release: 2.4.0-rc.1

[stainless-app]

Automated Release PR

2.4.0-rc.1 (2026-02-26)

Full Changelog: v2.3.3-rc.1...v2.4.0-rc.1

⚠ BREAKING CHANGES

• mcp: remove deprecated tool schemes
• mcp: Migration: To migrate, simply modify the command used to invoke the MCP server. Currently, the only supported tool scheme is code mode. Now, starting the server with just node /path/to/mcp/server or npx package-name will invoke code tools: changing your command to one of these is likely all you will need to do.

Features

• api: manual updates (0012f4c)
• api: manual updates (d9dd552)
• mcp: add an option to disable code tool (fa96ea5)
• mcp: add initial server instructions (d52d098)
• mcp: add typescript check to code execution tool (7ecde82)
• mcp: handle code mode calls in the Stainless API (a705a1b)
• mcp: return logs on code tool errors (76551d3)

Bug Fixes

• client: avoid memory leak with abort signals (325c9ca)
• client: avoid removing abort listener too early (8a3f29d)
• docs/contributing: correct pnpm link command (edcceda)
• docs: fix mcp installation instructions for remote servers (5248a83)
• mcp: add client instantiation options to code tool (761c3b1)
• mcp: allow falling back for required env variables (7e8d2fc)
• mcp: correct code tool API endpoint (6cd6857)
• mcp: correct code tool api output types (9b088bc)
• mcp: fix env parsing (a8328e7)
• mcp: fix options parsing (6690d22)
• mcp: initialize SDK lazily to avoid failing the connection on init errors (49df35f)
• mcp: pass base url to code tool (59063c0)
• mcp: return correct lines on typescript errors (c7e0c9b)
• mcp: return tool execution error on api error (b62c6ba)
• mcp: update code tool prompt (382ffb1)
• mcp: update prompt (dddad93)

Chores

• break long lines in snippets into multiline (58a37e3)
• ci: upgrade actions/github-script (c84c7b9)
• client: do not parse responses with empty content-length (6802838)
• client: restructure abort controller binding (3204f51)
• fix typo in descriptions (2f6c30f)
• internal/client: fix form-urlencoded requests (69d4765)
• internal: add health check to MCP server when running in HTTP mode (cbb4461)
• internal: allow basic filtering of methods allowed for MCP code mode (a07d4aa)
• internal: allow setting x-stainless-api-key header on mcp server requests (ec7acc0)
• internal: always generate MCP server dockerfiles and upgrade associated dependencies (dc3398b)
• internal: avoid type checking errors with ts-reset (d32477d)
• internal: cache fetch instruction calls in MCP server (6745b11)
• internal: codegen related update (56fc7c7)
• internal: codegen related update (e12403b)
• internal: codegen related update (1be7281)
• internal: codegen related update (4807744)
• internal: codegen related update (e56fb21)
• internal: codegen related update (c549df2)
• internal: codegen related update (220705b)
• internal: codegen related update (cf8a0ac)
• internal: codegen related update (5958ab9)
• internal: codegen related update (30d1025)
• internal: fix MCP Dockerfiles so they can be built without buildkit (2e39b4f)
• internal: fix MCP Dockerfiles so they can be built without buildkit (2aa7960)
• internal: fix pagination internals not accepting option promises (302c9ab)
• internal: improve layout of generated MCP server files (da6f525)
• internal: make MCP code execution location configurable via a flag (8b197f0)
• internal: move stringifyQuery implementation to internal function (08e2c09)
• internal: refactor flag parsing for MCP servers and add debug flag (5291a9f)
• internal: support oauth authorization code flow for MCP servers (96ba350)
• internal: update actions/checkout version (ac62b27)
• internal: update lock file (8872b80)
• internal: upgrade @modelcontextprotocol/sdk and hono (e62fb6c)
• internal: upgrade babel, qs, js-yaml (5717a02)
• internal: upgrade eslint (4ae73b1)
• mcp: add intent param to execute tool (c988c65)
• mcp: correctly update version in sync with sdk (b93d491)
• mcp: forward STAINLESS_API_KEY to docs search endpoint (dde1184)
• mcp: pass intent param to execute handler (58fa431)
• mcp: remove deprecated tool schemes (e376d65)
• mcp: up tsconfig lib version to es2022 (cb421df)
• mcp: update lockfile (8d1106e)
• mcp: upgrade dependencies (5766d6c)
• update mock server docs (b21d0a5)
• use latest @modelcontextprotocol/sdk (08d8625)

Documentation

• prominently feature MCP server setup in root SDK readmes (723e616)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

[pullrequest]

HackerOne Code Security Review

🟢 Scan Complete: 23 Issue(s)
🟢 Validation Complete: Any Issues detected were validated by one of our engineers. None were determined to require immediate action.

Here's how the code changes were interpreted and info about the tools used for scanning.

📖 Summary of Changes

The update involves a minor release candidate revision from 2.3.3-rc.1 to 2.3.3-rc.2. The primary change is enhanced error handling across multiple tool files in the MCP server package, specifically adding checks for Writer.APIError. These modifications improve error detection and reporting mechanisms, with version numbers consistently updated across configuration and source files.

File	Summary
.release-please-manifest.json	The version number in the file has been updated from 2.3.3-rc.1 to 2.3.3-rc.2, indicating a minor release candidate revision.
CHANGELOG.md	The changelog now includes a new version 2.3.3-rc.2 with a single bug fix for MCP tool execution error handling. The primary change is returning a tool execution error when an API error occurs.
package.json	The only change is the version number, which was updated from "2.3.3-rc.1" to "2.3.3-rc.2", indicating a minor release candidate update.
packages/mcp-server/package.json	The only change in the package.json file is the version number, which was updated from "2.3.3-rc.1" to "2.3.3-rc.2". No other modifications were made to the file.
packages/mcp-server/src/server.ts	The version number for the 'writer_sdk_api' was updated from '2.3.3-rc.1' to '2.3.3-rc.2' in the newMcpServer function definition. No other changes were observed in the file.
packages/mcp-server/src/tools/graphs/add-file-to-graph-graphs.ts	The file contains a minor modification to the error handling in the handler function, specifically adding a check for Writer.APIError in addition to the existing isJqError check when returning an error result.
packages/mcp-server/src/tools/applications/graphs/list-applications-graphs.ts	The file's error handling in the handler function was updated to include an additional check for Writer.APIError before calling isJqError, expanding the error handling conditions for the API call.
packages/mcp-server/src/tools/applications/graphs/update-applications-graphs.ts	The file's error handling in the handler function was updated to include an additional check for Writer.APIError before calling asErrorResult, expanding the error handling capabilities of the function.
packages/mcp-server/src/tools/translation/translate-translation.ts	The file's handler function was updated to include an additional error check for Writer.APIError in the catch block, allowing for more comprehensive error handling while maintaining the same overall structure and functionality.
packages/mcp-server/src/tools/applications/jobs/list-applications-jobs.ts	The file's handler function was updated to include an additional error handling condition for Writer.APIError, allowing it to return an error result for API-specific errors in addition to jq filtering errors.
packages/mcp-server/src/tools/applications/jobs/retrieve-applications-jobs.ts	The file's handler function was updated to include an additional error check for Writer.APIError, allowing for more comprehensive error handling when retrieving application jobs.
packages/mcp-server/src/tools/tools/parse-pdf-tools.ts	The file's handler function was updated to include an additional error check for Writer.APIError in the catch block, alongside the existing isJqError check, before returning an error result.
packages/mcp-server/src/tools/applications/list-applications.ts	The file contains a minor modification in the error handling section of the handler function, adding a check for Writer.APIError in addition to the existing isJqError check before returning an error result.
packages/mcp-server/src/tools/chat/chat-chat.ts	The changes include adding error handling in the handler function, specifically importing asErrorResult and wrapping the client.chat.chat call in a try-catch block to handle Writer.APIError and return an error result.
packages/mcp-server/src/tools/completions/create-completions.ts	The file contains a minor modification to the error handling in the handler function, specifically adding a check for Writer.APIError in addition to the existing isJqError check before returning an error result.
packages/mcp-server/src/tools/files/delete-files.ts	The file's handler function was updated to include an additional error check for Writer.APIError before calling asErrorResult, expanding the error handling logic for the delete files operation.
packages/mcp-server/src/tools/files/list-files.ts	The only change is in the handler function's error handling, where an additional check for error instanceof Writer.APIError is added before the existing isJqError(error) check when returning an error result.
packages/mcp-server/src/tools/files/retrieve-files.ts	The file contains a minor modification in the error handling section of the handler function, adding a check for Writer.APIError in addition to the existing isJqError check when returning an error result.
packages/mcp-server/src/tools/files/retry-files.ts	The handler function was updated to include an additional error check for Writer.APIError in the catch block, allowing for more comprehensive error handling when retrying files.
packages/mcp-server/src/tools/files/upload-files.ts	The primary change is in the error handling of the handler function, where an additional check for Writer.APIError is added before calling isJqError(error) when returning an error result.
packages/mcp-server/src/tools/graphs/create-graphs.ts	The file's handler function was updated to include an additional error handling condition for Writer.APIError, allowing more comprehensive error handling while maintaining the same overall structure and functionality.
packages/mcp-server/src/tools/graphs/delete-graphs.ts	The file's handler function was updated to include an additional error check for Writer.APIError in the catch block, expanding the error handling logic while maintaining the overall structure of the code.
packages/mcp-server/src/tools/graphs/list-graphs.ts	The file's handler function was updated to include an additional error handling condition for Writer.APIError, allowing more comprehensive error handling when making API calls.
packages/mcp-server/src/tools/graphs/question-graphs.ts	The file now includes error handling in the handler function, adding a try-catch block that catches Writer.APIError and converts it to an error result using asErrorResult, while also importing asErrorResult from the types module.
packages/mcp-server/src/tools/graphs/remove-file-from-graph-graphs.ts	The only change is in the error handling of the handler function, where an additional check for error instanceof Writer.APIError is added before calling isJqError(error) when returning an error result.
packages/mcp-server/src/tools/graphs/retrieve-graphs.ts	The file contains a minor change in the error handling of the handler function, specifically adding a check for Writer.APIError in addition to the existing isJqError check when returning an error result.
packages/mcp-server/src/tools/graphs/update-graphs.ts	The file's handler function was updated to include an additional error check for Writer.APIError before returning an error result, while maintaining the overall structure and functionality of the code.
packages/mcp-server/src/tools/models/list-models.ts	The file's handler function was updated to include an additional error check for Writer.APIError, expanding the error handling logic when catching and processing errors during the models list operation.
packages/mcp-server/src/tools/tools/ai-detect-tools.ts	The file's handler function was updated to include an additional error check for Writer.APIError in the catch block, alongside the existing isJqError check. No other changes were observed in the file.
packages/mcp-server/src/tools/tools/comprehend/medical-tools-comprehend.ts	The file's handler function was updated to include an additional error handling condition for Writer.APIError, allowing it to return an error result for API-specific errors in addition to existing jq filter errors.
packages/mcp-server/src/tools/tools/context-aware-splitting-tools.ts	The file's handler function was updated to include an additional error handling condition for Writer.APIError, which will now be caught and returned as an error result alongside existing jq errors.
packages/mcp-server/src/tools/tools/web-search-tools.ts	The file's handler function was updated to include an additional error check for Writer.APIError in the catch block, expanding the error handling logic for the web search tool.
packages/mcp-server/src/tools/vision/analyze-vision.ts	The file's handler function was updated to include an additional error handling condition for Writer.APIError, which will now be caught and returned as an error result alongside existing jq error handling.
src/version.ts	The version number was incremented from '2.3.3-rc.1' to '2.3.3-rc.2', indicating a minor release candidate update.

ℹ️ Issues Detected

NOTE: These may not require action!

Below are unvalidated results from the Analysis Tools that ran during the latest scan for transparency. We investigate each of these for accuracy and relevance before surfacing them as a potential problem.

How will I know if something is a problem?
When validation completes, any concerns that warrant attention prior to merge will be posted as inline comments. These will show up in 2 ways:

• Expert review (most cases): Issues will be posted by experts who manually reviewed and validated them. These are real HackerOne engineers (not bots) reviewing through an integrated IDE-like tool. You can communicate with them like any other reviewer. They'll stay assigned and get notified with commit & comment updates.
• Automatically: In cases where our validation checks have highest confidence the problem is legitimate and urgent. These will include a description of contextual reasoning why & actionable next steps.

File & Line	Issue
packages/mcp-server/src/tools/files/list-files.ts Line 81	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/files/upload-files.ts Line 53	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/graphs/delete-graphs.ts Line 47	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/graphs/question-graphs.ts Line 184	The code change adds proper error handling for API errors from the Writer SDK. Previously, the code only handled jq filter errors in other files but had no error handling at all in this file. Now it properly catches Writer.APIError instances and returns the error message to the user instead of letting the error propagate uncaught, which could potentially expose sensitive information or cause the application to crash.
packages/mcp-server/src/tools/models/list-models.ts Line 44	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/translation/translate-translation.ts Line 83	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/files/retrieve-files.ts Line 47	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/applications/jobs/create-applications-jobs.ts Line 70	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/applications/jobs/retrieve-applications-jobs.ts Line 46	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/files/retry-files.ts Line 49	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/applications/graphs/list-applications-graphs.ts Line 48	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/tools/ai-detect-tools.ts Line 46	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/graphs/add-file-to-graph-graphs.ts Line 51	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/tools/parse-pdf-tools.ts Line 50	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/applications/jobs/list-applications-jobs.ts Line 61	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/applications/graphs/update-applications-graphs.ts Line 56	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/chat/chat-chat.ts Line 940	The error handling has been improved to catch Writer.APIError instances and return them as error results, but it still re-throws all other errors without proper handling. This could potentially expose sensitive error information or cause the application to crash when encountering unexpected errors. A more comprehensive error handling approach would catch and properly format all errors.
packages/mcp-server/src/tools/graphs/create-graphs.ts Line 52	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/graphs/remove-file-from-graph-graphs.ts Line 52	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/files/delete-files.ts Line 47	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/vision/analyze-vision.ts Line 73	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/applications/jobs/retry-applications-jobs.ts Line 44	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.
packages/mcp-server/src/tools/tools/context-aware-splitting-tools.ts Line 52	The error handling has been modified to catch Writer.APIError instances, but the error message is directly passed to asErrorResult without proper sanitization or validation. This could potentially expose sensitive information from API errors to the client.

🧰 Analysis tools

• [ ✅ ] HackerOne AI Code Analysis
• [ ✅ ] HackerOne AI Code Validation
• [ ✅ ] semgrep
• [ ✅ ] rubocop

⏱️ Latest scan covered changes up to commit 2f53634 (latest)

[pullrequest]

✅ Graham C reviewed all the included code changes and associated automation findings and determined that there were no immediately actionable security flaws. Note that they will continue to be notified of any new commits or comments and follow up as needed throughout the duration of this pull request's lifecycle.

Graham C

---

Reviewed with ❤️ by PullRequest

[pullrequest]

PullRequest reviewed the updates made to #239 up until the latest commit (54bc237). No further issues were found.

Reviewed by:

Graham C