All notable changes to @socketsecurity/mcp will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- The copyable socket-gate hook directory in the published package moved from
hooks/socket-gatetodist/socket-gate.
- OAuth-enabled HTTP deployments now accept
sktsec_Socket API tokens sent viaAuthorization: Bearer <token>.
- Organization tools now scope their results to the authenticated caller.
- Composer package URLs parse correctly:
packagistis accepted as a composer alias, bare-name packages resolve, and the vendor namespace is split from the package name. - The
depscoretool no longer errors on packages with missing or non-numeric score data. - The HTTP server limits the size of POST request bodies.
- OAuth tokens whose introspection response carries a malformed expiry are now rejected.
- The
package_filesandorganizationstools no longer fail withUnexpected tokenJSON errors against the live Socket API.
Initial tracked release.