@vectros-ai/mcp-server 0.6.0 → 0.9.0

package/CHANGELOG.md

@@ -3,6 +3,85 @@
 All notable changes to `@vectros-ai/mcp-server` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org).
 
+## 0.9.0
+
+### Added
+
+- **Ownership scopes on writes.** `record_create`, `document_ingest`, and `folder_create`
+  accept a `scopes` array of `namespace:value` entries (at most 2 — e.g.
+  `["org:<uuid>", "group:eng-team"]`), declaring the item's complete scope ownership
+  from the credential's own identity. An empty array (`[]`) creates a **private**,
+  user-owned item — the building block for per-user agent memory alongside shared
+  team content. Omit the field to keep today's behavior (the credential's full
+  identity is stamped).
+- **`scope` filter on reads and retrieval.** `record_query` and `document_query`
+  (list mode), `hybrid_search`, and `rag_ask` retrieval accept a `scope` filter in the
+  same `namespace:value` form, confining results — or a grounded answer's corpus — to
+  one scope. `scope=org:<id>` / `scope=client:<id>` are equivalent to the existing
+  `orgId`/`clientId` filters.
+
+## 0.8.1 — 2026-07-10
+
+### Changed
+
+- **Dependency maintenance** — repinned the bundled `@vectros-ai/sdk` to `0.34.0`
+  (additive `scopes` read-back on record/document/folder responses, plus webhooks).
+  The server bundles the SDK into its published output, so this is a rebuild against
+  the current SDK; no tool behavior changes.
+
+## 0.8.0 — 2026-07-10
+
+Larger result limits and real pagination across every enumeration tool — no tool
+forces you to accept a hard ceiling you can't get past.
+
+### Changed
+
+- **Higher `limit` ceilings, up to each API's max.** Every enumeration tool keeps a low
+  default (context protection) but now lets you raise `limit` in a single call when you
+  can accept the larger payload: `record_query` and `document_query` max **10 → 100**;
+  `hybrid_search` max **10 → 50**; `rag_ask`'s grounding-corpus limit max **10 → 50**;
+  `lookup_principal` max **50 → 100**; `folder_query` max **50 → 100**. Heavy
+  passages/payloads already auto-truncate, so a high limit is safe.
+- **Pagination on every enumeration tool, with an explicit "more remains" signal.**
+  - `record_query`, `document_query`, and `lookup_principal` now return a
+    `{ data, nextCursor }` page and accept a `startFrom` cursor. **This is a shape change**
+    — these tools previously returned a bare array. A non-null `nextCursor` means more
+    results remain; pass it back as `startFrom` to page. (This matches `folder_query` and
+    `version_history`, which already worked this way.)
+  - `hybrid_search` keeps `offset` pagination and now adds an explicit `hasMore` flag
+    (derived from `totalResults`) so you know when results remain past the current page.
+- **Tool descriptions refreshed** to state the real max, that raising it is the agent's
+  context-cost call, and how to page.
+
+## 0.7.1 — 2026-07-09
+
+### Changed
+
+- **`rag_ask` model examples updated.** The `model` parameter description now lists
+  `claude-sonnet-5`; the earlier `claude-sonnet-4-6` alias has been retired. Call
+  `GET /v1/models` for the current inference catalog your key can reach.
+
+## 0.7.0 — 2026-07-05
+
+Text-retention control that works, and tool descriptions that tell the truth
+about it.
+
+### Added
+
+- **`storeText` works in file mode on `document_ingest`.** The flag was advertised but silently
+  dropped on file uploads; it now forwards your retention choice. Default `true` keeps the
+  extracted text available to `document_get(includeText: true)` and `document_ask`; `false`
+  discards it once indexing completes (search and the original-file download keep working).
+  Fixed at ingest — a re-ingest of the same document keeps the original choice.
+
+### Changed
+
+- **`document_update` no longer accepts `storeText`** — retention is immutable after ingest, so
+  the input was misleading (the server now rejects such updates).
+- `document_ingest`, `document_get`, and `document_update` descriptions rewritten to the real
+  retention semantics: text-mode bodies are always retained; text availability on
+  `document_get` reflects whether the text actually exists.
+
 ## 0.6.0 — 2026-07-03
 
 Curation-focused tool improvements: look records and documents up by your own

package/README.md

@@ -376,6 +376,13 @@ registry.
 self-contained and works without `.npmrc` config on the consumer's
 machine.
 
+## Security & trust
+
+Vectros enforces per-customer, fail-closed isolation and least-privilege scoped keys, with a
+tamper-evident audit and version history. Customer-facing surfaces are hardened through extensive
+adversarial security review. For the full trust posture, drawn plainly with its boundaries, see the
+[compliance and trust guide](https://docs.vectros.ai/guides/operations-trust/compliance).
+
 ## License
 
 Apache-2.0. See the LICENSE file.