chore(deps)(deps-dev): bump mcporter from 0.7.3 to 0.10.2

[dependabot]

Bumps mcporter from 0.7.3 to 0.10.2.

Release notes

Sourced from mcporter's releases.

mcporter v0.10.2

Highlights

• Faster warm keep-alive calls by trimming daemon round-trips and runtime startup work.
• More robust live MCP behavior for resource errors, OAuth/list failures, and tool-name auto-correction.
• Generated CLIs now keep JSON output parseable for plain-text MCP results.

SHA256 (mcporter-macos-arm64-v0.10.2.tar.gz): 540390c49b5d04ecd9174a33a48bfabd4a3748b8616409882776954f9c17b571 SHA256 (mcporter-0.10.2.tgz): fedf0974ad84b78183c48caada7faf773dbed3100530765d7a6c503dc4f5b016

mcporter v0.10.1

Changes

CLI

• Fixed Bun-compiled standalone macOS binaries so mcporter generate-cli --compile works from an empty directory, even when there is no local package.json or node_modules tree.
• generate-cli --compile now stages the matching published mcporter package dependencies when bundled dependencies cannot be linked or copied from the local package tree.
• The Bun compile step now runs from the staging directory, so generated CLI builds resolve mcporter, commander, and related dependencies from the same directory that contains the generated artifact.
• Added a clearer failure message for standalone development binaries that cannot resolve published bundler dependencies.

Tests

• Added an opt-in standalone Bun release-binary regression smoke behind MCPORTER_STANDALONE_BINARY_TEST=1.
• The smoke builds dist-bun/mcporter, packs the current package, runs generate-cli --compile from an empty temp directory, and verifies the compiled CLI help output.

Docs / Release Process

• Clarified that the Homebrew formula should install the npm .tgz, not the standalone Bun macOS tarball, because generated CLI compilation needs the installed package tree.
• Documented the Homebrew release verification flow: update the tap URL/SHA, use --min-release-age=0, refresh tap README callouts, run brew reinstall, brew test, and run an empty-directory compile smoke with /opt/homebrew/bin/mcporter.
• Documented npm and npx post-release verification, plus optional repeat verification on another Mac.

Maintenance

• Started the next development cycle after v0.10.0 with a fresh Unreleased changelog stub.

Included Commits

• 026eb28 fix: support standalone binary CLI compilation
• 6ed9860 docs: clarify Homebrew release verification
• 2100639 chore: start next development cycle

Release Verification

• npm package surface verified.
• npx mcporter@0.10.1 surface verified.
• Direct standalone macOS binary surface verified.

Artifacts

• mcporter-macos-arm64-v0.10.1.tar.gz

... (truncated)

Changelog

Sourced from mcporter's changelog.

[0.10.2] - 2026-05-09

CLI

• Keep keep-alive daemon retry diagnostics on stderr so mcporter call --output json stdout stays parseable after a daemon recovery. (PR #163 / issue #160, thanks @​clawSean)
• Increase the default OAuth browser wait from 60 seconds to 5 minutes so hosted MCP sign-ins have enough time for account and permission review.
• Skip the redundant daemon status preflight for warm keep-alive access, cutting one socket round-trip from each routed list/call/resource request while preserving stale-config and dead-daemon recovery.
• Route explicit default keep-alive calls like chrome-devtools.list_pages through a daemon-only fast path, avoiding full runtime startup on warm calls.
• Further reduce warm keep-alive call startup by avoiding runtime/config schema imports on CLI boot and using a narrower daemon call path for simple explicit calls.
• Keep single-server mcporter list non-interactive by reusing cached OAuth without launching new auth flows, and clamp oversized OAuth startup errors so HTML responses do not flood stdout/stderr.
• Label non-timeout mcporter list <server> failures as unavailable instead of timed out.
• Return concise/structured mcporter resource errors for servers that do not implement MCP resources instead of dumping SDK stack traces.
• Refresh Context7 examples for the live resolve-library-id and query-docs schemas.
• Make generate-cli --help, inspect-cli --help, and emit-ts --help print command help before flag parsing.
• Auto-correct near-miss tool names when a server reports an unknown tool as MCP isError content instead of throwing.
• Keep auto-correct diagnostics on stderr for mcporter call --output json/raw so stdout stays parseable.
• Make generated CLIs keep --output json parseable for plain text MCP results by falling back to the raw JSON envelope.

Config

• Preserve existing stdio executable paths that contain spaces instead of splitting them as inline command strings, so app bundle helpers like Hopper's MCP server can be configured directly.

Tooling

• Build dist/ once before the Vitest suite instead of letting parallel integration tests rebuild it mid-run.

[0.10.1] - 2026-05-04

CLI

• Fix Bun-compiled standalone binaries so generate-cli --compile can compile generated CLIs from empty directories by staging the matching published mcporter package dependencies when no local package tree is available.

Tests

• Add an opt-in standalone Bun release-binary smoke for the empty-directory generated CLI compile path.

[0.10.0] - 2026-05-04

CLI

• Return a non-zero exit code when MCP tool results are marked isError, and preserve that status through the forced-exit cleanup path. (PR #154 / issue #153, thanks @​jlapenna)
• Give forced-exit cleanup a short stdout/stderr flush window so large JSON output is not truncated when mcporter is run from child_process. (PR #151 / issue #145, thanks @​yuhp)
• Treat key:=value as a compatibility alias for key=value, avoiding malformed keys such as price:. (PR #150 / issue #100, thanks @​solomonneas)
• Restore mcporter call --key value / --key=value tool arguments, including JSON array/object coercion, --json - stdin payloads, schema-aware bare string-to-array wrapping, and kebab-case to camelCase field mapping. (Issues #119 and #126)
• Quote generated emit-ts members for tool names that are not valid TypeScript identifiers. (PR #149 / issue #30, thanks @​solomonneas)
• Resolve relative stdio args in generated CLI bundles against the generated script location instead of the caller's current directory. (PR #148 / issue #56, thanks @​solomonneas)
• Print OAuth manual-completion URLs at the default warning log level so headless users can copy them. (PR #143 / issue #139, thanks @​stainlu)
• Support repeatable --header KEY=value flags for ad-hoc HTTP servers and persisted ad-hoc entries. (Issue #117)

... (truncated)

Commits

• 3648a92 test: prebuild dist before vitest
• 9aab8df chore: release 0.10.2
• c0e251b fix: harden live mcp cli paths
• 6012708 perf: keep list non-interactive
• e6b451a perf: speed up daemon fast-path calls
• f412d42 test: create daemon metadata dir on windows
• e2c0641 fix: keep mcporter JSON stdout parseable
• 39b49ef chore(deps): pin patched ip-address
• 6f063bf perf(daemon): route warm keep-alive calls directly
• 761c11c perf(daemon): skip warm status preflight
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 Golden Principles Validation

Overall Grade: B-
Total Violations: 9

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	8
🔵 Low	0

View all violations

GP-013

• high: mcp-server/src/lib/lance-sync.ts:104
  • Pretty-printed JSON wastes ~30% tokens in MCP responses
  • Fix: Use JSON.stringify(data) without formatting args

GP-003

• medium: mcp-server/src/tools/chain-recall.ts
  • Tool file is 251 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/context-primitives.ts
  • Tool file is 203 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/defrag.ts
  • Tool file is 246 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/hierarchical-recall.ts
  • Tool file is 448 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/recall.ts
  • Tool file is 461 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/subspaces.ts
  • Tool file is 308 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/system-prompt-builder.ts
  • Tool file is 342 lines (guideline: ≤200). Consider splitting.

GP-008

• medium: AGENTS.md
  • AGENTS.md is 250 lines (max: 150). Keep it a lean navigation map.

---

📚 Reference: Golden Principles | Validation Tool

[dependabot]

Superseded by #63.