codeurali/mcp-dataverse

What's New in v0.4.5

This release brings 4 new attribute management tools, a full Search API v2.0 upgrade, and a comprehensive bug-fix sprint (BUG-025 through BUG-035) — covering 7 versions since v0.3.8.

🆕 New Tools (v0.4.0 — v0.3.9)

| Tool | Description |
|------|-------------|
| dataverse_create_attribute | Create columns (String, Integer, Decimal, Money, DateTime, Boolean, Picklist, MultiSelectPicklist, AutoNumber, Image…) |
| dataverse_update_attribute | Update column display name, description, requirement level, searchability |
| dataverse_delete_attribute | Remove custom columns (permanent — confirm: true guardrail) |
| dataverse_create_lookup_attribute | Create a lookup (N:1) column defining a 1:N relationship between two tables |
| dataverse_list_connection_references | List Connection References in the environment |

Total: 67 tools

🔍 Search API v2.0 (v0.4.2 — v0.4.5)

The Dataverse search endpoint is now /api/search/v2.0/query (v1.0 was legacy/deprecated).

Multiple v1.0-only parameters have been corrected for v2.0 compliance:

• querytype now serialized inside options string (BUG-033)
• select moved inside each entities entry as selectColumns (BUG-034)
• entities array now sent as a JSON-serialized string (BUG-035)
• returntotalrecordcount replaced by v2.0 count boolean (BUG-032)
• searchMode removed (not a v2.0 top-level parameter) (BUG-031)
• facets and orderby now JSON-serialized as strings (v2.0 spec)
• Disabled-search detection expanded to 7 patterns (403/404/400, 0x80048D0B, text variants)

🔒 HTTP Transport Hardening (v0.4.0)

• Bearer token auth with HMAC-SHA256 timing-safe verification (eliminates length timing oracle)
• WWW-Authenticate: Bearer realm="MCP Dataverse" header on 401
• Configurable CORS via MCP_HTTP_CORS_ORIGIN env var
• enableJsonResponse toggle via MCP_HTTP_JSON_RESPONSE for non-streaming clients

🐛 Bug Fixes

| ID | Tool | Fix |
|----|------|-----|
| BUG-035 | dataverse_search | entities serialized as JSON string |
| BUG-034 | dataverse_search | select → selectColumns inside entities |
| BUG-033 | dataverse_search | querytype → inside options string |
| BUG-032 | dataverse_search | returntotalrecordcount → count (v2.0) |
| BUG-031 | dataverse_search | Removed invalid searchMode top-level param |
| BUG-030 | dataverse_update_entity | Added hasSysAdmin preflight check |
| BUG-029 | All tools | isError: true now present in content[0].text body |
| BUG-028 | dataverse_delete_attribute | Structured error for protected/dependent columns |
| BUG-025 | dataverse_update_entity | Suggestion list filtered to modifiable attributes only |
| A1 | All write tools | Retry on 0x80071151 (customization lock) with exponential backoff |
| A2 | dataverse_create_lookup_attribute | Timeout no longer masks server-side success |
| A3 | dataverse_get_relationships | Full pagination via @odata.nextLink |
| A4 | dataverse_get_attribute_option_set | Now supports MultiSelectPicklist columns |

⚙️ Schema & Quality (v0.4.2 — v0.3.9)

• confirm parameter uses const: true on all destructive tools (uniform guardrail)
• dataverse_create_annotation parameters renamed to camelCase (noteText, fileName, mimeType, documentBody)
• errorCategory now auto-inferred in all structured error responses
• MSCRM.MergeLabels: true header on all metadata PUT/PATCH (preserves multi-language labels)
• suggest_tools no longer surfaces non-callable internal tools
• detect_duplicates caches EntitySetName to eliminate redundant metadata calls
• Batch executor: request body boundary uses CRLF (\r\n) per RFC 2046

📦 Full Changelog

v0.3.9...v0.4.5