Changelog
New features, improvements, security fixes, and bug fixes, newest first.
The current MCP spec, and three security fixes
Version 0.7.0 ·
The MCP server speaks spec revision 2026-07-28, and clients on the older revision keep working. Three security fixes came out of a look at scanner traffic.
New features
-
The MCP server speaks spec revision 2026-07-28
The current revision makes MCP stateless. There is no initialize handshake, and each request carries its own protocol version and capabilities. The server negotiates per request, answers server/discover, and returns cache hints on the two results that can be cached. Clients on the 2025-06-18 revision keep working, and a client that asks for a revision we do not accept gets an error that lists the ones we do.
Improvements
-
Install instructions for each MCP client
The MCP docs now give the steps for each client instead of one generic snippet. Claude Code, Cursor, VS Code, and the rest each have their own section.
-
The audit log covers the anonymous host and deleted votes
An anonymous host now gets an audit entry for their own seat in the retro they started. Deleting a post also records the votes that go with it, so a vote count in an export always adds up.
Security fixes
-
Per-IP limits count the real visitor, not our proxy medium
Behind our proxy every request looked like it came from one address, so the per-IP login limit was really a single shared bucket. A hundred failed logins from anywhere blocked login for everybody for an hour. Limits now use the address the proxy reports, which a visitor cannot set.
-
Paths that start with a dot return 404 low
Scanners probe every site on the internet for files like /.env and /.git/config. The app answered those requests with the page shell and a 200, which a scanner records as a hit and which attracts more probing. No file and no secret was ever exposed. Those paths now return 404.
Bug fixes
-
A retro no longer moves on by itself when everyone marks Ready
When every connected person marked Ready, the retro advanced to the next phase on its own, cleared the badges, and restarted the timer. It needed everyone with the tab open to agree, so one person with nothing to say could hold the room up with no way to override it. The facilitator moves the retro on.
-
A free retro expires 24 hours after it is created
Four places said the 24-hour window ran from the last activity in the retro. It runs from the moment the retro is created, and nothing extends it. The pricing card, the start-retro screen, and the docs now say so. A team that opens a retro on Monday cannot come back to it on Wednesday.
-
A tab left open picks up the new version
A tab left open across a release now reloads itself while nobody is using it, so you do not sit on an old version until you notice. The live connection also waits a random extra moment before each retry, and stops retrying when the server closes it for a reason that will not change.