Changelog

This page records user-visible changes for each tagged release. For the exact commit history and downloadable artifacts, see GitHub releases.

Unreleased

• No unreleased changes.

v0.28.0 - forum tag preservation and safe edits

• Channel reads and creation results now preserve forum/media available_tags with id, name, moderated, emoji_id, and emoji_name. Post reads, creation results, and all thread lists preserve applied_tags. Missing fields remain absent; empty arrays remain empty.
• channels_modify reads the current tag set before PATCH, keeps existing tag IDs and omitted emoji/moderation fields, and verifies the changed channel after PATCH. It now accepts applied_tags for existing forum/media posts.
• Migration: available_tags remains the complete desired list. Keep IDs when editing existing tags and omit IDs for additions. Every existing tag omitted from that list must now be explicitly named in remove_available_tag_ids; an unreadable current state blocks replacement.
• tags_verified: true confirms the changed channel’s tag readback. If PATCH succeeds but verification fails, the tool returns TAG_VERIFICATION_FAILED with patch_succeeded: true and retriable: false. Read the current state before retrying, and read old posts to verify their retained tag IDs.
• Forum tag emoji_id refers to a guild emoji. Application emoji support is not implied; reuse the artwork by uploading a guild emoji when needed.
• Regression tests cover output schemas, MCP serialization, safe replacements, emoji changes, and post tag preservation using synthetic Discord responses. They do not establish live Discord verification.

v0.27.1 - rich message reads

• Fixed #61: messages_get and messages_read now preserve the full Components V2 tree, legacy embeds, attachment metadata, and flags supplied by Discord. Nested properties and unknown component types remain available in structured results and pipelines.
• Human-readable results include nested Text Display and legacy embed text inside the existing untrusted-content fence. Original structured content stays unchanged, including empty component-only or upstream-redacted bodies.
• Rich fields are returned without truncation. Use a smaller history limit with before/after, or messages_get for one complete message, when a client’s response budget is tight. Attachment and media URLs are not fetched.
• Added protocol regression coverage for rich reads, output schemas, pipelines, pagination, empty fields, and malicious tag-like text. These checks use synthetic REST fixtures and do not establish live Discord activation.

v0.27.0 - DeepSeek Harness client support

• Added --client deepseek-harness to init and guided setup. Generated Cordis YAML patches register the official @deepseek-ai/dsh-mcp-client plugin over stdio with a 180-second tool-call timeout and startup failure reporting.
• Guided setup forwards DISCORD_TOKEN through a YAML environment reference without persisting the token value, keeps the bot and guild scope in a local profile, and defaults to progressive discovery and preview mode. Stateless init --token retains its explicit legacy token behavior.
• Added client setup documentation and coverage for YAML parsing, Windows paths, quoted values, token forwarding, and profile persistence. Harness config inspection through doctor --client and live DeepSeek-to-Discord activation evidence are not included in this release.
• Includes the runtime/documentation dependency and Vitest 4 coverage-tooling updates merged since v0.26.1.

v0.26.1 - stdio lifecycle cleanup

• Closed stdio clients now trigger one deduplicated cleanup path so Gateway, MCP, audit, and OpenTelemetry resources are released when the host closes its pipe. Cleanup is bounded to five seconds before the child exits.
• Multiple active AI-client sessions still use separate stdio server processes by design. On Windows, a PowerShell npx launch can also show additional npm/cmd/PowerShell wrapper processes for the server’s lifetime; a direct Node launcher avoids those wrappers but does not create a global server singleton.

v0.26.0 - security and pagination hardening

• Added resumable audit_log_get pages through an optional before cursor and oldest_id continuation marker.
• Migrated message pin list, pin, and unpin calls off Discord’s deprecated routes; pin listing now exposes timestamp pagination and has_more.
• Added scanned-page boundary IDs to messages_search_recent so zero-match pages can still continue through older channel history without gaps.
• Hardened network and parsing boundaries found by the first CodeQL baseline: bot credentials can no longer follow a remote DISCORD_API_BASE_URL, release checks validate the exact GitHub repository path, npm update checks use the fixed public registry endpoint, and adversarial fence/template/auth inputs are handled without backtracking-prone regular expressions.
• Hardened the local activity journal against symlink redirection, cross-process compaction races, oversized files, and stale-lock reclamation while keeping activity evidence best-effort and local-only.
• Hardened blueprint checkpoint, Activity Evidence, and apply-lock reads with bounded descriptor I/O, regular-file identity checks, symlink rejection, and descriptor-verified publication permissions.
• Hardened local profile storage with bounded descriptor reads, regular-file identity checks, atomic exclusive publication, and final profile file/directory symlink rejection. Profile metadata and command behavior remain unchanged.
• Hardened Codex launcher updates with bounded descriptor reads, caller-owned path validation, symlink-safe atomic writes, permission preservation, and stale-target content and identity checks.
• Stabilized blueprint plan-reference quota locking under Windows I/O contention by retrying bounded transient lock errors and extending the wait from 5 to 15 seconds, without weakening fail-closed storage errors.
• Updated compatible patch/minor dependencies across Discord REST, HTTP, validation, testing, and documentation tooling. Dependabot now keeps major and known Node-floor/toolchain migrations in dedicated review increments. The MSW-only test graph includes upstream transitive major updates accepted after the full workspace suite; those packages are not shipped at runtime.

v0.25.1 - release and runtime hardening

• Corrected runtime access evidence so Administrator and guild-owner grants remain complete for declared known permissions when Discord returns a newer unknown permission bit; the unknown bit remains visible in diagnostics.
• Upgraded dependencies, security baselines, and the build toolchain, including Astro 7 documentation builds and type checks.
• Added trusted exact-tag release gates and documented protected-main branch operations; branch protection is an operator control, not package runtime code.
• Added result-byte budget evidence for representative MCP responses to keep payload growth bounded and measurable.

v0.25.0 - verified access and approval hardening

• Wired MCP_AUDIT_SINK=otlp to a server-owned OpenTelemetry Logs pipeline when OTEL_ENABLED=true and an OTLP endpoint is configured. Audit records cross the core/server boundary only after redaction, use a bounded batch queue, and flush best-effort on shutdown; missing telemetry configuration remains an explicit stderr fallback. This is not durable spool storage.
• Added machine-readable access classification for all 209 tools (15 colocated definitions plus a conservative 208-route central registry). The recipient-targeted users_create_dm route is explicitly scope: user; its caller approval remains a separate policy gate. The three blueprint lifecycle tools are marked as delegated because their specialized target-bound permission, drift, and readback checks remain authoritative; unknown tools still fail closed.
• Added an optional same-filesystem durable approval ledger through MCP_APPROVAL_STATE_DIR and MCP_APPROVAL_HMAC_KEY. It uses bounded, HMAC-protected state, an exclusive lock, atomic replacement, TTL cleanup, and one-time consume semantics across processes; the default remains process-local memory and multi-host deployments still need an external transactional store.
• Added an opt-in runtime access gate (MCP_ACCESS_MODE=warn|enforce) and a built-in read-only REST evidence resolver for stdio and Streamable HTTP. It verifies the authenticated bot, target guild/channel, effective role and channel permissions, declared Gateway intent state, and role hierarchy where a contract requires it. Evidence is short-lived and bounded; partial or unknown data fails closed in enforce, and no resolver path performs a Discord mutation. Field-conditional and consent gates still apply, so this is not a claim that every shipped write is automatically admissible.
• Refreshed the Discord access contracts against the current permission split: emoji/sticker/sound creation requires CREATE_GUILD_EXPRESSIONS, scheduled event creation requires CREATE_EVENTS, pin/unpin requires PIN_MESSAGES, and stage operations check the full moderator permission set. Thread/archive routes now follow their distinct history, management, and in-thread-send permissions. Guild-scoped channel targets now include their channel overwrites in runtime evidence where the contract declares them.
• Declared MESSAGE_CONTENT for message-reading and intelligence contracts, while keeping metadata-only reaction, poll-voter, and thread-member reads on the narrower history/channel requirements.
• Added an advisory doctor --access preflight with a machine-readable catalogued access-requirement report for all 208 Discord routes plus the specialized blueprint verifier entries. It verifies the caller-owned bot identity, application and guild membership, evaluates role/channel permission bitfields, separates application intent availability from this process’s Gateway runtime configuration, and keeps bearer-only, missing, and unknown requirements distinct. Application identity mismatches and incomplete permission evidence fail closed. It does not mutate Discord or replace the server-side authorization policy.
• Added discord_intent_plan, a deterministic read-only front door for a deliberately small set of explicit channel workflows. It produces target-bound steps, aggregated access requirements, a plan digest, and fail-closed needs_input results; it never executes the returned writes or grants approval.
• Added a recipient-bound caller-approval gate for users_create_dm. Ambiguous post-send failures return DM_OUTCOME_UNKNOWN and never reuse the consumed approval; the host/operator remains responsible for obtaining human consent.
• Added payload-bound approval for components_v2_send, components_v2_edit, and components_v2_send_from_template. Their first validated call returns a redacted preview, risk flags, canonical SHA-256 payload_hash, and a short-lived one-time approval_id; execution requires MCP_DRY_RUN=false, __confirm:true, the exact __confirm_hash, and __confirm_id. Changed payloads fail closed before Discord, including fully interpolated template sends.
• Added the first readable live resource, discord://guild/{guild_id}/info, for configured guilds. Reads reuse the guild scope policy, cache short-lived Discord REST snapshots, and invalidate the cache before a Gateway resources/updated notification. Other Gateway URI families remain notification-only.
• Added a deterministic benchmark fault-injection seam for the critical RESULT_LOST_AFTER_MUTATION case. Trial evidence now records whether an apply response was lost after the simulated mutation and whether the retry recovered; replay, independent Activity Evidence, state/audit oracles, and duplicate-mutation protection remain required. This is a local proof seam, not a claim that the real 20-trial Discord campaign has passed.
• Split benchmark reporting into the compatibility activation gate (19/20) and a stricter verified_correctness_gate_passed signal. The latter requires all 20 eligible trials, zero serious permission failures, all safety cases, and at least one observed post-mutation lost-response recovery; a passing compatibility gate is no longer presented as full correctness proof.

v0.24.0 - activation hardening and bot operations

• Saved caller-owned profiles now persist MCP_CATEGORIES and MCP_WRITE_MODE; guided setup defaults to preview mode, while legacy profiles load as all categories with allow to preserve existing behavior. Profile activation clears ambient category policy and sets write mode explicitly.
• Added an authenticated GET /healthz readiness probe alongside the HTTP /mcp endpoint. It reuses bearer and loopback Host/Origin checks, returns only a secret-free status, and closes malformed body-bearing probes safely.
• Hardened the application-emoji surface for the authenticated bot: all five app_emojis_* tools can resolve an omitted application_id through /applications/@me, while guild-allowlisted deployments expose application emoji writes only for the identity-locked bot application. Uploads now fail closed before Discord for unsupported image MIME types, malformed base64, decoded payloads over 256 KiB, and names outside Discord’s [A-Za-z0-9_]{2,32} rule. A distinct BOT_SCOPE_UNRESOLVED error explains missing or mismatched bot identity locks. app_emojis_delete remains confirmation-gated.
• Added first-class Google Antigravity CLI setup and offline config auditing. Generated mcp_config.json fragments inherit the caller’s launch environment and never persist DISCORD_TOKEN; doctor fails closed if that field appears.
• Kept Gemini CLI as an enterprise and paid API-key compatibility target while moving the primary Google consumer path to Antigravity CLI.
• Added secret-free Cursor Agent CLI setup and offline launcher auditing for the official agent command on macOS, Linux, WSL, and native Windows. Cursor and Discord credentials stay in the launch environment; generated MCP JSON stores neither credential field.
• Added first-class support for the official Grok Build CLI: secret-free ~/.grok/config.toml generation and offline inspection, isolated GROK_HOME, bounded streaming-json parsing, exact MCP-only permissions, session resume, the native search_tool → use_tool discovery contract, private MCP capture, and a three-trial activation campaign over the shared Activity Evidence lifecycle. This is code and CI evidence only; no live Grok model or Discord campaign is predeclared here.
• Added a fail-closed five-host activation matrix verifier. It independently authenticates three live campaign trials for each first-class coding host, requires one exact release/commit/package build, and rejects cross-host reuse of trial IDs, client sessions, attestation envelopes, or Activity Evidence. The gate does not predeclare that the live 15-trial matrix has passed.
• Added a production matrix orchestrator for Codex, Claude Code, Antigravity CLI, Cursor Agent CLI, and Grok Build CLI. One target-bound approval starts a fail-closed credential and exact CLI-version preflight, five sequential three-trial campaigns, a same-build check, and the existing independent 15-trial verifier. It stops on the first host failure and emits no partial-success claim.
• Added the first Cursor Agent CLI activation adapter over the shared setup → plan → approve → apply/resume → Activity Evidence lifecycle. Its benchmark driver uses the official stream-json events, exact MCP argument capture, bounded process closure, private receipts, official-install launcher provenance on POSIX and native Windows, and a three-trial campaign entrypoint. This is code and CI evidence only; no live Cursor model or Discord campaign is predeclared here.

v0.23.0 - credential-free activation checkpoint

• Added discord-mcp catalog --check [--json], a bounded local MCP handshake that verifies the packaged 208-tool catalog, six static resources, resource reads, and the CATALOG_ONLY execution guard without loading a Discord token or contacting Discord or another network service.
• The check exits instead of waiting for stdio frames and emits the stable discord-mcp.catalog-check.v1 result in JSON mode. It proves only the installed catalog contract: it neither proves AI-host or live Discord connectivity nor creates Activity Evidence.
• Added the credential-free checkpoint to onboarding and the optional public outcome form. Reports can now identify the furthest activation stage without attaching credentials, Discord identifiers, screenshots, logs, exported files, or Activity Evidence payloads.

v0.22.0 - privacy-safe outcome feedback

• Extended the private local activity journal with coarse blueprint plan, apply, and evidence lifecycle outcomes for both stdio and authenticated HTTP. Records contain only timestamps and predefined enum values; no MCP arguments, result payloads, Discord identifiers, content, credentials, paths, or raw errors are retained.
• Added the opt-in discord-mcp activity --report shortcut. It prints the fixed voluntary outcome-form URL but never reads or exports the journal, opens a browser, accesses the network, pre-fills fields, or submits a report.
• Opened GitHub Discussions for credential-safe Q&A, recurring-workflow ideas, and consent-based redacted showcases.

v0.21.0 - credential-free catalog discovery

This minor release makes the complete MCP contract safely discoverable by directories and security tooling without weakening the caller-owned execution boundary.

• Added discord-mcp catalog, a credential-free stdio server that advertises the same 208 tool schemas and six static resources as the unrestricted full server. It does not load a token, profile, Discord REST client, Gateway, or OpenTelemetry path.
• Every catalog-mode tools/call, including unknown tool names, fails closed with CATALOG_ONLY before argument validation or dispatch. Operational use remains on discord-mcp serve with a caller-owned bot and the existing identity, allowlist, approval, and audit controls.
• Added a minimal non-root root Dockerfile whose default command is catalog discovery, plus CI that starts it without credentials under a read-only, network-disabled, capability-dropped container and verifies all 208 schemas.
• Extended clean-tarball acceptance so the published CLI must expose the exact catalog contract without regressing stdio or Streamable HTTP operation.

v0.20.1 - outcome-led onboarding and discovery

This patch makes the existing verified guild-build lifecycle discoverable and followable without changing the runtime or 208-tool contract.

• Repositioned the README, documentation landing page, package metadata, MCP Registry metadata, structured discovery data, and llms.txt around caller-owned Discord operations rather than tool count alone. Activity Evidence remains explicitly scoped to completed guild blueprint workflows; ordinary write tools do not gain a new verification guarantee.
• Added a first verified-outcome tutorial that links the prerequisite connection track, shows the exact Codex and JSON environment merge for confirmed apply, handles caller-local plan_ref and legacy plan_token fallback, and finishes with a separate read-only guild_blueprint_evidence call.
• Added a voluntary GitHub outcome report for time-to-value, repeat use, first friction, and the next recurring community job. The form prohibits credentials, Discord identifiers, plan/evidence identifiers, screenshots, logs, and exported files. discord-mcp sends no product telemetry from an installation.
• Added rendered desktop/mobile coverage for the primary verified-outcome CTA and regression tests for the activation contract and credential-safe report.

v0.20.0 - caller-local plan references and verifiable small-model apply

This minor release adds a short caller-local plan reference and independently verifiable benchmark tooling: an approved small-model live lifecycle harness and a local Architect planning CPU benchmark. The harnesses define evidence and verification paths; no live campaign result is predeclared here.

• Added plan_ref to guild_blueprint_plan and guild_blueprint_apply. The planner persists an immutable authenticated local payload, while apply accepts exactly one short reference or legacy self-contained plan_token. A reference remains bound to the active caller secret and is never standalone authority: exact guild, bot, approval, confirmation, live identity, locks, reconciliation, and final readback are still mandatory.

• Kept raw plan tokens out of local state. Missing, malformed, tampered, wrong-caller, and conflicting references fail closed before Discord access; the legacy token path remains compatible for portable and stateless clients.

• The approved small-model live lifecycle is the release gate for plan_ref. The existing 20-trial campaign runner intentionally retains the self-contained token path as backward-compatibility coverage rather than silently dropping it.

• Guided Codex setup now emits tool_timeout_sec = 180. This keeps bounded blueprint apply calls from being cut off by Codex’s 60-second default MCP tool timeout while leaving short calls and the server’s own safety bounds unchanged. discord-mcp update --apply adds the setting when an older generated launcher lacks it, but preserves any caller-defined value and every custom launcher.

• Added the small-model live lifecycle benchmark harness and verifier for independently checking an approved run when credentials and a real Discord server are available.

• Bound every resumed model turn to the exact non-secret guild, bot, approval, plan, blueprint, and caller-local reference while keeping the opaque legacy plan token out of prompts and artifacts. After the harness records explicit caller approval, its non-interactive Codex resume pre-approves only guild_blueprint_apply; it does not weaken the server-wide MCP tool policy. The verifier rebuilds the complete, digest-bound Activity Evidence only from the production tool’s public proof plus the already locked plan before passing it to the attested core validator. Approved failures now leave a bounded, HMAC-signed diagnostic capsule or retain the campaign lock if that capsule cannot be persisted.

• Added a deterministic benchmark for the local compile, reconcile, summarize, and authenticated-plan encoding path. It explicitly excludes template lookup, Discord I/O, and network waits.

• Kept the 208-tool registry and CLI surface unchanged.

v0.19.0 - AI Discord Architect foundation

The exact release date and tag commit are authoritative in GitHub Releases. Publication is conditional on the official 20-trial real-server campaign and independent verification of its authenticated Activity Evidence against the exact tag commit. The signed result belongs to that release’s artifacts; this changelog does not predeclare a campaign outcome.

• Added templates_recommend: submit one natural-language request to receive one verified primary template and 0–3 bounded inspirations after live verification. It is always strict and read-only. Explicitly dirty, malformed, unverified, or NSFW templates are rejected; an unknown dirty state has medium confidence. Risky source permission signals are surfaced and penalized, but all source permissions and overwrites are discarded and regenerated. Third-party names and descriptions remain fenced as untrusted text. Canonical provenance digests bind every valid live response used to select or reject a candidate.
• Added guild_blueprint_compile, the one-call architecture entrypoint. It reuses the bounded recommendation provider internally and emits a deterministic symbolic desired state by converting verified source structure into bounded capability signals—not by copying a third-party layout literally. The result covers guild settings, channels, roles, regenerated permissions, Onboarding, AutoMod, welcome-screen routing, and Components V2 publications.
• Blueprint references resolve only against the target guild or create results. Source template IDs, permissions, overwrites, names, and descriptions never enter trusted desired state. The compiler validates role safety, symbolic references, Onboarding’s 7/5 rule, AutoMod semantics and caps, and every Components V2 tree without writing to Discord. Components V2 channel placeholders are explicitly marked for target-guild resolution and revalidation before send.
• Added guild_blueprint_plan and guild_blueprint_apply: natural progressive discovery, request-only resolution from one locked caller profile, a target-bound dry-run, authenticated approval token, locally checkpointed resume, fail-closed reconciliation, and independent final Discord readback. Ambiguous multi-guild profiles require an explicit target. Completed approvals cannot repair later drift; a fresh plan is required.
• Community-protected singleton AutoMod rules can now be reused without a duplicate create: adoption requires one matching immutable trigger and the exact caller-owned bot as creator_id. Foreign-owned or ambiguous rules fail closed, while the real-server benchmark restores an adopted protected rule to its exact baseline instead of attempting an impossible delete.
• Successful terminal apply now persists completion-only, authenticated Activity Evidence and returns its ID, trusted plan counts and safety policy, plus the observed execution and final live-readback record. Partial or drifted results cannot claim terminal evidence.
• Added read-only guild_blueprint_evidence. With the explicit guild, bot, and plan IDs it reloads evidence after restart, verifies the caller and bot, and re-runs live Discord reconciliation without a plan token, confirmation flag, lock, checkpoint write, or guild mutation. Blueprint conformance and exact whole-guild snapshot continuity are reported separately.
• Long Discord rate-limit windows no longer sleep inside an MCP apply request or get clamped into an early retry. Apply returns the exact millisecond delay, the benchmark closes the child before waiting, and resume continues from an authenticated checkpoint. Trial evidence preserves that exact delay, and a campaign now quarantines at a verified, restored trial boundary as soon as the required 19/20 pass threshold is mathematically unreachable. Cleanup bindings are accepted only when they match the signed plan, exact guild/bot target, and blueprint resource domains. Before spending a full trial, the real-server campaign now probes each controlled guild with one zero-permission temporary role, removes it, and requires the exact baseline fingerprint; an unavailable role-create window quarantines the run before touching the next guild, with over-budget Retry-After windows reported separately as unaffordable.
• The source registry now contains 208 tools across the same 31 categories. The release gate requires an independently verified >=95% real-server benchmark; mocked integration coverage is never reported as that result.

v0.18.1 - Correct Hubdustry reference metadata

Released 2026-08-11.

• discord-mcp migrate --list no longer advertises the unreachable original Hubdustry repository or its unverifiable historical tool-count estimate.
• The CLI reference and migration guide now distinguish that unavailable upstream from the bundled synthetic fixture. Running the real adapter against the fixture reproducibly reports 0 mapped, 5 unmapped, and 0 manual-review tools, with exit code 1 indicating remaining migration work.
• A documentation drift guard derives those claims from the adapter result, so future fixture or extraction changes cannot silently leave either guide stale.

v0.18.0 - Audit channel access across roles

Released 2026-08-10.

• Added permissions_audit_channel, a read-only role-baseline audit for one channel or thread. It evaluates every guild role independently with @everyone for view, send, and manage access, with an optional action subset to reduce output.
• Standard channels require two Discord GETs and threads require three, regardless of role count. The tool does not fetch members, make per-role requests, or write to Discord; member-specific overwrites are counted and explicitly excluded from role-level conclusions.
• Thread evaluation uses parent overwrites, SEND_MESSAGES_IN_THREADS, and MANAGE_THREADS. Private-thread membership that Discord cannot prove remains unknown instead of being guessed.
• Discord response identities and permission evidence are validated before evaluation. Malformed or conflicting payloads fail closed, while missing evidence and permission bits unknown to this build produce partial results with warnings. The generated catalog now covers 203 tools across 31 categories.

v0.17.0 - Explain effective Discord permissions

Released 2026-08-09.

• Added permissions_explain, a read-only preflight tool that evaluates a member or role against guild permissions, channel overwrites, implicit prerequisites, active timeouts, thread inheritance, and supported role hierarchy actions.
• Results include a structured decision trace, missing or ineffective permissions, hierarchy evidence, warnings, and confidence. When Discord does not expose enough evidence, the tool returns a partial unknown result instead of inventing an allow or deny decision.
• Added the permissions category and expanded progressive discovery, guild allowlist, generated-reference, and contract coverage for the 202-tool, 31-category catalog.
• Updated discord-api-types to 0.38.53 for current permission flags. The tool remains advisory: it does not grant permissions, mutate Discord, or replace Discord’s final server-side authorization decision.

v0.16.11 - Faster stateless HTTP startup

Released 2026-08-09.

• Stateless HTTP requests now reuse one immutable, process-scoped tool registry while retaining fresh MCP servers, policy stores, and caller-owned Discord runtimes per request. Concurrent bot runtimes remain isolated.
• Progressive mode compiles a tool’s JSON Schema contract only when discovery selects it instead of compiling all 201 contracts during startup. Full mode keeps the complete compatibility surface unchanged.
• Local comparative measurements reduced warm server construction by about 36%, modern HTTP connection setup by about 49%, and working-set memory after 100 discovery calls by about 14%. These are release-machine measurements, not network latency guarantees.
• Clean-install CI now starts the packed CLI through both stdio and real loopback HTTP, covering bearer rejection, request-size and concurrency limits, modern stateless negotiation, progressive discovery, and write preview.

v0.16.10 - Hardened remote HTTP transport

Released 2026-08-08.

• Authenticated Streamable HTTP bodies are bounded before the MCP SDK buffers them. The default 4 MiB ceiling covers normal Discord asset workflows while declared and chunked overflow receive 413 and close the partial connection.
• A 16-request in-flight bulkhead now bounds simultaneous per-request MCP servers. Overflow is rejected immediately with 503 and Retry-After: 1 instead of retaining an application queue.
• Remote bearer credentials must contain at least 32 characters. The production Hono dependency is updated past its patched moderate advisories, and CI now enforces the production audit at the moderate threshold.
• The dated HTTP security review documents the caller-owned single-bot identity boundary, real attack-oriented regression evidence, and the HTTPS proxy controls still required for public deployments.

v0.16.9 - Faster discovery and startup

Released 2026-08-08.

• Progressive discovery now compiles its searchable 201-tool catalog once per server. Exact-name search and risk-matched dispatch use indexed lookups, while category groups and normalized descriptions are reused instead of rebuilt for every request. Exact-name searches return exactly one contract.
• A reproducible full-registry MCP benchmark and absolute serialized-payload budgets now guard the common category-browse and exact-contract journey. On the release machine, ambiguous search latency fell by 76% and exact-contract lookup by 87%; these are local benchmark measurements, not network claims.
• The CLI dynamically loads only the selected transport and loads the OpenTelemetry SDK only when enabled. This reduces default stdio startup work and makes lightweight CLI commands such as --version avoid the MCP, HTTP, Discord REST, and telemetry runtime graph entirely.

v0.16.8 - All-write preview safety

Released 2026-08-08.

• MCP_WRITE_MODE=preview is now an explicit no-mutation mode. It blocks every mutating tool before Discord receives a request, including ordinary writes such as sending a message or creating a channel, and returns a redacted WRITE_PREVIEW response instead.
• The default remains allow for compatibility. Existing MCP_DRY_RUN and __confirm safeguards continue to control destructive operations, while preview is the clear choice for audits, planning and safe dogfood.
• discord-mcp doctor --client codex reports the effective write mode and warns when dry-run is enabled but non-destructive writes still remain active.

v0.16.7 - Safe Codex client audit

Released 2026-08-07.

• discord-mcp doctor --profile <name> --client codex now audits the saved generated Codex launcher locally. It reports normalized launcher state only: version, enabled state, startup timeout, dry-run, and OTel enabled state.
• The audit never returns configuration text, bot tokens, other environment values, OTLP endpoints, or absolute paths. It does not change configuration or Discord state; like other doctor runs, it records only a filtered local outcome in the privacy-safe activity journal.
• An explicit --config <path> applies consistently to this client audit and to the existing online launcher-update check when both options are used.

v0.16.6 - Reliable first npx launch

Released 2026-08-07.

• Guided Codex setup now adds startup_timeout_sec = 90 when it emits the portable, pinned npx launcher for a caller-owned bot profile. This prevents Codex from abandoning a legitimate first start while npm fetches the package into its local cache.
• Local node launchers remain unchanged. The setting is a startup grace period, not a claim that a cold npm download is faster.

v0.16.5 - Privacy-safe performance evidence

Released 2026-08-05.

• OpenTelemetry now measures progressive discovery response size and shape with bounded labels only. It distinguishes compact/full responses, contract mode, and a small match-count bucket without exporting search queries, tool names, schemas, or response payloads.
• The shared channel-to-guild resolver now reports cache hits, misses, outcome, and wait time. This provides production evidence of avoided REST lookups while never exporting channel IDs, guild IDs, or message data.
• New performance evidence is strictly observational: telemetry failures cannot change a tool response or allowlist authorization decision.

v0.16.4 - Efficient progressive discovery

Released 2026-08-04.

• Progressive mcp_tools_search now returns compact matches by default for ambiguous searches, avoiding repeated descriptions, annotations, and JSON Schemas in the model context. A single returned match includes its complete contract immediately; for multiple matches, search the selected exact tool name to load its schema. detail: "full" remains available when a workflow deliberately needs several contracts at once.
• The measured eight-channel selection journey is 57.2% smaller than returning all eight full contracts; the browse response alone is 81.4% smaller. These are serialized MCP payload measurements, not a model-specific billing claim.
• Channel-targeted message sends in an allowlisted deployment now share a bounded channel-to-guild lookup between scope verification and canonical jump link generation, removing a duplicate Discord REST metadata request.

v0.16.3 - Public template URL input

Released 2026-08-04.

• templates_get now accepts either a raw Discord Guild Template code or its canonical https://discord.new/<code> URL. It parses the URL locally and calls Discord’s official template endpoint directly; it does not follow a redirect, enter the source guild, or create a server.
• Only HTTPS discord.new URLs with one code path segment are accepted. The returned snapshot remains fenced as untrusted third-party template data.

v0.16.2 - Dogfood hardening

Released 2026-08-03.

• Emoji.gg inspiration search now ranks multi-word natural-language queries term-by-term without sending the query to the provider, and gives automation an explicit license_review_required signal.
• onboarding_get now returns a compact configuration summary and explicitly distinguishes API readback from a fresh member’s client experience.
• A successful JSON update --apply result now carries data.restart_required: true, so automation cannot mistake a pinned launcher for an already-restarted MCP process.
• Template sync guidance now tells callers to verify comparable drift and the official snapshot’s channel-type limitations with templates_diff.

v0.16.1 - Template comparison fidelity

Released 2026-08-03.

• templates_diff now recognizes Discord News and Stage channels that the official Guild Template serializer omits. They are reported separately as non-representable rather than producing permanent false drift or a no-op sync recommendation.
• Forum tags and a forum’s default reaction are compared by semantic meaning, not Discord-generated IDs, avoiding false differences after template sync.

v0.16.0 - Native Guild Templates

Released 2026-08-03.

• Added the caller-owned templates category with native Discord Guild Template lifecycle tools: inspect public templates, list/create/modify/sync a source guild snapshot, and confirmation-gated delete. The server never stores a user’s token or operates a central template catalog.
• Added templates_inspect and templates_diff so an AI can review a template’s structure, risky permissions, source-guild boundary, comparable role/channel/overwrite changes, and sync recommendation before sharing or updating it. Template text and raw names remain fenced as untrusted data.
• Added smoke --confirm-template-lifecycle for an explicit, self-cleaning live verification of create, inspect, drift detection, sync, clean diff, and delete. It refuses to write unless --confirm-write is also supplied.

v0.15.0 - External inspiration discovery

Released 2026-08-03.

• Added inspiration_emoji_gg_search, an opt-in, caller-invoked read-only Emoji.gg discovery tool. It returns candidate metadata only: no Discord mutation, emoji download, automatic import, or sharing of bot credentials, guild IDs, caller profiles, or search terms with Emoji.gg. Review the individual asset page and licence before explicitly using emojis_create.
• Emoji.gg is isolated in the new inspiration category, so callers can omit it from MCP_CATEGORIES to keep a Discord-only tool surface.
• Guild message sends now return canonical guild-aware Discord jump links even when Discord omits guild_id from a create-message response.

v0.14.8 - Read-only launcher update discovery

Released 2026-08-03.

• doctor --online --profile <codex-profile> now reports whether its exact generated launcher has a newer npm release. Discovery is read-only: it does not send bot/profile data, modify configuration, or update automatically. Custom and ambiguous launchers remain caller-managed.

v0.14.7 - Explicit caller-controlled updates

Released 2026-08-03.

• Added discord-mcp update --profile <name> [--check|--apply] for generated Codex launchers. It compares the pinned launcher version with npm latest; --apply is explicit, updates exactly one recognized launcher atomically, and fails closed on custom or ambiguous configuration. The check never sends bot tokens, Discord identities, guild IDs, or profile contents to npm.
• members_get_current_user now uses the bot-compatible specified-member Discord route after resolving the authenticated bot ID. It no longer calls the user OAuth-only current-member endpoint, so a least-privilege bot can retrieve its own allowed-guild membership without requiring GUILD_MEMBERS intent.

v0.14.6 - Actionable activity evidence

Released 2026-08-03.

• Setup warnings caused by a selected bot having Discord Administrator now record the safe, non-identifying administrator-warning signal in local Activity Evidence. The journal still excludes every Discord identity and guild ID.
• Generated profile launchers pass --loglevel=error to npx, so unrelated npm configuration warnings from the caller’s project do not add startup noise while actual errors remain visible.

v0.14.5 - Local activity evidence

Released 2026-08-03.

• Added discord-mcp activity [--json], a local-only summary of recent onboarding outcomes from setup, doctor, and smoke. It helps an operator identify setup and verification friction without a telemetry service or external account.
• The capped local journal records only timestamps, command outcomes, and predefined technical signals. It never stores or sends bot tokens, Discord identities or guild IDs, paths, command arguments, or raw errors. Set DISCORD_MCP_ACTIVITY=off to opt out for a run.

v0.14.4 - Portable guided setup

Released 2026-08-03.

• Guided setup profile fragments now launch the exact @discord-mcp/cli release through npx, rather than persisting an absolute local installation or npm-cache path. They still start serve --profile <name> and keep DISCORD_TOKEN outside generated configuration and profile metadata.
• Added repository funding metadata for the maintainer’s GitHub Sponsors profile.

v0.14.3 - Caller-owned bot profiles and safe setup

Released 2026-08-03.

• Added discord-mcp setup, a guided caller-owned bot flow that verifies the live bot and guild boundary, saves only versioned non-secret profile metadata, and generates client config that starts serve --profile <name>. Profiles use the explicit provider reference env:DISCORD_TOKEN; token values are never written to profile files.
• Added profile list, profile show, and confirmation-gated profile remove lifecycle commands, plus --profile activation for serve, doctor, and smoke. A profile remains locked to its first verified bot ID even during a setup --force update, preventing accidental cross-bot reassignment.
• Added DISCORD_EXPECTED_BOT_ID, an optional non-secret runtime lock that verifies the caller-owned token still belongs to the configured bot before serving MCP. init --discover-guilds emits the lock automatically, and doctor --online reports identity mismatches.
• Added a credential-lifecycle playbook for Developer Portal token reset, caller-controlled secret replacement, read-only verification, restart, and retirement. Discord OAuth token revocation is not presented as bot-token revocation.
• Added discord-mcp init --discover-guilds, a caller-owned setup flow that verifies DISCORD_TOKEN against Discord, paginates the bot’s visible guilds, selects or validates an explicit allowlist, and injects ALLOWED_GUILDS without persisting the token by default. Ambiguous non-interactive selection fails closed, and selected guilds that grant Administrator emit a warning.
• Removed the visible interactive token prompt from init; a token enters a generated snippet only through the explicit, discouraged --token flag.

v0.14.2 - Guild-scoped safety boundary

Released 2026-08-03.

• Added ALLOWED_GUILDS, a server-side guild boundary that checks direct guild IDs without network overhead and resolves channel, thread, webhook, invite, and guild-sticker targets before execution. Resolutions are cached.
• Calls with a known disallowed guild return GUILD_NOT_ALLOWED. Global writes, interaction-token routes, and subscriptions whose guild cannot be proven fail closed with GUILD_SCOPE_UNRESOLVED; unavailable tools are also hidden from full and progressive discovery. Pipeline steps remain independently gated.
• Added discord-mcp init --allowed-guilds <ids> for safe client snippets.

v0.14.1 - Progressive loading and smoke verification

Released 2026-08-03.

• Added discord-mcp smoke, a deterministic read-only MCP-to-Discord check. Passing --confirm-write runs one explicitly authorized, self-cleaning channel/message create-edit-delete lifecycle through the real MCP middleware and audit path. Multi-guild bots must pass --guild-id, preventing an ambiguous write target.
• Cached the immutable 192-tool JSON Schema catalog once per process instead of regenerating it for every tools/list request. MCP 2026 clients also receive a one-hour private cache hint, while 2025-era clients keep their existing response shape and behavior.
• Added opt-in MCP_TOOL_SURFACE=progressive for clients without native deferred MCP loading. It advertises mcp_tools_search plus separate read, write, and destructive dispatchers whose host-visible annotations match the selected tool’s risk. Dispatch rejects route mismatches, discovery is restricted by MCP_CATEGORIES, and selected tools still run through the complete middleware chain. discord-mcp init --tool-surface progressive writes the setting into generated client config. The OpenAI guide now uses caller-native tool_search plus defer_loading for Responses API.

v0.14.0 - MCP 2026 and remote HTTP

Released 2026-08-02.

• Migrated the core and CLI from the monolithic MCP SDK v1 package to the stable TypeScript SDK v2 package split. The HTTP endpoint negotiates MCP 2026-07-28 while retaining a stateless 2025-era path for current clients.
• Added discord-mcp serve --http --host <host> --port <port>, exposing all 192 tools at /mcp behind a required DISCORD_MCP_ACCESS_TOKEN. Local stdio remains the default and existing client configuration continues to work.
• Added caller-runtime isolation with AsyncLocalStorage, process-scoped audit lifecycle management, loopback Host/Origin validation, and protocol tests covering authentication, both protocol eras, tool discovery, and tool calls.
• Added remote OpenAI Responses API and Codex documentation. One deployment still uses one caller-owned Discord bot; OAuth, per-user Discord credentials, and multi-tenant token storage are intentionally not part of this release.

Embedding migration

@discord-mcp/core consumers must replace the MCP v1 peer with @modelcontextprotocol/server@^2.0.0. Import the stdio transport from @modelcontextprotocol/server/stdio.

v0.13.4 - Codex client setup

Released 2026-08-02.

• Added discord-mcp init --client codex, which emits a Codex TOML fragment that forwards DISCORD_TOKEN from the launch environment by default instead of persisting the token in ~/.codex/config.toml.
• Added Codex setup guidance to the tutorial, client compatibility guide, landing page, README, and CLI reference.
• Corrected generated client snippets from the packaged CLI to reference the actual dist/cli.js entrypoint.

v0.13.2 - Documentation architecture and runtime contract hardening

Released 2026-08-01.

• Rebuilt the documentation information architecture around Start, Guides, Reference, and Develop journeys, with a searchable tool catalog and generated input/output contracts for all 192 tools.
• Corrected Discord API examples, interaction callback types, Components V2 validation, REST error normalization, confirmation previews, and credential redaction.
• Documented the exact trust boundary between raw structuredContent and separately fenced human-readable or untrusted_* fields.
• Corrected the npm mcpName ownership namespace and added an official server.json manifest for MCP Registry publication.

v0.13.1 - Correctness follow-up, default guild, and published package cleanup

Released 2026-08-01.

• Fixed 18 follow-up defects found by re-auditing v0.13.0, including output schema fallback coverage, credential redaction, channel/member result drift, and OpenTelemetry startup checks.
• Added DISCORD_DEFAULT_GUILD_ID, which supplies an omitted top-level guild_id before validation while preserving explicit arguments.
• Removed duplicate document headings across the docs site.
• Restored the public npm scope to @discord-mcp/* and published package version 0.13.1.

v0.13.0 - Correctness audit: the confirmation gate, the category gate, and 58 verified defects

Released 2026-07-27.

A seven-dimension audit of the v0.12.0 tree (runtime, tools, tests, security, docs, packaging, API surface) produced 58 independently-verified defects. This release fixes them. Three were load-bearing.

Breaking

• Destructive tools were unusable. validateMiddleware runs before preconditionMiddleware and replaces ctx.args with the zod-parsed object. Zod strips unknown keys and no tool declared __confirm, so by the time ConfirmRequired read the flag it was gone - every confirm-gated tool returned DRY_RUN_PREVIEW forever, regardless of MCP_DRY_RUN. The wire half was broken too: additionalProperties: false meant a spec-conforming client could not legally send the flag, and an agent reading tools/list had no way to discover it. Both halves fixed. If you depended on destructive tools never executing, note that they now can - the MCP_DRY_RUN=false + __confirm:true contract works as documented.
• @discordjs/rest, @modelcontextprotocol/sdk, zod and @sapphire/pieces moved from dependencies to peerDependencies on @discord-mcp/core. Each crosses the public .d.ts surface nominally, so a consumer with a duplicate copy could not call buildServer at all. @discord-mcp/cli users are unaffected.
• discord.js moved from optionalDependencies to an optional peer. optionalDependencies are installed by default, so every REST-only user was paying for a WebSocket stack.
• engines floor raised to Node >= 22.12 - the lowest version CI verifies.
• MCP_TIMEOUT_LONG_MS removed: validated and documented, read by no code path.

Security

• MCP_CATEGORIES was a dead control. It is documented as a least-privilege gate, but the category_enabled precondition implementing it was declared by zero of 192 tools, so setting it restricted nothing. Now enforced as middleware plus a tools/list filter, with unknown category names failing at boot.
• Webhook and interaction tokens are bearer credentials that live in the URL path. They reached OTel spans via url.full, and reached stderr via pino’s default err serializer along with unredacted request bodies. Both closed.
• interaction_token was in no redaction key set, so live tokens were written into audit records.
• Discord message content containing </untrusted_discord_messages> escaped the untrusted-content boundary, after which the remainder was presented to the agent as trusted text.
• 27 high advisories in the production dependency tree cleared; pnpm audit --audit-level=high --prod exits 0.

Correctness

• Retry backoff never grew - MCP_RETRY_MAX_DELAY_MS and the exponent were inert, and every retry waited the base delay.
• POST was retried on ambiguous failures, so a POST that reached Discord with a lost response was replayed: duplicate messages, duplicate bans.
• One shared debouncer per gateway handler meant subscribers to different URIs cancelled each other; with N subscribed channels only the most recently active one was notified.
• mcp_pipeline sampled the abort signal once before its loop, so cancelling mid-run still executed every remaining step.
• Components V2 Section.accessory is required by Discord but optional in both the builder and the validator, so components_v2_validate returned valid: true for layouts that always 400. Four shipped templates were themselves broken; repaired.
• The server advertised version 0.0.0 and instructions reading “v0/Plan-1 - only messages_send available” - injected into the agent’s system context on a 192-tool server.
• commands_bulk_overwrite_global / _guild wipe the entire command registry and shipped destructiveHint: false with no confirmation gate.
• outputSchema is now published for all 191 declaring tools and enforced against handler results under test. That immediately caught real drift: all five intelligence_* tools declared a schema their fallback path never satisfied - and the fallback is the path every client without sampling capability takes.

Documentation

Corrected every false claim the audit found, including a confirmation page that overstated the gated set by ~2.4x, five fabricated intelligence tool names, two invented CLI subcommands, a quickstart whose documented steps produce a non-working install, a pipeline result envelope that does not exist, and six metric names with the dashboard queries built on them. Added drift guards so tool names, metric names, gateway handler names, and the gated-tool list are now checked against the code at test time.

Tests

909 → 1005, with a coverage gate on @discord-mcp/core (98.9% statements) and snapshot freezes on the public exports, the CLI flag set, and the config surface. Load-sensitive tests fixed: the suite now passes on consecutive cold-cache runs under full parallel load, not only in isolation.

v0.12.0 - Test infra hardening + v1.0.0 readiness polish

Released 2026-05-01. Tag: v0.12.0.

Plan 12 is the polish lap before v1.0.0. No new tools, no new runtime behavior - the test rig, build pipeline, and release surface all got sharpened so v1.0.0 has a clean foundation. This is the final plan of the discord-mcp roadmap (Plans 0-12).

• @discord-mcp/server-mocks workspace package - eliminates 165 relative-path imports across the test tree; consumers now import from '@discord-mcp/server-mocks'.
• ResourceStore extracted from server.ts (matches ToolStore / PreconditionStore pattern).
• Integration test reliability: 0 unconditional skips, doctor.integration stdout race fixed.
• vitest globalSetup auto-builds mcp-core if dist/ is missing - no more separate pnpm build step before pnpm test.
• tsdown external migrated to deps.neverBundle (deprecation cleared).
• GitHub Actions Node 24 opt-in matrix.
• 10 biome info-level useLiteralKeys lints cleared.
• 4 vitest bench files for hot paths (messages_send, mcp_pipeline, gateway debounce, REST policy chain).
• Security audit pass - fixed P1 (reactions_delete_all missing confirmation gate); P2 deferred to Plan 13.
• Docs link audit - 1 broken link fixed; version coherence verified.
• npm publish dry-run verified for @discord-mcp/core and @discord-mcp/cli - prepack ships root README + LICENSE in both tarballs; mcp-core flipped to private:false with public publishConfig.
• v1.0.0 readiness checklist shipped.

v0.11.0 - Migration adapters

Released 2026-05-01. Tag: v0.11.0.

Plan 11 ships four production migration adapters so teams can move to discord-mcp from the most-established community Discord MCP servers without re-tooling their agents from scratch.

• PaSympa (@pasympa/discord-mcp) - ~91 tools, TypeScript, Zod-based schemas. Adapter maps 78 tools, intentionally leaves 13 unmapped.
• quadslab (@quadslab.io/discord-mcp) - ~138 tools with MCP Resources support. Adapter maps 96 tools, leaves 14 unmapped.
• discord-ops (bookedsolidtech/discord-ops) - multi-guild routing, tool profiles, dry-run mode, saved templates. Adapter maps 36 tools and documents the architectural mismatches that don’t translate cleanly.
• Hubdustry (reference adapter, non-Discord) - kept as the canonical adapter-authoring example.
• discord-mcp migrate --list flag for adapter discovery (TTY + JSON).
• 4-way cross-detection: every adapter rejects all other adapters’ fixtures so detection never silently misroutes.
• Migration docs section at cappyeo.github.io/discord-mcp/migrate: per-adapter guides + adapter authoring guide for community contributors.

v0.10.0 - Documentation site

Released 2026-05-01. Tag cut from the Plan 10 merge commit on main.

Plan 10 ships a hand-written + auto-generated documentation site (Astro Starlight, deployed to GitHub Pages) covering all 192 tools, six recipes, operations runbooks, architecture deep-dives, and the reference surface you’re reading now.

• 192 auto-generated tool reference pages with JSON Schema tables.
• 6 hand-written cookbook recipes (moderation, components V2, pipeline, intelligence, webhooks, gateway).
• Operations runbooks for telemetry, resilience, audit, client capabilities.
• Architecture deep-dives for components V2, pipeline, gateway, error handling, confirmation, sampling, rate-limits.
• This reference section: CLI, config, API, changelog.

v0.9.0 - CLI sub-commands

Released 2026-05-01. Tag commit: 038c1138.

Plan 9 split the single binary into four sub-commands routed by commander and shipped a structured emitResult envelope shared across all of them.

• discord-mcp serve - the existing stdio transport, still default sub-command.
• discord-mcp doctor [--json] [--online] - config + connectivity diagnostics with offline / online check registries.
• discord-mcp init [--client] [--token] [--gateway] [--output] - generate Claude Desktop / Claude Code / Cursor / Generic client config snippets.
• discord-mcp migrate --from <adapter> - Hubdustry-Go-MCP migration scaffolding with a pluggable adapter registry.
• Distribution polish: .gitattributes, README quickstart, npm pack verification, post-build CLI smoke tests.

v0.8.0 - Production hardening

Released 2026-05-01. Tag commit: b034bebf.

Plan 8 added the production-grade observability and resilience surface that makes discord-mcp safe to run in front of a real Discord guild.

• OpenTelemetry traces + the six built-in metrics (mcp.tool.duration_ms, mcp.tool.calls, mcp.tool.errors, mcp.circuit.transitions, mcp.bulkhead.rejected.count, mcp.deadletter.count). There is no retry metric and no gauge for circuit state or bulkhead in-flight depth. 9 OTEL_* env vars.
• Cockatiel composite policy: retry (with jitter strategies), per-call timeout, circuit breaker, bulkhead. 11 MCP_RETRY_/TIMEOUT_/CIRCUIT_/BULKHEAD_* env vars.
• Mutating-only audit log with four sinks (stderr, file, otlp-stub, none), PII redaction policy, JSONL schema. 3 MCP_AUDIT_* env vars.
• Integration tests covering the full cockatiel chain end-to-end.

v0.7.0 - Bulk REST surface (192 tools)

Released 2026-04-29. Tag commit: 947269d7.

Plan 7 brought the tool count from 29 to 192 by mechanically covering every Discord REST endpoint that maps cleanly onto a single MCP tool.

• New categories: webhooks, application commands, interactions, scheduled events, automod, audit log, monetization, soundboard, polls, voice, onboarding, stage instances.
• Per-category integration tests against @discordjs/rest route fixtures.
• Pagination helpers (encodeCursor / decodeCursor) for list endpoints.
• Branded snowflake types extended to all ID classes.

v0.6.0 - Gateway resource subscriptions

Released 2026-04-28. Tag commit: 4dbac6ec.

Plan 6 (USP) made discord-mcp the first MCP server to surface live Gateway events as MCP resources via the subscribe capability.

• createGatewayClient lazy-imports discord.js so cold start without --gateway stays minimal (serve doesn’t pay the import cost).
• 5 Gateway event handlers - guild_update, voice_state_update, typing_start, presence_update, audit_log_poll. Message events are not among them; there is no message handler.
• SubscriptionRegistry tracks active resource URIs and fires notifyResource(uri) when relevant events arrive.
• --gateway CLI flag on serve toggles the whole subsystem.

v0.5.0 - Intelligence sampling

Released 2026-04-28. Tag commit: dcd49aa1.

Plan 5 (USP) introduced the five intelligence tools that delegate reasoning back to the agent via MCP sampling.

• intelligence_summarize_channel - summarize recent messages.
• intelligence_classify_messages - multi-label classification.
• intelligence_draft_response - context-aware reply drafts.
• intelligence_moderate_content - policy-aware moderation.
• intelligence_extract_entities - structured entity extraction.
• All five honor client sampling capability - degrade gracefully when the client doesn’t advertise it.

v0.4.0 - Pipeline executor

Released 2026-04-28. Tag commit: 07745aa0.

Plan 4 (USP) shipped mcp_pipeline - a single tool that lets the agent queue a sequence of dependent tool calls with interpolation and conditional execution.

• executePipeline runtime: serial step execution with ${steps.<id>.<path>} interpolation and if/unless predicates.
• Step result shape (StepResult with ok/skipped/failed).
• 19 unit tests covering interpolation, conditionals, nested paths, error propagation.

v0.3.0 - Components V2

Released 2026-04-28. Tag commit: b7f976e6.

Plan 3 made Components V2 a first-class category.

• 8 tools: components_v2_build_container, _build_section, _build_media_gallery, _validate, _preview, _send, _edit, _send_from_template.
• 5 templates exposed via the components-v2:// resource scheme.
• Schema resource (components-v2://schema) for agents to discover the V2 component shape.
• Validate-then-send workflow with a structured preview before commit.

v0.2.0 - Hot-path tools

Released 2026-04-28. Tag commit: 227dd28a.

Plan 2 grew the surface from 1 tool to 15 by covering the high-frequency day-one operations Discord agents typically need.

• Messages: _send, _read, _edit, _delete, _get, _pin, _unpin.
• Reactions: _create, _delete_own, _list.
• Channels / Members / Guild basics.
• Sapphire loadPiece auto-discovery so adding a tool is one import + one registration line.

v0.1.0 - Errors + middleware

Released 2026-04-28. Tag commit: acec9440.

Plan 1 established the error hierarchy, middleware composition framework, and capability router that every subsequent plan builds on.

• DiscordError hierarchy with code / retriable / category / recoveryHint contract.
• compose(...middlewares, handler) framework.
• validateMiddleware, preconditionMiddleware, baseline error formatter.
• Capability router (CapabilityRouter) for client-feature gating.
• Untrusted-content wrapping helpers (wrapUntrusted / wrapMessages).

v0.0.0 - Project skeleton

Released 2026-04-28. Tag commit: 3ab74826.

Plan 0 stood up the monorepo and shipped the smallest viable tool surface.

• pnpm + Turbo + tsdown workspace layout.
• @discord-mcp/core and @discord-mcp/cli packages.
• Single tool: messages_send.
• Biome, vitest, tsc, baseline CI.

See also

• GitHub releases - full release notes per tag.
• Architecture - how the pieces from each plan fit together today.