| 1 |
root |
1.2 |
Revision history for AnyEvent::MCP |
| 2 |
|
|
|
| 3 |
root |
1.57 |
0.82 (unreleased) |
| 4 |
|
|
- bootstrap remote mcp-fs over a short Perl command, streaming the |
| 5 |
|
|
launcher source over stdin. Avoid rsh command length limits and |
| 6 |
|
|
preserve worker input across exec by using exact sysread. |
| 7 |
root |
1.58 |
- format mcp-fs sandbox grants, tools, trusted configuration keys |
| 8 |
|
|
and permission action classes as individually searchable POD items. |
| 9 |
root |
1.57 |
|
| 10 |
root |
1.56 |
0.81 Thu 05 Nov 2026 04:51:59 CET |
| 11 |
root |
1.55 |
- keep OAuth2 tests working without optional Mail::IMAPTalk, |
| 12 |
|
|
IO::Socket::SSL or Authen::SASL; skip only worker-specific checks. |
| 13 |
|
|
- support optional `mount-try.SUFFIX = ro:/path` or `rw:/path` in |
| 14 |
|
|
mcp-fs configuration. Pass these directly as bubblewrap |
| 15 |
|
|
--ro-bind-try/--bind-try for each invocation, without startup path |
| 16 |
|
|
checks, locally and remotely; required mount.* entries are unchanged. |
| 17 |
|
|
- support one remote host per mcp-fs instance with -h/--host and |
| 18 |
|
|
-e/--rsh; resolve remote workdirs and available tools in a single |
| 19 |
|
|
startup probe, then execute existing workers through a binary-framed |
| 20 |
|
|
remote Perl launcher without installing any MCP modules remotely. |
| 21 |
root |
1.56 |
- use logical absolute pathnames (without resolving symlinks) as compact |
| 22 |
|
|
workdir IDs across hosts; qualify remote permission scopes independently. |
| 23 |
|
|
Named profiles remain shared between instances. Report cached remote |
| 24 |
|
|
VCS markers and remote umask. |
| 25 |
root |
1.55 |
- reserve -h for application-specific options; --help remains common. |
| 26 |
|
|
- test remote workers, external GNU utilities, permission isolation, |
| 27 |
|
|
shell argument quoting and startup probing using a mock remote shell |
| 28 |
|
|
and bubblewrap, including unsandboxed/auto behavior. Verify matching |
| 29 |
root |
1.56 |
workdir IDs for identical logical paths across local and remote |
| 30 |
root |
1.55 |
instances. |
| 31 |
|
|
- make mock remote-agent tests independent of a local SSH_AUTH_SOCK |
| 32 |
|
|
inherited from the test runner (including CPAN Testers). |
| 33 |
|
|
- document --eager when starting mcp-webbrowser through multibroker; |
| 34 |
|
|
defer possible downstream preferences for --eager and --hidden. |
| 35 |
|
|
|
| 36 |
root |
1.53 |
0.8 Thu 05 Nov 2026 01:52:48 CET |
| 37 |
root |
1.49 |
- INCOMPATIBLE CHANGE: due to the added user management, existing |
| 38 |
|
|
url tokens have been invalidated. |
| 39 |
root |
1.54 |
- limit distribution permission normalization to its staging |
| 40 |
|
|
directory, and supply proper CPAN author and abstract metadata. |
| 41 |
root |
1.52 |
- give shared command-line switches their own reference in |
| 42 |
|
|
Server::Simple; use individually indexed POD items for executable |
| 43 |
|
|
options and application-specific shared-option behavior. |
| 44 |
root |
1.51 |
- refresh the introductory guide and mcp-imap/mcp-http manuals |
| 45 |
|
|
with first-use workflows, OAuth2 setup, mailbox/search examples |
| 46 |
|
|
and reverse-TLS troubleshooting; correct stale retry documentation. |
| 47 |
root |
1.50 |
- extend mcp-imap SEARCH filters with recursive AND/OR/NOT, header, |
| 48 |
|
|
text/body, date, size and flag criteria; use explicitly quoted |
| 49 |
|
|
IMAP arguments and bounded filter complexity. |
| 50 |
|
|
- capture deliberately triggered connection errors in test assertions, |
| 51 |
|
|
avoiding noisy successful test runs. |
| 52 |
root |
1.49 |
- expose IMAP LSUB to inspect subscribed mailboxes, alongside |
| 53 |
|
|
subscribe/unsubscribe; return the same format as LIST. |
| 54 |
|
|
- remove superseded IMAP OAuth provider and pagination prototypes |
| 55 |
|
|
and their obsolete reference tests. |
| 56 |
root |
1.51 |
- defer outgoing mail submission research (mcp-smtp or mcp-imap) |
| 57 |
|
|
in TODO.md. |
| 58 |
root |
1.48 |
- retry reverse connections only for TCP connection refusal and |
| 59 |
|
|
unexpected disconnects; report and stop on other TCP errors or |
| 60 |
|
|
TLS handshake/verification failures. |
| 61 |
|
|
- force scalar context when checking Mail::IMAPTalk results; |
| 62 |
|
|
list context truncated LIST responses and could corrupt SEARCH |
| 63 |
|
|
results. Test with context-sensitive IMAP mocks. |
| 64 |
|
|
- report HTTPS reverse-connection handshake failures rather than |
| 65 |
|
|
silently retrying; send credentials only after verified TLS succeeds. |
| 66 |
|
|
- omit pointless mailbox permission dimension for mcp-imap mailboxes. |
| 67 |
|
|
- clarify expected OAuth redirect error page and account selection. |
| 68 |
|
|
- implement mcp-imap OAuth2 authorization-code login with PKCE, |
| 69 |
|
|
human-pasted headless browser redirect, HTTPS token exchange, |
| 70 |
|
|
refresh-token persistence/rotation and IMAP SASL XOAUTH2. |
| 71 |
|
|
Keep interactive credentials outside MCP tools and argv. |
| 72 |
|
|
- omit unnecessary shell quotes in mcp-imap providers commands. |
| 73 |
|
|
- expand mcp-imap providers with Thunderbird ISPDB domain search, |
| 74 |
|
|
provider-hosted HTTPS autoconfig lookup and ISPDB fallback, |
| 75 |
|
|
password-based IMAP alternatives and provider setup instructions; |
| 76 |
|
|
continue printing optional OAuth configuration without saving it. |
| 77 |
root |
1.47 |
- add per-downstream --hidden to mcp-multibroker, omitting a |
| 78 |
|
|
server's tools from normal discovery while retaining explicit |
| 79 |
|
|
list-tools, discover-brokers and call-tool access. |
| 80 |
root |
1.46 |
- number the user management test consecutively as t/27_users.t. |
| 81 |
root |
1.45 |
- tidy Perl import grouping, internal comments and source layout |
| 82 |
|
|
in the command-line tools and library modules. |
| 83 |
|
|
- stop imposing an IMAP account file mode check; access is governed |
| 84 |
|
|
by ordinary filesystem permissions. |
| 85 |
root |
1.44 |
- use the permission engine's literal matching convention for exact |
| 86 |
|
|
user identities and test positive permission-scope validation. |
| 87 |
|
|
- reject invalid browser WebSocket credentials via the documented |
| 88 |
|
|
handshake exception interface, producing one specific warning. |
| 89 |
|
|
- apply the same handshake rejection handling to Vim WebSocket |
| 90 |
|
|
connections, including peer and invalid-token/path warnings. |
| 91 |
|
|
- document user-management scopes and URL examples in command help. |
| 92 |
root |
1.43 |
- add scoped, revocable MCP users with HKDF-derived credentials, |
| 93 |
|
|
an implicit global default user, and atomic user management; |
| 94 |
|
|
list effective user URLs with --print-url[=USER], also accepting |
| 95 |
|
|
--print-urls, without binding the advertised listener port. |
| 96 |
|
|
- associate HTTP credentials with per-request users, bind user |
| 97 |
|
|
identity to persistent permissions and permission continuations, |
| 98 |
|
|
and delegate original users through trusted multibrokers. |
| 99 |
|
|
- select the effective connect_user (default: default) for reverse |
| 100 |
|
|
MCP, private Vim and browser connections, independently of normal |
| 101 |
|
|
authenticated HTTP tool calls. |
| 102 |
root |
1.42 |
- treat empty directory paths as "." in mcp-fs list, find, grep and |
| 103 |
|
|
VCS cwd, without accepting empty filenames. |
| 104 |
root |
1.41 |
- support opportunistic HTTP/HTTPS and reverse MCP connections on the |
| 105 |
|
|
same listener, TLS certificate/key CLI options, and dual URL discovery; |
| 106 |
|
|
support verified HTTPS for outgoing reverse connections. |
| 107 |
root |
1.39 |
- treat idle HTTP disconnects as normal EOF while retaining errors |
| 108 |
|
|
for clients disconnecting during request headers or bodies. |
| 109 |
|
|
- identify failing MCP connections by client name, remote address |
| 110 |
|
|
and connection id, including modern per-request client metadata. |
| 111 |
root |
1.38 |
- trace local multibroker prompt starts, outcomes and cancellations |
| 112 |
|
|
with elapsed time to diagnose disappearing permission dialogs. |
| 113 |
|
|
- use an 8 MiB default MCP message size across JSONL and HTTP |
| 114 |
|
|
clients and servers, allowing large base64 tool requests through |
| 115 |
|
|
mcp-multibroker; log server transport errors at warn level |
| 116 |
|
|
instead of silently closing connections. |
| 117 |
root |
1.37 |
- load AnyEvent::Log at compile time so its format_time call is parsed |
| 118 |
|
|
as a function, fixing activity logging on Perl 5.10. |
| 119 |
|
|
|
| 120 |
root |
1.36 |
0.71 Fri 30 Oct 2026 18:01:51 CET |
| 121 |
root |
1.35 |
- make multibroker-spawned children ask for permissions through MCP, |
| 122 |
|
|
independently of the multibroker's own permission prompt mode. |
| 123 |
root |
1.36 |
- log VCS backend and a bounded, JSON-quoted preview of filenames for |
| 124 |
|
|
vcs-diff, vcs-status and vcs-log. |
| 125 |
|
|
- load only core modules in t/00_load.t; optional IMAP dependencies |
| 126 |
|
|
are tested separately when available. |
| 127 |
|
|
- let the fake bubblewrap test use the host temporary directory on |
| 128 |
|
|
systems without /tmp (notably Termux). |
| 129 |
|
|
- suppress Perl startup locale warnings in sandbox workers when |
| 130 |
|
|
the requested C.UTF-8 locale is unavailable. |
| 131 |
|
|
- canonicalize temporary test paths to match mcp-fs on systems with |
| 132 |
|
|
symlinked temp directories; diagnose failing filesystem assertions. |
| 133 |
|
|
- test SSE notification ordering at client delivery rather than |
| 134 |
|
|
server enqueue time, avoiding a network scheduling race. |
| 135 |
|
|
- diagnose failing multibroker HTTP integration tests with preflight |
| 136 |
|
|
responses, RPC results and bounded server startup diagnostics. |
| 137 |
root |
1.35 |
|
| 138 |
root |
1.34 |
0.7 Fri 30 Oct 2026 14:56:18 CET |
| 139 |
|
|
- WARNING: mcp-imap is unfinished and has not been tested against a real IMAP server. |
| 140 |
|
|
- INCOMPATIBLE CHANGE: rules have changed, old rules will be erased. |
| 141 |
|
|
- declare the same license terms as Perl itself in distribution metadata. |
| 142 |
|
|
- new mcp servers in this release: mcp-http |
| 143 |
|
|
- accept optional dimension default matcher for persistent-rule prompts; |
| 144 |
root |
1.33 |
- clarify that mcp-fs exec has private /tmp by default; shared-tmp |
| 145 |
|
|
exposes host /tmp and is not needed for ordinary temporary files or IPC. |
| 146 |
root |
1.32 |
- add mcp-fs vcs-log for Git, SVN, CVS and Mercurial, reusing bounded |
| 147 |
|
|
output and dedicated permission actions; SVN log receives network |
| 148 |
|
|
and SSH-agent grants alongside CVS operations. |
| 149 |
root |
1.31 |
mcp-webbrowser prefers any JavaScript in the current tab, while the |
| 150 |
|
|
independent origin dimension remains scoped to the current origin. |
| 151 |
root |
1.30 |
- log mcp-http requests with their method and a sanitized URL preview; |
| 152 |
|
|
identify mcp-http/$VERSION in User-Agent unless overridden by the caller. |
| 153 |
root |
1.31 |
Allow generic key=value context in the shared mcp_log_request formatter. |
| 154 |
root |
1.29 |
- silently treat invalid saved permission-rule files as empty, prompting |
| 155 |
|
|
instead of aborting broker startup; subsequent saves replace the old file. |
| 156 |
root |
1.30 |
- add mcp-http for arbitrary HTTP methods with URL-scoped approvals, |
| 157 |
|
|
caller-managed cookie jars, bounded bodies and text grep/regex/substitution. |
| 158 |
|
|
Disable redirects, retries and proxies; verify HTTPS certificates. |
| 159 |
|
|
- derive browser permission origins from reported URLs, not a new |
| 160 |
|
|
userscript field; keep older browser clients able to execute with |
| 161 |
|
|
origin-scoped permissions. |
| 162 |
|
|
- accept compatible browser-protocol minor versions; return empty |
| 163 |
|
|
operation discovery for 1.0 clients instead of disconnecting them. |
| 164 |
root |
1.29 |
Direct rule saves no longer perform semantic validation. |
| 165 |
root |
1.28 |
- replace special-case subject, origin and workdir permission scopes with |
| 166 |
|
|
named dimensions: metadata-driven prompts, generic match.NAME rule keys, |
| 167 |
|
|
and engine-enforced matcher choices. Reject old request and rule fields; |
| 168 |
|
|
no conversion or backward-compatible rule loading. |
| 169 |
root |
1.27 |
- preserve selected origin scopes when external permission helpers |
| 170 |
|
|
forward persistent decisions through native MCP elicitation. |
| 171 |
root |
1.26 |
- add origin-scoped MCP permission rules, selectable independently of |
| 172 |
root |
1.30 |
code/tab scopes; mcp-webbrowser derives browser origins for |
| 173 |
root |
1.26 |
JavaScript and tab operations, with exact, any-port and any-origin |
| 174 |
|
|
choices. Existing rules without origins continue to match all origins. |
| 175 |
root |
1.25 |
- use POSIX::uname instead of nonportable hostname -f for the XPCSE |
| 176 |
|
|
browser nickname, consistent with HTTP URL wildcard host selection. |
| 177 |
|
|
- make form helper test run via explicit ./ path, avoid early HTTP |
| 178 |
|
|
timer races, and test filesystem discovery with optional tools absent. |
| 179 |
root |
1.23 |
- report browser protocol rejections through bounded WebSocket close |
| 180 |
|
|
reasons; show abnormal disconnects in the userscript console and toast. |
| 181 |
|
|
- document browser wire-protocol minor-version compatibility: accept |
| 182 |
|
|
compatible older and newer clients without breaking base functionality. |
| 183 |
|
|
- remove the obsolete private stdio permission-result bridge from |
| 184 |
|
|
mcp-multibroker; use ordinary form elicitation. |
| 185 |
root |
1.22 |
- add per-tab operation discovery and calls to mcp-webbrowser, with |
| 186 |
|
|
per-tab routing, ordinary MCP permissions and browser protocol 1.1; |
| 187 |
|
|
the userscript initially advertises no extra operations. |
| 188 |
|
|
- make the unsandboxed-warning test tolerate diagnostic output from |
| 189 |
|
|
non-GNU utility probes (FreeBSD and BusyBox). |
| 190 |
|
|
- add mcp-imap with one named password-authenticated account per instance, |
| 191 |
|
|
bounded UID search, MIME reads, explicit mailbox/message mutations, |
| 192 |
|
|
UIDPLUS-only targeted expunge, forked worker and MCP permissions. |
| 193 |
root |
1.21 |
- propagate XPCSE save response ETags back to Vim session metadata; |
| 194 |
|
|
make stale upload HTTP status an editor error. |
| 195 |
|
|
- require GNU sed in worker tool discovery; report missing-Perl diagnostics in tests. |
| 196 |
root |
1.18 |
- xpcse: forward Vim's :write! flag through mcp-vim to browser |
| 197 |
|
|
uploads, without changing upload behavior yet. |
| 198 |
root |
1.19 |
- recommend rather than require WebSocket modules: only mcp-vim and |
| 199 |
|
|
mcp-webbrowser use them; mcp-vim loads them only for browser clients, |
| 200 |
|
|
and tests skip optional WebSocket coverage when unavailable. |
| 201 |
root |
1.18 |
|
| 202 |
root |
1.17 |
0.65 Fri 23 Oct 2026 22:41:32 CEST |
| 203 |
root |
1.14 |
- fix mcp-webbrowser userscript title indicator duplicating prefixes on empty titles. |
| 204 |
root |
1.17 |
- use built scripts in make test PATH, avoiding source shebangs and |
| 205 |
|
|
accidentally installed helpers in rule management tests. |
| 206 |
root |
1.15 |
- clarify browser execute code wrapper and reject function/symbol return |
| 207 |
|
|
values instead of silently converting them to null. |
| 208 |
root |
1.17 |
- fix many bugs in the testsuite. |
| 209 |
root |
1.13 |
|
| 210 |
root |
1.12 |
0.62 Thu 22 Oct 2026 13:32:52 CEST |
| 211 |
root |
1.16 |
- INCOMPATIBLE API CHANGE: mcp_getoptions now returns a hash reference instead of |
| 212 |
|
|
a key/value list. |
| 213 |
root |
1.11 |
- Simple accepts server_name/server_version independently of the local |
| 214 |
|
|
instance name, leaving server_info as an unmodified protocol override. |
| 215 |
|
|
- query multibroker children in parallel for tool and broker discovery, |
| 216 |
|
|
preserving tool order and returning partial results after 15 seconds |
| 217 |
|
|
instead of blocking on an unresponsive child. |
| 218 |
root |
1.8 |
- accept a missing trailing slash on HTTP MCP endpoint URLs, working |
| 219 |
root |
1.10 |
around Claude's MCP connector wrongly dropping it from the configured URL, |
| 220 |
root |
1.18 |
thus corrupting it. |
| 221 |
root |
1.7 |
- allow omitted ports in reverse extension URLs, defaulting to port 80. |
| 222 |
root |
1.9 |
- fix MCP client/server version fields serialized as JSON numbers in 0.61. |
| 223 |
root |
1.7 |
|
| 224 |
root |
1.6 |
0.61 Thu 22 Oct 2026 08:57:42 CEST |
| 225 |
root |
1.5 |
- resolve bind hostnames via AnyEvent::Socket instead of Socket::getaddrinfo. |
| 226 |
root |
1.4 |
- honor user-selected file permissions and preserve them across replacements. |
| 227 |
|
|
- fix permission test fixture grants. |
| 228 |
|
|
- fix activity log timestamp formatting on older perl versions. |
| 229 |
|
|
- correct multibroker test tool count (including meta-instructions). |
| 230 |
|
|
- fix perl 5.12 syntax errors in mcp-fs and mcp-vim. |
| 231 |
|
|
|
| 232 |
root |
1.3 |
0.6 Wed 21 Oct 2026 20:43:20 CEST |
| 233 |
root |
1.2 |
- 34k LOC of pure llm madness. but seems to work. yay. |
| 234 |
root |
1.1 |
|
| 235 |
|
|
0.0 Sat 03 Oct 2026 07:29:39 CEST |
| 236 |
|
|
- original version, an AnyEvent::HTTP clone. |
