v1.0.0 readiness

discord-mcp v0.13.0 is the correctness-audit release. v1.0.0 commits to API stability for 6+ months. Tagging v1.0.0 from main happens only when every box below is ticked. Re-evaluate before each minor; the unchecked items below are the gating work that remains.

State at v0.13.0

• 192 MCP tools across 28 categories.
• 1009 tests (711 @discord-mcp/core + 267 @discord-mcp/cli + 31 site), 0 unconditional skips, 1 documented it.todo (msw + undici interop, tracked in otel-undici.integration.test.ts).
• Coverage gate enforced on @discord-mcp/core: 98.9% statements / 98.6% functions / 73.6% branches, with thresholds in vitest.config.ts set at the measured level so the gate fails on a regression rather than sitting permanently red or vacuous.
• 4 perf bench files (messages_send, mcp_pipeline, gateway debounce, REST policy chain) producing baseline numbers under pnpm bench.
• Security audit pass - see the 2026-05-01 audit. P1 fixed in-commit, P2 deferred. That page is a point-in-time record and has since been superseded - the current audit is the 2026-07-27 audit.
• npm publish dry-run verified for @discord-mcp/core and @discord-mcp/cli.

Pre-conditions for v1.0.0 tag

Code & test

• v0.12.0 polish phase complete
• @discord-mcp/server-mocks workspace package - eliminates 165 relative-path imports
• ResourceStore extracted from server.ts (matches ToolStore / PreconditionStore pattern)
• 0 unconditional .skip calls, 1 documented it.todo
• Performance benchmarks for 4 hot paths
• Security audit pass - re-run pnpm audit --audit-level=high --prod at tag time; last pass 2026-07-27 (0 high in the production tree)
• vitest globalSetup auto-builds mcp-core if dist/ missing
• tsdown deprecation cleared (external -> deps.neverBundle)
• GitHub Actions Node 24 opt-in
• 0 biome info/warning lints
• Test count ≥ 1000 (1009)
• Coverage gate enforced in CI (98.9% statements, ≥ 80% target met)
• No load-sensitive tests - the suite passes on consecutive cold-cache runs under full parallel load, not only in isolation
• Destructive-tool authorization actually works - __confirm survives validation and is advertised in tools/list (was: every confirm-gated tool permanently returned DRY_RUN_PREVIEW)
• MCP_CATEGORIES enforced at both the call gate and tools/list (was: declared by zero tools, so the documented control restricted nothing)
• outputSchema published for all 191 declaring tools and enforced against handler results under test

Distribution

• npm publish dry-run verified
• prepack copies root README.md + LICENSE into both publishable tarballs
• Release workflow with id-token: write exists, so publishConfig.provenance: true is actually satisfiable (.github/workflows/release.yml, behind workflow_dispatch + a protected environment)
• CI fails if the workspace: protocol survives into a published manifest - npm does not rewrite it, and such a tarball is unrecoverable without a deprecate + republish
• @discord-mcp/core published to npm registry
• @discord-mcp/cli published to npm registry
• discord-mcp init quickstart works after npm install -g @discord-mcp/cli
• At least 30 days of soak time with active users post-publish

Quality

• No critical (P0) bugs filed against the published versions
• No high-priority (P1) bugs unresolved
• Documentation reviewed by external party
• Security review pass by external auditor (optional)

API stability commitment

Each of these is now enforced by a snapshot test rather than by intent, so a removal or rename fails CI instead of reaching a consumer.

• @discord-mcp/core exports frozen - src/exports.test.ts
• CLI flag set frozen - packages/mcp-server/src/cli.surface.test.ts snapshots every subcommand and flag; serve | doctor | init | migrate
• Config env var set frozen - src/config.surface.test.ts snapshots names and resolved defaults (a silently changed default is a behavioural break even when the name is unchanged)
• Tool surface (192 tools) frozen - src/tools/registry.invariants.test.ts also asserts destructive-iff-confirm-gated and complete annotations

v1.0.0 commitment

• Semver: breaking changes require a major bump (v2.0.0).
• API stability: @discord-mcp/core exports stable for 6+ months.
• Tool surface: 192 tools maintained; new tools = minor version.
• CLI flags: discord-mcp serve|doctor|init|migrate flag set frozen.
• Config: env var names + defaults frozen (additions allowed; renames forbidden).
• Discord API tracking: Discord deprecations may force adapter changes; these are documented in the changelog and shipped in patches.

Tag v1.0.0 only when every checklist item above is checked.

What is NOT in v1.0.0

• HTTP transport - stdio-only at v1.0.0. Streamable HTTP is on the v1.x minor track.
• OAuth flows - bot-token auth only at v1.0.0. User-token / OAuth deferred.
• Components V3 - Discord has not released V3; the V2 surface is final.
• i18n docs site - English-only at v1.0.0.

After v1.0.0

Subsequent minor versions add tools, transports, and adapters without breaking the v1 API. Breaking changes are batched into v2.0.0 and signaled at least one minor before ship. The plan-as-release-train cadence (one plan number = one minor) continues.