Changelog

All notable changes to this project. Each entry links to its full per-version file in changelog/.

0.11.0 — 2026-11-10 · ⚠️ Breaking

Correct BrAPI filtering and genotype exports, and keep concurrently staged dataframes queryable.

0.10.1 — 2026-10-18

Preserve literal BrAPI results and bounded collection coverage.

0.10.0 — 2026-10-18 · ⚠️ Breaking

Bound wide result previews while preserving staged data and pedigree recovery.

0.9.1 — 2026-10-18

Preserve SGN observation completeness and resolve study program metadata.

0.9.0 — 2026-10-17 · ⚠️ Breaking · 🛡️ Security

find_* inline results fit a 24,000-byte budget with the rest staged as a dataframe, upstream requests in a call share one 50 s deadline, configured aliases connect on first use, and phenotype tools page past page one. brapi_dataframe_query refuses current_setting, current_schema(s), in_search_path, and query_table. Adopts mcp-ts-core ^0.13.15.

0.8.1 — 2026-10-04 · 🛡️ Security

Apply-mode brapi_submit_observations writes now proceed only on the round that redeems a single-use consent record of the prompt, so a pre-supplied or replayed confirmation asks again. Adopts @cyanheads/mcp-ts-core ^0.13.11.

0.8.0 — 2026-09-23 · ⚠️ Breaking · 🛡️ Security

Server-configured credentials are only sent to the base URL configured with them, and caller-supplied credentials are refused on session-less shared HTTP. The T3 built-ins are gone, auth walls fail brapi_connect with typed errors, and the orientation envelope names the finders the server supports.

0.7.13 — 2026-09-19 · 🛡️ Security

Declares stateful session mode in src/index.ts so an HTTP start under MCP_SESSION_MODE=stateless fails at startup instead of serving a mode the observation-write confirmation round trip cannot use, fixes a ReDoS and a prototype-pollution gap in mcp-ts-core 0.13.1-0.13.6, and lists the hosted endpoint in server.json.

0.7.12 — 2026-09-13

Adopts @cyanheads/mcp-ts-core ^0.13.0: empty and unsubstituted ${…} env values read as unset across every BRAPI_* path, async-search cancellation and poll deadlines classify as RequestCancelled and Timeout, and the framework skill tree moves out of the plugin-loaded skills/ directory.

0.7.11 — 2026-08-22

Adopts @cyanheads/mcp-ts-core ^0.12.3 (MCP SDK v2): every HTTP endpoint serves protocol revision 2026-07-28 alongside the 2025 era, undeclared tool arguments are rejected instead of stripped, and brapi_submit_observations' apply-mode confirmation becomes a multi-round-trip input_required result.

0.7.10 — 2026-07-16

brapi_germplasm_performance and brapi_build_phenotype_matrix now pull per-study observations in bounded-concurrency batches sized by BRAPI_MAX_CONCURRENT_REQUESTS (default 4, previously inert) instead of serially; outcomes reassemble in input order, so matrix column/row order and each tool's failure behavior are unchanged.

0.7.9 — 2026-07-16

brapi_export_genotype_matrix bounds distinct-variant columns via a new maxColumns input and BRAPI_GENOTYPE_MATRIX_MAX_COLUMNS ceiling while keeping every germplasm row; brapi_dataframe_describe budgets its per-column listing and points overflow at brapi_dataframe_query.

0.7.8 — 2026-07-16

brapi_germplasm_performance gains an optional studyDbIds bypass for its study-discovery cap; brapi_walk_pedigree spills node and edge sets exceeding loadLimit to two JOINable canvas dataframes; brapi_find_locations resolves free-form country names to ISO 3166-1 alpha-3 codes via a new iso-country service

0.7.7 — 2026-07-15

mcp-ts-core ^0.10.9 → ^0.10.14, adopting the supply-chain install guard (bunfig minimumReleaseAge, Socket scanner) and a bun-native Docker HEALTHCHECK the slim image can actually run; capped find_* renders and the genotype-matrix preview now name the dataframe holding the rest; export_genotype_matrix clamps maxCalls to the deployment ceiling

0.7.6 — 2026-06-20

mcp-ts-core ^0.10.6 → ^0.10.9 — ctx.content media collector, two new devcheck guards (dependency specifiers, plugin marketplace manifests), sharper canvas SQL error classification; @duckdb/node-api and @types/node bumps; eight skills re-synced

0.7.5 — 2026-06-18

Fix dataframe describe/query failing on an ambiguous table_name probe, and stop get_study from reporting server-wide companion counts as study-scoped

0.7.4 — 2026-06-12

Adopt @cyanheads/mcp-ts-core ^0.10.6, migrate boolean env flags to z.stringbool(), set explicit createApp identity, and harden MCPB bundle packaging

0.7.3 — 2026-06-08

Decouple spillover pageSize from loadLimit via BRAPI_PAGE_SIZE — fixes spillover timeout when agents request a small inline preview

0.7.2 — 2026-06-02

Adopt @cyanheads/mcp-ts-core 0.9.21 — HTTP log context fix, secret-safe error messages, fail-fast retries

0.7.1 — 2026-06-01

fix: find_* dataframe spillover survives reserved-word columns (end, order, etc.) via centralized sanitization; brapi_walk_pedigree now enforces its 1,000-node cap mid-traversal as a hard ceiling

0.7.0 — 2026-06-01

phenotype matrix, germplasm performance, genotype export, observation variable resource

0.6.4 — 2026-05-30

Enrichment adoption — brapi_find_* tools now surface filter echoes, result totals, and empty-result guidance via ctx.enrich(); @cyanheads/mcp-ts-core ^0.9.13 → ^0.9.16

0.6.3 — 2026-05-28

@cyanheads/mcp-ts-core ^0.9.6 → ^0.9.13: HTTP 413 body cap, session-init gate, quieter error logs, landing inventory open-catalog override, URL placeholder guard

0.6.2 — 2026-05-23

mcp-ts-core ^0.9.1 → ^0.9.6: RequestContextLike adoption removes the manual asRequestContext shim in canvas-bridge, format-parity fixes in find-observations and submit-observations, manifest.json + .mcpbignore scaffolded for MCPB bundle support, install badges added to README.

0.6.1 — 2026-05-22

Three field-test fixes against T3 / Breedbase image surfaces: collapse double slashes in resolved imageURL paths, wire the SGN row normalizer through brapi_get_image, and coerce numeric-string image dimensions at schema-validation time.

0.6.0 — 2026-05-22

BMS dialect for the CGIAR crop community, route escalation to POST /search when GET would downcast multi-value filters, walk_pedigree direction field, plus fixes for bbox spillover ordering, schemeless imageURL resolution, singleton-fetch 5xx retry storms, and large inline JSON in find_* text rows.

0.5.5 — 2026-05-16

Adopt framework 0.9.1 — wire instructions field for server-level orientation, port two raw schemas off z.url() and three off .nullish() unions to clear the new cross-vendor portability lint family (schema-format-portability, schema-anyof-needs-type).

0.5.4 — 2026-05-08

Patch maintenance — drop misleading 'legacy' label from the shared-workspace shape; adopt framework 0.8.19 (engines bump, Docker base 1.3, api-telemetry skill).

0.5.3 — 2026-05-05

Per-session isolation on ServerRegistry connection state and the CanvasBridge default canvas — concurrent HTTP callers under MCP_AUTH_MODE=none now operate in isolated workspaces by default.

0.5.2 — 2026-05-05

Tenant-isolation hardening on the dataframe surface — gate brapi_dataframe_describe list-all under shared-trust HTTP, reject system-catalog reads in brapi_dataframe_query, and forward gate context on rejection.

0.5.1 — 2026-05-05

Verify extraFilters honor on every find_* tool and relabel the rendered filters block as Filters sent to server so the trace stops implying the upstream applied them.

0.5.0 — 2026-05-05 · ⚠️ Breaking

Consolidate spillover onto canvas-only dataframes — remove brapi_manage_dataset and the brapi://dataset/{id} resource, mandate DuckDB, gate brapi_dataframe_drop opt-in, and return typed columns from brapi_dataframe_query.

0.4.14 — 2026-05-04

Live-fire fixes against Cassavabase: canvas dataframes survive null columns; deduplicates 11×-repeated synonyms; find_variables actually re-ranks against the spilled union; truthful truncated-dataset metadata; trims empty nested containers.

0.4.13 — 2026-05-04

Built-in alias rename — source-prefixed handles (bti-*, t3-*); adds T3/Oat and T3/Barley; fixes hyphenated-builtin env shadow.

0.4.12 — 2026-05-04

Built-in alias registry — cassava, sweetpotato, wheat, and breedbase resolve out-of-the-box without env vars; orientation envelope now carries CC-BY attribution metadata.

0.4.11 — 2026-05-03

Framework bump to 0.8.13 — gated tools stay visible in the operator manifest via disabledTool(), SQL gate function deny-list adopted from the framework, RequestContext slice swapped onto the framework's exported type.

0.4.10 — 2026-05-03

Dataframe surface (Tier 3, opt-in) — spilled find_* rows auto-register as DuckDB-backed dataframes; agents run SELECT SQL across them via brapi_dataframe_query/describe/drop. Genotype-call cap promoted to operator policy.

0.4.9 — 2026-05-02

Sweetpotatobase follow-up: keep Breedbase location filters plural, add URL-pattern dialect detection, and fail soft when observation spillover pages stall.

0.4.8 — 2026-05-01

Generalize the /observations preflight from germplasm-only to any unanchored query, and make the probe fail-soft via companion call options so a stalled count surfaces as a warning instead of a hard error.

0.4.7 — 2026-05-01

Foundational dialect-bypass fix — every BrAPI client GET routes through the dialect adapter, with tight companion-call budgets so slow upstreams no longer 4× the response time.

0.4.6 — 2026-05-01

BrAPI Test Server v2.0 dialect, shared singularizing engine, and typed all_filters_dropped guard across find_* tools.

0.4.5 — 2026-05-01

Compatibility upgrade: OAuth2 client credentials, tolerant capability fallback, route-planned find tools, and live server matrix.

0.4.4 — 2026-04-30

format() / structuredContent parity — every find_* and get_* tool now emits passthrough fields so text-only clients see the full upstream payload.

0.4.3 — 2026-04-30

Field-test follow-up: studyCount cross-check, find_germplasm text spillover guard, find_observations preflight on unscoped germplasm queries, honest zero-match distributions, prominent dataset expiry.

0.4.2 — 2026-04-30

Row schemas accept null fields from sparse upstreams. FK match-rate checks across find_studies / find_observations / find_images surface silently-ignored filters as warnings. CassavaBase locationDbIds dropped on /studies.

0.4.1 — 2026-04-30

Dialects declare known-dead POST /search routes — raw_search and find_genotype_calls refuse with a typed error before hitting the upstream. Orientation envelope surfaces the active dialect so agents can plan around quirks.

0.4.0 — 2026-04-30

Per-server dialect adapters route around upstream filter quirks. CassavaBase and SGN-family deployments now receive the singular filter forms they actually honor; searchText (the fictional non-spec query param earlier versions sent) is dropped.

0.3.9 — 2026-04-29

Resolver field-name fix for BrAPI v2.1 trait subobjects + bbox swap-on-zero detection for non-conformant GeoJSON deployments.

0.3.8 — 2026-04-29

Field-test fixes from real CassavaBase data — GeoJSON coordinates, pageSize=0→pageSize=1 for v2.1-strict servers, variable text-match by dbId when PUI is sparse, pedigree leaf-count correctness — plus shared find_* rendering.

0.3.7 — 2026-04-29

Add BRAPI_ENABLE_WRITES env-var gate for the write surface — brapi_submit_observations is omitted from tools/list unless the operator opts in for the deployment. Mirrors obsidian-mcp-server's OBSIDIAN_ENABLE_COMMANDS pattern.

0.3.6 — 2026-04-30

Drop the tsx runtime shim — package scripts and the production entry point invoke Bun directly. Fixes a Docker linux/arm64 build failure (tsx + Bun 1.3.13 in oven/bun:1) and aligns the script execution model with the cyanheads MCP fleet.

0.3.5 — 2026-04-30

Cassavabase null-tolerance pass — schemas accept upstream nulls without dropping rows, walk-pedigree no longer false-flags inverse-edge backtracks as cycles, get-image flags broken upstream URLs. Plus npm scope rename to @cyanheads/brapi-mcp-server.

0.3.4 — 2026-04-29

Field-test pass against real BrAPI servers — capability-gated companion lookups, top-level study FK probes, structured-season + multi-set variant tolerance, and a multi-tenant HTTP deployment notice.

0.3.3 — 2026-04-29

Tighten recovery hints across BrAPI tool/resource error contracts and wire service-layer throws so declared hints actually reach the wire.

0.3.2 — 2026-04-29

Adopt mcp-ts-core 0.8.6 typed-error contracts across the BrAPI surface, fix a germplasmOrigin schema bug that broke output validation against spec-compliant servers.

0.3.1 — 2026-04-29

Per-alias env-var fallback for brapi_connect — credentials live in BRAPI__* and never enter the LLM context. Plus a Breedbase /token form-encoding fix that unblocks SGN auth against Cassavabase et al.

0.3.0 — 2026-04-25

Surface complete — adds brapi_submit_observations write tool, six brapi:// resources, two workflow prompts (eda_study, meta_analysis), POST/PUT methods on BrapiClient, and full test backfill (101 → 191 tests).

0.2.1 — 2026-04-24

Framework bump to @cyanheads/mcp-ts-core 0.6.16 — recursive describe-on-fields linting, synced skills, and .describe() coverage on every nested field, array element, and union variant across the 18-tool surface.

0.2.0 — 2026-04-23

Read-side surface expansion — 11 new tools (variables, observations, images, genotype calls, locations, variants, pedigree walks, dataset lifecycle, raw passthrough) plus OntologyResolver and binary image fetch.

0.1.2 — 2026-04-23

Docs and metadata polish for publish — full README, LICENSE, project tree; BrAPI-specific CLAUDE.md; richer package.json keywords/engines, server.json env vars, and Dockerfile OCI labels.

0.1.1 — 2026-04-23

Phase 3 tool surface — 7 read-side BrAPI tools (connect, server_info, describe_filters, find/get studies & germplasm) plus ServerRegistry for session-scoped multi-server workflows and a static BrAPI v2.1 filter catalog.

0.1.0 — 2026-04-23

Initial scaffold from @cyanheads/mcp-ts-core with complete MCP surface design — 19 tools and 6 resources for BrAPI v2.1 find/get, pedigree traversal, writes, filter discovery, and dataset lifecycle.