Skip to content

nteract/semiotic

v3.7.2 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 1mo MCP Data & Storage
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai d3 data-visualization nteract react streaming
+1 more
visualization

Affected surfaces

auth rce_ssrf

Summary

AI summary

Added stateless MCP HTTP mode and Cloud Run deployment wrapper for autoscaling.

Changes in this release

Security High

Hardens MCP HTTP mode by normalizing Host header, returning clean 404s, and closing transports promptly to prevent DNS rebinding and keep‑alive leaks.

Hardens MCP HTTP mode by normalizing Host header, returning clean 404s, and closing transports promptly to prevent DNS rebinding and keep‑alive leaks.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Feature Low

Adds stateless MCP HTTP mode for hosted connectors, enabling autoscaling serverless hosts like Cloud Run.

Adds stateless MCP HTTP mode for hosted connectors, enabling autoscaling serverless hosts like Cloud Run.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Feature Low

Adds Cloud Run deployment wrapper packaging minimal public MCP deployment with documentation and privacy pages.

Adds Cloud Run deployment wrapper packaging minimal public MCP deployment with documentation and privacy pages.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Dependency Medium

Updates Cloud Run wrapper dependency to require semiotic@^3.7.2, ensuring the hosted wrapper resolves the 3.7.2 MCP server.

Updates Cloud Run wrapper dependency to require semiotic@^3.7.2, ensuring the hosted wrapper resolves the 3.7.2 MCP server.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Fixes light selected‑row fallback in accessible navigation tree when dark mode lacks --semiotic-surface token.

Fixes light selected‑row fallback in accessible navigation tree when dark mode lacks --semiotic-surface token.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Fixes bidirectional BarChart rendering as a light Carbon island inside dark docs theme.

Fixes bidirectional BarChart rendering as a light Carbon island inside dark docs theme.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Fixes missing visual annotations in contested‑annotations blog demo caused by string month values used as XY coordinates.

Fixes missing visual annotations in contested‑annotations blog demo caused by string month values used as XY coordinates.

Source: llm_adapter@2026-06-13

Confidence: high

 —
Full changelog

Added

  • Stateless MCP HTTP mode for hosted connectors. semiotic-mcp --http now creates an
    ephemeral MCP server + Streamable HTTP transport per request, returns JSON responses instead of
    holding long-lived SSE streams open, and exposes /mcp, /healthz, and /health endpoints. This
    makes the read-only MCP tool surface suitable for autoscaling serverless hosts such as Cloud Run.
  • Cloud Run deployment wrapper. deploy/cloud-run packages a minimal public MCP deployment that
    runs the published semiotic-mcp binary, documents unauthenticated read-only deployment, health
    endpoints, host allowlisting, and ChatGPT/Claude connector setup, and includes hosted-app privacy
    and terms pages for app review.

Changed

  • MCP HTTP hardening. HTTP mode normalizes the Host header for optional
    MCP_ALLOWED_HOSTS DNS-rebinding protection, returns clean 404s for non-MCP paths including
    .well-known/* probes, makes request teardown idempotent, and closes each per-request transport
    promptly to avoid serverless keep-alive leaks.
  • Docs dark-mode polish. The visible AccessibleNavTree selected row now resolves through
    --semiotic-surface, --semiotic-grid, and --semiotic-bg, with --semiotic-text applied to
    visible rows. The Accessibility / Structured Navigation bidirectional BarChart now mirrors the
    docs theme by switching between carbon and carbon-dark.
  • Annotation blog demo reliability. The "Annotations That Get Contested, and Heard" chart now
    uses numeric XY coordinates with month tick formatting, so editorial-status callouts render on the
    visible line while the prose and navigation tree keep human-readable month labels.
  • Cloud Run wrapper release line. The Cloud Run package now depends on semiotic@^3.7.2 so the
    hosted wrapper resolves the 3.7.2 MCP server after the npm package is published.

Fixed

  • Fixed a light selected-row fallback in the accessible navigation tree when the docs site was in
    dark mode but no --semiotic-surface token was present.
  • Fixed the bidirectional sync demo's BarChart rendering as a light Carbon island inside dark docs.
  • Fixed missing visual annotations in the contested-annotations blog demo caused by string month
    values being used as XY coordinates.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track nteract/semiotic

Get notified when new releases ship.

Sign up free

About nteract/semiotic

React data visualization MCP server with 30+ chart types. 5 tools: suggest charts for a dataset, render validated React configs to SVG, diagnose configuration anti-patterns, get component schemas, and report issues.

All releases →

Related context

Earlier breaking changes

  • v3.8.1 Removed `/healthz` alias; only `GET /health` is supported for health checks.
  • v3.8.0 Deprecates `GuantletChart` typo alias; use `GauntletChart`. Migration required.
  • v3.6.0 Changes DifferenceChart to accept 2+ series via top‑2 subselection, adding caveats for extra series.
  • v3.6.0 Changes AreaChart to a single‑series chart; multi‑series inputs are subselected.

Beta — feedback welcome: [email protected]