Skip to content

LumabyteCo/clarifyprompt-mcp

v1.11.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Updates default, https://github.com/advisories/GHSA-345p-7cg4-v4c7, and byte-identical across a mixed release.

Full changelog

What's new in 1.11.0

Step #6 of the MCP modernization roadmap: a pluggable transport factory. ClarifyPrompt can now serve over Streamable HTTP in addition to stdio — the runway toward Agent-to-Agent (A2A, #7) and remote MCP hosts. stdio stays the default; nothing about existing setups changes.

Transports

Set CLARIFYPROMPT_TRANSPORT:

| Value | Behaviour |
|---|---|
| stdio (default) | One server over stdin/stdout — exactly as before |
| streamable-http | MCP Streamable HTTP over Node's built-in http (no new deps): stateful sessions (mcp-session-id), SSE streaming, a /health probe |

HTTP knobs (only in streamable-http mode): CLARIFYPROMPT_HTTP_PORT (3000), CLARIFYPROMPT_HTTP_HOST (127.0.0.1 — localhost-only by default; set 0.0.0.0 to expose), CLARIFYPROMPT_HTTP_PATH (/mcp).

```bash
CLARIFYPROMPT_TRANSPORT=streamable-http CLARIFYPROMPT_HTTP_PORT=3000 npx clarifyprompt-mcp

→ POST http://127.0.0.1:3000/mcp · GET http://127.0.0.1:3000/health

```

Per-session server factory

Tool/resource registration moved into an exported createServer() factory. stdio creates exactly one server; streamable-http creates one per session — the SDK-recommended pattern, since sharing a single server across concurrent HTTP sessions can leak one client's response data to another (GHSA-345p-7cg4-v4c7).

Back-compat

stdio is unchanged and remains the default — every existing Claude Desktop / Cursor / Claude Code config keeps working with no changes. The registration block was wrapped in createServer() char-identical; the stdio wire test passes unmodified.

Tests

New deterministic npm run test:http (tests/http-transport.mjs) drives a real MCP session over HTTP (no LLM): /health, initialize → session id, tools/list returns all 23 tools, unknown path → 404, and a second client gets a distinct session id (per-session isolation proven). Added to test:all.

Verified

test:http · wire/stdio (byte-identical) · resources / elicit / thinking / cancel · integration 9/9 · compose eval on gemma4:31b-cloud · all CI build/docker/secrets jobs · evals on gpt-4o-mini.

Install

```bash
npm install -g [email protected]
```

Security Fixes

  • GHSA-345p-7cg4-v4c7 – per‑session server factory prevents response data leakage between concurrent HTTP clients

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track LumabyteCo/clarifyprompt-mcp

Get notified when new releases ship.

Sign up free

About LumabyteCo/clarifyprompt-mcp

MCP server for AI prompt optimization — transforms vague prompts into platform-optimized prompts for 58+ AI platforms across 7 categories (image, video, voice, music, code, chat, document).

All releases →

Related context

Earlier breaking changes

  • v1.7.0 Migrated all tools from `server.tool()` shorthand to `server.registerTool()`.

Beta — feedback welcome: [email protected]