This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Summary
AI summaryAdded incremental MCP Registry sync, private‑registry opt‑in support, and SPEC_COMPLIANCE.md compliance tracking.
Full changelog
Added
SPEC_COMPLIANCE.mdtracks PMCP against the current stable MCP revision
(2025-11-25) with a per-requirement compliance table, a draft-revision
migration assessment (stateless transport, theio.modelcontextprotocol/tasks
extension,server/discover,CacheableResult, DCR→Client ID Metadata
Documents, SSE resumability), and a next-stable tracking checklist. PMCP is
confirmed compliant with the folded-in current-stable items (403 on invalid
Originper PR #1439,insufficient_scope403 step-up per SEP-835,
input-validation as tool-execution errors per SEP-1303, JSON Schema 2020-12
default dialect per SEP-1613, tool/resource/prompt icon passthrough per
SEP-973).- MCP Registry incremental sync. The registry client persists
last_synced_at
and acceptsupdated_sinceto fetch only changed servers
(?version=latest&updated_since=…with cursor pagination), merging deltas into
the cache viamerge_registry_delta. A failed incremental attempt degrades to
a full fetch, and a failed full fetch degrades to the prior cache. Default
full-fetch callers are unchanged. - Opt-in private-registry support (
PMCP_REGISTRY_ALLOW_PRIVATE, default off).
When enabled withPMCP_REGISTRY_PRIVATE_ENDPOINT, PMCP discovers from a
private/custom registry and tolerates draft/non-GAserver.jsonschema fields,
surfacing all versions — a debugging aid for developers building their own
private MCP servers, not for production discovery. With the flag off,
discovery behavior is unchanged.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About ViperJuice/mcp-gateway
A meta-server for minimal Claude Code tool bloat with progressive disclosure and dynamic server provisioning. Exposes 9 stable meta-tools, auto-starts Playwright and Context7, and can dynamically provision 25+ MCP servers on-demand from a curated manifest.
Related context
Beta — feedback welcome: [email protected]