DollhouseMCP/mcp-server

v2.0.36 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 23d MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agents ai ai-tools claude codex cursor

+14 more

dollhousemcp ensembles llm mcp mcp-server memory model-context-protocol personas prompt-engineering skills templates typescript vscode windsurf

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates Pull Requests, Highlights, and Validation across a mixed release.

Full changelog

Highlights

Fix silent memory data loss — addEntry reported success while entries were never written to disk once a memory's serialized YAML exceeded 64KB (a hidden frontmatter-sized cap on the save path), and deferred save failures were swallowed. Memory YAML limits are now aligned at 256KB across save, load, and index extraction; addEntry verifies persistability before reporting success and rolls back on failure; failed deferred saves are tracked, retried, and surfaced to the caller. All users are strongly encouraged to upgrade. (#2329)
Fix GitHub OAuth helper token handoff: the helper now stores tokens through TokenManager (honoring DOLLHOUSE_HOME_DIR consistently on both sides) instead of plaintext fallback files, with flow-scoped state/result handling, slow_down backoff, and sanitized diagnostics. (#2325)

Validation

PRs #2325, #2332, and #2333 passed SonarCloud (0 new issues), Security Audit, DollhouseMCP Security Audit, CodeQL, Docker amd64/arm64, Docker Compose, build artifacts, dependency review, documentation validation, Claude review, Codex review, and the full OS/Node test matrix.
The memory fix ships with 9 new regression tests (unit + end-to-end), including the >64KB persistence repro, rollback on overflow, failed-save recovery, and deleted-memory non-resurrection.

Pull Requests

#2325 Fix OAuth helper token handoff
#2330 Fix memory silent save loss (develop)
#2332 Fix memory silent save loss (main hotfix)
#2333 Release 2.0.36

Package

npm package: @dollhousemcp/[email protected]

Security Fixes

GitHub OAuth helper now stores tokens via TokenManager respecting DOLLHOUSE_HOME_DIR, with flow‑scoped state, backoff, and sanitized diagnostics

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track DollhouseMCP/mcp-server

Get notified when new releases ship.

About DollhouseMCP/mcp-server

One-line installable MCP server that adds reusable customization elements — personas, skills, templates, agents, memory, and ensembles (collected customization tools)

All releases →