MCP Server v0.0.1-beta.15

Explicit Account-Wide Access

Eligible users can explicitly authorize Entire account, including future
projects during Convert OAuth consent. That grant enables account-wide tools,
including project creation, while the backend continues to enforce live roles,
permissions, plan limits, and the role approved at consent time.

Selecting all existing projects is still a selected-project grant, not permission
over future projects. Existing customers retain their current access without a
forced reconnect or automatic privilege expansion. Reconnect only to deliberately
approve a broader grant. Local API-key/HMAC access keeps its existing permission
model.

Approval Governance

The MCP preserves Convert's backend approval requirements and returns actionable
request information instead of treating an approval requirement as an ordinary
failed write. Request IDs survive the dedicated safe projection so agents can
inspect an existing pending request rather than submit duplicates.

Approval actions require explicit, target-bound confirmation. The MCP never
automatically approves or retries an approved action. Account-wide approval
settings additionally require explicit account-wide consent on hosted connections.

Approval-request writes are enabled in authorized write profiles, with the
backend's live permissions and independent-review requirements still enforced.

Safer Project Management

Project creation is advertised only for eligible hosted grants and independently
checked against the exact target account at execution. New projects are
discoverable with an existing explicit entire-account grant.

The existing backend project-delete endpoint is now represented in the generated
contract and curated MCP namespace. Deletion still requires an explicit user
request followed by a second confirmation naming the exact numeric resource.
Read-only profiles do not expose deletion; generated operation IDs cannot bypass
the namespace guardrails.

Reliability And Knowledge

• Grant-aware catalogs recover after transient scope-resolution failures and
  notify compatible clients when the authoritative catalog changes.
• Refreshed knowledge corpus with 9,738 chunks and compatibility mappings for
  previously issued document IDs. Local semantic search and hosted hybrid search
  retain their respective vector-backed implementations.
• Standalone validators cover all 127 generated API operations, including the
  newly exported project lifecycle operation.
• Improved reusable MCP Inspector certification distinguishes successful feature
  access, expected plan restrictions, deliberately disabled features, and actual
  errors. Output schemas are checked alongside response status.
• Staging-only dual authentication supports the protected backend staging service;
  production authentication and existing OAuth storage remain unchanged.

Notifications Deferred

Notification settings/history support is implemented but disabled by default
in this release while the backend notification feature finishes rollout.
Disabled notification tools are absent from the catalog and cannot be invoked
through stale calls. The implementation is retained for a later controlled
activation, with plan/role/scope checks and webhook credential redaction.

This release does not change notification settings or delivery in the Convert UI.
Local npm and hosted clients keep working without configuring this future feature.

Release Verification

Publication is gated on the final committed tree: deterministic CI, generated
drift and validators, namespace/authorization tests, package binary startup,
semantic artifacts, hosted builds, and staging acceptance. The local npm package
remains stdio; remote-only UI/Worker code is not shipped as the npm entrypoint.

See the repository's dated QA certification for actual test outcomes and residual
limitations. Release preparation or a GitHub merge is not proof of deployment.