Changelog

Release history for vantage-peers-mcp.

v2.4.1 — 2026-05-30

DCR auth path 401 regression (#556 / #557) — oauthDcr:validateAccessToken was declared internalQuery and unreachable via the HTTP client, so Path 3 DCR returned 401 even with a valid token. Now exposed as a public query. Claude.ai Custom Connectors via DCR works end-to-end.
WWW-Authenticate header format (#557) — emits Bearer resource_metadata="..." per MCP spec §Protected Resource Metadata Discovery. The prior Bearer resource="..." broke Claude.ai PRM bootstrap on 401.

ChatGPT Apps SDK tool annotations (#555) — all 84 MCP tools now ship with readOnlyHint, openWorldHint, and destructiveHint. 34 read-only + 41 write + 9 destructive. ChatGPT custom connectors render confirmation prompts only on writes/destructive ops.
DCR scope isolation (#554) — new public-readonly profile + cross-tenant assertion tests. The DCR auto-discovery flow now resolves to scopeProfile=client-generic (never master), even if a legacy token row carries scope="mcp:full".
VantagePeers Cloud documentation (site #120) — dedicated /docs/cloud/ section for the hosted, multi-tenant version. Multi-client MCP: Claude.ai, ChatGPT, Claude Code, Codex, any MCP-supporting IDE.

iframeEmbedSessions table + __VP_TOOL_RESULT__ stream marker (#545) — M3 milestone. Embedded ack-checklist UI primitive. 24 tests.
credentials:issueBearerFromClerk httpAction (#546) — server-side bearer issuance bound to a Clerk identity, with audit log. Iter 2 P1 fixes.

list_tasks, list_missions, list_tasks_by_mission, and list_briefing_notes accept a fields parameter ("lite" or "full", default "full"). Lite returns a compact projection.
status filter on list_tasks, list_missions, and list_tasks_by_mission now accepts arrays and named aliases:
- Tasks: "open" → todo+in_progress+review+blocked, "active" → todo+in_progress, "all" → no filter
- Missions: "open" → brainstorm+plan+execute+validate (excludes complete), "active" → plan+execute, "all" → no filter

vantage-peers-mcp@2.3.0 is deprecated. v2.3.0 shipped with two blockers caught in delta-review: status="all" was advertised but rejected by the backend, and setPendingAliasReleases was exposed as a public mutation. Upgrade to >=2.3.1.