements:
+    // "The progress value MUST increase with each notification, even if
+    // the total is unknown."
+    let lastSent = -1;
     return ({ status, progress, attempt, video_id }) => {
+        // Always monotonic: at least attempt+1 (so initial attempt=0 → 0 stays
+        // reserved for the 'submitted' ping). If upstream has a real numeric
+        // progress that's higher than our counter, adopt that.
+        const candidate = typeof progress === 'number' ? Math.max(attempt, progress) : attempt;
+        const next = Math.max(lastSent + 1, candidate);
+        lastSent = next;
         void server.notification({
             method: 'notifications/progress',
             params: {
                 progressToken,
-                // Progress MUST increase per the MCP spec. We use attempt as a
-                // monotonic counter when the upstream doesn't return a numeric
-                // progress value.
-                progress: typeof progress === 'number' ? progress : attempt,
-                ...(typeof progress === 'number' ? { total: 100 } : {}),
+                progress: next,
                 message: `video ${video_id} — ${status}${typeof progress === 'number' ? ` (${progress}%)` : ''}`,
             },
         });
@@ -119,23 +132,28 @@ const TOOL_DESCRIPTIONS = {
         '- UNSAFE_PATH: save_path or reference image paths escaped the sandbox\n' +
         '- UPSTREAM_REFUSED: content policy, credits, or bad request\n' +
         '- JOB_FAILED: provider marked the job as failed\n' +
-        '- JOB_STILL_RUNNING: exceeded max_wait_ms (response carries the video_id to resume)\n' +
         '- UNSUPPORTED_FORMAT: reference/frame image could not be decoded\n\n' +
+        'Returns successfully with `_meta.code: JOB_STILL_RUNNING` (NOT an error) when the timeout ' +
+        'elapses — the response carries `_meta.video_id` so callers can resume via get_video_status.\n\n' +
         'Works with: get_video_status (resume timed-out jobs), generate_video_from_image (narrower image-to-video variant).',
     generate_video_from_image: 'Narrower convenience wrapper around generate_video for image-to-video workflows. Takes a single ' +
         '`image` argument (used as the first frame) and `prompt`. Per arxiv 2511.03497, narrower tools with ' +
-        'fewer parameters improve tool-call hit rate.\n\n' +
+        'fewer parameters improve tool-call hit rate. For last-frame conditioning or reference images, use ' +
+        'generate_video directly.\n\n' +
         'Fails when:\n' +
         '- INVALID_INPUT: image or prompt missing\n' +
         '- UNSAFE_PATH: image path escaped the sandbox\n' +
-        '- UPSTREAM_REFUSED / JOB_FAILED / JOB_STILL_RUNNING: same as generate_video\n\n' +
+        '- UPSTREAM_REFUSED / JOB_FAILED: same as generate_video\n\n' +
+        'Returns successfully with `_meta.code: JOB_STILL_RUNNING` on timeout (resumable via ' +
+        'get_video_status).\n\n' +
         'Works with: generate_video (full parameter surface), get_video_status.',
     get_video_status: 'Poll an async video-generation job by id. Downloads the result when complete (and saves if save_path given).\n\n' +
         'Fails when:\n' +
         '- INVALID_INPUT: video_id missing\n' +
         '- UNSAFE_PATH: save_path escaped the sandbox\n' +
-        '- JOB_FAILED: provider marked the job as failed\n' +
-        '- JOB_STILL_RUNNING: job not yet complete (carries `_meta.last_status` + `progress`)\n\n' +
+        '- JOB_FAILED: provider marked the job as failed\n\n' +
+        'Returns successfully with `_meta.code: JOB_STILL_RUNNING` (NOT an error) when the job is still ' +
+        'in flight — response carries `_meta.last_status` and `_meta.progress` so callers can retry later.\n\n' +
         'Works with: generate_video, generate_video_from_image.',
     rerank_documents: 'Re-order a list of documents by relevance to a query using an OpenRouter reranker. Default model: ' +
         'cohere/rerank-english-v3.0.\n\n' +

package/dist/version.d.ts

@@ -6,7 +6,7 @@
  * Bumped in lockstep with package.json / server.json / smithery.yaml /
  * scripts/build-manifest.mjs during release prep.
  */
-export declare const SERVER_VERSION = "4.5.0";
+export declare const SERVER_VERSION = "4.5.1";
 /**
  * MCP protocol version our SDK speaks. Hardcoded to match the version
  * bundled with `@modelcontextprotocol/sdk`; update when upgrading the

package/dist/version.js

@@ -6,7 +6,7 @@
  * Bumped in lockstep with package.json / server.json / smithery.yaml /
  * scripts/build-manifest.mjs during release prep.
  */
-export const SERVER_VERSION = '4.5.0';
+export const SERVER_VERSION = '4.5.1';
 /**
  * MCP protocol version our SDK speaks. Hardcoded to match the version
  * bundled with `@modelcontextprotocol/sdk`; update when upgrading the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stabgan/openrouter-mcp-multimodal",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "mcpName": "io.github.stabgan/openrouter-multimodal",
   "description": "MCP server for OpenRouter with text chat, image analysis + generation, audio analysis + generation, video analysis, and video generation (Veo 3.1 / Sora 2 Pro / Seedance / Wan)",
   "type": "module",