This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryPro users no longer get silently rate‑limited; env var FREIGHTUTILS_API_KEY now passes API keys through both HTTP and stdio transports.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds support for `FREIGHTUTILS_API_KEY` env var to build Authorization header. Adds support for `FREIGHTUTILS_API_KEY` env var to build Authorization header. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Feature | Low |
Updates `npx freightutils-mcp ping` diagnostic to report observed tier and auth status. Updates `npx freightutils-mcp ping` diagnostic to report observed tier and auth status. Source: llm_adapter@2026-05-31 Confidence: high |
— |
| Bugfix | Medium |
Fixes silent rate‑limiting for Pro users on stdio transport by forwarding `FREIGHTUTILS_API_KEY`. Fixes silent rate‑limiting for Pro users on stdio transport by forwarding `FREIGHTUTILS_API_KEY`. Source: llm_adapter@2026-05-31 Confidence: low |
— |
| Refactor | Low |
Removes outdated limitation note from README and adds `FREIGHTUTILS_API_KEY` setup instructions. Removes outdated limitation note from README and adds `FREIGHTUTILS_API_KEY` setup instructions. Source: llm_adapter@2026-05-31 Confidence: high |
— |
Full changelog
Added
FREIGHTUTILS_API_KEYenv var support.apiGet/apiPostnow build anAuthorization: Bearerheader from the env var on every outbound call when set. Backwards compatible — unset env var preserves the existing anonymous behaviour, so users running freely continue to work without code changes.
Fixed
- Sytze pattern. Pro customers using the stdio transport were silently being rate-limited at the anonymous 25/day cap because the package was not forwarding the API key from the environment to the underlying
/api/*HTTP calls. v2.3.0 closes this end-to-end — the same key honored by the remote/api/mcptransport now flows through the stdio path too.
Updated
npx freightutils-mcp pingdiagnostic now reports observed tier. WithFREIGHTUTILS_API_KEYset, the header now readsauth: ✓ Authenticated as Pro(orFree) after a successful/api/auth/whoamicall; with the env var unset it readsauth: ⚠ Anonymous (25/day cap). Adds a fourth informational line at the diagnostic header without changing the existing 3-check exit semantics.- README — removed the "Known limitation: this npm package does not yet pass the API key through" wording from the Troubleshooting table; replaced with
FREIGHTUTILS_API_KEYsetup instructions. Added an "Authenticating with a Pro key" section under Installation with a stdio config example that wiresFREIGHTUTILS_API_KEYinto theenvblock of an MCP server entry.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About SoapyRED/freightutils-mcp
17 freight calculation and reference tools — ADR dangerous goods, HS codes, LDM/CBM/chargeable weight calculators, duty estimation, airline codes, UN/LOCODE, and more. Free REST APIs + MCP server.
Related context
Related tools
Earlier breaking changes
- v1.0.5 /api/mcp promoted as canonical Streamable HTTP transport URL.
Beta — feedback welcome: [email protected]