Skip to content

vinkius-labs/mcp-fusion

v3.1.6 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 3mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mcp mcp-framework mcp-server model-context-protocol

Affected surfaces

auth

Summary

AI summary

Fixed a race condition corrupting session data in the serverless FSM.

Full changelog

Fixed

  • FSM race condition in serverless — Concurrent requests shared mutable FSM state, corrupting session data. Added StateMachineGate.clone() for per-request isolation when fsmStore is present.

  • Underscore parsing breaks Inspector topologystartServer.ts split flat tool names by '_', misattributing groups for tools like user_accounts_list. Now uses builder.getName() directly.

  • Same underscore bug in telemetryServerAttachment.ts used split('_') for route events, producing incorrect telemetry attribution. Now resolves via exposition routing map.

  • ** createGroup.execute() throws instead of returning ToolResponse** — Unknown actions threw Error and Zod validation threw ZodError, violating the Promise<ToolResponse> contract. Now returns toolError() with INVALID_PARAMS code.

  • schema.strict() re-allocated per call — Strict schemas now pre-computed at group creation time.

Test Suite

  • 55 new regression tests across 6 test files covering FSM concurrency isolation, underscore parsing correctness, and createGroup contract compliance.
  • 3340 total tests passing across 128 test files.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

Sign up free

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Earlier breaking changes

  • v4.0.0 All packages now published under the `@mcpfusion` npm scope.
  • v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
  • v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.

Beta — feedback welcome: [email protected]