Added

• MCP structured content + output schema — every tool now advertises an outputSchema and emits structuredContent (UseStructuredContent = true), so clients get a machine-readable, schema-validated result in addition to the JSON text.
• Progress notifications for long-running tools — AnalyzeSolution, ApplyFixes, and RenameSymbol now report progress via MCP progress notifications.
• Human-readable tool titles and an honest OpenWorld hint — every tool advertises a Title; OpenWorld is false for the local-only tools and true only for AnalyzeSolution (which can clone a Git URL).
• Write confirmation via MCP elicitation — the write tools (ApplyFixes, EditMember, RenameSymbol) ask the client to confirm before writing when previewOnly: false; declining downgrades the call to a preview (nothing is written).
• Failure logging via MCP logging notifications — tool failures are surfaced to the client's log stream through MCP logging notifications that carry the correlation ID.

Changed

• BREAKING: tools now return a typed ToolResult<T> envelope instead of a hand-serialized JSON string. The response wire shape changed: success payloads are now nested under data ({ "ok": true, "data": { ... } }) and failures under error ({ "ok": false, "error": { "type", "message", "hint?", "correlationId" } }). The human-readable message moved from the top-level error field to error.message; type/hint/correlationId moved under error. See docs/API.md.
• server.json websiteUrl now points at the documentation site (https://atypical-consulting.github.io/RoselineMCP/) instead of the GitHub repo. Reaches the live MCP Registry entry on the next published version.

Fixed

• MCP Registry publish 403'd on namespace casing. The registry namespace derived from GitHub OIDC is case-sensitive and matches the org's canonical login (Atypical-Consulting), but server.json's name and the README ownership marker used lowercase (io.github.atypical-consulting/...), so the first publish was Forbidden. Corrected both to io.github.Atypical-Consulting/roseline-mcp. (The lowercase GHCR image name is unrelated and stays lowercase, as Docker requires.)
• Docs /releases page didn't refresh on new releases. The release: trigger on deploy-docs.yml never fired because the release is created by the publish workflow's GITHUB_TOKEN, and GitHub does not start workflows from token-created events. Switched to a workflow_run trigger on the Publish NuGet workflow's completion, which keys off the workflow (whose original trigger was a human tag push) and fires regardless of the publish outcome.

Documentation

• Docs site: a Releases page generated from GitHub Releases at build time (notes rendered from each release, plus direct .mcpb/.nupkg download buttons), a new Claude Desktop (1-click) install tab, and a note that RoselineMCP is listed in the official MCP Registry. The Astro build fetches the Releases API (authenticated in CI to avoid rate limits) and degrades to a GitHub link-out if the fetch fails.

Added

• One-click install for Claude Desktop (MCPB bundle). A mcpb/manifest.json (MCPB spec 0.3) describes RoselineMCP as a dnx-launched server; the release now builds and attaches a RoselineMCP.mcpb to each GitHub Release, so users can install with a dialog instead of editing JSON config. The bundle only wraps the dnx RoselineMCP launch (the .NET 10 SDK is still required, since analysis loads projects through MSBuild), so it stays tiny and platform-agnostic.
• Automated MCP Registry publishing. publish-nuget.yml now has a publish-registry job that, after a successful NuGet publish, waits for the version to index, then authenticates via GitHub OIDC (mcp-publisher login github-oidc, no secret) and publishes .mcp/server.json to the official registry (registry.modelcontextprotocol.io) — so the server is discoverable by any client/aggregator that reads the registry. Ownership is proven by an mcp-name: marker added to the packed README.md, which the registry cross-checks against the NuGet package. The manifest $schema was migrated from the deprecated 2025-10-17 to the current 2025-12-11 (a URL-only change; the format is unchanged for stdio package servers). Takes effect on the next tagged release.

Security

• Pinned Microsoft.Bcl.Memory to 10.0.9 (aligned with the net10.0 TFM) in RoselineMCP.TokenBenchmark to override the 9.0.4 that Microsoft.ML.Tokenizers 2.0.0 pulled in transitively, which was vulnerable to CVE-2026-26127 (GHSA-73j8-2gch-69rq, high severity — Base64Url out-of-bounds-read DoS). The benchmark harness is never packaged and is not referenced by the shipped RoselineMCP package, so published users were never exposed; this clears the NU1903 restore warning. Remove the pin once Microsoft.ML.Tokenizers references a patched build.

Changed

• publish-nuget.yml now creates a GitHub Release and verifies the artifact before publishing. A git tag is not a GitHub Release, and nothing was creating one — so tagged versions published to NuGet without a corresponding Release (v1.3.0 had to be backfilled by hand). The release job now: (1) fails the build if the packed .nupkg is missing .mcp/server.json or its embedded version doesn't match the tag — a guard that would have caught the original dnx-fetches-1.0.0 bug at the source rather than in the wild; and (2) after a successful NuGet push, creates (or heals) the matching GitHub Release with notes extracted from this CHANGELOG and the .nupkg attached.

Dependencies

• Microsoft.ML.Tokenizers and Microsoft.ML.Tokenizers.Data.Cl100kBase 1.0.3 → 2.0.0 (RoselineMCP.TokenBenchmark only — not part of the shipped package) (#76)
• Website: astro 5.x → 7.0.0 (#77) and CI Node 20 → 24 (#75)
• actions/upload-pages-artifact action 4 → 5 (#74)

[1.3.0] - 2026-07-03

Added

• Token-efficient code navigation tools — six new read-only MCP tools that let an AI agent retrieve precise structural/semantic information via Roslyn instead of reading whole files (source code typically dominates an agent's token budget):
  • search_symbols — find symbols by wildcard/substring name pattern, or outline a single file
  • get_symbol_info — a symbol's kind, accessibility, modifiers, signature, base types, interfaces, XML docs, and definition location (optionally its source) — the compact "go to definition" payload
  • find_references — every use site of a symbol across the solution, as location + snippet
  • find_implementations — implementations of an interface/member, overrides, or derived types
  • get_call_graph — a depth-bounded caller/callee graph with cycle detection
  • get_type_hierarchy — a type's base-class chain, interfaces, and derived types
• Surgical code-editing tools — two new write tools that emit a member-level change (not a whole-file rewrite), keeping the tokens an agent produces proportional to the change. Both default to preview mode (previewOnly: true) like ApplyFixes, so nothing is written to disk unless the caller passes previewOnly: false explicitly:
  • edit_member — replace, add, or delete a single type member
  • rename_symbol — rename a symbol and update every reference across the solution (Roslyn rename)
• IProjectLoader/ProjectLoader service that loads a project — and its containing solution when present, so references and renames span projects — into a fresh workspace per call, plus ICodeNavigationService and ICodeEditService and their response models.
• Token-savings benchmark (RoselineMCP.TokenBenchmark) — a reproducible harness that runs the real services against RoselineMCP's own source and measures each tool's output against the source an agent would otherwise read, tokenized with cl100k_base. Systematic sweeps; results stamped with commit + date. Reproduce with dotnet run --project RoselineMCP.TokenBenchmark -c Release.
• Documentation site (website/, Astro) with an overview, the tool reference, and the honest benchmark (charts + methodology + limitations), deployed to GitHub Pages via .github/workflows/deploy-docs.yml. Across 477 navigation tasks the read-only tools showed a pooled 81% / median 74% token reduction versus reading the corresponding files.

Changed

• search_symbols file outline is now token-lean. The benchmark caught the outline costing tokens (it repeated the file path and fully-qualified name on every symbol); it now returns a lean projection (name, kind, signature, line), flipping its median from −45% to +30%. SymbolSummary also omits null fields from its JSON. Project-wide search is unchanged.

Fixed

• dnx-based installs pulled an ancient 1.0.0. .mcp/server.json hardcoded version/ packages[0].version at 1.0.0 — a version that was never released (releases start at 1.2.0) — so any client resolving the MCP manifest was told to fetch 1.0.0. Worse, despite PackageType=McpServer the manifest was never packed into the .nupkg (it lives at the repo root with no <None Include> wiring it in), so the McpServer package shipped without its own manifest. Fixed by: (1) correcting the manifest to the current release, (2) packing ../.mcp/server.json into the package at .mcp/server.json, and (3) stamping the version into the manifest from the release tag in publish-nuget.yml (mirroring MinVerVersionOverride) so it can never drift out of lockstep with the package version again.

First real published release of RoselineMCP: reference-project hardening covering security defaults, real Git-URL analysis, correctness fixes, CI/CD, packaging, and a full documentation accuracy pass. See CHANGELOG.md for the itemized [1.2.0]/[1.2.1] entries.

Install

dotnet tool install -g RoselineMCP

Or via Docker:

docker pull phmatray/roseline-mcp:1.2.1

Note on versioning

v1.2.0's tag push published Docker Hub/GHCR images successfully but hit a CI bug that blocked the NuGet.org publish (fixed in this release — see CHANGELOG). v1.2.1 republishes identical application content to both registries and is NuGet.org's first successful release.