bykaranteli-mcp 0.36.1 → 0.36.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/dist/index.js +5 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,16 @@
|
|
|
2
2
|
|
|
3
3
|
Notable changes to the `bykaranteli-mcp` package. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Dates are UTC and come from the git tag of each release (the version commit where no tag exists). The tool count is the number of tools the server registers in that release.
|
|
4
4
|
|
|
5
|
+
## [0.36.2] - 2026-10-23
|
|
6
|
+
|
|
7
|
+
68 tools.
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
|
|
11
|
+
- `@modelcontextprotocol/sdk` floor raised from `^1.12.0` to `^1.32.1`: the SDK's October 2026 advisories (OAuth client redirect handling, experimental task sessions, the DoS through deeply nested tool arguments, GHSA-46jr) are fixed from 1.32.0, and an install of this package now resolves at least that version.
|
|
12
|
+
- The stdio server sets `maxToolInputElements` to 2,000 (an SDK 1.32 option): a `tools/call` whose arguments carry more than two thousand array elements and object members combined is answered `-32602` before validation. The largest real input, an alert recipe, is a few dozen members. The hosted endpoint on bykaranteli.com applies the same ceiling.
|
|
13
|
+
- Tool input errors read as `<message> at <path>` lines (SDK 1.32 formats Zod issues this way, one per line) instead of the earlier raw issue dump; a `tools/call` without an `arguments` member is validated as `{}` (so a tool whose inputs are all optional answers instead of refusing).
|
|
14
|
+
|
|
5
15
|
## [0.36.1] - 2026-10-21
|
|
6
16
|
|
|
7
17
|
68 tools.
|
package/dist/index.js
CHANGED
|
@@ -15,10 +15,14 @@ import { registerByKaranteliTools } from "./tools.js";
|
|
|
15
15
|
// and sits one level above both src/ and dist/.
|
|
16
16
|
const { version: VERSION } = createRequire(import.meta.url)("../package.json");
|
|
17
17
|
const BASE_URL = (process.env.BYKARANTELI_BASE_URL ?? "https://bykaranteli.com").replace(/\/+$/, "");
|
|
18
|
+
/* GHSA-46jr (SDK 1.32.0): the combined number of array elements and object members one tools/call `arguments`
|
|
19
|
+
* payload may carry; above it the SDK answers -32602 before validation. The largest real input is an alert recipe
|
|
20
|
+
* (a few dozen members); the hosted endpoint sets the same ceiling. */
|
|
21
|
+
const MAX_TOOL_INPUT_ELEMENTS = 2_000;
|
|
18
22
|
const server = new McpServer({
|
|
19
23
|
name: "bykaranteli",
|
|
20
24
|
version: VERSION,
|
|
21
|
-
});
|
|
25
|
+
}, { maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS });
|
|
22
26
|
registerByKaranteliTools(server, { version: VERSION });
|
|
23
27
|
async function main() {
|
|
24
28
|
// If the host dies while a response is in flight, exit quietly instead of
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "bykaranteli-mcp",
|
|
3
|
-
"version": "0.36.
|
|
3
|
+
"version": "0.36.2",
|
|
4
4
|
"description": "MCP server for live crypto derivatives data from bykaranteli.com: funding rates, funding arbitrage, open interest pressure, liquidations, options, ETF flows, Fear & Greed and BTC dominance. 68 read-only and account tools (the alert and watchlist tools act on your own account), free account key, paid depth via plans or x402.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -47,7 +47,7 @@
|
|
|
47
47
|
"url": "https://github.com/bykarantelicom/bykaranteli-mcp/issues"
|
|
48
48
|
},
|
|
49
49
|
"dependencies": {
|
|
50
|
-
"@modelcontextprotocol/sdk": "^1.
|
|
50
|
+
"@modelcontextprotocol/sdk": "^1.32.1",
|
|
51
51
|
"zod": "^4.3.6"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|