Release v1.1.1

[mohanagy]

Release promotion

Promote the exact finalized development commit e43f8abc0c237aa8492478e323e80d70cc35177d to main for v1.1.1.

Included change

• Claude Desktop-compatible tool catalog schemas for Vercel, Firebase, and Stripe
• preservation of valid secret-looking JSON Schema property definitions
• normalization of schema-valued true to equivalent {} while retaining false
• redaction of configured secrets, bearer values, and recognized provider tokens in schema values and object keys
• finalized package, lockfile, changelog, and current-version documentation

Security impact

The release closes a schema-catalog credential exposure gap identified during review: actual secret/token text used as a schema object key is now redacted before client exposure. Existing structured secret redaction, routing policy, audit, containment, OAuth, and public API contracts remain unchanged.

Evidence

• feature PR Fix Claude tool schema compatibility #398: exact-head CI green and CodeRabbit approved
• release-prep PR chore: prepare v1.1.1 release #400: exact-head CI green and CodeRabbit completed with no actionable findings
• exact combined candidate: 158 suites; 1,948 passed, 34 skipped, 0 failed
• typecheck, lint, build, 31 package-contract tests, Inspector 2.1.0, and 57-file pack contract passed
• dependency signature audit: 280 verified signatures and 74 attestations

Publication boundary

Merging this PR does not publish. After exact-main CI passes, create GitHub Release v1.1.1 at the exact current main commit; that protected Release event is the only npm trusted-publishing trigger. Never run workstation npm publish.

Tracks #399.

Summary by CodeRabbit

• New Features
  • Added compatibility preparation for Claude Desktop tool catalogs.
  • Improved handling of tool input and output schemas, including open schemas and secret-like fields.
• Bug Fixes
  • Preserved valid JSON Schema structures while redacting sensitive metadata and values from tool listings.
  • Added stable aliases to prevent collisions during redaction.
• Documentation
  • Updated installation instructions, compatibility guides, and release references to version 1.1.1.
• Release
  • Released version 1.1.1 with schema-handling and compatibility improvements.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 15e7d96f-6fcf-4ae1-b0a4-0f673121adc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8996f2d7-28fe-4e76-b37e-502b7e2842b5

📥 Commits

Reviewing files that changed from the base of the PR and between e43f8ab and 1b5e306.

📒 Files selected for processing (5)

• CHANGELOG.md
• src/mcp/server/miftah-server.ts
• tests/fixtures/fake-upstream-bundled.mjs
• tests/fixtures/fake-upstream-runtime.mjs
• tests/mcp-wrapper.test.ts

---

📝 Walkthrough

Walkthrough

The release updates Miftah to 1.1.1, adds schema-aware redaction for audited tool listings, introduces schema compatibility fixtures and regression coverage, and updates release and documentation contracts.

Changes

Schema Compatibility Release

Layer / File(s)	Summary
Schema-aware tool-list redaction src/mcp/server/miftah-server.ts	tools/list uses schema-aware redaction. runAudited accepts an optional result-redaction callback. JSON Schema structures and boolean schemas are preserved or normalized during redaction.
Schema compatibility validation tests/fixtures/fake-upstream-runtime.mjs, tests/mcp-wrapper.test.ts	Schema-heavy fixture tools cover Vercel, Firebase, and Stripe patterns. Integration tests verify schema preservation, normalization, and secret redaction.
Release metadata and contract updates package.json, CHANGELOG.md, README.md, docs/..., tests/*release*, tests/*docs-contract*	Version references and release assertions cover 1.1.1. Protocol documentation tests continue to validate the explicit 1.1.0 release section.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant MiftahServer
  participant AuditFlow
  Client->>MiftahServer: Request tools/list
  MiftahServer->>AuditFlow: Run audit with schema-aware redactor
  AuditFlow-->>MiftahServer: Return redacted tool catalog
  MiftahServer-->>Client: Return preserved schemas and redacted metadata

Loading

Possibly related issues

• [Release] Publish v1.1.1 Claude Desktop compatibility patch #399 — Describes the same v1.1.1 Claude Desktop compatibility patch, including schema-preserving redaction and boolean-schema normalization.

Possibly related PRs

• mohanagy/miftah#64 — Modifies related tool metadata handling in the same server and tool-listing flow.
• mohanagy/miftah#99 — Modifies MCP tool discovery and result handling in src/mcp/server/miftah-server.ts.
• mohanagy/miftah#394 — Updates the same release metadata and version-dependent contract tests.

Suggested labels: documentation, area:mcp

Poem

I’m a rabbit with schemas to spare,
Redacting secrets with careful repair.
true becomes {}, structures stay bright,
Tool catalogs hop into Claude’s sight.
Version 1.1.1 lands just right.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Docstring Coverage	❌ Error	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies this as the v1.1.1 release, which matches the primary purpose and changes in the pull request.
Description check	✅ Passed	The description explains the release scope, security impact, validation evidence, and publication boundary, although it does not use every template heading or checklist item.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch development

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 56: README.md lines 56-56: do not expose the 1.1.1 install command until
1.1.1 is published from the exact current main commit and registry and
provenance verification is complete; otherwise retain the last published
version. Apply the same publication gate to docs/whats-new-in-0.5.md lines 3-6,
keeping both version references consistent.

In `@src/mcp/server/miftah-server.ts`:
- Around line 3714-3719: Update redactClientVisibleSchema and the related
literal-object redaction path in src/mcp/server/miftah-server.ts#L3714-L3719 and
`#L3751-L3753` to generate stable unique aliases for colliding redacted keys,
preserving every entry and applying the same aliases to dependent references;
add two sensitive keys to the properties fixture in
tests/fixtures/fake-upstream-runtime.mjs#L389-L413 and assert both redacted
property definitions remain present in tests/mcp-wrapper.test.ts#L3897-L3913.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7a202386-024e-4162-afc3-40dc753a9ae4

📥 Commits

Reviewing files that changed from the base of the PR and between bb9c9c6 and e43f8ab.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (13)

• CHANGELOG.md
• README.md
• docs/mcp-compatibility.md
• docs/presets-and-clients.md
• docs/whats-new-in-0.5.md
• package.json
• src/mcp/server/miftah-server.ts
• tests/authenticated-request-context-docs-contract.test.ts
• tests/fixtures/fake-upstream-bundled.mjs
• tests/fixtures/fake-upstream-runtime.mjs
• tests/mcp-wrapper.test.ts
• tests/profile-context-handle-docs-contract.test.ts
• tests/release-version.test.ts

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

The major collision finding is fixed and CodeRabbit confirmed it addressed on head 1b5e306. The remaining publication-sequencing note is intentionally handled by the protected exact-main GitHub Release workflow and its thread is resolved with rationale.

[mohanagy]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.