This release includes 1 security fix for security teams reviewing exposed deployments.
Affected surfaces
Summary
AI summaryUpdates default, https://github.com/advisories/GHSA-345p-7cg4-v4c7, and byte-identical across a mixed release.
Full changelog
What's new in 1.11.0
Step #6 of the MCP modernization roadmap: a pluggable transport factory. ClarifyPrompt can now serve over Streamable HTTP in addition to stdio — the runway toward Agent-to-Agent (A2A, #7) and remote MCP hosts. stdio stays the default; nothing about existing setups changes.
Transports
Set CLARIFYPROMPT_TRANSPORT:
| Value | Behaviour |
|---|---|
| stdio (default) | One server over stdin/stdout — exactly as before |
| streamable-http | MCP Streamable HTTP over Node's built-in http (no new deps): stateful sessions (mcp-session-id), SSE streaming, a /health probe |
HTTP knobs (only in streamable-http mode): CLARIFYPROMPT_HTTP_PORT (3000), CLARIFYPROMPT_HTTP_HOST (127.0.0.1 — localhost-only by default; set 0.0.0.0 to expose), CLARIFYPROMPT_HTTP_PATH (/mcp).
```bash
CLARIFYPROMPT_TRANSPORT=streamable-http CLARIFYPROMPT_HTTP_PORT=3000 npx clarifyprompt-mcp
→ POST http://127.0.0.1:3000/mcp · GET http://127.0.0.1:3000/health
```
Per-session server factory
Tool/resource registration moved into an exported createServer() factory. stdio creates exactly one server; streamable-http creates one per session — the SDK-recommended pattern, since sharing a single server across concurrent HTTP sessions can leak one client's response data to another (GHSA-345p-7cg4-v4c7).
Back-compat
stdio is unchanged and remains the default — every existing Claude Desktop / Cursor / Claude Code config keeps working with no changes. The registration block was wrapped in createServer() char-identical; the stdio wire test passes unmodified.
Tests
New deterministic npm run test:http (tests/http-transport.mjs) drives a real MCP session over HTTP (no LLM): /health, initialize → session id, tools/list returns all 23 tools, unknown path → 404, and a second client gets a distinct session id (per-session isolation proven). Added to test:all.
Verified
test:http · wire/stdio (byte-identical) · resources / elicit / thinking / cancel · integration 9/9 · compose eval on gemma4:31b-cloud · all CI build/docker/secrets jobs · evals on gpt-4o-mini.
Install
```bash
npm install -g [email protected]
```
Security Fixes
- GHSA-345p-7cg4-v4c7 – per‑session server factory prevents response data leakage between concurrent HTTP clients
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About LumabyteCo/clarifyprompt-mcp
MCP server for AI prompt optimization — transforms vague prompts into platform-optimized prompts for 58+ AI platforms across 7 categories (image, video, voice, music, code, chat, document).
Related context
Related tools
Earlier breaking changes
- v1.7.0 Migrated all tools from `server.tool()` shorthand to `server.registerTool()`.
Beta — feedback welcome: [email protected]