This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+13 more
ReleasePort's take
Light signalMartin-Loop v0.1.2 requires Node.js >=20 and adds file-backed run storage for martin_inspect and martin_status. Packaging now vendors dependencies with standardized cross-platform installation.
Why it matters: Node.js >=20 is required for standalone MCP server; verify compatibility before upgrading. Run inspection tools now support persisted lookups with strict validation. Test installation in dev before rolling out.
Summary
AI summaryNode.js runtime requirement raised to >=20 for standalone MCP server.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
`martin_inspect` supports canonical persisted runs at `<runsDir>/<loopId>/loop-record.json` and legacy `*.jsonl` run-store files. `martin_inspect` supports canonical persisted runs at `<runsDir>/<loopId>/loop-record.json` and legacy `*.jsonl` run-store files. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`martin_inspect` now accepts `file` and `runsDir`, defaulting to `MARTIN_RUNS_DIR` or `~/.martin/runs`. `martin_inspect` now accepts `file` and `runsDir`, defaulting to `MARTIN_RUNS_DIR` or `~/.martin/runs`. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`martin_status` supports persisted run lookups via `file`, `loopId`, `runsDir`, and `latest` while retaining `loopJson` backward compatibility. `martin_status` supports persisted run lookups via `file`, `loopId`, `runsDir`, and `latest` while retaining `loopJson` backward compatibility. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`martin_status` rejects ambiguous selector combinations with clear validation errors. `martin_status` rejects ambiguous selector combinations with clear validation errors. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`martin_run` preserves `allowedPaths` and `deniedPaths` in the runtime task contract. `martin_run` preserves `allowedPaths` and `deniedPaths` in the runtime task contract. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`martin_run` resolves `repoRoot` from `workingDirectory` before execution starts. `martin_run` resolves `repoRoot` from `workingDirectory` before execution starts. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
MCP server writes to a real file-backed run store in the MCP path for inspection by `martin_inspect` and `martin_status`. MCP server writes to a real file-backed run store in the MCP path for inspection by `martin_inspect` and `martin_status`. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Packaged MCP tarball rebuilds tracked vendored runtime dependencies before packing. Packaged MCP tarball rebuilds tracked vendored runtime dependencies before packing. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Standalone package now vendors needed Martin runtime facades instead of depending on unrelated workspace outputs. Standalone package now vendors needed Martin runtime facades instead of depending on unrelated workspace outputs. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Package manifest exposes both `mcp` and `martin-loop-mcp`, keeping `npx @martinloop/mcp` as primary install path. Package manifest exposes both `mcp` and `martin-loop-mcp`, keeping `npx @martinloop/mcp` as primary install path. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`smoke:pack` verifies packed tarball after fresh vendored builds. `smoke:pack` verifies packed tarball after fresh vendored builds. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`smoke:published` verifies installed package artifact from isolated temp workspace for deterministic testing across platforms. `smoke:published` verifies installed package artifact from isolated temp workspace for deterministic testing across platforms. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Public install guidance standardized for direct run, Claude macOS/Linux, and Claude Windows. Public install guidance standardized for direct run, Claude macOS/Linux, and Claude Windows. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
RC gate list now includes `pnpm mcp:published:smoke`. RC gate list now includes `pnpm mcp:published:smoke`. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Node runtime requirement updated to '> = 20'. Node runtime requirement updated to '> = 20'. Source: granite4.1:30b@2026-05-23-audit Confidence: low |
— |
Full changelog
@martinloop/mcp v0.1.2
@martinloop/[email protected] is the pre-listing hardening release for the standalone Martin Loop MCP server. This release focuses on real run-store compatibility, safer standalone packaging, clearer install guidance, and stronger cross-platform release verification before external registry submission.
Highlights
Real run-store compatibility
martin_inspectnow supports canonical persisted runs at<runsDir>/<loopId>/loop-record.jsonand legacy*.jsonlrun-store files.martin_inspectnow supportsfileandrunsDir, and can default toMARTIN_RUNS_DIRor~/.martin/runs.martin_statusnow supports persisted run lookups throughfile,loopId,runsDir, andlatest, while keepingloopJsonfor backward compatibility.martin_statusnow rejects ambiguous selector combinations with clear validation errors.
Governed MCP execution improvements
martin_runnow preservesallowedPathsanddeniedPathsin the runtime task contract.martin_runnow resolvesrepoRootfromworkingDirectorybefore execution starts.- The MCP server now writes to a real file-backed run store in the MCP path so saved runs can be inspected by
martin_inspectandmartin_status.
Standalone packaging hardening
- The packaged MCP tarball now rebuilds tracked vendored runtime dependencies before packing, preventing stale local build residue from leaking into the npm artifact.
- The standalone package now vendors the tracked Martin runtime facades it actually needs instead of depending on unrelated workspace outputs being present on disk.
- The package manifest exposes both
mcpandmartin-loop-mcp, while keepingnpx @martinloop/mcpas the primary install path.
Install and release verification hardening
- Public install guidance is standardized to:
- direct run:
npx @martinloop/mcp - Claude macOS/Linux:
claude mcp add --scope user martin-loop -- npx @martinloop/mcp - Claude Windows:
claude mcp add --scope user martin-loop cmd /c "npx @martinloop/mcp"
- direct run:
smoke:packverifies the packed tarball after fresh vendored builds.smoke:publishedverifies the installed package artifact from an isolated temp workspace, which keeps the published-artifact smoke deterministic on Windows as well as Linux and macOS.- The RC gate list now includes
pnpm mcp:published:smoke.
Metadata
- npm package:
@martinloop/mcp - MCP registry server name:
io.github.keesan12/martin-loop - Node runtime requirement:
>=20
Verification
pnpm --filter @martinloop/mcp lintpnpm --filter @martinloop/mcp testpnpm --filter @martinloop/mcp buildpnpm --filter @martinloop/mcp smoke:packpnpm --filter @martinloop/mcp smoke:publishedpnpm release:matrix:local
Publish path
- Merge PR
#34tomain - Push tag
mcp-v0.1.2 - Let
.github/workflows/publish-mcp.ymlpublish via npm trusted publishing - Verify live npm with
npm view @martinloop/mcp version - Re-run
pnpm --filter @martinloop/mcp smoke:publishedagainst the real published package
Notes
- npm publication is the required precursor to any official MCP Registry submission.
Breaking Changes
- Minimum Node.js runtime requirement increased to version 20 or higher.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Keesan12/Martin-Loop
All releases →Related context
Related tools
Earlier breaking changes
- vmcp-v0.1.3 martin_status uses oneOf for selector exclusivity, latest as const.
- vmcp-v0.1.3 maxIterations and maxTokens modeled as integers in tool schemas.
- vmcp-v0.1.3 Tool schemas enforce additionalProperties: false on public contracts.
- vmcp-v0.1.3 Packaged artifacts now require and ship server.json alongside package.json.
Beta — feedback welcome: [email protected]