Issues

• docs: fix stale README transport and exchange details, drop leftover codecov and requireBearer

  documentation
  FerrLabs/MCP#467 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(oauth): check the exchange host against the allowlist and ignore stray callbacks

  security
  FerrLabs/MCP#466 · Filter by author BryanFRD opened on Oct 23, 2026

• ci(release): disable the setup-node cache in the npm publish job

  security
  FerrLabs/MCP#465 · Filter by author BryanFRD opened on Oct 23, 2026

• feat(tools): declare readOnlyHint and destructiveHint annotations on every tool

  enhancement
  FerrLabs/MCP#464 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(tools): validate id and slug arguments so dot segments cannot retarget the request path

  security
  FerrLabs/MCP#463 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(transport): parse the request body before building the server, and answer bad JSON with 400

  bug
  FerrLabs/MCP#462 · Filter by author BryanFRD opened on Oct 23, 2026

• fix(transport): bound stateful sessions and tie them to the bearer that created them

  bug
  FerrLabs/MCP#461 · Filter by author BryanFRD opened on Oct 23, 2026

• security(transport): validate the bearer instead of passing the client token through to the product APIs

  security
  FerrLabs/MCP#460 · Filter by author BryanFRD opened on Oct 23, 2026

• chore: stop releasing @ferrlabs/mcp from both this repo and FerrLabs/FerrLabs

  chore
  FerrLabs/MCP#459 · Filter by author BryanFRD opened on Oct 23, 2026