kitsune-mcp 0.12.0 → 0.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +8 -9
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -17,17 +17,16 @@
17
17
 
18
18
  ---
19
19
 
20
- ## What's new in v0.9.0
20
+ ## What's new in v0.12.0
21
21
 
22
- Friction-reduction release focused on first-run onboarding, credential visibility, and agent workflows.
22
+ Security, reliability, and quality-of-life release.
23
23
 
24
- - **`search()` shows credential status per result** — `✅ ready` or `✗ needs BRAVE_API_KEY` inline, so you know before you shapeshift
25
- - **`shapeshift(server_id, source="local", confirm=True)`** — force a local `npx`/`uvx` install without a Smithery key; `source="smithery"` forces HTTP; `source="official"` requires a verified registry listing
26
- - **`shiftback(uninstall=True)`** — optionally removes the locally installed package (uvx fully removed via `uv tool uninstall`; npx cache clears automatically)
27
- - **`KITSUNE_TRUST=community`** env var — skip the `confirm=True` gate permanently for trusted users and agents; set once via `key("KITSUNE_TRUST", "community")`
28
- - **First-run onboarding in `status()`** — clean sessions now show a 5-step getting-started guide with an example flow
29
- - **Lean-mounting hint** — after a heavy `shapeshift()` the output suggests `tools=[...]` with a concrete tool name and token cost
30
- - **Registry failure reporting** — `search()` now shows `⚠️ Skipped: <name> (timeout)` when one registry is slow, so you know results are partial instead of silently incomplete
24
+ - **SSRF protection** — `fetch()` and `craft()` now block requests to private/loopback addresses (127.x, 10.x, 192.168.x, 169.254.x, localhost), consistent with `skill()`. Set `KITSUNE_ALLOW_LOCAL_FETCH=1` to allow local URLs in dev environments.
25
+ - **Parameter aliasing** — `from_timezone` is automatically remapped to `source_timezone`, `to` to `target`, `src`/`dst`/`dest` to `source`/`target`, and language variants. Works transparently for any server with non-intuitive param names (e.g. `mcp-server-time`). Closes #9.
26
+ - **Session persistence** — `crafted_tools` and named `connect()` sessions survive server restarts. State is written to `~/.kitsune/state.json` on exit and restored on startup. Crafted tools are re-registered automatically.
27
+ - **Registration failures surface** — if `mcp.add_tool()` throws during `shapeshift()`, the error is now shown inline (`⚠️ N tool(s) failed to register`) instead of being silently swallowed.
28
+ - **`auto()` prefers free stdio over Smithery HTTP** — `mcp-server-time` (official, local, free) beats a Smithery HTTP equivalent when both match a query.
29
+ - **MCP Registry backfill** — all versions back to v0.9.0 are now listed in the MCP Registry (previously silently failing due to an OIDC change in the publisher tool).
31
30
 
32
31
  See [CHANGELOG.md](CHANGELOG.md) for the full list plus internal refactors and bug fixes.
33
32
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "kitsune-mcp",
3
- "version": "0.12.0",
3
+ "version": "0.14.0",
4
4
  "description": "The shape-shifting MCP hub — shapeshift() into 10,000+ MCP servers at runtime. One entry point, no restarts, 7 registries.",
5
5
  "mcpName": "io.github.kaiser-data/kitsune-mcp",
6
6
  "bin": {