portkey-admin-mcp 0.15.1 → 0.16.0

package/COMPATIBILITY.md

@@ -1,16 +1,18 @@
 # Compatibility and deprecations
 
-Last reviewed: 2026-10-25. Package versions, SDK versions, and negotiated MCP
+Last reviewed: 2026-10-30. Package versions, SDK versions, and negotiated MCP
 protocol revisions are separate compatibility boundaries.
 
 ## Release lines
 
 | Package release | MCP SDK | MCP protocol | Support and behavior |
 | --- | --- | --- | --- |
-| 0.15.1 | server/client 2.3.1, Node adapter 2.1.1 (exact pins) | Native `2026-07-28` plus older clients on the same endpoint | Current release, 194 tools across 22 domains, Node.js 24+. HTTP session and replay stores are retired; obsolete settings warn and are ignored. First warnings and ignored settings start in 0.15.0; session/replay behavior is removed in that release. |
-| 0.14.1 | v1; dependency floor 1.32.1 | Latest supported revision: `2025-11-25` | Previous line, 194 tools across 22 domains, Node.js 24+. Stateful HTTP sessions and optional replay stores remain active. |
+| 0.16.0 | server/client 2.4.0, Node adapter 2.1.2 (exact pins) | Native `2026-07-28` plus older clients on the same endpoint | Current release, 194 tools across 22 domains, Node.js 24+, also tested on Node 26, which the Docker image runs. HTTP session and replay stores are retired; obsolete settings warn and are ignored. First warnings and ignored settings start in 0.15.0; session/replay behavior is removed in that release. |
+| 0.15.2 | server/client 2.4.0, Node adapter 2.1.2 (exact pins) | Native `2026-07-28` plus older clients on the same endpoint | Previous line, 194 tools across 22 domains, Node.js 24+. HTTP session and replay stores are retired; obsolete settings warn and are ignored. First warnings and ignored settings start in 0.15.0; session/replay behavior is removed in that release. |
 | 0.13.0 | v1; dependency floor 1.31.0 | Latest supported revision: `2025-11-25` | Historical release, 184 tools across 20 domains. Upgrade to the latest minor for security fixes. |
 
+Node.js 24 is the supported floor (`engines.node` is `>=24`). The main CI checks and the release build run on Node 24. Node 26 is also tested in CI, and the Docker image runs Node 26 from 0.16.0.
+
 The 0.14.x SDK supports `2025-11-25`, `2025-06-18`, `2025-03-26`,
 `2024-11-05`, and `2024-10-07`. A newer client that negotiates an older
 revision can use this server; that fallback does not mean the server natively
@@ -26,7 +28,7 @@ No deprecation warnings or removals for the settings below shipped in 0.14.x.
 As of 0.15.0, the listed settings warn and are ignored, and the underlying
 session/replay behavior is removed. There was no intermediate warning-only
 release. Obsolete names remain recognized for warnings; this does not retain
-their former functionality. 0.14.x is the previous line and is unchanged.
+their former functionality. 0.14.x is unchanged.
 
 | Setting or behavior | 0.14.x | 0.15.0 behavior | First warning / ignored / removal release |
 | --- | --- | --- | --- |

package/README.md

@@ -419,10 +419,10 @@ tool catalog in this repository as authoritative when a third-party index lags.
 <h2 align="center" id="built-with">Built With</h2>
 
 [![TypeScript](https://img.shields.io/badge/TypeScript_7.0-3178C6?logo=typescript&logoColor=fff)](https://www.typescriptlang.org/)
-[![MCP SDK](https://img.shields.io/badge/MCP_SDK_2.3-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
+[![MCP SDK](https://img.shields.io/badge/MCP_SDK_2.4-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
 [![Zod 4](https://img.shields.io/badge/Zod_4-3E67B1?logo=zod&logoColor=fff)](https://zod.dev/)
 [![Biome](https://img.shields.io/badge/Biome_2.5-60a5fa?logo=biome&logoColor=fff)](https://biomejs.dev/)
-[![Node 24](https://img.shields.io/badge/Node_24-339933?logo=nodedotjs&logoColor=fff)](https://nodejs.org/)
+[![Node 24 | 26](https://img.shields.io/badge/Node_24_%7C_26-339933?logo=nodedotjs&logoColor=fff)](https://nodejs.org/)
 [![Anthropic](https://img.shields.io/badge/Anthropic-CC785C?style=flat&logo=anthropic&logoColor=white)](https://claude.ai/)
 
 [![SemVer](https://img.shields.io/badge/semver-2.0.0-blue)](https://semver.org/)
@@ -439,7 +439,7 @@ Marketplace listings on [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admi
 
 **[MIT License](LICENSE)** · Inspired by [r-huijts/portkey-admin-mcp-server](https://github.com/r-huijts/portkey-admin-mcp-server)
 
-<a href="https://github.com/CodesWhat">
+<a href="https://codeswhat.com">
   <picture>
     <source media="(prefers-color-scheme: dark)" srcset="assets/codeswhat-logo-dark.svg" />
     <source media="(prefers-color-scheme: light)" srcset="assets/codeswhat-logo-original.svg" />
@@ -447,6 +447,8 @@ Marketplace listings on [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admi
   </picture>
 </a>
 
+[CodesWhat](https://codeswhat.com): small, sharp tools from one developer and a lot of agents.
+
 <a href="#portkey-admin-mcp-server">Back to top</a>
 
 </div>

package/build/index.js

@@ -236,6 +236,19 @@ async function parseErrorResponse(response) {
   }
 }
 
+// src/lib/path-segment.ts
+function isDotPathSegment(value) {
+  let decoded = value;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+  }
+  return decoded === "." || decoded === ".." || value === "." || value === "..";
+}
+function isInvalidPathSegment(value) {
+  return value === "" || isDotPathSegment(value);
+}
+
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
 var DEFAULT_PUBLIC_BASE_URL = "https://api.portkey.ai";
@@ -379,9 +392,32 @@ var BaseService = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.v2BaseUrl = toV2BaseUrl(this.baseUrl);
   }
+  /**
+   * Encode a caller-supplied value for use as one URL path segment. "", "."
+   * and ".." (including percent-encoded forms) are refused: fetch's URL
+   * parser would collapse them and send the request to a different endpoint.
+   */
   encodePathSegment(value) {
+    if (isInvalidPathSegment(value)) {
+      throw new Error('Invalid path segment: must not be empty, "." or ".."');
+    }
     return encodeURIComponent(value);
   }
+  /**
+   * Defence in depth: refuse to send a request whose path the URL parser
+   * rewrote (dot segments), since that would reach a different endpoint than
+   * the one the service built.
+   */
+  assertPathNotNormalised(baseUrl, path, url) {
+    const queryIndex = path.search(/[?#]/);
+    const builtPath = queryIndex === -1 ? path : path.slice(0, queryIndex);
+    const expected = `${new URL(baseUrl).pathname.replace(/\/+$/, "")}${builtPath}`;
+    if (new URL(url).pathname !== expected) {
+      throw new Error(
+        "Refusing request: the request path would be normalised by the URL parser"
+      );
+    }
+  }
   buildUrl(path, params, baseUrl = this.baseUrl) {
     return `${baseUrl}${path}${buildQueryString(params)}`;
   }
@@ -404,6 +440,7 @@ var BaseService = class {
     }
     const requestId = crypto.randomUUID();
     const url = this.buildUrl(path, options.params, options.baseUrl);
+    this.assertPathNotNormalised(options.baseUrl ?? this.baseUrl, path, url);
     const startTime = Date.now();
     Logger.debug("HTTP request started", {
       requestId,
@@ -781,7 +818,7 @@ var AnalyticsService = class extends BaseService {
       throw new Error("metadataKey is required");
     }
     return this.get(
-      `/analytics/groups/metadata/${encodeURIComponent(metadataKey)}`,
+      `/analytics/groups/metadata/${this.encodePathSegment(metadataKey)}`,
       this.buildAnalyticsParams(params)
     );
   }
@@ -2515,6 +2552,9 @@ function pageSizeSchema(max = 100) {
   return z4.coerce.number().int().positive().max(max).optional().describe(`Results per page (max ${max})`);
 }
 var PageSizeSchema = pageSizeSchema();
+var PathIdSchema = z4.string().min(1).refine((value) => !isInvalidPathSegment(value), {
+  message: 'Must not be empty, "." or ".."'
+});
 
 // src/tools/utils.ts
 function formatFullName(firstName, lastName) {
@@ -3973,7 +4013,9 @@ var GUARDRAILS_TOOL_SCHEMAS = {
     current_page: CurrentPageSchema
   },
   getGuardrail: {
-    guardrail_id: z13.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
+    guardrail_id: PathIdSchema.describe(
+      "The guardrail UUID or slug (with guard_ prefix) to retrieve"
+    )
   },
   createGuardrail: {
     name: z13.string().describe("Name of the guardrail"),
@@ -3986,13 +4028,13 @@ var GUARDRAILS_TOOL_SCHEMAS = {
     organisation_id: z13.string().optional().describe("Organisation ID (required if workspace_id not provided)")
   },
   updateGuardrail: {
-    guardrail_id: z13.string().describe("The guardrail UUID or slug to update"),
+    guardrail_id: PathIdSchema.describe("The guardrail UUID or slug to update"),
     name: z13.string().optional().describe("New name for the guardrail"),
     checks: z13.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
     actions: guardrailActionSchema.optional().describe("Updated actions configuration")
   },
   deleteGuardrail: {
-    guardrail_id: z13.string().describe("The guardrail UUID or slug to delete")
+    guardrail_id: PathIdSchema.describe("The guardrail UUID or slug to delete")
   },
   updateOrganisationDefaults: {
     input_guardrails: z13.array(z13.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model input"),
@@ -4007,16 +4049,16 @@ var GUARDRAILS_TOOL_SCHEMAS = {
     override_existing: z13.boolean().optional().describe("Replace existing exclusion states instead of merging changes")
   },
   listGuardrailMcpServerMappings: {
-    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug")
+    guardrail_id: PathIdSchema.describe("Guardrail UUID or slug")
   },
   replaceGuardrailMcpServerMappings: {
-    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug"),
+    guardrail_id: PathIdSchema.describe("Guardrail UUID or slug"),
     mcp_servers: z13.record(z13.string().uuid(), guardrailMcpServerMappingConfigSchema).describe(
       "Complete MCP-server mapping set keyed by server UUID; an empty object clears every mapping"
     )
   },
   upsertGuardrailMcpServerMapping: {
-    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug"),
+    guardrail_id: PathIdSchema.describe("Guardrail UUID or slug"),
     mcp_server_id: z13.string().uuid().describe("MCP server UUID"),
     ...guardrailMcpServerMappingConfigShape
   }
@@ -8765,7 +8807,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     status: z28.enum(["active", "archived"]).optional().describe("Filter by workspace lifecycle status")
   },
   getWorkspace: {
-    workspace_id: z28.string().describe(
+    workspace_id: PathIdSchema.describe(
       "The unique identifier of the workspace to retrieve. This can be found in the workspace's URL or from the list_workspaces tool response"
     )
   },
@@ -8780,7 +8822,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     rate_limits: z28.array(workspaceRateLimitSchema).optional().describe("Initial workspace rate-limit settings")
   },
   updateWorkspace: {
-    workspace_id: z28.string().describe("The workspace ID to update"),
+    workspace_id: PathIdSchema.describe("The workspace ID to update"),
     name: z28.string().optional().describe("New name for the workspace"),
     slug: z28.string().optional().describe("New slug for the workspace"),
     description: z28.string().optional().describe("New description"),
@@ -8795,10 +8837,12 @@ var WORKSPACES_TOOL_SCHEMAS = {
     rate_limits: z28.array(workspaceRateLimitSchema).optional().describe("Replacement workspace rate-limit settings")
   },
   deleteWorkspace: {
-    workspace_id: z28.string().describe("The workspace ID to delete")
+    workspace_id: PathIdSchema.describe("The workspace ID to delete")
   },
   addWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID to add the member to"),
+    workspace_id: PathIdSchema.describe(
+      "The workspace ID to add the member to"
+    ),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
@@ -8807,14 +8851,14 @@ var WORKSPACES_TOOL_SCHEMAS = {
     role: z28.enum(["admin", "member", "manager"]).describe("Role in the workspace")
   },
   listWorkspaceMembers: {
-    workspace_id: z28.string().describe("The workspace ID to list members for"),
+    workspace_id: PathIdSchema.describe("The workspace ID to list members for"),
     current_page: CurrentPageSchema.describe("Zero-based page number"),
     page_size: PageSizeSchema.describe("Number of members per page"),
     role: z28.enum(["admin", "manager", "member"]).optional().describe("Filter by workspace role"),
     email: z28.string().email().optional().describe("Filter by member email")
   },
   getWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID"),
+    workspace_id: PathIdSchema.describe("The workspace ID"),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
@@ -8822,7 +8866,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     )
   },
   updateWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID"),
+    workspace_id: PathIdSchema.describe("The workspace ID"),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
@@ -8831,7 +8875,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     role: z28.enum(["admin", "member", "manager"]).describe("New role in the workspace")
   },
   removeWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID"),
+    workspace_id: PathIdSchema.describe("The workspace ID"),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe("The user ID to remove")

package/build/server.js

@@ -249,6 +249,19 @@ var Logger = {
   }
 };
 
+// src/lib/path-segment.ts
+function isDotPathSegment(value) {
+  let decoded = value;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+  }
+  return decoded === "." || decoded === ".." || value === "." || value === "..";
+}
+function isInvalidPathSegment(value) {
+  return value === "" || isDotPathSegment(value);
+}
+
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
 var DEFAULT_PUBLIC_BASE_URL = "https://api.portkey.ai";
@@ -392,9 +405,32 @@ var BaseService = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.v2BaseUrl = toV2BaseUrl(this.baseUrl);
   }
+  /**
+   * Encode a caller-supplied value for use as one URL path segment. "", "."
+   * and ".." (including percent-encoded forms) are refused: fetch's URL
+   * parser would collapse them and send the request to a different endpoint.
+   */
   encodePathSegment(value) {
+    if (isInvalidPathSegment(value)) {
+      throw new Error('Invalid path segment: must not be empty, "." or ".."');
+    }
     return encodeURIComponent(value);
   }
+  /**
+   * Defence in depth: refuse to send a request whose path the URL parser
+   * rewrote (dot segments), since that would reach a different endpoint than
+   * the one the service built.
+   */
+  assertPathNotNormalised(baseUrl, path, url) {
+    const queryIndex = path.search(/[?#]/);
+    const builtPath = queryIndex === -1 ? path : path.slice(0, queryIndex);
+    const expected = `${new URL(baseUrl).pathname.replace(/\/+$/, "")}${builtPath}`;
+    if (new URL(url).pathname !== expected) {
+      throw new Error(
+        "Refusing request: the request path would be normalised by the URL parser"
+      );
+    }
+  }
   buildUrl(path, params, baseUrl = this.baseUrl) {
     return `${baseUrl}${path}${buildQueryString(params)}`;
   }
@@ -417,6 +453,7 @@ var BaseService = class {
     }
     const requestId = crypto.randomUUID();
     const url = this.buildUrl(path, options.params, options.baseUrl);
+    this.assertPathNotNormalised(options.baseUrl ?? this.baseUrl, path, url);
     const startTime = Date.now();
     Logger.debug("HTTP request started", {
       requestId,
@@ -794,7 +831,7 @@ var AnalyticsService = class extends BaseService {
       throw new Error("metadataKey is required");
     }
     return this.get(
-      `/analytics/groups/metadata/${encodeURIComponent(metadataKey)}`,
+      `/analytics/groups/metadata/${this.encodePathSegment(metadataKey)}`,
       this.buildAnalyticsParams(params)
     );
   }
@@ -2528,6 +2565,9 @@ function pageSizeSchema(max = 100) {
   return z4.coerce.number().int().positive().max(max).optional().describe(`Results per page (max ${max})`);
 }
 var PageSizeSchema = pageSizeSchema();
+var PathIdSchema = z4.string().min(1).refine((value) => !isInvalidPathSegment(value), {
+  message: 'Must not be empty, "." or ".."'
+});
 
 // src/tools/utils.ts
 function formatFullName(firstName, lastName) {
@@ -3986,7 +4026,9 @@ var GUARDRAILS_TOOL_SCHEMAS = {
     current_page: CurrentPageSchema
   },
   getGuardrail: {
-    guardrail_id: z13.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
+    guardrail_id: PathIdSchema.describe(
+      "The guardrail UUID or slug (with guard_ prefix) to retrieve"
+    )
   },
   createGuardrail: {
     name: z13.string().describe("Name of the guardrail"),
@@ -3999,13 +4041,13 @@ var GUARDRAILS_TOOL_SCHEMAS = {
     organisation_id: z13.string().optional().describe("Organisation ID (required if workspace_id not provided)")
   },
   updateGuardrail: {
-    guardrail_id: z13.string().describe("The guardrail UUID or slug to update"),
+    guardrail_id: PathIdSchema.describe("The guardrail UUID or slug to update"),
     name: z13.string().optional().describe("New name for the guardrail"),
     checks: z13.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
     actions: guardrailActionSchema.optional().describe("Updated actions configuration")
   },
   deleteGuardrail: {
-    guardrail_id: z13.string().describe("The guardrail UUID or slug to delete")
+    guardrail_id: PathIdSchema.describe("The guardrail UUID or slug to delete")
   },
   updateOrganisationDefaults: {
     input_guardrails: z13.array(z13.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model input"),
@@ -4020,16 +4062,16 @@ var GUARDRAILS_TOOL_SCHEMAS = {
     override_existing: z13.boolean().optional().describe("Replace existing exclusion states instead of merging changes")
   },
   listGuardrailMcpServerMappings: {
-    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug")
+    guardrail_id: PathIdSchema.describe("Guardrail UUID or slug")
   },
   replaceGuardrailMcpServerMappings: {
-    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug"),
+    guardrail_id: PathIdSchema.describe("Guardrail UUID or slug"),
     mcp_servers: z13.record(z13.string().uuid(), guardrailMcpServerMappingConfigSchema).describe(
       "Complete MCP-server mapping set keyed by server UUID; an empty object clears every mapping"
     )
   },
   upsertGuardrailMcpServerMapping: {
-    guardrail_id: z13.string().min(1).describe("Guardrail UUID or slug"),
+    guardrail_id: PathIdSchema.describe("Guardrail UUID or slug"),
     mcp_server_id: z13.string().uuid().describe("MCP server UUID"),
     ...guardrailMcpServerMappingConfigShape
   }
@@ -8778,7 +8820,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     status: z28.enum(["active", "archived"]).optional().describe("Filter by workspace lifecycle status")
   },
   getWorkspace: {
-    workspace_id: z28.string().describe(
+    workspace_id: PathIdSchema.describe(
       "The unique identifier of the workspace to retrieve. This can be found in the workspace's URL or from the list_workspaces tool response"
     )
   },
@@ -8793,7 +8835,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     rate_limits: z28.array(workspaceRateLimitSchema).optional().describe("Initial workspace rate-limit settings")
   },
   updateWorkspace: {
-    workspace_id: z28.string().describe("The workspace ID to update"),
+    workspace_id: PathIdSchema.describe("The workspace ID to update"),
     name: z28.string().optional().describe("New name for the workspace"),
     slug: z28.string().optional().describe("New slug for the workspace"),
     description: z28.string().optional().describe("New description"),
@@ -8808,10 +8850,12 @@ var WORKSPACES_TOOL_SCHEMAS = {
     rate_limits: z28.array(workspaceRateLimitSchema).optional().describe("Replacement workspace rate-limit settings")
   },
   deleteWorkspace: {
-    workspace_id: z28.string().describe("The workspace ID to delete")
+    workspace_id: PathIdSchema.describe("The workspace ID to delete")
   },
   addWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID to add the member to"),
+    workspace_id: PathIdSchema.describe(
+      "The workspace ID to add the member to"
+    ),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
@@ -8820,14 +8864,14 @@ var WORKSPACES_TOOL_SCHEMAS = {
     role: z28.enum(["admin", "member", "manager"]).describe("Role in the workspace")
   },
   listWorkspaceMembers: {
-    workspace_id: z28.string().describe("The workspace ID to list members for"),
+    workspace_id: PathIdSchema.describe("The workspace ID to list members for"),
     current_page: CurrentPageSchema.describe("Zero-based page number"),
     page_size: PageSizeSchema.describe("Number of members per page"),
     role: z28.enum(["admin", "manager", "member"]).optional().describe("Filter by workspace role"),
     email: z28.string().email().optional().describe("Filter by member email")
   },
   getWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID"),
+    workspace_id: PathIdSchema.describe("The workspace ID"),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
@@ -8835,7 +8879,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     )
   },
   updateWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID"),
+    workspace_id: PathIdSchema.describe("The workspace ID"),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
@@ -8844,7 +8888,7 @@ var WORKSPACES_TOOL_SCHEMAS = {
     role: z28.enum(["admin", "member", "manager"]).describe("New role in the workspace")
   },
   removeWorkspaceMember: {
-    workspace_id: z28.string().describe("The workspace ID"),
+    workspace_id: PathIdSchema.describe("The workspace ID"),
     user_id: z28.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe("The user ID to remove")

package/docs/VERCEL_DEPLOYMENT.md

@@ -4,8 +4,8 @@
 
 This guide describes how to self-deploy this MCP server on Vercel.
 
-This guide follows the **unreleased SDK v2 candidate**, not the published 0.14.x
-session/replay implementation. No deployment of this candidate has been verified.
+This guide follows the **SDK v2 implementation shipped in 0.15.0**, not the 0.14.x
+session/replay implementation. No Vercel deployment of it has been verified.
 Use the guide from your installed release when operating 0.14.x. See
 [compatibility and recovery](../COMPATIBILITY.md) before upgrading; the retirement and names-only warnings target 0.15.0.
 
@@ -17,7 +17,7 @@ Use the guide from your installed release when operating 0.14.x. See
 - Redis: shared rate limiting only
 - Auth: `clerk` (preferred for teams) or `bearer` (internal-only)
 
-Each POST is independent. GET replay, session IDs and DELETE session operations are retired in the candidate. After an interrupted mutation, inspect Portkey state before retrying; see the recovery guide. Forward `MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` through any proxy. No idle change-notification streams are advertised.
+Each POST is independent. GET replay, session IDs and DELETE session operations are retired in 0.15.0. After an interrupted mutation, inspect Portkey state before retrying; see the recovery guide. Forward `MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` through any proxy. No idle change-notification streams are advertised.
 
 ## 1. Prerequisites
 

package/package.json

@@ -57,12 +57,12 @@
 		"jose": "^6.2.2",
 		"redis": "^6.3.0",
 		"zod": "^4.6.7",
-		"@modelcontextprotocol/server": "2.3.1",
-		"@modelcontextprotocol/node": "2.1.1"
+		"@modelcontextprotocol/server": "2.4.0",
+		"@modelcontextprotocol/node": "2.1.2"
 	},
 	"name": "portkey-admin-mcp",
 	"mcpName": "io.github.CodesWhat/portkey-admin-mcp",
-	"version": "0.15.1",
+	"version": "0.16.0",
 	"main": "build/index.js",
 	"keywords": [
 		"mcp",
@@ -101,6 +101,6 @@
 		"lefthook": "2.2.2",
 		"tsx": "4.23.15",
 		"typescript": "7.0.2",
-		"@modelcontextprotocol/client": "2.3.1"
+		"@modelcontextprotocol/client": "2.4.0"
 	}
 }