chore(deps)(deps-dev): bump mcporter from 0.7.3 to 0.10.0

[dependabot]

Bumps mcporter from 0.7.3 to 0.10.0.

Release notes

Sourced from mcporter's releases.

mcporter v0.10.0

Highlights

• Added mcporter resource <server> [uri] for listing and reading MCP resources, including keep-alive daemon routing.
• Improved generated keep-alive CLIs and Bun-compiled macOS daemon startup for persistent server workflows.
• Added XDG directory support and static OAuth client configuration for providers without dynamic registration.

SHA256 (mcporter-macos-arm64-v0.10.0.tar.gz): 4b23391b709ea3ba877df283cb1b66c69d361fc8cee6f87d0b5d7fd8838be0e5 SHA256 (mcporter-0.10.0.tgz): 446fdf8c6a61e5201868ba702087de003308fbb11c56f6209ef331579c1af917

mcporter v0.9.0

Changelog

CLI

• Add per-server exact-name tool filtering with allowedTools and blockedTools, including config serialization and runtime call/list enforcement. (Rebuild of PR #39, thanks @​tonylampada)
• Escalate stuck stdio child-process shutdowns after close timeouts instead of treating the timeout as a clean exit. (PR #39, thanks @​tonylampada)
• Quote OAuth browser URLs when launching cmd.exe on Windows, preserving query parameters such as redirect_uri. (PR #136, thanks @​cosminilie)
• Document OAuth-protected server config setup with mcporter config add --auth oauth and mcporter auth. (PR #34, thanks @​prateek)
• Respect schema-declared string parameters when coercing numeric-looking mcporter call key=value arguments, so Slack timestamps like thread_ts stay strings. (PR #141, thanks @​Hamzaa6296)

Checksums

SHA256 (mcporter-macos-arm64-v0.9.0.tar.gz): 20cae1f412c8790d1801bd557825b12bb6354e73bd277be5484e53a58cf81c0b SHA256 (mcporter-0.9.0.tgz): 7ebe1d1050f04a9ddea0478f8314b94239b6716f87061b2daad750d281b84526

mcporter v0.8.1

[0.8.1] - 2026-03-29

CLI

• Bun-compiled/Homebrew binaries now embed the package version before boot, so mcporter --version reports the real release (for example 0.8.1) instead of falling back to 0.0.0-dev.

Tests

• Added regression coverage for the Bun compile wrapper so future release builds keep the embedded runtime version intact.

Tooling / Dependencies

• npm publishes now use an explicit package allowlist, so local release tarballs/checksum files do not get bundled into the published package.

SHA256 (mcporter-macos-arm64-v0.8.1.tar.gz): 7f726f70801bdded163699b53fade8b602c18f0dbc07851ce5ddad8e0e8bcb3b SHA256 (mcporter-0.8.1.tgz): 07abbbc8e3ffbaf1fd2a8030a90b56a5c895f52cfa301b42ff79cbaa0644242e

mcporter v0.8.0

[0.8.0] - 2026-03-29

CLI

• Preserve OAuth flow vs post-auth transport failures so invalid OAuth/provider errors surface directly, while real legacy 404/405 transport mismatches still fall back to SSE correctly. (PR #97, thanks @​mavam)
• Ignore static Authorization headers once OAuth is active so imported editor configs cannot override fresh OAuth tokens. (PR #123, thanks @​ahonn)
• Keep mcporter call --output json parseable by emitting valid JSON even when the command falls back to raw output. (PR #128, thanks @​armanddp)
• Render resource content blocks in call output helpers instead of dropping them, including markdown resources and JSON text payloads. (PR #124, thanks @​mvanhorn)
• Preserve full JSON/error payloads when data is just one field instead of collapsing the response to data alone. (PR #106, thanks @​AielloChan)

... (truncated)

Changelog

Sourced from mcporter's changelog.

[0.10.0] - 2026-05-04

CLI

• Return a non-zero exit code when MCP tool results are marked isError, and preserve that status through the forced-exit cleanup path. (PR #154 / issue #153, thanks @​jlapenna)
• Give forced-exit cleanup a short stdout/stderr flush window so large JSON output is not truncated when mcporter is run from child_process. (PR #151 / issue #145, thanks @​yuhp)
• Treat key:=value as a compatibility alias for key=value, avoiding malformed keys such as price:. (PR #150 / issue #100, thanks @​solomonneas)
• Restore mcporter call --key value / --key=value tool arguments, including JSON array/object coercion, --json - stdin payloads, schema-aware bare string-to-array wrapping, and kebab-case to camelCase field mapping. (Issues #119 and #126)
• Quote generated emit-ts members for tool names that are not valid TypeScript identifiers. (PR #149 / issue #30, thanks @​solomonneas)
• Resolve relative stdio args in generated CLI bundles against the generated script location instead of the caller's current directory. (PR #148 / issue #56, thanks @​solomonneas)
• Print OAuth manual-completion URLs at the default warning log level so headless users can copy them. (PR #143 / issue #139, thanks @​stainlu)
• Support repeatable --header KEY=value flags for ad-hoc HTTP servers and persisted ad-hoc entries. (Issue #117)
• Let generated CLIs use --raw without also passing required flags, and parse array flags containing JSON object items. (Issues #102 and #103)
• Preserve auth: "oauth" when an ad-hoc HTTP server is OAuth-promoted and saved with --persist. (Issue #82)
• Let non-interactive mcporter list use existing OAuth token caches for HTTP servers even when older configs are missing auth: "oauth". (Issue #137)
• Fail OAuth flows immediately when the server never creates an authorization URL, instead of waiting for a browser callback that cannot arrive. (Issue #115)
• Support mcporter list server.tool --schema to print a single tool's schema instead of the whole server. (Issue #116)
• Surface MCP server instructions from the initialize response in single-server mcporter list text and JSON output. (Issue #76)
• Add compact mcporter list <server> --brief / --signatures output for scanning signatures without doc blocks, examples, or schemas. (PR #144, thanks @​yuhp)
• Launch Bun-compiled macOS daemon children through nohup so Homebrew binaries can start keep-alive daemons in the background on macOS 26. (Issue #66)
• Let generated CLIs use the keep-alive daemon for embedded servers with lifecycle: "keep-alive", preserving stdio server state across separate generated-CLI invocations. (Issue #101)
• Add mcporter resource <server> [uri] for listing and reading MCP resources, including keep-alive daemon routing. (Issue #134)

Config

• Honor XDG Base Directory env vars for mcporter-owned config, data, cache, and state paths while preserving the legacy ~/.mcporter fallback when XDG vars are unset. MCPORTER_DAEMON_DIR, MCPORTER_CONFIG, --config, and per-server tokenCacheDir remain explicit overrides. (Issue #155)
• Support pre-registered OAuth clients via oauthClientId/oauthClientSecretEnv and token endpoint auth method overrides for providers without dynamic client registration. (Issue #132)
• Respect configured stdio cwd values, including relative paths resolved from the config file and ~ home expansion. (PR #147 / issue #146, thanks @​solomonneas)

Tooling / Dependencies

• Updated zod to 4.4.3.

[0.9.0] - 2026-04-18

CLI

• Add per-server exact-name tool filtering with allowedTools and blockedTools, including config serialization and runtime call/list enforcement. (Rebuild of PR #39, thanks @​tonylampada)
• Escalate stuck stdio child-process shutdowns after close timeouts instead of treating the timeout as a clean exit. (PR #39, thanks @​tonylampada)
• Quote OAuth browser URLs when launching cmd.exe on Windows, preserving query parameters such as redirect_uri. (PR #136, thanks @​cosminilie)
• Document OAuth-protected server config setup with mcporter config add --auth oauth and mcporter auth. (PR #34, thanks @​prateek)
• Respect schema-declared string parameters when coercing numeric-looking mcporter call key=value arguments, so Slack timestamps like thread_ts stay strings. (PR #141, thanks @​Hamzaa6296)

[0.8.1] - 2026-03-29

CLI

• Bun-compiled/Homebrew binaries now embed the package version before boot, so mcporter --version reports the real release (for example 0.8.1) instead of falling back to 0.0.0-dev.

Tests

... (truncated)

Commits

• fa8406b fix: align release tarball generation
• b4504a6 chore: prepare 0.10.0 release
• be965df chore: refresh transitive dependencies
• a5468c4 chore: update zod to 4.4.3
• efb72ce test: make xdg path assertions portable
• bb6e646 fix: honor xdg directories
• eb8986c docs: clarify daemon isolation
• dd33721 feat: support static oauth clients
• caa00dd docs: document agent skill pattern
• 75dba26 feat: add resource read command
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 Golden Principles Validation

Overall Grade: B-
Total Violations: 9

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	8
🔵 Low	0

View all violations

GP-013

• high: mcp-server/src/lib/lance-sync.ts:104
  • Pretty-printed JSON wastes ~30% tokens in MCP responses
  • Fix: Use JSON.stringify(data) without formatting args

GP-003

• medium: mcp-server/src/tools/chain-recall.ts
  • Tool file is 251 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/context-primitives.ts
  • Tool file is 203 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/defrag.ts
  • Tool file is 246 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/hierarchical-recall.ts
  • Tool file is 448 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/recall.ts
  • Tool file is 461 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/subspaces.ts
  • Tool file is 308 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/system-prompt-builder.ts
  • Tool file is 342 lines (guideline: ≤200). Consider splitting.

GP-008

• medium: AGENTS.md
  • AGENTS.md is 250 lines (max: 150). Keep it a lean navigation map.

---

📚 Reference: Golden Principles | Validation Tool

[dependabot]

Superseded by #62.