summary	mcp-ts-core ^0.9.9 → ^0.9.13: 413 body cap, HTTP session-init gate, quieter 401/403/400/404 logging, GET /mcp surfaces keywords; landing.requireAuth explicit; plugin metadata scaffolded
breaking	false
security	false

2.5.2 — 2026-05-28

Changed

@cyanheads/mcp-ts-core ^0.9.9 → ^0.9.13 — framework adoption picks up four releases:
- MCP_HTTP_MAX_BODY_BYTES — new configurable inbound body cap on the HTTP MCP endpoint (default 1 MiB); oversized requests rejected with 413 before any parsing or session allocation.
- HTTP session-init gate — stateful HTTP mode now returns 400 on requests arriving without an Mcp-Session-Id header before the session is established.
- Quieter expected-error logging — 401, 403, 400, and 404 HTTP errors now log at warning level without stack traces, reducing noise in error logs.
- GET /mcp keywords — package.json keywords now surface on the status JSON alongside name, version, and description.
landing.requireAuth: false — added to createApp() to explicitly opt the landing page into full inventory serving; required because 0.9.13 changed the default to auth-gated when MCP_AUTH_MODE is jwt or oauth.
manifest.json — repository, homepage, and license fields added.
.claude-plugin/ and .codex-plugin/ — plugin metadata files scaffolded for Claude Code and Codex discovery.