Turn one public release-note URL into ordered upgrade tasks that retain a source excerpt, anchor, confidence, and uncertainty. The MCP server never executes release text or project code.

Install

Node.js 22.14 or newer is required.

{
  "mcpServers": {
    "release-to-tasks": {
      "command": "npx",
      "args": ["-y", "release-to-tasks-mcp@0.1.0"]
    }
  }
}

For a clean local invocation before npm publication:

npm ci
npm test
node dist/index.js

Tool

release_url_to_tasks

{
  "release_url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.1"
}

The result contains sourceFormat, releaseTitle, ordered tasks, and warnings. Every task includes the exact source URL/anchor and a short source excerpt. Low-confidence entries explicitly require human impact assessment.

Supported sources:

GitHub release pages (resolved through the public GitHub API)
GitHub release API URLs
GitLab release pages
Public Markdown/plain-text changelogs
Public HTML release-note pages

Malformed URLs, non-HTTPS URLs, local/private destinations, unsupported pages, missing release bodies, oversized responses, and unsafe redirects return explicit errors.

Demo

Configure the server in an MCP client.
Call release_url_to_tasks with a real public release URL.
Check each proposed task against its source.excerpt and source.url before applying an upgrade.

The repository includes a non-fabricated sample response shape. The sample deliberately contains no tasks because release content can change; tests contain deterministic source fixtures.

Privacy and security

Telemetry is disabled by default and there is no hosted collector. Optional local aggregate telemetry never includes URLs or release contents. See PRIVACY.md and SECURITY.md.

Future extension points

The parser and fetcher boundaries can later support authenticated private-source connectors. This release contains no payment, Stripe, private-source, or hosted-service dependency.

Development

npm ci
npm test
npm pack --dry-run

Internal tests and owner traffic are technical signals only; they never count as external adoption. LEVEL 2 requires three unrelated external users to install the public package and successfully process real release URLs.