# Release Notes Index

> Release notes and changelogs from across the web, indexed for agents. Also via CLI and REST API.

- name: sh.releases/mcp
- version: 0.15.2
- connection class: R0 (autonomous)
- trust: 93/100
- quality: 97/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/sh.releases%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/sh.releases%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "releases": {
      "type": "http",
      "url": "https://agents.releases.sh/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 75
- drivers: +repository +dns-namespace +reachable +uptime-100% +updated-17d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 97/100 (strong)

### protocol: 100 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- pass `protocol.list_ttl`: tool list is cacheable (ttlMs 3600000)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 2 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 18 of 18 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 6,497 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: 5 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 18, about 6,497 tokens to load them all
- tool set hash: c59b36e5fde89ccc58a8f7c4182f44ad
- tools last changed: 2026-10-16T19:44:05.592Z
- badge: [![protogrid quality](https://protogrid.dev/badge/sh.releases/mcp.svg)](https://protogrid.dev/servers/sh.releases/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-16 `whats_changed` changed (description)
  - before: Given a package and a `from`/`to` version, return the changelog entries between them — `(from, to]`, from exclusive, to inclusive — with summaries and breaking-change verdicts. One call instead of reading N changelog pages to plan an upgrade. `package` is a tracked source slug or a GitHub `owner/repo` coordinate (set `ecosystem: "github"` for a bare coordinate). Reads already-indexed releases only. If the package isn't in the catalog you'll get a clear 'not tracked' answer (npm/PyPI names may not be mapped to a source yet).
  - after: Given a package and a `from`/`to` version, return the changelog entries between them — `(from, to]`, from exclusive, to inclusive — with summaries and breaking-change verdicts. One call instead of reading N changelog pages to plan an upgrade. `package` is a tracked source slug or a GitHub `owner/repo` coordinate (set `ecosystem: "github"` for a bare coordinate). Reads already-indexed releases only. If the package isn't in the catalog you'll get a clear 'not tracked' answer (npm/PyPI names may not be mapped to a source yet). Each entry prints `URL:` (the original source — cite that) before `Web:` (the releases.sh copy), when present. Structured results still include both `url` and `webUrl`.
- 2026-10-16 `get_personalized_feed` changed (description)
  - before: Your personalized release feed — recent releases from the organizations and products you follow, newest first. Requires a signed-in user. Same item shape as `get_latest_releases`, scoped to your follows. Cursor-paginated: pass `cursor` from a prior response's `_meta.pagination.nextCursor` and optional `limit` (1–100, default 30).
  - after: Your personalized release feed — recent releases from the organizations and products you follow, newest first. Requires a signed-in user. Same item shape as `get_latest_releases`, scoped to your follows. Each item prints `URL:` (the original source — cite that) before `Web:` (the releases.sh copy), when present. Cursor-paginated: pass `cursor` from a prior response's `_meta.pagination.nextCursor` and optional `limit` (1–100, default 30).
- 2026-10-16 `get_release` changed (description)
  - before: Fetch the full content of a single release by id. Release ids are returned by search or get_latest_releases — pass them here to read the whole entry (e.g. to quote a specific Next.js release note). Accepts the full rel_<nanoid> form or the bare 21-char nanoid.
  - after: Fetch the full content of a single release by id. Release ids are returned by search or get_latest_releases — pass them here to read the whole entry (e.g. to quote a specific Next.js release note). Accepts the full rel_<nanoid> form or the bare 21-char nanoid. Cite `URL:` (the original source) ahead of `Web:` (the releases.sh copy). Structured `url` and `webUrl` carry the same pair.
- 2026-10-05 `get_latest_releases` changed (inputSchema)
- 2026-10-05 `search` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/sh.releases%2Fmcp/changes

## Remotes

- https://agents.releases.sh/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (18)

- `follow`: Follow an organization or a product so it appears in your personalized feed (`get_personalized_feed`). Following an organization implicitly includes all of its products.

Requires a signed-in user (a `relu_` user key or an OAuth token). `entity` is a typed id — an `org_…` id or a `prod_…` id — as returned by `search`, `get_organization`, or `get_catalog_entry`. Idempotent: following something you already follow is a no-op.
- `get_catalog_entry`: Detail for a single catalog entry — accepts a prod_ id, src_ id, or an org-scoped coordinate in the form orgSlug/slug (e.g. 'vercel/nextjs' or 'vercel/next-js'). Returns the union of product / source detail fields depending on the entry kind. Source entries list tracked CHANGELOG files by path and byte size. Pass `include_changelog: true` to inline the root CHANGELOG, or `changelog_path` / `changelog_offset` / `changelog_limit` / `changelog_tokens` to embed a specific file or slice — heading-aligned, supports per-package files in monorepos (e.g. `packages/next/CHANGELOG.md`), and emits `totalTokens` / `sliceTokens` for LLM context budgeting. Files over 1MB are flagged as truncated so you know the tail is missing.
- `get_collection`: Detail for a single collection — name, description, and the ordered list of member organizations. Hidden / on-demand orgs never leak through; only publicly visible orgs appear in the member list.
- `get_collection_releases`: Interleaved cross-org release feed for a collection — same shape as `get_latest_releases` but scoped to the collection's member orgs.

Cursor-paginated: pass `limit` for slice size (default 20), `cursor` to continue from a prior call. The result's `_meta.pagination` carries `kind: 'cursor'`, `hasMore`, and `nextCursor` when more rows exist; the response text echoes `nextCursor` so an LLM caller can chain without parsing `_meta`. Cursors are stable under inserts.
- `get_latest_releases`: Get the most recent releases, optionally filtered by product or organization. Excludes prereleases (canaries / alphas / betas / RCs) by default — pass `include_prereleases: true` to include them.

Cursor-paginated: pass `limit` for slice size (default 10), `cursor` to continue from a prior call. The result's `_meta.pagination` carries `kind: 'cursor'`, `hasMore`, and `nextCursor` when more rows exist; the response text echoes `nextCursor` so an LLM caller can chain without parsing `_meta`. Cursors are stable under inserts — a release added between calls won't shift the slice.
- `get_organization`: Get detailed information about a single organization — accounts, tags, sources, products, aliases. When an AI-generated overview exists the response includes a short preview; pass `include_overview: true` to inline the full briefing (with a stale warning if the content is older than 30 days since last write).
- `get_personalized_feed`: Your personalized release feed — recent releases from the organizations and products you follow, newest first. Requires a signed-in user. Same item shape as `get_latest_releases`, scoped to your follows. Each item prints `URL:` (the original source — cite that) before `Web:` (the releases.sh copy), when present.

Cursor-paginated: pass `cursor` from a prior response's `_meta.pagination.nextCursor` and optional `limit` (1–100, default 30).
- `get_release`: Fetch the full content of a single release by id. Release ids are returned by search or get_latest_releases — pass them here to read the whole entry (e.g. to quote a specific Next.js release note). Accepts the full rel_<nanoid> form or the bare 21-char nanoid. Cite `URL:` (the original source) ahead of `Web:` (the releases.sh copy). Structured `url` and `webUrl` carry the same pair.
- `list_catalog`: List catalog entries — products and standalone sources combined into one list with an `entryType: 'product' | 'source'` discriminator per row.

Orgs that group multiple sources under a product (e.g. Vercel → Next.js, Turborepo) surface those products; orgs with a single source that isn't part of a product surface it directly as an `entryType: 'source'` entry. Either shape is a reasonable thing to pass to `search(entity: ...)`.

Paginated: defaults to 50 entries per page. Pass `page: 2` for the next slice. The footer surfaces the total when more pages exist.
- `list_collections`: List curated collections — named cross-org playlists (e.g. 'Frontier AI Labs') independent of the fixed category taxonomy.

Use `get_collection` for a collection's full member list, or `get_collection_releases` for the interleaved cross-org release feed. Paginated: defaults to 50 entries per page; pass `page: 2` for the next slice.
- `list_follows`: List the organizations and products you follow (newest first). Requires a signed-in user.
- `list_organizations`: List all indexed organizations, optionally filtered. Paginated: defaults to 50 entries per page; pass `page: 2` for the next slice. Orgs with zero indexed releases are hidden by default (curator-stub noise); set `include_empty: true` to see them.
- `list_webhooks`: List your outbound release webhooks, personal or workspace. Requires a signed-in user (a `relu_` user key or an OAuth token).

With no `workspace`, lists your personal webhooks (`GET /v1/me/webhooks`) and includes a short list of your workspaces (id, slug, role) so you can target one next. Pass `workspace` (an id or a slug) to list that workspace's webhooks instead. Pass `id` to see one webhook plus its 10 most recent deliveries. Pass `enabled` to filter by enabled/disabled state.
- `lookup_domain`: Resolve a domain to the org or product that owns it. The domain is normalized first (scheme, `www.`, path, and trailing slash stripped, lowercased), so `https://vercel.com/about` and `vercel.com` both look up the same row.

Returns the matching org (with primary-vs-alias distinction) and any products whose alias targets the same domain. Pure resolution — does not probe the domain or materialize anything; unknown domains surface a 'no match' message. Use `lookup_domain` when you have a URL-shaped input; use `get_organization` when you already have a slug or id.
- `manage_webhook`: Create, update, delete, test, or rotate the signing key of an outbound release webhook — personal or workspace. Requires a signed-in user. This tool sends requests to an external URL you supply and can delete or disable delivery, so treat it as a write.

Pass `workspace` (an id or slug) to act on a workspace's webhooks instead of your personal ones; workspace webhooks are always org-scoped (`scope: "follows"` is personal-only and is rejected up front). Only workspace owners and admins can create, update, delete, or rotate a workspace webhook — any member can test one.

`action: "create"` needs `url` and `format` (`json`, `slack`, or `discord`), plus either `scope: "follows"` (personal only — everything you follow) or an org-scoped target: `org` (an org slug or `org_…` id), optionally narrowed by `product` (slug or `prod_…` id) or `source` (slug or `src_…` id). `action: "update"` needs `id` plus any fields to change; pass `source: null` or `product: null` to clear a filter. `action: "delete"`, `action: "test"`, and `action: "rotate_secret"` need only `id`.

`create` and `rotate_secret` return a one-time `signingKey` for `json`-format webhooks — store it now, it will not be shown again. `slack` and `discord` deliveries aren't signed, so those formats never return one.
- `search`: Unified search across the registry and release content. Returns up to four sections — organizations, catalog entries (products + standalone sources folded into one list), curated collections (cross-org playlists), and releases with CHANGELOG chunks interleaved by relevance.

Use `type` to narrow the surfaces you want and skip the expensive paths. For example, pass `type: ['catalog']` to look up a known entity by name (fast, registry-only); pass `type: ['releases']` when you only care about release content and want to avoid entity lookups. Omit `type` to search all four.

Collections surface via two paths: a direct match on the collection's name/description (lexical in every mode, plus a vector match in hybrid/semantic mode) and a member rollup that includes every collection containing one of the matched orgs. Member rollups carry a list of result-set org slugs that triggered the rollup so a UI can render an "includes X" hint.

Use `entity` (product slug / prod_ id OR source slug / src_ id) to scope release results to one catalog entry. Product identifiers expand to every source under the product. Use `organization` to scope to a whole org. Release retrieval defaults to hybrid (FTS5 + semantic vectors fused via RRF); it silently degrades to lexical when vector infra is unavailable and flags the result.
- `unfollow`: Stop following an organization or product. Requires a signed-in user. `entity` is an `org_…` or `prod_…` id. Idempotent: unfollowing something you don't follow is a no-op.
- `whats_changed`: Given a package and a `from`/`to` version, return the changelog entries between them — `(from, to]`, from exclusive, to inclusive — with summaries and breaking-change verdicts. One call instead of reading N changelog pages to plan an upgrade.

`package` is a tracked source slug or a GitHub `owner/repo` coordinate (set `ecosystem: "github"` for a bare coordinate). Reads already-indexed releases only. If the package isn't in the catalog you'll get a clear 'not tracked' answer (npm/PyPI names may not be mapped to a source yet).

Each entry prints `URL:` (the original source — cite that) before `Web:` (the releases.sh copy), when present. Structured results still include both `url` and `webUrl`.