chore(deps)(deps-dev): bump mcporter from 0.7.3 to 0.11.1

[dependabot]

Bumps mcporter from 0.7.3 to 0.11.1.

Release notes

Sourced from mcporter's releases.

mcporter v0.11.1

Changelog

CLI

• Make generate-cli --runtime node --bundle <name>.mjs emit an ES module bundle with a local require shim, fixing .mjs artifacts that previously crashed at startup.
• Classify generated .mjs and .cjs outputs as bundle artifacts in embedded metadata instead of reporting them as binaries.
• Avoid leaving implicit <server>.ts template files in the current directory when generating bundle-only artifacts without --output.
• Print generated CLI help with a trailing newline so subsequent shell output no longer glues onto the help footer.
• Point generated CLI metadata and npm package metadata at openclaw/mcporter.
• Document the existing generate-cli --timeout, --minify, and --no-minify flags in generate-cli --help.
• Suppress expected Rolldown unresolved-import warnings for Node built-ins during successful generated CLI bundling.

Verification

• npm: https://www.npmjs.com/package/mcporter/v/0.11.1
• npm tarball: https://registry.npmjs.org/mcporter/-/mcporter-0.11.1.tgz
• npm integrity: sha512-L62k1w9aSIqUUK/etaRW0EzGEFtFE82Pnx89Mf1+jI8miQ6D2apgiZjzwTaMmdjKLL+7Z14YANh3dEuCYnefYw==
• CI: https://github.com/openclaw/mcporter/actions/runs/25877631589
• Empty-dir compile smoke: npx --yes mcporter@0.11.1 generate-cli "npx -y chrome-devtools-mcp" --compile

Checksums

• SHA1 (mcporter-0.11.1.tgz): 2bb09b7be426e3eca533a5cfa1063b5b5878a959
• SHA256 (mcporter-0.11.1.tgz): 0e93f4f6c036e21160ef32e1da8806744ded0fd90da336718ad0f7ad7f3a2abd
• SHA256 (mcporter-macos-arm64-v0.11.1.tar.gz): 2c48292812bc23a7c7f690df6f70a721cf92df7dc0eaee0dc739a100df8b7abd

mcporter v0.11.0

Highlights

• mcporter serve exposes daemon-managed keep-alive servers as one MCP bridge with readable server__tool names.
• Headless OAuth is stronger: no-browser auth URLs, vault seeding/clearing, cached token refresh, and auth: "refreshable_bearer" for stdio/env injection.
• HTTP compatibility improved with httpFetch: "node-http1", including automatic Sunsama support.
• Parallel agents get safer config/vault/cache writes and parseable JSON output under daemon recovery.

Full Changelog

Config

• Support auth: "refreshable_bearer" with explicit refresh settings so cached OAuth tokens can be refreshed before HTTP connects or injected into stdio env vars. (Issue #173, thanks @​tokyo-s)
• Add httpFetch: "node-http1" for HTTP MCP servers whose providers reject Node's built-in fetch, and auto-apply it to Sunsama's endpoint. (Issue #158, thanks @​mattash)
• Resolve ${VAR} and ${VAR:-fallback} placeholders across string-valued server config fields such as baseUrl, command/args, tokenCacheDir, and pre-registered OAuth fields while keeping headers/env/bearer-token placeholders lazy until runtime. (PR #161 / issue #157, thanks @​zxyasfas)
• Add mcporter vault set <server> and mcporter vault clear <server> so headless deployments can seed or clear OAuth vault credentials without reproducing mcporter's internal vault-key format. (Issue #156)

CLI

• Add mcporter serve, exposing daemon-managed keep-alive servers as one MCP bridge with readable server__tool names for stdio and Streamable HTTP clients. (PR #172, thanks @​zm2231)
• Prefer MCP structuredContent nested inside JSON-RPC result envelopes so mcporter call --output json stays parseable for dual text/structured tool responses. (Issue #168, thanks @​mar-zh)
• Serialize read-modify-write config and OAuth vault updates, and write JSON/cache metadata atomically to avoid lost entries under parallel invocations. (Issue #167, thanks @​alexminza)
• Patch chrome-devtools-mcp --autoConnect launches at runtime so mcporter call chrome-devtools.list_pages can keep using a logged-in Chrome profile while upstream DevTools-window detection can hang on busy profiles.

... (truncated)

Changelog

Sourced from mcporter's changelog.

[0.11.1] - 2026-05-14

CLI

• Make generate-cli --runtime node --bundle <name>.mjs emit an ES module bundle with a local require shim, fixing .mjs artifacts that previously crashed at startup.
• Classify generated .mjs and .cjs outputs as bundle artifacts in embedded metadata instead of reporting them as binaries.
• Avoid leaving implicit <server>.ts template files in the current directory when generating bundle-only artifacts without --output.
• Print generated CLI help with a trailing newline so subsequent shell output no longer glues onto the help footer.
• Point generated CLI metadata and npm package metadata at openclaw/mcporter.
• Document the existing generate-cli --timeout, --minify, and --no-minify flags in generate-cli --help.
• Suppress expected Rolldown unresolved-import warnings for Node built-ins during successful generated CLI bundling.

[0.11.0] - 2026-05-14

Config

• Support auth: "refreshable_bearer" with explicit refresh settings so cached OAuth tokens can be refreshed before HTTP connects or injected into stdio env vars. (Issue #173, thanks @​tokyo-s)
• Add httpFetch: "node-http1" for HTTP MCP servers whose providers reject Node's built-in fetch, and auto-apply it to Sunsama's endpoint. (Issue #158, thanks @​mattash)
• Resolve ${VAR} and ${VAR:-fallback} placeholders across string-valued server config fields such as baseUrl, command/args, tokenCacheDir, and pre-registered OAuth fields while keeping headers/env/bearer-token placeholders lazy until runtime. (PR #161 / issue #157, thanks @​zxyasfas)
• Add mcporter vault set <server> and mcporter vault clear <server> so headless deployments can seed or clear OAuth vault credentials without reproducing mcporter's internal vault-key format. (Issue #156)

CLI

• Add mcporter serve, exposing daemon-managed keep-alive servers as one MCP bridge with readable server__tool names for stdio and Streamable HTTP clients. (PR #172, thanks @​zm2231)
• Prefer MCP structuredContent nested inside JSON-RPC result envelopes so mcporter call --output json stays parseable for dual text/structured tool responses. (Issue #168, thanks @​mar-zh)
• Serialize read-modify-write config and OAuth vault updates, and write JSON/cache metadata atomically to avoid lost entries under parallel invocations. (Issue #167, thanks @​alexminza)
• Patch chrome-devtools-mcp --autoConnect launches at runtime so mcporter call chrome-devtools.list_pages can keep using a logged-in Chrome profile while upstream DevTools-window detection can hang on busy profiles.

OAuth

• Add headless OAuth login support via --no-browser, --browser none, and MCPORTER_OAUTH_NO_BROWSER, emitting parseable authorization URLs for remote auth flows. (PR #171 / issue #169, thanks @​feniix)
• Proactively complete OAuth for configured HTTP servers that allow unauthenticated initialize/listTools but require credentials for tool calls, and close the local callback server promptly after browser authorization. (PR #159, thanks @​Spacefish)
• Refresh expired cached OAuth access tokens during non-interactive mcporter list without opening a browser or clearing cached credentials when refresh fails. (Issue #166, thanks @​chrisabad)

[0.10.2] - 2026-05-09

CLI

• Keep keep-alive daemon retry diagnostics on stderr so mcporter call --output json stdout stays parseable after a daemon recovery. (PR #163 / issue #160, thanks @​clawSean)
• Increase the default OAuth browser wait from 60 seconds to 5 minutes so hosted MCP sign-ins have enough time for account and permission review.
• Skip the redundant daemon status preflight for warm keep-alive access, cutting one socket round-trip from each routed list/call/resource request while preserving stale-config and dead-daemon recovery.
• Route explicit default keep-alive calls like chrome-devtools.list_pages through a daemon-only fast path, avoiding full runtime startup on warm calls.
• Further reduce warm keep-alive call startup by avoiding runtime/config schema imports on CLI boot and using a narrower daemon call path for simple explicit calls.
• Keep single-server mcporter list non-interactive by reusing cached OAuth without launching new auth flows, and clamp oversized OAuth startup errors so HTML responses do not flood stdout/stderr.
• Label non-timeout mcporter list <server> failures as unavailable instead of timed out.
• Return concise/structured mcporter resource errors for servers that do not implement MCP resources instead of dumping SDK stack traces.
• Refresh Context7 examples for the live resolve-library-id and query-docs schemas.
• Make generate-cli --help, inspect-cli --help, and emit-ts --help print command help before flag parsing.
• Auto-correct near-miss tool names when a server reports an unknown tool as MCP isError content instead of throwing.
• Keep auto-correct diagnostics on stderr for mcporter call --output json/raw so stdout stays parseable.

... (truncated)

Commits

• 46cc31c fix: harden generated cli bundles
• dd000bd chore: open 0.11.1 changelog
• 2ce585a chore: release 0.11.0
• c871508 ci: strengthen main workflow
• 7f1e9a8 feat: support refreshable bearer stdio auth
• 3e06e58 fix: add HTTP fetch compatibility mode
• 2171c1f Merge pull request #171 from feniix/feat/headless-oauth-no-browser
• 33afa74 fix: preserve headless auth stdout
• 23565e2 fix: harden concurrent config writes
• 8d962fb Merge remote-tracking branch 'origin/main' into feat/mcporter-serve
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 Golden Principles Validation

Overall Grade: B-
Total Violations: 9

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	8
🔵 Low	0

View all violations

GP-013

• high: mcp-server/src/lib/lance-sync.ts:104
  • Pretty-printed JSON wastes ~30% tokens in MCP responses
  • Fix: Use JSON.stringify(data) without formatting args

GP-003

• medium: mcp-server/src/tools/chain-recall.ts
  • Tool file is 251 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/context-primitives.ts
  • Tool file is 203 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/defrag.ts
  • Tool file is 246 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/hierarchical-recall.ts
  • Tool file is 448 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/recall.ts
  • Tool file is 461 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/subspaces.ts
  • Tool file is 308 lines (guideline: ≤200). Consider splitting.
• medium: mcp-server/src/tools/system-prompt-builder.ts
  • Tool file is 342 lines (guideline: ≤200). Consider splitting.

GP-008

• medium: AGENTS.md
  • AGENTS.md is 250 lines (max: 150). Keep it a lean navigation map.

---

📚 Reference: Golden Principles | Validation Tool