bykaranteli-mcp 0.36.2 → 1.0.1

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 Notable changes to the `bykaranteli-mcp` package. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Dates are UTC and come from the git tag of each release (the version commit where no tag exists). The tool count is the number of tools the server registers in that release.
 
+## [1.0.1] - 2026-10-23
+
+68 tools.
+
+### Changed
+
+- The stderr line for a frame the server could not use collapses whitespace before it is cut to 300 characters (a validation issue list spanned nineteen short lines; security review of the 1.0.0 release).
+- `serveStdio` is called with `legacy: "serve"` spelled out (the SDK's default), so a later change of that default cannot drop the 2025-era clients unnoticed (independent review of the 1.0.0 release).
+
+## [1.0.0] - 2026-10-23
+
+68 tools.
+
+### Changed
+
+- The server moved from the maintenance line of the MCP TypeScript SDK (`@modelcontextprotocol/sdk` 1.32) to its stable line, `@modelcontextprotocol/server` 2.3, which implements the 2026-07-28 revision of the protocol. The tools, their names, descriptions, inputs and answers are unchanged.
+- Both protocol eras are served: a client that opens with the 2025-era `initialize` handshake (every client released before the 2026-07-28 revision) is served exactly as 0.36 served it, on the revision it negotiates; a client that opens with a 2026-07-28 per-request envelope (`server/discover` first) is served on that revision, with `resultType`, the cache fields on the cacheable results and the server identity in `_meta`. The era is decided by the opening exchange and pinned for the connection.
+- Node.js 20 or newer is required (the SDK's floor; the 0.x releases ran on 18).
+- Tool input errors no longer carry the `MCP error -32602:` prefix the 1.x SDK added to the text: a tool error now starts with `Input validation error: Invalid arguments for tool <name>: ...`, and the 2,000-element ceiling reads `Invalid arguments for tool <name>: arguments contain more than the maximum of 2000 elements`. A call to a tool name the server does not have is a JSON-RPC error (`-32602`, `Tool <name> not found`) instead of a tool error result.
+- Advertised input schemas carry `$schema` (JSON Schema 2020-12) and no longer carry `additionalProperties: false` (the SDK's conversion); the properties, types, enums and descriptions are unchanged.
+- The README's OAuth paragraph names client metadata documents, which the hosted endpoint's authorization server accepts from this release's web deployment on.
+
 ## [0.36.2] - 2026-10-23
 
 68 tools.

package/README.md

@@ -20,9 +20,11 @@ listing the tools work without one. The key travels one of three ways:
 
 Or sign in with OAuth 2.1 where the client offers it (claude.ai custom
 connectors: Authentication, Sign in; ChatGPT connectors: OAuth): the client
-registers itself (RFC 7591, PKCE S256), you approve it once on bykaranteli.com
-and it runs on a key of your own account, which the Data and API page lists
-under connected apps. Discovery:
+identifies itself with its client metadata document (an https client id the
+authorization server reads, the way the 2026-07-28 MCP revision prefers) or
+registers itself (RFC 7591), always with PKCE S256; you approve it once on
+bykaranteli.com and it runs on a key of your own account, which the Data and
+API page lists under connected apps. Discovery:
 <https://mcp.bykaranteli.com/.well-known/oauth-protected-resource>.
 
 A free account covers the API and the hosted MCP on one monthly counter;
@@ -58,7 +60,7 @@ Add to `claude_desktop_config.json`:
 
 Any stdio MCP client works: command `npx`, args `["-y", "bykaranteli-mcp"]`, env `BYKARANTELI_API_KEY`.
 
-Requires Node.js 18 or newer.
+Requires Node.js 20 or newer (1.0.0; the 0.x releases ran on 18). The server speaks both the 2026-07-28 revision of the protocol and the 2025-era `initialize` handshake, so every MCP client released so far connects unchanged.
 
 ## Tools
 

package/dist/index.js

@@ -8,23 +8,28 @@
  * generated-at timestamp; quote it when citing values.
  */
 import { createRequire } from "node:module";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { McpServer } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { registerByKaranteliTools } from "./tools.js";
 // Single source of truth for the version: package.json ships in the tarball
 // and sits one level above both src/ and dist/.
 const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 const BASE_URL = (process.env.BYKARANTELI_BASE_URL ?? "https://bykaranteli.com").replace(/\/+$/, "");
-/* GHSA-46jr (SDK 1.32.0): the combined number of array elements and object members one tools/call `arguments`
- * payload may carry; above it the SDK answers -32602 before validation. The largest real input is an alert recipe
- * (a few dozen members); the hosted endpoint sets the same ceiling. */
+/* GHSA-46jr (SDK 1.32.0, kept on 2.x): the combined number of array elements and object members one tools/call
+ * `arguments` payload may carry; above it the server answers a tool error (isError) before validation. The largest
+ * real input is an alert recipe (a few dozen members); the hosted endpoint sets the same ceiling. */
 const MAX_TOOL_INPUT_ELEMENTS = 2_000;
-const server = new McpServer({
-    name: "bykaranteli",
-    version: VERSION,
-}, { maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS });
-registerByKaranteliTools(server, { version: VERSION });
-async function main() {
+/* One server per connection (1.0.0, SDK 2.x). serveStdio owns the era decision: a client that opens with the
+ * 2025-era `initialize` handshake (every client released before the 2026-07-28 revision) is served exactly as the
+ * 0.x releases served it; a client that opens with a 2026-07-28 per-request envelope (`server/discover` is the
+ * modern probe) is served on that revision, with the same tools. The factory is called once per connection, plus
+ * once for a discarded probe instance, so it registers the tools afresh each time. */
+function buildServer() {
+    const server = new McpServer({ name: "bykaranteli", version: VERSION }, { maxToolInputElements: MAX_TOOL_INPUT_ELEMENTS });
+    registerByKaranteliTools(server, { version: VERSION });
+    return server;
+}
+function main() {
     // If the host dies while a response is in flight, exit quietly instead of
     // crashing with an unhandled EPIPE from the stdout pipe. Non-EPIPE stream
     // errors would be swallowed once a listener exists, so log and exit nonzero.
@@ -34,12 +39,19 @@ async function main() {
         console.error("bykaranteli-mcp stdout error:", err);
         process.exit(1);
     });
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
-    // stdout is the JSON-RPC channel; log to stderr only.
+    // stdout is the JSON-RPC channel; log to stderr only. Out-of-band protocol errors (a frame the server could not
+    // use) are reported there too, cut short: the SDK builds some messages from the client's own frame.
+    serveStdio(buildServer, {
+        // The SDK's default, named so a later default change cannot silently drop the 2025-era clients.
+        legacy: "serve",
+        onerror: (err) => console.error(`bykaranteli-mcp: ${String(err.message ?? err).replace(/\s+/g, " ").slice(0, 300)}`),
+    });
     console.error(`bykaranteli-mcp ready (base: ${BASE_URL})`);
 }
-main().catch((err) => {
+try {
+    main();
+}
+catch (err) {
     console.error("bykaranteli-mcp fatal:", err);
     process.exit(1);
-});
+}

package/dist/tools.d.ts

@@ -4,7 +4,7 @@
  * bykaranteli.com both call registerByKaranteliTools on their own server
  * instance, so every tool has exactly one definition.
  */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { McpServer } from "@modelcontextprotocol/server";
 export type RegisterOptions = {
     /** Override the API origin used for OUTBOUND fetches (the hosted endpoint
      * points this at the container-internal origin). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bykaranteli-mcp",
-  "version": "0.36.2",
+  "version": "1.0.1",
   "description": "MCP server for live crypto derivatives data from bykaranteli.com: funding rates, funding arbitrage, open interest pressure, liquidations, options, ETF flows, Fear & Greed and BTC dominance. 68 read-only and account tools (the alert and watchlist tools act on your own account), free account key, paid depth via plans or x402.",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "prepare": "npm run build"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "keywords": [
     "mcp",
@@ -47,7 +47,7 @@
     "url": "https://github.com/bykarantelicom/bykaranteli-mcp/issues"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@modelcontextprotocol/server": "^2.3.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {