portkey-admin-mcp 0.14.0 → 0.15.0

package/COMPATIBILITY.md

@@ -0,0 +1,95 @@
+# Compatibility and deprecations
+
+Last reviewed: 2026-10-25. Package versions, SDK versions, and negotiated MCP
+protocol revisions are separate compatibility boundaries.
+
+## Release lines
+
+| Package release | MCP SDK | MCP protocol | Support and behavior |
+| --- | --- | --- | --- |
+| 0.15.0 | server/client 2.3.1, Node adapter 2.1.1 (exact pins) | Native `2026-07-28` plus older clients on the same endpoint | Current release, 194 tools across 22 domains, Node.js 24+. HTTP session and replay stores are retired; obsolete settings warn and are ignored. First warnings and ignored settings start in 0.15.0; session/replay behavior is removed in that release. |
+| 0.14.1 | v1; dependency floor 1.32.1 | Latest supported revision: `2025-11-25` | Previous line, 194 tools across 22 domains, Node.js 24+. Stateful HTTP sessions and optional replay stores remain active. |
+| 0.13.0 | v1; dependency floor 1.31.0 | Latest supported revision: `2025-11-25` | Historical release, 184 tools across 20 domains. Upgrade to the latest minor for security fixes. |
+
+The 0.14.x SDK supports `2025-11-25`, `2025-06-18`, `2025-03-26`,
+`2024-11-05`, and `2024-10-07`. A newer client that negotiates an older
+revision can use this server; that fallback does not mean the server natively
+supports `2026-07-28`. Release tests cover modern auto/pinned clients and default legacy clients over HTTP and stdio. Client products, deployed proxies and marketplace acceptance still need release validation.
+
+[SECURITY.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md) owns the security-support policy: fixes ship on the
+latest published minor line; older minor lines do not receive backports.
+See [CHANGELOG.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CHANGELOG.md) for changes in each published release.
+
+## Configuration lifecycle
+
+No deprecation warnings or removals for the settings below shipped in 0.14.x.
+As of 0.15.0, the listed settings warn and are ignored, and the underlying
+session/replay behavior is removed. There was no intermediate warning-only
+release. Obsolete names remain recognized for warnings; this does not retain
+their former functionality. 0.14.x is the previous line and is unchanged.
+
+| Setting or behavior | 0.14.x | 0.15.0 behavior | First warning / ignored / removal release |
+| --- | --- | --- | --- |
+| `MCP_SESSION_MODE`, `MCP_SESSION_TIMEOUT` | Active; stateful mode is the default | Ignored with a warning; older clients use stateless requests | 0.15.0 / 0.15.0 / 0.15.0 |
+| `MCP_EVENT_STORE`, `MCP_EVENT_TTL_SECONDS`, `MCP_EVENT_STORE_MAX_EVENTS`, `MCP_EVENT_STORE_MAX_BYTES`, `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | Active replay configuration | Ignored with a warning; authenticated GET/DELETE return 405 (auth and Origin checks still apply first: 401 without credentials, 403 for a disallowed Origin) | 0.15.0 / 0.15.0 / 0.15.0 |
+| `MCP_EVENT_ENCRYPTION_KEY`, `MCP_REDIS_KEY_PREFIX` | Active Redis replay configuration | Ignored with a warning | 0.15.0 / 0.15.0 / 0.15.0 |
+| HTTP GET stream, `Last-Event-ID` recovery, session identifiers | Active under the configured HTTP mode | No session IDs are returned; authenticated GET/DELETE, including legacy session or `Last-Event-ID` headers, return 405. Unauthenticated requests get 401 and a disallowed Origin gets 403 | 0.15.0 / 0.15.0 / 0.15.0 |
+| `RATE_LIMIT_*` | Active rate-limit configuration | Retained, including shared Redis limiting | No removal planned |
+| `RATE_LIMIT_REDIS_URL`, `MCP_REDIS_URL`, `REDIS_URL` | Rate limiter uses these URL sources in that order; replay uses the latter two | Documented Redis connection path for rate limiting is preserved now that replay is retired | No removal assigned |
+| `MCP_MAX_SESSIONS` | Bounds stateful sessions or active stateless request handlers | Retain the stateless concurrency bound | No removal planned |
+| `MCP_TOOL_DOMAINS`, `CORS_ORIGIN` | Supported fallbacks for `PORTKEY_TOOL_DOMAINS`, `ALLOWED_ORIGINS` | No change assigned | No removal planned |
+
+Redis rate limiting and Redis replay are separate features. Retiring the replay
+store does not remove the need for a shared rate limiter in multi-instance or
+serverless deployments. Keep working settings on a 0.14.x deployment until you
+upgrade to 0.15.0.
+
+## Migration notes
+
+The migration shipped in 0.15.0, ahead of the original 2026-12-01 start-by
+date and the 2027-01-27 completion target. Those were project planning dates,
+not announced configuration-removal dates or an SDK end-of-life guarantee.
+[ROADMAP.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) tracks follow-up work.
+
+Operators upgrading from 0.14.x need an upgrade guide covering:
+
+- warning and removal behavior for every retired setting;
+- loss of session affinity, the GET stream, and `Last-Event-ID` recovery;
+- how to inspect Portkey state after an interrupted mutation before retrying,
+  since an automatic retry can repeat a successful write;
+- retained Redis rate-limit configuration and concurrency bounds; and
+- client, reverse-proxy, Vercel, and marketplace compatibility checks.
+
+The release updated this table, the README configuration reference,
+[architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md), [Vercel guide](docs/VERCEL_DEPLOYMENT.md),
+[security assurance case](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md), and changelog together.
+
+## Interrupted requests
+
+The SDK v2 server keeps older `initialize` clients working on `/mcp` without
+persistent HTTP sessions. Modern clients use `server/discover` on the same URL.
+Clients and proxies must forward `MCP-Protocol-Version`, `Mcp-Method` and, for
+named operations such as `tools/call`, `Mcp-Name`. Tool filters apply to every
+request; reuse the same `?tools=` URL throughout a client workflow.
+
+GET streams, DELETE session operations and `Last-Event-ID` replay are retired.
+A disconnected request can still have changed Portkey state even when its result
+was lost. Do not automatically replay a write:
+
+1. Save the operation name, target workspace/resource ID and intended change
+   without recording credentials or secret values.
+2. Reconnect and use the matching `get_*` or `list_*` tool, or the Portkey
+   dashboard, to inspect whether the change completed. For creates, correlate
+   the intended name/metadata and time; a missing response is not proof of failure.
+3. If the desired state already exists, continue from that resource. If failure
+   is confirmed, retry once intentionally. If the outcome is still ambiguous,
+   inspect the upstream audit/usage records or ask the tenant administrator before
+   repeating creates, completions or other operations with side effects.
+
+Reads can be requested again. Neither transport reconnect nor a successful new
+handshake proves a previous mutation failed. There is no exactly-once guarantee.
+`MCP_MAX_SESSIONS` now caps concurrent request handlers; it does not restore
+sessions or replay. Redis remains available for shared rate limiting through
+`RATE_LIMIT_REDIS_URL`, `MCP_REDIS_URL`, then `REDIS_URL`. No replay encryption key
+is needed. Keep deployed 0.14.x settings until upgrading; the first
+warning, ignored-setting and feature-removal release is 0.15.0.

package/ENDPOINTS.md

@@ -209,7 +209,7 @@ Routes:
 |---|---|
 | `create_prompt` | Create a new prompt template and initial version. Use this for first-time setup; use migrate_prompt for idempotent CI/CD flows. Accepts plain text or structured chat messages, creates a new version immediately, and returns the prompt id, slug, and version id. For multi-message chat prompts pass messages (preferred) or a JSON-encoded array as string. |
 | `list_prompts` | List prompts across the workspace, with optional collection, workspace, or search filters. Returns a paginated summary with id, name, slug, model, and status so you can choose a prompt_id before get_prompt, update_prompt, or render_prompt. |
-| `get_prompt` | Fetch a prompt's full definition, active version, and version history. Use this before updating, publishing, rendering, or copying a prompt when you need the stored template and metadata. For multi-message chat prompts pass messages (preferred) or a JSON-encoded array as string. |
+| `get_prompt` | Fetch a prompt's full definition, active version, and version history. Use this before updating, publishing, rendering, or copying a prompt when you need the stored template and metadata. template_format in the result shows whether the stored template is a plain string or a JSON messages array. |
 | `update_prompt` | Update an existing prompt and create a new archived version. Only provided fields change, and publish_prompt is what makes the new version active. For multi-message chat prompts pass messages (preferred) or a JSON-encoded array as string. |
 | `delete_prompt` | Delete a prompt and all its versions by id. This cannot be undone, immediately breaks callers using the slug, and should only be used after checking list_prompt_versions or confirming you do not need an audit trail. |
 | `publish_prompt` | Publish a specific version of a prompt as the active default, unlike promote_prompt which copies across environments or update_prompt which creates a new draft. This immediately routes all callers using the slug to that version and there is no rollback, so use list_prompt_versions to pick the version and update_prompt first if you need to create new content before promoting it. |
@@ -238,11 +238,11 @@ Routes:
 | `get_error_rate_analytics` | Get error-rate time-series data with summary.error_rate_percent and per-bucket percentages of total requests. Use this for reliability and SLA trends; use get_error_analytics for absolute error counts instead. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_cache_hit_latency` | Get cache-hit-only latency time-series data with summary.total_latency, summary.avg_latency, and per-bucket total/avg latency. Use this to evaluate cached-response speed; use get_latency_analytics for all requests. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_cache_hit_rate` | Get cache-effectiveness time-series data with summary.hit_rate, summary.total_hits, summary.total_misses, and per-bucket hits/misses/rate. Use this to measure cache effectiveness; use get_cache_hit_latency for speed rather than hit/miss ratio. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
-| `get_cache_summary` | Enterprise-gated. Get cache summary metrics for one workspace and time range: hits, average cache-hit latency, total requests, and percentage speedup. Use the graph cache tools when you need changes over time instead of one aggregate. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
+| `get_cache_summary` | Enterprise-gated. Get cache summary metrics for a workspace or organisation and time range: hits, average cache-hit latency, total requests, and percentage speedup. Choose workspace_slug, include_all_workspaces=true, or exclude_workspace_slugs. Use the graph cache tools when you need changes over time instead of one aggregate. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_users_analytics` | Get user-growth time-series data with summary.total_active_users, summary.total_new_users, and per-bucket active/new user counts. Use this for growth and adoption trends; use get_user_requests_analytics for per-user traffic or get_analytics_group_users for per-user cost and token detail. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_users` | Get a paginated per-user breakdown with total_groups, group_count, and a users array containing request count, cost, and token usage. Use this for billing, audits, or top-consumer analysis; use get_users_analytics for aggregate active and new user trends. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_models` | Get a paginated per-model breakdown with total_groups, group_count, and a models array containing request count, cost, and token usage. Use this to compare model cost, popularity, and efficiency; use get_token_analytics or get_cost_analytics for time-series trends instead. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
-| `get_analytics_group_providers` | Enterprise-gated. Get provider-grouped analytics for one workspace and time range with selectable metrics, ordering, pagination, and optional total count. Use this when comparing provider traffic or reliability; requested metric fields are preserved in each provider row. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
+| `get_analytics_group_providers` | Enterprise-gated. Get provider-grouped analytics for one workspace or organisation-wide and a time range with selectable metrics, ordering, pagination, and optional total count. Choose workspace_slug, include_all_workspaces=true, or exclude_workspace_slugs. Use this when comparing provider traffic or reliability; requested metric fields are preserved in each provider row. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_metadata` | Get a paginated metadata breakdown with total_groups, group_count, and a metadata_groups array grouped by the required metadata_key. Use this for custom breakdowns like per-environment or per-feature analysis; pass metadata_key in addition to the time window. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_mcp` | Get a paginated per-MCP-server breakdown with total_groups, group_count, and an mcp_servers array containing each server name and its request count. Use this to see which MCP servers receive the most traffic; use get_analytics_group_a2a for A2A agents or get_analytics_group_users and get_analytics_group_models for other breakdowns. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
 | `get_analytics_group_a2a` | Get a paginated per-agent breakdown with total_groups, group_count, and an agents array containing each A2A (agent-to-agent) agent name and its request count. Use this to see which agents receive the most traffic; use get_analytics_group_mcp for MCP servers instead. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. |
@@ -461,7 +461,7 @@ Routes:
 | `disconnect_mcp_server_connection` | Disconnect one user's active session from a Portkey-managed MCP server. This immediately ends that connection but does not revoke future access; use update_mcp_server_user_access when access itself should be removed. Provide user_id with service keys (user keys derive it), and workspace_id with organisation admin keys. Inspect list_mcp_server_connections first when the target is uncertain. |
 | `list_mcp_servers` | List MCP servers in the organization. Returns paginated server records plus total for discovering server IDs; use get_mcp_server for one server's details and list_mcp_integrations for the parent integration. |
 | `create_mcp_server` | Create an MCP server under an existing integration. Registers the server and returns the new id and slug; use list_mcp_integrations first to find the parent integration, then capabilities or access tools to configure it. |
-| `get_mcp_server` | Retrieve one MCP server by id or slug. Returns server details including the parent integration, status, and created time; use get_mcp_server when you need the server record rather than the integration config. |
+| `get_mcp_server` | Retrieve one MCP server by id or slug. Returns server details including the parent integration, status, and created time; use get_mcp_server for the server record, and get_mcp_integration for the parent integration's URL, auth, and transport configuration. |
 | `update_mcp_server` | Update an MCP server's name or description. Changes apply immediately, but URL and auth live on the parent integration, so use update_mcp_integration for those fields. |
 | `delete_mcp_server` | Delete an MCP server instance. This is irreversible, removes connected users' access immediately, and should be used only after confirming no workflows depend on the server. |
 | `test_mcp_server` | Test connectivity to an MCP server. Sends a live check and returns success, response time, HTTP status, and any error; use this before changing configuration or when diagnosing reachability. |

package/README.md

@@ -36,27 +36,52 @@
 
 <h2 align="center">Contents</h2>
 
+- [Documentation](#documentation)
 - [Quick Start](#quick-start)
 - [What You Can Do](#what-you-can-do)
 - [API Key Scopes](#api-key-scopes)
 - [HTTP Server (Experimental)](#http-server)
-- [Architecture](./docs/ARCHITECTURE.md)
+- [Architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md)
 - [Distribution and directories](./docs/DISTRIBUTION.md)
 - [Prisma AIRS interoperability](./docs/PRISMA_AIRS_INTEROPERABILITY.md)
-- [Verify a release](./docs/VERIFY_RELEASE.md)
+- [Verify a release](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/VERIFY_RELEASE.md)
 - [Development](#development)
+- [Roadmap](#roadmap)
 - [Community](#community)
-- [Contributing](./CONTRIBUTING.md)
-- [Governance](./GOVERNANCE.md)
-- [Security assurance](./SECURITY-ASSURANCE.md)
+- [Built With](#built-with)
+- [Contributing](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CONTRIBUTING.md)
+- [Governance](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/GOVERNANCE.md)
+- [Security assurance](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md)
 - [Full tool list — ENDPOINTS.md](./ENDPOINTS.md)
 
 <hr>
 
+<h2 align="center" id="documentation">Documentation</h2>
+
+| Resource | Link |
+| --- | --- |
+| Tool reference | [ENDPOINTS.md](./ENDPOINTS.md) |
+| Compatibility and deprecations | [COMPATIBILITY.md](./COMPATIBILITY.md) |
+| Changelog | [CHANGELOG.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CHANGELOG.md) |
+| Roadmap | [ROADMAP.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) |
+| Architecture | [Architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md) |
+| Deployment | [HTTP configuration](#http-server), [Vercel guide](./docs/VERCEL_DEPLOYMENT.md) |
+| Distribution | [Directories and release records](./docs/DISTRIBUTION.md), [verify a release](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/VERIFY_RELEASE.md) |
+| Prisma AIRS | [Interoperability guide](./docs/PRISMA_AIRS_INTEROPERABILITY.md) |
+| Contributing and governance | [CONTRIBUTING.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CONTRIBUTING.md), [GOVERNANCE.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/GOVERNANCE.md), [Code of Conduct](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CODE_OF_CONDUCT.md) |
+| Security | [Reporting policy](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md), [assurance case](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md) |
+
+<hr>
+
 <h2 align="center" id="quick-start">Quick Start</h2>
 
 You need a **Portkey API key** with appropriate scopes. Get one from your [Portkey dashboard](https://app.portkey.ai/) under API Keys.
 
+Version 0.15.0 uses MCP SDK v2 and serves protocol revision `2026-07-28` and
+older clients on the same endpoint. It retires HTTP sessions and replay;
+obsolete settings warn and are ignored. See
+[compatibility and deprecations](./COMPATIBILITY.md) before upgrading from 0.14.x.
+
 ### Claude Code
 
 ```bash
@@ -150,7 +175,7 @@ Then use this config:
 | **Egress Allowlist** | 5 | Organisation trust for custom outbound hosts |
 | **Usage Limits** | 7 | Cost and token consumption limits |
 | **Rate Limits** | 5 | Request frequency controls |
-| **Analytics** | 25 | Cost, latency, errors, tokens, cache, feedback, provider, MCP, A2A, and workspace groups |
+| **Analytics** | 25 | Cost, latency, errors, tokens, cache, feedback, provider, MCP, A2A, and workspace groups; organisation scope and workspace exclusions |
 | **Logging** | 10 | Log retrieval, ingestion, export, and field restrictions |
 | **Tracing** | 2 | Feedback creation and updates on traces |
 | **Users & Workspaces** | 24 | User management, invites, workspace members, SCIM group mappings |
@@ -254,17 +279,9 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
 | `CLERK_ALLOWED_ORGANIZATION_IDS` / `CLERK_ALLOWED_ROLES` | — | Optional CSV organization and role constraints; every configured constraint must match |
 | `CLERK_REQUIRED_PERMISSIONS` | — | Optional CSV permissions that must all be present in the verified Clerk JWT |
 | `MCP_ALLOW_UNAUTHENTICATED_HTTP` | — | Set to `true` only for intentional local unauthenticated HTTP debugging |
-| `MCP_SESSION_MODE` | `stateful` | `stateful` or `stateless` |
-| `MCP_SESSION_TIMEOUT` | `3600000` | Idle timeout for stateful sessions, in milliseconds; `0` or more |
-| `MCP_MAX_SESSIONS` | `100` | Maximum concurrent stateful sessions or active stateless request handlers |
-| `MCP_EVENT_STORE` | `off` | `off`, `memory`, or `redis`; stateless `GET /mcp` replay requires `memory` or `redis` |
-| `MCP_EVENT_TTL_SECONDS` | `300` | Replay retention in seconds |
-| `MCP_EVENT_STORE_MAX_EVENTS` | `10000` | Maximum events retained by the in-memory replay store; oldest events are evicted first |
-| `MCP_EVENT_STORE_MAX_BYTES` | `67108864` | Approximate maximum serialized bytes retained by the in-memory replay store |
-| `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | `5000` | Redis command timeout for the event store, in milliseconds; `0` disables the timeout (restores unbounded pre-v6 behavior) |
-| `MCP_REDIS_URL` | — | Redis URL for shared event store; production requires `rediss://` and ACL-scoped credentials |
-| `MCP_EVENT_ENCRYPTION_KEY` | — | Required 32-byte base64 AES key for Redis replay payloads; generate with `openssl rand -base64 32` |
-| `MCP_REDIS_KEY_PREFIX` | `mcp:event-store` | Dedicated Redis namespace for replay data |
+| `MCP_MAX_SESSIONS` | `100` | Maximum concurrent HTTP MCP request handlers (retained name) |
+| `MCP_REDIS_URL` | — | Fallback Redis URL for shared rate limiting, after `RATE_LIMIT_REDIS_URL` and before `REDIS_URL`; production requires `rediss://` |
+| `MCP_SESSION_MODE`, `MCP_SESSION_TIMEOUT`, `MCP_EVENT_*`, `MCP_REDIS_KEY_PREFIX` | Ignored as of 0.15.0 | Old session/replay settings produce a warning containing names only. 0.14.x behavior is unchanged; see [compatibility](./COMPATIBILITY.md). |
 | `MCP_TLS_KEY_PATH` | — | TLS key for native HTTPS |
 | `MCP_TLS_CERT_PATH` | — | TLS cert for native HTTPS |
 | `MCP_TLS_CA_PATH` | — | Optional CA bundle for native HTTPS; only used when the TLS key and cert are set |
@@ -297,7 +314,7 @@ Production containers must choose their rate-limit topology explicitly: set
 Vercel support is kept as a reference proof of concept — we do not run a hosted deployment. See [docs/VERCEL_DEPLOYMENT.md](./docs/VERCEL_DEPLOYMENT.md) if you want to self-deploy.
 
 Key points:
-- Uses stateless request handling with encrypted, principal-bound Redis replay and a shared atomic Redis rate limiter
+- Uses stateless request handling and a shared atomic Redis rate limiter (SDK v2); GET replay is retired
 - Requires Clerk or bearer auth
 - Leave `MCP_TLS_*` unset (Vercel terminates HTTPS)
 - Set `MCP_PUBLIC_BASE_URL` to your deployment URL so advertised MCP endpoints never depend on request headers
@@ -317,10 +334,14 @@ docker run \
   -e MCP_PORT=3000 \
   -e MCP_AUTH_MODE=bearer \
   -e MCP_AUTH_TOKEN=your_secret \
+  -e RATE_LIMIT_SINGLE_PROCESS=true \
   -p 3000:3000 \
   portkey-admin-mcp
 ```
 
+This example runs one long-lived container with in-memory rate limiting. Use
+`RATE_LIMIT_STORE=redis` and a TLS Redis URL for multiple instances.
+
 </details>
 
 ### Health Endpoints
@@ -357,16 +378,32 @@ The required CI and release gates measure every TypeScript source file and fail
 below 80% line coverage. The CI and Coverage workflow reports show the current
 line, branch, and function coverage.
 
+The [CI workflow](https://github.com/CodesWhat/portkey-admin-mcp/actions/workflows/ci.yml)
+also runs the standalone Qlty CLI and publishes `quality-reports` artifacts for
+each analyzed commit, including lint/security results, duplication, complexity,
+and metrics. The existing Qlty maintainability and coverage badges remain
+Cloud-generated; local analysis does not update those badges. Coverage uploads
+and Cloud analysis still consume Qlty analysis minutes.
+
 `npm run dev:http` now requires `MCP_AUTH_MODE=bearer` or `MCP_AUTH_MODE=clerk` by default. For deliberate local-only unauthenticated testing, set `MCP_ALLOW_UNAUTHENTICATED_HTTP=true`.
 
 Contributions use pull requests and the checks documented in
-[`CONTRIBUTING.md`](CONTRIBUTING.md). Project decisions and maintainer roles are
-documented in [`GOVERNANCE.md`](GOVERNANCE.md). Report vulnerabilities through
-[`SECURITY.md`](SECURITY.md), and see [`SECURITY-ASSURANCE.md`](SECURITY-ASSURANCE.md)
+[`CONTRIBUTING.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CONTRIBUTING.md). Project decisions and maintainer roles are
+documented in [`GOVERNANCE.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/GOVERNANCE.md). Report vulnerabilities through
+[`SECURITY.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md), and see [`SECURITY-ASSURANCE.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md)
 for the public threat model and assurance case.
 
 <hr>
 
+<h2 align="center" id="roadmap">Roadmap</h2>
+
+Release 0.15.0 moves to MCP SDK v2 and the 2026-07-28 spec.
+The [roadmap](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) separates completed work from upstream contract and
+tenant-verification gates. The MCP v2 migration shipped in 0.15.0 and keeps older
+clients on the same endpoint while retiring session and replay storage. See [compatibility and deprecations](./COMPATIBILITY.md).
+
+<hr>
+
 <h2 align="center" id="community">Community</h2>
 
 Questions and bug reports belong in [Issues](https://github.com/CodesWhat/portkey-admin-mcp/issues); broader discussion, ideas, and help using the server belong in [Discussions](https://github.com/CodesWhat/portkey-admin-mcp/discussions).
@@ -379,10 +416,10 @@ tool catalog in this repository as authoritative when a third-party index lags.
 
 <div align="center">
 
-### Built With
+<h2 align="center" id="built-with">Built With</h2>
 
 [![TypeScript](https://img.shields.io/badge/TypeScript_7.0-3178C6?logo=typescript&logoColor=fff)](https://www.typescriptlang.org/)
-[![MCP SDK](https://img.shields.io/badge/MCP_SDK_1.32-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
+[![MCP SDK](https://img.shields.io/badge/MCP_SDK_2.3-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
 [![Zod 4](https://img.shields.io/badge/Zod_4-3E67B1?logo=zod&logoColor=fff)](https://zod.dev/)
 [![Biome](https://img.shields.io/badge/Biome_2.5-60a5fa?logo=biome&logoColor=fff)](https://biomejs.dev/)
 [![Node 24](https://img.shields.io/badge/Node_24-339933?logo=nodedotjs&logoColor=fff)](https://nodejs.org/)
@@ -392,6 +429,14 @@ tool catalog in this repository as authoritative when a third-party index lags.
 [![Conventional Commits](https://img.shields.io/badge/commits-conventional-fe5196?logo=conventionalcommits&logoColor=fff)](https://www.conventionalcommits.org/)
 [![Keep a Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog-E05735)](https://keepachangelog.com/)
 
+Marketplace listings on [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp) and [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp):
+
+[![LobeHub MCP](https://lobehub.com/badge/mcp/codeswhat-portkey-admin-mcp)](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp)
+
+<a href="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp"><img src="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp/badges/card.svg" alt="portkey-admin-mcp MCP server"></a>
+
+---
+
 **[MIT License](LICENSE)** · Inspired by [r-huijts/portkey-admin-mcp-server](https://github.com/r-huijts/portkey-admin-mcp-server)
 
 <a href="https://github.com/CodesWhat">
@@ -402,12 +447,6 @@ tool catalog in this repository as authoritative when a third-party index lags.
   </picture>
 </a>
 
-Marketplace listings on [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp) and [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp):
-
-[![LobeHub MCP](https://lobehub.com/badge/mcp/codeswhat-portkey-admin-mcp)](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp)
-
-<a href="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp"><img src="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp/badges/card.svg" alt="portkey-admin-mcp MCP server"></a>
-
 <a href="#portkey-admin-mcp-server">Back to top</a>
 
 </div>