Skip to content

[pull] main from modelcontextprotocol:main#312

Merged
pull[bot] merged 6 commits intothreatcode:mainfrom
modelcontextprotocol:main
Mar 15, 2026
Merged

[pull] main from modelcontextprotocol:main#312
pull[bot] merged 6 commits intothreatcode:mainfrom
modelcontextprotocol:main

Conversation

@pull
Copy link

@pull pull bot commented Mar 15, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

anshul-garg27 and others added 6 commits March 15, 2026 08:35
fix(fetch): handle malformed input without crashing

Changes `raise_exceptions=True` to `raise_exceptions=False` in the fetch server's `Server.run()` call, preventing the server from crashing on malformed JSON-RPC input. This aligns with the SDK's intended default behavior and is consistent with other reference servers.

Fixes #3359
feat(sequential-thinking): add tool annotations

Adds MCP ToolAnnotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to the sequential-thinking tool, bringing it in line with the annotation pattern established by the filesystem server.

Fixes #3403
…#3574) (#3581)

feat(time): add tool annotations

Adds MCP ToolAnnotations to both time server tools (get_current_time, convert_time). Both are read-only, non-destructive, idempotent, and closed-world.

Fixes #3574
…te_branch, git_log, and git_branch (#3545)

fix(git): add missing argument injection guards

Extends existing startswith("-") input validation to git_show, git_create_branch, git_log, and git_branch, preventing user-supplied values from being interpreted as CLI flags by GitPython's subprocess calls to git.
feat(git): add tool annotations

Adds MCP ToolAnnotations to all 12 git server tools, marking read-only operations (status, diff, log, show, branch) and distinguishing destructive (reset) from non-destructive write operations (add, commit, create_branch, checkout).

Fixes #3573
…3533)

fix(sequential-thinking): use z.coerce for number and safe preprocess for boolean params

Uses z.coerce.number() for number fields and a z.preprocess() helper for boolean fields to handle string-typed parameters from LLM clients. The preprocess approach correctly handles "false" → false, avoiding the z.coerce.boolean() footgun where Boolean("false") === true.

Fixes #3428
@pull pull bot locked and limited conversation to collaborators Mar 15, 2026
@pull pull bot added the ⤵️ pull label Mar 15, 2026
@pull pull bot merged commit 1cdf806 into threatcode:main Mar 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants