Changelog
Back to All
Improved

MCP Server v0.0.1-beta.14

2 months ago by ReadMe API

Beta.14 expands hosted tools, read-only investigation, experimentation guidance and optional visual reports while preserving local API-key/HMAC access and existing hosted OAuth grants.

Safer Hosted Catalog

  • Local stdio retains 16 compact tools. Hosted MCP exposes 45 tools: 40 read/write/delete tools plus five read-only render tools, with 20 prompts and six resources.
  • Reads use base namespaces, writes use write and deletion uses delete. POST-backed reports are classified as reads according to their behavior.
  • WrongToolForAction errors provide the correct call when an action is sent to the wrong tool.
  • Hosted selected-project grants no longer advertise account-level actions they cannot authorize, including project creation, billing portal access, account-wide live data/history and collaborator listing. Local actions remain subject to Convert permissions; project-scoped alternatives remain available remotely.
  • API-key listing is omitted because API-authenticated callers cannot retrieve key records; stale calls fail explicitly instead of suggesting a successful empty result.
  • Canonical documentation tools are search and fetch; search_knowledge_base is not advertised.
  • Improved connector metadata and client compatibility do not imply approval or availability in third-party directories.

Read-Only Investigation And Opportunities

  • operator.investigate provides a structured evidence packet with confirmed facts, anomalies, hypotheses, missing evidence, limitations and safe next checks.
  • projects.debug_logs offers explicit, authorized drill-down into bounded tracking diagnostics. experiences.report_integrity compares complete recent and baseline windows for meaningful stream drops.
  • Default investigation output minimizes data, excluding visitor IDs, full URLs, referrers, user-agent strings and raw debug rows. Data minimization is not a claim of anonymity.
  • Unknown evidence remains unknown; empty debug logs alone do not prove healthy tracking. Project and experience live-data feeds retain their different goal scopes.
  • The High-Impact Experience Opportunities prompt grounds recommendations in configuration, experiences, goals, hypotheses, audiences, locations, results and measurement readiness. It does not promise impact or modify resources.
  • Browser and source checks remain client-side capabilities; MCP does not embed a browser.

Experience And Statistics Guidance

  • Uses experience terminology consistently. Deploy experiences are rollout containers, not visitor/conversion-tracked tests; empty tracking data alone does not mean a deploy is broken.
  • Keeps Bayesian, fixed-sample Frequentist and sequential evidence distinct. done is interpreted within the configured engine, and reaching a sample target is not necessarily significance.
  • Sample ratio mismatch blocks result verdicts, including inferential intervals and Bayesian/sequential completion claims. Explicitly labeled sample-planning progress may remain visible.
  • Multi-Armed Bandit allocation is not evidence of significance or a winner. MAB is limited to standard A/B, fullstack A/B and MVT experiences; Frequentist MAB requires Sequential.
  • Preserves automatic-MDE locks, clarifies fixed_mde as relative-percent planning input and rejects unsafe unknown or legacy-scale updates. Planning thresholds are not expected or observed lift.
  • More precise statistics validation, allowed-value guidance and guarded MDE updates prevent ambiguous or silently normalized writes. Inactive-engine results are not invented from counts.
  • Goal definitions are resolved against authoritative catalogs, with incomplete coverage reported explicitly.
  • Portfolio and audit workflows follow pagination and disclose bounded coverage rather than treating an initial page as a complete total.
  • Unknown wrapper fields and misplaced history pagination fail before dispatch with corrective guidance.

Optional Visual Reports

Hosted clients supporting MCP Apps can render project portfolios, experience details, draft reviews, experience results and investigation reports.

Rendering is optional and read-only. Agents first retrieve and analyze ordinary tool data; every renderer also provides a sanitized text digest. Clients without MCP Apps receive the same substantive evidence. Existing versioned visual resources retain compatibility.

Safer Writes And Security

  • Improved validation of nullable and composed API schemas, account scope and JSON inputs, including embedded JavaScript, CSS and selectors.
  • Verified operator writes independently read back persisted changes. Disclosed trimming of code-edge whitespace is distinguished from substantive changes, preventing duplicate retries after successful writes.
  • Variation-code updates preserve omitted code, page binding and sibling content, use optimistic concurrency, and fail closed on ambiguous, incomplete or stale readback.
  • Authentication headers cannot be overridden. Bounded retries apply to safe/idempotent rate-limit and service-unavailable responses; unsafe writes are not automatically retried by default.
  • Upstream redirects are rejected without forwarding credentials or replaying OAuth codes.
  • Hosted OAuth supports Dynamic Client Registration and HTTPS Client ID Metadata Documents with PKCE. Refresh-token lifetime is bounded by the upstream session.
  • Strengthened credential protection, origin restrictions and redaction keep secrets and sensitive upstream diagnostics out of model-visible output.
  • Hosted stream results are not persisted for replay. Interrupted streams restart instead of resuming via Last-Event-ID.
  • Deletion still requires an exact user request and a second confirmation naming the numeric resource. Generated API operations cannot bypass namespace guardrails.

Knowledge And Feedback

  • Refreshed support, developer and public website knowledge with 9,523 chunks, hybrid search and one result per canonical article.
  • Earlier document IDs resolve to exact compatible content or an explicit stale-document response, never a fuzzy substitute.
  • The local package includes its semantic index and retains keyword fallback when optional dependencies are omitted.
  • operator.prepare_feedback creates a sanitized preview without storing it. operator.submit_feedback requires explicit approval of the prepared content; local feedback never forwards Convert credentials.

Compatibility And Security Notice

Hosted clients retain the same endpoint, OAuth client, grants and selected account/project scope. The beta.14 transport-session security update requires active MCP sessions to initialize again but preserves OAuth authorization. Host caching may require an explicit tool/app refresh or a new conversation; catalog-change notifications are advisory, not guaranteed delivery.

The local package retains stdio transport and excludes hosted-only runtime components.

At beta.14 release, the optional text-embedding runtime inherited upstream sharp image-decoding and adm-zip archive advisories. Neither affected path accepted MCP request data; the archive dependency was used by the model runtime's vendor-binary installer. Installations omitting optional semantic dependencies did not include those findings. These are historical beta.14 dependency notes, not a statement about later package versions.