Changelog
The release history embedded in the currently deployed application.
# Changelog
All notable changes to `mcp-site-service` are documented in this file.
The deployed service reports the same release identifier through `GET /version`
and in the application footer.
## [0.5.0] - 2026-08-27
### Added
- Added a URL-shareable comparison workspace for up to three catalog tools,
showing category, access, expected input, reliability, rate estimate, and
daily workspace quota side by side.
- Added one-click comparison bundles to each curated outcome so users can turn
an audit, stack-discovery, or company-research path into a decision-ready set.
- Added a combined multi-tool MCP configuration export directly from the
comparison workspace, with placeholder-only credentials and accessible copy
confirmation.
### Changed
- Added quick comparison controls to every catalog card and improved empty
descriptions with an actionable fallback.
- Added frontend linting to the required self-hosted Woodpecker pipeline before
the production build.
## [0.4.4] - 2026-08-24
### Fixed
- Reconciled the application, apex, and checked-in Nginx referrer policies to
strict `no-referrer`, preventing the edge proxy from appending its older,
weaker `no-referrer-when-downgrade` value to tool documentation responses.
## [0.4.3] - 2026-08-24
### Added
- Added ready-to-copy curl, TypeScript, and Python examples to every catalog
tool dialog, with accessible language tabs and copy confirmation.
- Added direct developer-guide, OpenAPI, and MCP-manifest navigation alongside
registry-assessed reliability and usage-policy signals.
### Changed
- Tool sharing now copies the stable, indexable `/tools/{id}` documentation
URL instead of transient catalog query state.
- Standardized documentation examples on the `MCP_API_KEY` environment name
and `X-API-Key` request header.
### Security
- Removed API credentials from example URLs, browser-launch links, history, and
referrers. Keyed tools now direct live testing through the scoped server-side
sandbox, while direct browser launch remains available only for open tools.
- Added no-referrer, nosniff, and restrictive content-security headers to the
server-rendered per-tool documentation pages.
## [0.4.2] - 2026-08-24
### Changed
- Reworked the public app hero around concrete outcomes, agent-ready API
contracts, and direct catalog/workspace calls to action.
- Added keyboard-first catalog discovery with `/` and Command/Ctrl+K focus,
Escape-to-clear, visible reset controls, and announced result counts.
- Added resilient catalog skeleton, retry, and actionable empty states.
- Improved tool-card scanability, navigation branding, product-resource links,
responsive polish, and reduced-motion behavior.
- Published the embedded release history at `/changelog` and added it to the
sitemap, keeping the page tied to the exact application version deployed.
## [0.4.1] - 2026-08-09
### Fixed
- Preserve workflow run history when a saved workflow is deleted, so failure
rates, latency, and operational evidence remain available to observability.
- Align the checked-in apex and app reverse-proxy templates with the five-minute
bounded workflow response window used in production.
## [0.4.0] - 2026-08-09
### Added
- Personal workspaces with durable pinned tools and live per-tool daily usage
meters.
- An ordered multi-tool workflow builder and runner with URL-escaped variables,
sequential results, run history records, server-side scoped keys, and strict
safe-tool eligibility.
- One-click MCP configuration export for every saved workflow.
- Server-enforced workspace execution quotas and estimated per-tool rate limits
shown before execution or configuration.
- Stable, public OpenAPI 3.1 documents and machine-readable MCP manifests for
every catalog tool.
- HTTPS webhook endpoints with one-time signing secrets, HMAC-SHA256 delivery,
redirect/private-network protection, manual retry, and a durable delivery log.
- Key-issuance, request-spike, and failure-spike anomaly detection with an
admin resolution workflow.
- An operations dashboard covering access-review queue time, workflow failures,
metered tool health, anomaly alerts, and the 30-day product funnel.
- Funnel instrumentation across landing, catalog, tool details, access requests,
and successful sandbox/workflow execution.
### Fixed
- Prevented open-tool sandbox output from being corrupted by redaction when no
API key was present.
- Allowed unattended execution on controlled `0crawl.com` and `0exec.com`
fleet hosts, while excluding tools without a safe executable example from
the workflow builder.
- Increased the per-step workflow deadline to 30 seconds so composite fleet
tools can complete without being cut off by the runner.
- Raised the application write deadline to five minutes so ordered workflows
can return their response instead of losing the socket at 30 seconds.
## [0.3.2] - 2026-08-09
### Added
- Responsive layouts for phone and tablet widths, including wrapping top
navigation, scrollable tabs, one-column catalog/workflow cards, and
touch-sized actions.
- Mobile-safe request and key histories: searchable filters, horizontal
overflow at intermediate sizes, and labeled stacked records on phones.
- Catalog discovery improvements: typo-tolerant fuzzy search across names,
categories, descriptions, and tags; Arrow-key result selection; saved
filters; and recently viewed tools.
### Changed
- Tool detail is now a keyboard-safe modal dialog with dialog semantics,
initial/restored focus, focus trapping, Escape close, backdrop handling,
and contained scrolling.
## [0.3.1] - 2026-08-09
### Added
- Curated, outcome-focused workflows for website audits, technology-stack
discovery, and company research. Each workflow links directly to the
complementary tool steps, inputs, access requirements, and MCP setup.
- A signed-in safe-example sandbox for eligible catalog tools. It executes only
the catalog's fixed HTTPS example server-side, keeps scoped keys out of the
browser and logs, rejects redirects or target changes, and excludes active
scanning categories.
## [0.3.0] - 2026-08-09
### Added
- A fast server-rendered, indexable `0mcp.com` landing page focused on
practical outcomes: auditing a site, discovering a tech stack, and
researching a company.
- SEO foundations for the public site: descriptive title and summary,
canonical URL, Open Graph/Twitter metadata and share image, `robots.txt`,
and `sitemap.xml`.
- A deployable apex nginx virtual host that proxies `0mcp.com` to the
existing application instead of redirecting visitors to the dashboard.
### Changed
- Marked the authenticated `app.0mcp.com` SPA as `noindex,follow` so the
public marketing page is the canonical search result.
## [0.2.1] - 2026-08-09
### Fixed
- Register the service self-test with the route shape required by go-common so
the live probe performs the database check rather than returning its generic
fallback response.
## [0.2.0] - 2026-08-09
### Security
- Bind API-key issuance to one explicit approved grant, preventing a key from
being issued with the scope of a different service in the same tier.
- Rate-limit authenticated tier requests and key-issuance attempts.
- Add an admin audit-log viewer with actor/action/target search.
- Require confirmation before a user or admin revokes access or an API key.
- Add durable in-app notifications for access approvals, denials, and admin revocations.
- Add a self-hosted Woodpecker pipeline for Postgres-backed tests and frontend builds.
- Add self-hosted Gitleaks scanning and a transactional two-key encryption
rotation path backed by the fleet secrets vault.
- Set Go's toolchain path explicitly in Docker and Woodpecker for the
self-hosted runtime image.
### Changed
- Show service-bound grants in the key issuance selector.
- Establish a canonical repository version used by the backend, container
image, and frontend runtime display.
## [0.1.0] - 2026-08-09
### Added
- Initial GitHub-authenticated catalog, tier-review, API-key issuance, and
registry-change workflow release for `app.0mcp.com`.