cameronrye/activitypub-mcp

v1.0.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 6mo MCP Data & Storage

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

activitypub fedify fediverse mcp mcp-server webfinger

Affected surfaces

deps

Summary

AI summary

Fixed mobile search functionality.

Full changelog

[1.0.3] - 2025-11-16

Added

OG image generation for social media sharing
Enhanced documentation site with improved navigation and search
Production-ready deployment configurations

Changed

Upgraded dependencies to latest versions for security and performance
Updated Astro to 5.15.8 for improved site building
Updated MCP SDK to 1.22.0 for latest protocol features
Replaced deprecated npm-run-all with npm-run-all2
Improved site styling and mobile responsiveness
Enhanced code review findings and documentation clarity

Fixed

Documentation formatting and broken links
Mobile search functionality
Code block horizontal scrolling issues
Biome configuration schema validation
Various text and formatting improvements

Security

Fixed security vulnerabilities in dependencies
Updated packages with known security issues

Security Fixes

Fixed security vulnerabilities in dependencies

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cameronrye/activitypub-mcp

Get notified when new releases ship.

About cameronrye/activitypub-mcp

A comprehensive MCP server that enables LLMs to explore and interact with the Fediverse through ActivityPub protocol. Features WebFinger discovery, timeline fetching, instance exploration, and cross-platform support for Mastodon, Pleroma, Misskey, and other ActivityPub servers.

All releases →

Related context

Related tools

Earlier breaking changes

v2.1.0 `activitypub://instance-info/{domain}` `software` field now an object instead of a string.
v2.1.0 Removed `activitypub://post-thread/{postUrl}` URI form; use `{domain}/{statusId}` instead.
v2.0.0 'get-relationship' no longer accepts legacy `accountIds` array; requires single `acct` string.
v2.0.0 `MCP_HTTP_CORS_ORIGINS` no longer defaults to '*'; must be set explicitly.
v2.0.0 `scheduledId` renamed to `scheduledPostId` in scheduling tools.