chore(release): merge v2/main into main for v2.8.0 - #2456

Merged

cliffhall merged 95 commits into

mainfrom

v2/chore/milestone-merge-v2.8.0

Sep 23, 2026

Commits on Sep 16, 2026

fix(web): only DANGEROUSLY_OMIT_AUTH=true/1 disables /api auth (#2331)

cliffhall
and
claude
committed
210b1e1
feat: per-server setting to suppress the standalone GET notification stream (#2317)

cliffhall
and
claude
committed
da8c352
fix: inline same-document $refs before choosing form widgets (#2321)

cliffhall
and
claude
committed
2376420
fix: stamp Mcp-Method on modern-era notification POSTs (#2385)

cliffhall
and
claude
committed
b95e60f
Merge pull request #2390 from modelcontextprotocol/v2/fix/2331-omit-auth-false
cliffhall
authored
bc75602
fix: decode the whole $ref fragment before splitting; walk legacy dependencies (#2391 review)

cliffhall
and
claude
committed
2b5ddad
docs: frame the notification header stamping as a compatibility workaround (#2392 review)

cliffhall
and
claude
committed
134723e
fix: detach the OIDC compat's normal-path body releases (#2389)

cliffhall
and
claude
committed
956bf13
Merge remote-tracking branch 'origin/v2/main' into v2/fix/2389-oidc-detached-body-release
cliffhall
committed
a6ae234
Merge remote-tracking branch 'origin/v2/main' into v2/fix/2385-mcp-name-header
cliffhall
committed
0b2402d
Merge pull request #2392 from modelcontextprotocol/v2/fix/2385-mcp-name-header
cliffhall
authored
716d597
fix: keep constraining $ref siblings, skip embedded resources, bound expansion (#2391 review)

cliffhall
and
claude
committed
8d682ed
Merge pull request #2393 from modelcontextprotocol/v2/fix/2389-oidc-detached-body-release
cliffhall
authored
2b6e7ba
fix: suppress only the endpoint's SSE GET, and scope the setting to the legacy era (#2394 review)

cliffhall
and
claude
committed
4a447ce
fix: walk only subschema keywords, bound depth, reject bad escapes, keep enumNames (#2391 review)

cliffhall
and
claude
committed
091bc36
Merge remote-tracking branch 'origin/v2/main' into v2/feat/2317-suppress-get-stream
cliffhall
committed
6a54c38
Merge remote-tracking branch 'origin/v2/main' into v2/fix/2321-resolve-ref-widgets
cliffhall
committed
4451a3b
Merge pull request #2391 from modelcontextprotocol/v2/fix/2321-resolve-ref-widgets
cliffhall
authored
2de7423
Merge pull request #2394 from modelcontextprotocol/v2/feat/2317-suppress-get-stream
cliffhall
authored
0958136
fix(core): reframe type-union as a portability trade, not a defect (#2286)

cliffhall
and
claude
committed
3d51384
docs: document read-only mcp.json consumption by external tooling (#1912)

cliffhall
and
claude
committed
0a05f9f
docs(core): admit the dialect-portability evidence class in schemaLint's contract (#2395 review)

cliffhall
and
claude
committed
2ca982c
docs: note that the Inspector keeps env and client secrets out of mcp.json (#2396 review)

cliffhall
and
claude
committed
c12adbc
test(core): pin the named dialect in the type-union message (#2395 review)

cliffhall
and
claude
committed
ae9c186
docs: scope the secret-stripping note to the catalog fields it covers (#2396 review)

cliffhall
and
claude
committed
d6d8b8e
fix(core): caveat the null branch of the type-union suggestion (#2395 review)

cliffhall
and
claude
committed
626d1b9
docs: note the memory secret store keeps existing plaintext in mcp.json (#2396 review)

cliffhall
and
claude
committed
9bab0a7
docs: clarify the memory-store wording and flag stdio command execution (#2396 review)

cliffhall
and
claude
committed
e9cdf32
Merge pull request #2395 from modelcontextprotocol/v2/chore/2286-type-union-caveat
cliffhall
authored
ea5e7b3
Merge remote-tracking branch 'origin/v2/main' into v2/docs/1912-readonly-config-interop
cliffhall
committed
0e883be
Merge pull request #2396 from modelcontextprotocol/v2/docs/1912-readonly-config-interop
cliffhall
authored
66770e1
feat: run skills:eval through the GitHub Copilot CLI (#2397)

cliffhall
and
claude
committed
3b78545
fix: never score a Copilot turn past the budget from a coalesced chunk (#2398 review)

cliffhall
and
claude
committed
4badc53
Merge branch 'v2/main' into v2/chore/2397-copilot-skills-eval
cliffhall
authored
41c9994
fix: surface the Copilot sign-in hint, name the agent on the empty hand-off line, pin --disallow-temp-dir (#2398 review)

cliffhall
and
claude
committed
57f23bc
docs: re-measure the Copilot hand-offs at RUNS=5 and track the pagination gap in #2399

cliffhall
and
claude
committed
ce20b2e
Merge remote-tracking branch 'origin/v2/chore/2397-copilot-skills-eval' into v2/chore/2397-copilot-skills-eval
cliffhall
committed
54608dc
fix: stop Copilot's whole process group at the turn budget; record user-invocable behavior (#2398 review)

cliffhall
and
claude
committed
eb44b0d
fix: stop in-flight Copilot groups when a sample rejects, not only on a signal (#2398 review)

cliffhall
and
claude
committed
54f15c0
docs: re-align the H2 2026 roadmap with the published MCP roadmap (#2400)

cliffhall
and
claude
committed
cf6d4b9
Merge pull request #2398 from modelcontextprotocol/v2/chore/2397-copilot-skills-eval
cliffhall
authored
306a50c
docs: link the unblocked-work artifact at the top of the roadmap (#2400)

cliffhall
and
claude
committed
c0bef16
docs(skills): load test-servers before searching on e2e coverage prompts (#2399)

cliffhall
and
claude
committed
d8a7356
docs: account for all five recorded Copilot runs (#2402 review)

cliffhall
and
claude
committed
d701734
Merge branch 'v2/main' into v2/docs/2400-roadmap-realign
cliffhall
authored
41b5a33
docs: address Copilot review on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
298cce3
Merge pull request #2402 from modelcontextprotocol/v2/chore/2399-copilot-testing-handoff
cliffhall
authored
8ce0d7c
Merge branch 'v2/main' into v2/docs/2400-roadmap-realign
cliffhall
authored
e5494eb
docs: address Copilot round 2 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
3961bd1

Commits on Sep 17, 2026

docs: address Copilot round 3 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
9741759
docs: address Copilot round 4 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
a9453bd
docs: address Copilot round 5 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
5157b0a
docs: address Copilot round 6 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
a2430e7
docs: address Copilot round 7 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
2235798
docs: address Copilot round 8 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
1683fa4
docs: address Copilot round 9 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
070fe36
docs: address Copilot round 10 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
1a6df14
docs: address Copilot round 11 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
8be1cd6
docs: address Copilot round 12 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
b4efb47
docs: address Copilot round 13 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
4bc4643
docs: address Copilot round 14 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
85f4ecc
docs: address Copilot round 15 on the roadmap realignment (#2401 review)

cliffhall
and
claude
committed
d7c1f9f

Commits on Sep 18, 2026

Merge pull request #2401 from modelcontextprotocol/v2/docs/2400-roadmap-realign
cliffhall
authored
85be2c1

Commits on Sep 19, 2026

docs: add the security-advisory skill and carve advisory drafts out of the board audit (#2443)

cliffhall
and
claude
committed
8dee4cf
docs: address Copilot review round 1 on #2444

cliffhall
and
claude
committed
41efd17
docs: address Copilot review round 2 on #2444

cliffhall
and
claude
committed
2bba258
docs: address Copilot review round 3 on #2444

cliffhall
and
claude
committed
b2d44ff
docs: address Copilot review round 4 on #2444

cliffhall
and
claude
committed
4da164a
docs: address Copilot review round 5 on #2444

cliffhall
and
claude
committed
856c82f

Commits on Sep 23, 2026

docs: address Copilot review round 6 on #2444

cliffhall
and
claude
committed
50a9634
docs: add a secret-storage guide for every runtime (#2447)

cliffhall
and
claude
committed
f8b3521
chore: add the project LICENSE and point every manifest at it (#2406)

cliffhall
and
claude
committed
c0c2a20
docs: address Copilot review round 1 on secret-storage guide (#2448)

cliffhall
and
claude
committed
14cde9e
docs: address Copilot review round 8 on #2444

cliffhall
and
claude
committed
ccc831c
docs: address Copilot review round 2 on secret-storage guide (#2448)

cliffhall
and
claude
committed
67b23bd
docs: name the lock after the configured secrets file (#2448 review)

cliffhall
and
claude
committed
2b96781
Merge pull request #2449 from modelcontextprotocol/v2/chore/2406-license
cliffhall
authored
15f2d98
feat: MCP_INSPECTOR_SECRET_KEY_FILE, a Docker warning and a threat model (#2447)

cliffhall
and
claude
committed
cc73b5b
fix: treat a blank MCP_INSPECTOR_SECRET_KEY_FILE as a key problem (#2448 review)

cliffhall
and
claude
committed
bf4beba
docs: loudly call out the plaintext fallback on hosts with no keychain (#2447)

cliffhall
and
claude
committed
d8f8895
docs: key-file wording, stale comments and a safer Docker key example (#2448 review)

cliffhall
and
claude
committed
8e4cfff
fix: refuse a key file that is the secrets file itself (#2448 review)

cliffhall
and
claude
committed
b4af7e4
Merge pull request #2444 from modelcontextprotocol/v2/docs/2443-security-advisory-skill
cliffhall
authored
bb83deb
docs(skills): stop board lookups from trusting item-list --limit (#2451)

cliffhall
and
claude
committed
8a78c74
Merge branch 'v2/main' into v2/docs/2447-secret-storage-guide
cliffhall
authored
15310eb
Merge pull request #2448 from modelcontextprotocol/v2/docs/2447-secret-storage-guide
cliffhall
authored
9b03435
docs(skills): fail closed on a missing ITEM_ID and an incomplete dump (#2452 review)

cliffhall
and
claude
committed
eabbfc4
Merge branch 'v2/main' into v2/fix/2451-board-lookup-limits
cliffhall
authored
7dd0362
docs(skills): name every id a #11 card needs, not just the lookup's (#2452 review)

cliffhall
and
claude
committed
4964bb6
docs(skills): gate the recovery steps on a complete dump (#2452 review)

cliffhall
and
claude
committed
68dc5f5
docs(skills): refuse to re-apply without a usable snapshot (#2452 review)

cliffhall
and
claude
committed
24b1a12
Merge pull request #2452 from modelcontextprotocol/v2/fix/2451-board-lookup-limits
cliffhall
authored
de44e97
chore: bump version to 2.8.0 (#2453)

cliffhall
and
claude
committed
f9dba02
Merge pull request #2454 from modelcontextprotocol/v2/chore/2453-bump-2-8-0
cliffhall
authored
dcc43ad
chore: merge v2/main into main for the v2.8.0 release

cliffhall
and
claude
committed
3ad3f72