Skip to main content

Versioning and roadmap

The MCP server lives by two rhythms: the rhythm of the software (releases on npm, bugfixes, new tools) and the rhythm of the content (each snapshot carries the version of the Manual at which it was published). The two do not move in sync — and that asymmetry is the source of most versioning questions. This page explains how to read each one, and what is planned next.

Versioning policy​

The server follows SemVer 2.0.0 with the following semantics:

TypeWhenExamples
Major (X.0.0)Breaking changes to the MCP surface (tools renamed/removed, incompatible parameters, resources renamed)The move to 1.0.0 (stabilisation)
Minor (0.X.0)New tools, new resources, new optional parameters, new concerns or roles — backward-compatibleA new tool or a new resource
Patch (0.0.X)Bug fixes, retrieval improvements, refinement of outputs without changing the schemaA retrieval fix

While the major version is 0, the server is pre-stable: breaking changes may occur in a minor until 1.0.0.

How to find the current version​

Always via the resource:

sbd://toe/version

Or via npm:

npm view @shiftleftpt/sbd-toe-mcp version
npm view @shiftleftpt/sbd-toe-mcp versions  # histĂłrico completo

What the served version contains is in sbd://toe/version; what each release changed is in the server's CHANGELOG and in the GitHub Releases of SbD-ToE/sbd-toe-mcp. The list of tools, resources and prompts of the installed version is the one the server itself returns (tools/list, resources/list, prompts/list).

Relationship with Manual versions​

ComponentVersioningWhere
MCP serverSemVer on npm@shiftleftpt/sbd-toe-mcp@<x.y.z>
Manual canon (Ch. 00–14)Git tags in the Manual repositoryvX.Y.Z in SbD-ToE/sbd-toe-manual
Normative cross-checksAdditive to the canon — they travel inside the MCP snapshot if published before it; otherwise, they live only in the web Manual until the next publicationWeb Manual at /sbd-toe/cross-check-normativo/; the coverage of the served snapshot is in sbd://toe/version
AppSec Core v1 ontologyVersion pinned inside the MCPsbd://toe/ontology (declares the version)

Important — there is no one-to-one mapping:

  • A server release does not correspond to a Manual tag: each release carries the Manual and the KG as they stood at publication, and sbd://toe/version states which
  • The server carries a snapshot of the canon at the time of publication, and a KG index built from it
  • A piece of content may be in the Manual snapshot and, even so, outside the KG index — that is an indexing gap, not a version gap (see content lag)

Roadmap (public)​

Indicative roadmap, with no hard dates. Priorities may change according to feedback.

Short term​

  • Stabilisation for 1.0.0 — close the tools / resources surface, freeze the schemas.
  • Refinement of prepare_sbd_toe_codegen_context — more stacks supported in the regulatory_overlay.
  • Client-specific documentation — guides for Zed and Windsurf on the server's GitHub.

Medium term​

  • Comparison tools — diff between canon versions, diff between risk levels.

Long term​

  • State layer / stateful-assess (Premium tier) — verification against the real state of CI / repo / runtime (the observed side that today remains not verified — runtime).
  • Interaction protocol — server-driven chaining beyond the next band.
  • Multi-language manual support — once the Manual exists in languages other than PT, expose a selector via parameter.
  • Streaming responses for large outputs (L3 full coverage).
  • MCP transport HTTP/SSE in addition to stdio (consumption from cloud agents).

How to keep up​

ChannelFor
GitHub Releases and the CHANGELOG of the server repositoryWhat each release changed
npm view @shiftleftpt/sbd-toe-mcpChecking the latest version
npm view @shiftleftpt/sbd-toe-mcp timeDates of each version
sbd://toe/version in sessionKnowing what the client is actually using
Web Manual — Normative cross-checkUp-to-date regulatory content

How to contribute​

Issues and PRs in the server repository: SbD-ToE/sbd-toe-mcp.

For suggestions on the Manual content (chapters 00–14, cross-checks, policies), the target repository is SbD-ToE/sbd-toe-manual. The MCP serves the snapshot of what is in that repository at the date of publication.

Next​