# release-to-tasks-mcp

Turn one **public release-note URL** into ordered upgrade tasks that retain a source excerpt, anchor, confidence, and uncertainty. The MCP server never executes release text or project code.

## Install

Node.js 22.14 or newer is required.

```json
{
  "mcpServers": {
    "release-to-tasks": {
      "command": "npx",
      "args": ["-y", "release-to-tasks-mcp@0.1.0"]
    }
  }
}
```

For a clean local invocation before npm publication:

```sh
npm ci
npm test
node dist/index.js
```

## Tool

`release_url_to_tasks`

```json
{
  "release_url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.1"
}
```

The result contains `sourceFormat`, `releaseTitle`, ordered `tasks`, and `warnings`. Every task includes the exact source URL/anchor and a short source excerpt. Low-confidence entries explicitly require human impact assessment.

Supported sources:

1. GitHub release pages (resolved through the public GitHub API)
2. GitHub release API URLs
3. GitLab release pages
4. Public Markdown/plain-text changelogs
5. Public HTML release-note pages

Malformed URLs, non-HTTPS URLs, local/private destinations, unsupported pages, missing release bodies, oversized responses, and unsafe redirects return explicit errors.

## Demo

1. Configure the server in an MCP client.
2. Call `release_url_to_tasks` with a real public release URL.
3. Check each proposed task against its `source.excerpt` and `source.url` before applying an upgrade.

The repository includes a non-fabricated [sample response shape](examples/sample-output.json). The sample deliberately contains no tasks because release content can change; tests contain deterministic source fixtures.

## Privacy and security

Telemetry is disabled by default and there is no hosted collector. Optional local aggregate telemetry never includes URLs or release contents. See [PRIVACY.md](PRIVACY.md) and [SECURITY.md](SECURITY.md).

## Future extension points

The parser and fetcher boundaries can later support authenticated private-source connectors. This release contains no payment, Stripe, private-source, or hosted-service dependency.

## Development

```sh
npm ci
npm test
npm pack --dry-run
```

Internal tests and owner traffic are technical signals only; they never count as external adoption. LEVEL 2 requires three unrelated external users to install the public package and successfully process real release URLs.

## License

MIT