search-rotation 0.5.0 → 0.5.2

package/README.md

@@ -43,7 +43,7 @@ client to run `search-rotation` with no arguments. See the
 ### Pinned release from GitHub
 
 ```sh
-npx -y --allow-git=all github:robin-bially/search-rotation-mcp#v0.5.0
+npx -y --allow-git=all github:robin-bially/search-rotation-mcp#v0.5.2
 ```
 
 Use this when you want a fixed version instead of the current npm release.

package/docs/clients.md

@@ -77,7 +77,7 @@ Add this entry under `mcp.servers`:
 If installed locally, use `search-rotation` as the command. A prebuilt archive is also available under [GitHub Releases](https://github.com/robin-bially/search-rotation-mcp/releases/latest):
 
 ```sh
-npm install -g ./search-rotation-0.5.0.tgz
+npm install -g ./search-rotation-0.5.2.tgz
 ```
 
 npx installs the package from the npm registry, so no Git access is required. The pinned

package/docs/distribution.md

@@ -1,22 +1,20 @@
 # Distribution and listings
 
 Where search-rotation is published or listed, who keeps each channel current, and
-what still needs attention. Snapshot: 2026-09-26, after the account rename from `localfoundry` to `robin-bially` and the 0.4.11 release.
+what still needs attention. Snapshot: 2026-10-10, after the 0.5.1 maintenance release.
+The 0.5.0 release renamed the MCP tools to `search_web`, `fetch_url`, `get_engine_status`,
+`update_engine_config` and `open_dashboard`.
 
 ## Channels
 
 | Channel | Entry | Kept current by | State |
 | --- | --- | --- | --- |
-| npm | `search-rotation` | release workflow, trusted publishing | 0.4.11 |
-| Homebrew | `brew install robin-bially/tap/search-rotation` | release script writes the formula | 0.4.11 |
-| Official MCP Registry | `io.github.robin-bially/search-rotation` | release workflow, GitHub OIDC | 0.4.11; the old `io.github.localfoundry/search-rotation` stays frozen at 0.4.10 because the registry has no unpublish |
-| GitHub releases | tag, tarball and checksum | release script | v0.4.11 |
+| npm | `search-rotation` | release workflow, trusted publishing | 0.5.1 |
+| Homebrew | `brew install robin-bially/tap/search-rotation` | release script writes the formula | 0.5.1 |
+| Official MCP Registry | `io.github.robin-bially/search-rotation` | release workflow, GitHub OIDC | 0.5.1; the old `io.github.localfoundry/search-rotation` stays frozen at 0.4.10 because the registry has no unpublish |
+| GitHub releases | tag, tarball and checksum | release script | v0.5.1 |
 | Glama | [directory entry](https://glama.ai/mcp/servers/robin-bially/search-rotation-mcp), rated A | Glama indexes the repository on its own | listed under the current account name; Glama picked up the rename by itself, the previous `RobinBially` path still resolves |
-| mcpservers.org | [submission](https://mcpservers.org/de/submit) from 2026-09-26 | reviewed by the site | in review, up to two weeks |
 | PulseMCP | — | ingests the official registry | submissions paused, not listed yet |
-| [punkpeye/awesome-mcp-servers](https://github.com/punkpeye/awesome-mcp-servers/pull/15171) | Search & Data Extraction | maintainers | pull request open, listing checks done |
-| [YuzeHao2023/Awesome-MCP-Servers](https://github.com/YuzeHao2023/Awesome-MCP-Servers/pull/550) | Search & Web | maintainers | pull request open |
-| [ever-works/awesome-mcp-servers](https://github.com/ever-works/awesome-mcp-servers/pull/188) | Web Search | maintainers | pull request open |
 
 Channels that build on the official registry follow a release by themselves, so a
 release needs no manual work for them.
@@ -37,6 +35,8 @@ Four details are easy to forget:
 - `server.json` and `mcpName` must name the same server; `test/registry-manifest.test.ts` fails when they drift apart.
 - The registry limits `description` to 100 characters.
 - The registry verifies ownership through the published npm package, so a manifest can only be registered once that version exists on npm. The workflow skips an already published version, which makes a re-run safe.
+- That ownership check also races npm propagation: with 0.5.0 the registry answered `version '0.5.0' was not found (status: 404)` seconds after the publish, and `gh run rerun <id> --failed` registered the version on the second attempt without republishing (the publish step sees the existing version and skips). After the same race with 0.5.1 the registry step waits up to five minutes until npm serves the version.
+- The Homebrew formula carries a `test do` block that asserts the tool names from `tools/list`; it has to follow a rename like the one in 0.5.0, and `brew audit` does not catch a stale list.
 - npm trusted publishing is bound to one repository, so an account rename has to be re-pointed by hand: `npm trust github search-rotation --file publish.yml --repo robin-bially/search-rotation-mcp --allow-publish` (one-time password in the browser). That was missed for 0.4.11, whose publish failed with `404 Not Found - PUT https://registry.npmjs.org/search-rotation`; the stale entry for `localfoundry/search-rotation-mcp` was revoked on 2026-09-26, because the freed owner name would otherwise let a stranger publish to this package.
 
 ## Recurring checks
@@ -44,10 +44,20 @@ Four details are easy to forget:
 - After a release: `npm view search-rotation version` and the [registry entry](https://registry.modelcontextprotocol.io/?q=io.github.robin-bially%2Fsearch-rotation) should both show the new version. The release script already waits for npm. A failed publish workflow leaves the release and the tap ahead of npm, which happened with 0.4.11; `gh workflow run publish.yml` then repairs npm and the registry in one run.
 - Dependency and tap maintenance runs outside this repository on a biweekly schedule.
 - The GitHub account moved from `localfoundry` to `robin-bially` on 2026-09-26. The registry has no unpublish, so the entry `io.github.localfoundry/search-rotation` stays frozen at 0.4.10 while the next release adds `io.github.robin-bially/search-rotation`. The old handle is free again, so anything still pointing there can end up at a different account.
-- Open externally: mcpservers.org reviews the submission, PulseMCP is paused, and the three list pull requests wait for their maintainers. Glama has re-crawled the repository after the rename.
+- Open externally: PulseMCP is paused and takes the entry from the official registry once it reopens. Glama has re-crawled the repository after the rename.
 
 ## Deliberately not used
 
 Directories that require a new account before a submission (Glama's own form,
 mcp.so) are skipped. The Glama listing exists because Glama indexes public GitHub
 repositories without a submission; it picked up the repository rename by itself.
+
+mcpservers.org is not maintained. The entry from the 2026-09-26 submission went live under the old `localfoundry` path and brought no visible stars; it stays as it is and is not updated. The channels that count are the official MCP Registry, Glama and PulseMCP.
+
+Curated awesome lists are skipped too. The three merge requests opened on
+2026-09-26 (punkpeye/awesome-mcp-servers#15171, YuzeHao2023/Awesome-MCP-Servers#550,
+ever-works/awesome-mcp-servers#188) were closed on 2026-09-27 without waiting for a
+reviewer: the official MCP Registry and Glama already carry the server, and neither
+list adds discovery that the registry does not. PulseMCP and Glama derive their
+entries from the registry and the public repository, so no manual list work is
+needed to stay visible.

package/docs/release-notes.md

@@ -1,3 +1,40 @@
+## v0.5.2 — Dependency update for four advisories
+
+Maintenance release with no change to tools, arguments or configuration. The lockfile
+moves `zod` to 4.6.7 (memory exhaustion on oversized constrained collections),
+`@modelcontextprotocol/sdk` to 1.32.2 and `@hono/node-server` to 2.1.5, and pulls in
+fixed versions of the transitive packages `body-parser`, `fast-uri` and
+`ip-address`. `npm audit` reports no vulnerabilities.
+
+```sh
+brew update && brew upgrade robin-bially/tap/search-rotation
+```
+
+Or run the pinned GitHub version:
+
+```sh
+npx -y --allow-git=all github:robin-bially/search-rotation-mcp#v0.5.2
+```
+
+
+## v0.5.1 — Dependency update for the MCP SDK advisory
+
+Maintenance release. `@modelcontextprotocol/sdk` moves from 1.30.1 to 1.32.1, which
+fixes an advisory in the SDK's OAuth client: it could send credentials to an
+authorization server chosen by the MCP server. Hono 4.13.13 and @hono/node-server
+2.1.4 come along as patch updates. Tools, arguments and configuration are unchanged.
+
+```sh
+brew update && brew upgrade robin-bially/tap/search-rotation
+```
+
+Or run the pinned GitHub version:
+
+```sh
+npx -y --allow-git=all github:robin-bially/search-rotation-mcp#v0.5.1
+```
+
+
 ## v0.5.0 — Consistent tool names and programmable engine configuration
 
 The tool definitions were rewritten against the TDQS rubric, and two tools changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "search-rotation",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "mcpName": "io.github.robin-bially/search-rotation",
   "description": "Round-robin web search over the free tiers of multiple search APIs (Tavily, Firecrawl, Parallel, Exa, Google PSE, Jina, DuckDuckGo) as an MCP server — with a local dashboard for API keys, engine order/toggles and live quota status.",
   "type": "module",