[dangrondahl]

Release prep for 0.6.0. A draft for now: it gets rebased once #97 (CodeQL) merges, then marked ready.

npm version minor --no-git-tag-version moves package.json, package-lock.json and the generated src/version.ts together. manifest.json gets the version at pack time. Nothing else changes.

What's in 0.6.0 (since 0.5.0)

⚠️ Changes that affect existing setups

• No configured org (feat!: require the org on every call, and remove KOSLI_ORG #65). KOSLI_ORG and the Desktop extension's Organization setting are removed. Every org-scoped call names its org through the execute tools' org input, so no request lands in an org the caller didn't name. An existing config that still sets KOSLI_ORG starts fine and logs that the value is ignored, but calls that relied on the default are now refused until an org is given.
• Node ≥ 22 (chore: raise Node floor to 22 and keep @types/node aligned to it #38). It was ≥ 20.

Fixes

• Evidence downloads work again (fix: download evidence without sending our token to the signed URL #88, fixes get_attestation_evidence always returns 400: bearer token is forwarded to the signed S3 URL #86). Since 16 Oct, every get_attestation_evidence call failed: our token was forwarded to the pre-signed S3 URL. Text files come back as text, and binary files return a clear error.
• The .mcpb bundle starts on Node 22.0 – 22.6 (ci: add typecheck and smoke tests, fix .mcpb on Node < 22.7, group Dependabot #87). It didn't before.
• No known vulnerabilities in the bundled dependencies (fix(deps): update the SDK's transitive dependencies to clear npm audit #96). npm audit --omit=dev is clean.

Features

• org input on the execute tools (feat!: require the org on every call, and remove KOSLI_ORG #65).
• User-Agent carries the version (feat: include the version in User-Agent from a single source of truth #41): kosli-mcp-server/<version>.

Dependencies

• Runtime: @modelcontextprotocol/sdk 1.29.0 → 1.32.1 (chore: bump @modelcontextprotocol/sdk from 1.29.0 to 1.30.0 #29, chore: bump @modelcontextprotocol/sdk from 1.30.0 to 1.30.1 #71, chore: bump @modelcontextprotocol/sdk from 1.30.1 to 1.32.1 #79).
• Dev: TypeScript 7 (chore: bump typescript from 5.9.3 to 7.0.2 #45), with emitted output byte-identical to 5.9. vitest 5 (chore: bump vitest from 4.1.11 to 5.0.5 #93).
• Catalog: regenerated from the OpenAPI spec (chore: regenerate catalog from OpenAPI spec #50, chore: regenerate catalog from OpenAPI spec #53, chore: regenerate catalog from OpenAPI spec #60, chore: regenerate catalog from OpenAPI spec #69, chore: regenerate catalog from OpenAPI spec #78).

Release confidence (CI only)

Typecheck of tests and scripts, a stdio smoke test against dist/ and the unzipped bundle (including Node 22.0.0), mcpb validate, and release.yml publishing only after every check (#87). There's also a phased Claude review (#90), Dependabot grouping with a 7-day cooldown, and CodeQL (#97).

Checked locally on this branch

• Build, typecheck, 122 tests.
• The smoke test reports server advertises version 0.6.0, both from dist/ and from the unzipped bundle.
• kosli-mcp-server-0.6.0.mcpb: the manifest says 0.6.0 and mcpb validate passes.

Before tagging (after merge)

• Rebase onto main once ci: add CodeQL code scanning #97 merges, then mark ready.
• Install the 0.6.0 .mcpb in Claude Desktop, including an upgrade over 0.5.0 with an org configured.
• Run KOSLI_API_TOKEN=… KOSLI_SMOKE_ORG=<org> npm run smoke on main.
• Download one piece of evidence via get_attestation_evidence.
• git tag -a v0.6.0 -m "v0.6.0" <merge commit> && git push origin v0.6.0. release.yml does the rest.

[claude]

Claude finished @dangrondahl's task in 1m 1s —— View job

---

Review: chore: bump version to 0.6.0

No findings. This is a clean release bump — nothing in the diff touches the invariants in CLAUDE.md.

What I checked

• Diff is exactly the bump. git diff origin/main...HEAD is three files, 4 lines: package.json:3, both self-version fields in package-lock.json (lines 3 and 9), and src/version.ts:17. No source, catalog, workflow or test changes rode along — scope matches the title and description.
• src/version.ts is generated, not hand-edited. I re-derived the file from scripts/sync-version.mjs against package.json version 0.6.0; the branch content is byte-identical, including the doc comment. So the version lifecycle hook (package.json:24) did this, as required, and test/version.test.ts will pass — it reads package.json at runtime and compares.
• manifest.json placeholder untouched. Still "version": "0.0.0-replaced-at-build-time" (manifest.json:5). Correct — the pack script injects it.
• No stale 0.5.0 left. The only remaining occurrences are historical prose in test/version.test.ts:9 and CLAUDE.md:101, both describing the past 0.1.0-at-0.5.0 drift bug. Those are meant to stay.
• Rebase precondition from the checklist is met. git merge-base origin/main HEAD equals origin/main (844fc9e, ci: add CodeQL code scanning (#97)), so the branch is a clean fast-forward on top of a main that already has ci: add CodeQL code scanning #97. The first checklist box is effectively done.
• Conventional Commits. PR title and the single commit are both chore: bump version to 0.6.0. ✅
• CI. CI ✅ success, CodeQL ✅ success on this head.

One note, not a blocker: User-Agent and the advertised server version both come from VERSION, so they move to 0.6.0 together — the smoke test's server advertises version 0.6.0 line you quoted from both dist/ and the unzipped bundle is the right thing to have confirmed, since that's the exact guard the 0.5.0 release lacked.

The release checklist in the description is unusually thorough about the things that can only be verified post-merge (Desktop upgrade over an 0.5.0 install with an org configured is the right call, given #65 removes KOSLI_ORG). Nothing for me to flag before merge.
· branch chore/release-0.6.0