s-b-e-n-s-o-n/portkey-admin-mcp

Added

• Type-check the test suite in local and hosted CI, align Node type definitions with the Node 24 runtime, and pin the expected npm version through packageManager.
• Add stateless GET /mcp redelivery from Last-Event-ID, including detached completion when a client disconnects before an in-flight POST result is ready.
• Add rotate_api_key and five Secret Reference CRUD tools, plus documented-response fixtures, contracts, and a safe disposable live-fixture recorder.

Changed

• Upgrade to node-redis 6.1 and TypeScript 7.0 while preserving the Redis event store's RESP2, timeout, and keepalive behavior.
• Keep the stateless event store opt-in (off by default); memory enables single-instance replay and redis enables cross-instance replay.
• Require integer current_page and page_size values across all paginated tools.

Security

• Pin the MCP Registry publisher to v1.7.9 and verify its official SHA-256 checksum before executing it in the OIDC-enabled release job.
• Harden unauthenticated loopback Host validation for IPv4 and bracketed IPv6, including rejection of malformed IPv6 authority suffixes.
• Use opaque replay cursors and per-stream memory/Redis leases so cursors cannot be guessed and concurrent replay connections cannot duplicate delivery.

Fixed

• Run release CI and registry publishing against the requested tag during manual/automatic dispatches instead of implicitly checking out main.
• Normalize trailing slashes in PORTKEY_BASE_URL, strictly validate integer environment settings, and apply the configured graceful-shutdown timeout consistently.
• Accept post-initialization MCP requests without a protocol header by using negotiated/backwards-compatible behavior, while continuing to reject unsupported or mismatched versions.
• Return controlled JSON for malformed request bodies instead of Express's default HTML error response.
• Restore the missing 0.4.1 changelog boundary and clearly label the June audit and completed roadmap as historical snapshots.

What's Changed

• 🔧 config(coderabbit): tailor agent rules for MCP tool surface by @scttbnsn in https://github.com/CodesWhat/portkey-admin-mcp/pull/17
• 🔧 config(greptile): on-call reviews only, skip automatic by @scttbnsn in https://github.com/CodesWhat/portkey-admin-mcp/pull/21
• Release v0.5.0: control-plane tools, resumable MCP, Redis 6 and TypeScript 7 by @scttbnsn in https://github.com/CodesWhat/portkey-admin-mcp/pull/22

Full Changelog: https://github.com/CodesWhat/portkey-admin-mcp/compare/v0.4.2...v0.5.0