premiere-pro-mcp 1.9.0 → 1.9.2

package/CHANGELOG.md

@@ -6,6 +6,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.9.2] - 2026-08-04
+
+### Fixed
+
+- Changed the CEP Premiere host declaration to a minimum-only supported version
+  so Adobe Developer Distribution does not reject the signed ZXP for claiming
+  an unsupported future maximum.
+- Updated transitive URL, HTTP middleware, and IP-address parsing dependencies
+  to patched versions after newly disclosed security advisories.
+
+### Added
+
+- Added a public privacy policy covering local media processing, optional MCP
+  operational telemetry, website analytics, retention, and user choices.
+
+## [1.9.1] - 2026-08-02
+
+### Security
+
+- Added a production HTTP header baseline for the landing site, health route,
+  and remote MCP responses: CSP, HSTS, MIME sniffing protection, frame denial,
+  referrer and permissions policies, and cross-origin opener isolation.
+- Restricted the browser connection policy to the application, configured
+  analytics endpoints, and the bounded PostHog host.
+
 ## [1.9.0] - 2026-08-02
 
 ### Added

package/README.md

@@ -29,7 +29,20 @@ An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that l
 
 The AI handles the entire workflow through 280 core tools spanning the supported ExtendScript, QE DOM, local media analysis, safe edit-planning, and connection-verification surfaces. A compatible, authenticated UXP panel adds 19 documented, capability-gated workflows without replacing the production CEP bridge.
 
-### What's new in 1.9.0
+### What's new in 1.9.2
+
+- **Adobe Marketplace compatibility:** the signed CEP connector now declares a
+  minimum supported Premiere version without an artificial future maximum.
+- **Clear privacy disclosure:** the public site now documents local processing,
+  optional operational telemetry, site analytics, retention, and user choices.
+
+### Previous release: 1.9.1
+
+- **Production browser hardening:** every HTTP response includes CSP, HSTS,
+  MIME sniffing protection, frame denial, bounded permissions, and explicit
+  referrer and cross-origin policies.
+
+### Earlier release: 1.9.0
 
 - **Assistant-first setup:** Claude Desktop users start with a validated MCPB
   bundle, while npm and manual JSON configuration stay under Advanced setup.
@@ -73,9 +86,9 @@ The AI handles the entire workflow through 280 core tools spanning the supported
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.0/premiere-pro-mcp-1.9.0.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.2/premiere-pro-mcp-1.9.2.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.0/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.2/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP Bridge**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -299,11 +312,11 @@ From a clone of this repository:
 ```bash
 codex plugin marketplace add .
 codex plugin add premiere-pro@premiere-pro-mcp
-npx -y premiere-pro-mcp@1.9.0 --install-cep
+npx -y premiere-pro-mcp@1.9.2 --install-cep
 ```
 
 Restart Premiere Pro and start a new Codex session after installation. The plugin
-launches `premiere-pro-mcp@1.9.0` through `npx`; the separate CEP installation is
+launches `premiere-pro-mcp@1.9.2` through `npx`; the separate CEP installation is
 required because the MCP server communicates with the running Premiere host through
 the local bridge.
 
@@ -323,7 +336,7 @@ For Claude Code, add this repository as a marketplace and install the plugin:
 Then install the Premiere bridge and start a new Claude Code session:
 
 ```bash
-npx -y premiere-pro-mcp@1.9.0 --install-cep
+npx -y premiere-pro-mcp@1.9.2 --install-cep
 ```
 
 The Claude Code package lives in

package/cep-plugin/CSXS/manifest.xml

@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.9.0" ExtensionBundleName="MCP Bridge">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.9.2" ExtensionBundleName="MCP Bridge">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.9.0"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.9.0"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.9.2"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.9.2"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>
-      <Host Name="PPRO" Version="[14.0,99.9]"/>
+      <Host Name="PPRO" Version="14.0"/>
     </HostList>
     <LocaleList>
       <Locale Code="All"/>

package/cep-plugin/index.html

@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">Connector updates</span>
-        <strong id="updateTitle">Version 1.9.0</strong>
+        <strong id="updateTitle">Version 1.9.2</strong>
         <span id="updateDetail">Checking for updates…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" disabled>

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.9.0";
+  var CURRENT_VERSION = "1.9.2";
   var LATEST_RELEASE_API =
     "https://api.github.com/repos/leancoderkavy/premiere-pro-mcp/releases/latest";
   var RELEASES_URL =

package/dist/http-security.d.ts

@@ -0,0 +1,12 @@
+import type http from "node:http";
+export declare const HTTP_SECURITY_HEADERS: Readonly<{
+    "Content-Security-Policy": string;
+    "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
+    "X-Content-Type-Options": "nosniff";
+    "X-Frame-Options": "DENY";
+    "Referrer-Policy": "strict-origin-when-cross-origin";
+    "Permissions-Policy": "camera=(), microphone=(), geolocation=()";
+    "Cross-Origin-Opener-Policy": "same-origin";
+}>;
+export declare function applyHttpSecurityHeaders(res: http.ServerResponse): void;
+//# sourceMappingURL=http-security.d.ts.map

package/dist/http-security.js

@@ -0,0 +1,28 @@
+export const HTTP_SECURITY_HEADERS = Object.freeze({
+    "Content-Security-Policy": [
+        "default-src 'self'",
+        "base-uri 'self'",
+        "frame-ancestors 'none'",
+        "object-src 'none'",
+        "form-action 'self'",
+        "img-src 'self' data: https:",
+        "media-src 'self'",
+        "font-src 'self'",
+        "style-src 'self' 'unsafe-inline'",
+        "script-src 'self' 'unsafe-inline' https://www.googletagmanager.com",
+        "connect-src 'self' https://www.google-analytics.com https://www.googletagmanager.com https://us.i.posthog.com https://*.posthog.com",
+        "upgrade-insecure-requests",
+    ].join("; "),
+    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "strict-origin-when-cross-origin",
+    "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
+    "Cross-Origin-Opener-Policy": "same-origin",
+});
+export function applyHttpSecurityHeaders(res) {
+    for (const [name, value] of Object.entries(HTTP_SECURITY_HEADERS)) {
+        res.setHeader(name, value);
+    }
+}
+//# sourceMappingURL=http-security.js.map

package/dist/http-server.js

@@ -29,6 +29,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { createServer } from "./server.js";
 import { cleanupTempDir, getTempDir } from "./bridge/file-bridge.js";
 import { getTelemetry } from "./telemetry.js";
+import { applyHttpSecurityHeaders } from "./http-security.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const LANDING_DIR = path.resolve(__dirname, "../landing-dist");
 const MIME = {
@@ -106,6 +107,7 @@ console.error(`[premiere-pro-mcp] Temp directory: ${tempDir}`);
 cleanupTempDir(bridgeOptions);
 // Each request gets its own transport+server instance (stateless per-request model)
 const httpServer = http.createServer(async (req, res) => {
+    applyHttpSecurityHeaders(res);
     // Health check
     if (req.method === "GET" && req.url === "/health") {
         res.writeHead(200, { "Content-Type": "application/json" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premiere-pro-mcp",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Adobe Premiere Pro MCP server with 280 core AI video editing tools and a capability-aware UXP bridge for supported Premiere workflows.",
   "main": "dist/index.js",
   "types": "./dist/index.d.ts",
@@ -97,6 +97,9 @@
   },
   "overrides": {
     "@hono/node-server": "^2.0.5",
-    "body-parser": "^2.3.0"
+    "body-parser": "^2.3.0",
+    "fast-uri": "^3.1.5",
+    "hono": "^4.12.34",
+    "ip-address": "^10.4.0"
   }
 }

package/uxp-plugin/manifest.json

@@ -2,7 +2,7 @@
   "manifestVersion": 5,
   "id": "com.ppmcp.premiere.uxp",
   "name": "Premiere Pro MCP Bridge",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "main": "index.html",
   "host": { "app": "premierepro", "minVersion": "25.6.0" },
   "entrypoints": [