@wrongstack/mcp 1.0.4 → 1.0.5

package/dist/index.js

@@ -5128,13 +5128,17 @@ var MCPServer = class {
    * tools are written against the schema they declared.
    *
    * SCOPE: `validateAgainstSchema` is the shared validator that also gates the
-   * agent's own tool executor. It checks `type`, `enum`, and `required`, and
-   * recurses through `properties`/`items` — it does NOT check
-   * `additionalProperties: false`, numeric bounds, or string lengths. So those
-   * keywords stay advisory here. Teaching the shared validator about them
-   * would change what the agent accepts on every tool call in the product,
-   * which is a deliberate decision that does not belong inside a transport
-   * fix; it is tracked separately.
+   * agent's own tool executor. It checks `type`, `enum`, `required`, recurses
+   * through `properties`/`items`, enforces numeric bounds
+   * (`minimum`/`maximum`), rejects unknown keys on strict-closed objects
+   * (`additionalProperties: false`), validates the `additionalProperties`
+   * subschema form against unknown-key values, applies `patternProperties`
+   * to matching keys, enforces string lengths (`minLength`/`maxLength`) and
+   * `pattern`, array lengths (`minItems`/`maxItems`/`uniqueItems`), and the
+   * combinators `allOf`/`anyOf`/`oneOf` (all landed 2026-09-11). Still
+   * advisory per the 2026-09-11 usage survey: `const` and `$ref` — declared
+   * only in the techstack rulebook, which validates with its own
+   * `validateRulebook`, not this validator.
    *
    * Unknown tool names are left alone — the host owns that error, and
    * answering "no such tool" here would fork the message for no benefit.

package/dist/server.d.ts

@@ -93,13 +93,17 @@ export declare class MCPServer {
      * tools are written against the schema they declared.
      *
      * SCOPE: `validateAgainstSchema` is the shared validator that also gates the
-     * agent's own tool executor. It checks `type`, `enum`, and `required`, and
-     * recurses through `properties`/`items` — it does NOT check
-     * `additionalProperties: false`, numeric bounds, or string lengths. So those
-     * keywords stay advisory here. Teaching the shared validator about them
-     * would change what the agent accepts on every tool call in the product,
-     * which is a deliberate decision that does not belong inside a transport
-     * fix; it is tracked separately.
+     * agent's own tool executor. It checks `type`, `enum`, `required`, recurses
+     * through `properties`/`items`, enforces numeric bounds
+     * (`minimum`/`maximum`), rejects unknown keys on strict-closed objects
+     * (`additionalProperties: false`), validates the `additionalProperties`
+     * subschema form against unknown-key values, applies `patternProperties`
+     * to matching keys, enforces string lengths (`minLength`/`maxLength`) and
+     * `pattern`, array lengths (`minItems`/`maxItems`/`uniqueItems`), and the
+     * combinators `allOf`/`anyOf`/`oneOf` (all landed 2026-09-11). Still
+     * advisory per the 2026-09-11 usage survey: `const` and `$ref` — declared
+     * only in the techstack rulebook, which validates with its own
+     * `validateRulebook`, not this validator.
      *
      * Unknown tool names are left alone — the host owns that error, and
      * answering "no such tool" here would fork the message for no benefit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/mcp",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "license": "MIT",
   "description": "WrongStack Model Context Protocol client and registry: stdio, SSE, and streamable HTTP transports.",
   "repository": {
@@ -26,7 +26,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.4",
+    "@wrongstack/core": "1.0.5",
     "undici": "^8.10.0"
   },
   "devDependencies": {