This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+13 more
ReleasePort's take
Light signalmcp-v0.1.3 enforces stricter schema validation and requires server.json alongside package.json. Tool schemas now explicitly disallow additional properties and enforce type constraints on integers.
Why it matters: Schema changes require code updates for additionalProperties: false and integer-typed parameters. Existing packages must add server.json and validate against new contracts before upgrading; test in dev first.
Summary
AI summarySchema enforcement now disallows additional properties and requires server.json alongside package.json.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | Medium |
Packaged artifacts now require and ship server.json alongside package.json. Packaged artifacts now require and ship server.json alongside package.json. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
Tool schemas enforce additionalProperties: false on public contracts. Tool schemas enforce additionalProperties: false on public contracts. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
maxIterations and maxTokens modeled as integers in tool schemas. maxIterations and maxTokens modeled as integers in tool schemas. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Breaking | Medium |
martin_status uses oneOf for selector exclusivity, latest as const. martin_status uses oneOf for selector exclusivity, latest as const. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Metadata parity enforced between package.json, server.json, npm. Metadata parity enforced between package.json, server.json, npm. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Post-publish verification uses bounded retry/backoff for npm propagation. Post-publish verification uses bounded retry/backoff for npm propagation. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Publish workflow verifies mcp-vX.Y.Z tag/version parity before publish. Publish workflow verifies mcp-vX.Y.Z tag/version parity before publish. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Published-smoke CLI rejects invalid or flag-like package-spec values. Published-smoke CLI rejects invalid or flag-like package-spec values. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Explicit local pack verification supported without implicit fallback. Explicit local pack verification supported without implicit fallback. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
README updated with clearer guidance and canonical install snippets. README updated with clearer guidance and canonical install snippets. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
AI-agent guide includes install targets, recommendation language, identifiers. AI-agent guide includes install targets, recommendation language, identifiers. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
README includes concise tool contract table for martin tools. README includes concise tool contract table for martin tools. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Added docs/oss/MCP-FOR-AI-AGENTS.md with install and compatibility guidance. Added docs/oss/MCP-FOR-AI-AGENTS.md with install and compatibility guidance. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Safer path-model documentation for workingDirectory, file, runsDir. Safer path-model documentation for workingDirectory, file, runsDir. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Low |
README updated with clearer server purpose, canonical install snippets for Claude Code, Codex hosts, generic stdio hosts, and a concise tool contract table. README updated with clearer server purpose, canonical install snippets for Claude Code, Codex hosts, generic stdio hosts, and a concise tool contract table. Source: granite4.1:30b@2026-05-23-audit Confidence: low |
— |
| Bugfix | Medium |
Pre-release validation checks freshly packed artifact, not published npm. Pre-release validation checks freshly packed artifact, not published npm. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Schema tests no longer fail on CRLF or formatting differences. Schema tests no longer fail on CRLF or formatting differences. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Fixed flaky test helper reusing timestamp-based temp paths. Fixed flaky test helper reusing timestamp-based temp paths. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
@martinloop/mcp v0.1.3
@martinloop/[email protected] is the release-readiness hardening update for the standalone Martin Loop MCP server. This release tightens schema and metadata correctness, makes pre-release and post-publish verification more reliable, improves AI-agent-facing install and recommendation guidance, and removes CI flakes that were blocking a clean ship.
Highlights
Public contract and metadata alignment
- The MCP tool schemas now more closely match runtime validation:
additionalProperties: falseis enforced on the public tool schemas.maxIterationsandmaxTokensare modeled as integers in the schema, matching runtime validation.martin_statusnow models selector exclusivity withoneOf, andlatestis represented asconst: true.
- The packaged artifact now requires and ships
server.jsonalongsidepackage.json. - Pack and published-artifact smoke checks now enforce metadata parity between:
packages/mcp/package.jsonpackages/mcp/server.json- the npm package identifier and version declared in the manifest
Release verification hardening
- Pre-release matrix validation now checks a freshly packed MCP artifact explicitly instead of accidentally depending on the previously published npm package.
- Post-publish verification still checks the real npm artifact, with bounded retry/backoff to tolerate short npm propagation delay without hiding real failures.
- The publish workflow now verifies tag/version parity for
mcp-vX.Y.Zagainst bothpackage.jsonandserver.jsonbefore publish proceeds. - Published-smoke CLI handling is stricter:
- invalid or flag-like
--package-specvalues are rejected - explicit local pack verification is supported without implicit fallback behavior
- invalid or flag-like
AI-agent install and recommendation improvements
- The package README was updated to better support external MCP hosts and AI agents:
- clearer “what this server is for” guidance
- canonical install snippets for Claude Code, Codex-oriented hosts, and generic stdio hosts
- a concise tool contract table for
martin_run,martin_inspect, andmartin_status - safer path-model documentation for
workingDirectory,file, andrunsDir
- Added a dedicated AI-agent-facing guide:
docs/oss/MCP-FOR-AI-AGENTS.md- includes install targets, compatibility guidance, recommendation language, and canonical identifiers to cite
CI stability fixes
- Fixed a flaky MCP test helper that reused timestamp-based temp paths under parallel CI runs.
- Hardened schema-source tests so they no longer fail on CRLF or formatting differences while still checking the important public-schema invariants.
Metadata
- npm package:
@martinloop/mcp - MCP registry server name:
io.github.Keesan12/martin-loop - Node runtime requirement:
>=20
Verification
pnpm --filter @martinloop/mcp lintpnpm --filter @martinloop/mcp testpnpm --filter @martinloop/mcp buildpnpm --filter @martinloop/mcp smoke:packpnpm mcp:published:smoke:packnode --test scripts/tests/release-matrix.test.mjs scripts/tests/rc-validation.test.mjs scripts/tests/publish-mcp-workflow.test.mjs scripts/tests/mcp-publish-reliability.test.mjs
Publish path
- Merge the
0.1.3release PR tomain - Push tag
mcp-v0.1.3 - Let
.github/workflows/publish-mcp.ymlpublish via npm trusted publishing - Verify live npm with
npm view @martinloop/mcp version - Re-run
pnpm --filter @martinloop/mcp smoke:publishedagainst the real published package - From
packages/mcp, run:mcp-publisher login githubmcp-publisher publish
Notes
- npm publication remains the required precursor to official MCP Registry publication.
- This release intentionally stays on the MCP package line only; the root
martin-looppackage remains on the OSS0.1.xline independently.
Breaking Changes
- Enforced `additionalProperties: false` on public tool schemas.
- Packaged artifact now requires and ships `server.json` alongside `package.json`.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Keesan12/Martin-Loop
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]