sh.releases/mcp

Est-ce que sh.releases/mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « sh.releases/mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 18 outils

• follow≈ 219 tokens

  Follow an organization or a product so it appears in your personalized feed (`get_personalized_feed`). Following an organization implicitly includes all of its products. Requires a signed-in user (a `relu_` user key or an OAuth token). `entity` is a typed id — an `org_…` id or a `prod_…` id — as returned by `search`, `get_organization`, or `get_catalog_entry`. Idempotent: following something you already follow is a no-op.

  Paramètres, retour & exemple (1)

  Paramètres

  • entity · string · requis
    Entity to follow — an `org_…` or `prod_…` id (from search / get_* results).

  Exemple d'appel

  {"name": "follow", "arguments": {"entity": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_catalog_entry≈ 565 tokens

  Detail for a single catalog entry — accepts a prod_ id, src_ id, or an org-scoped coordinate in the form orgSlug/slug (e.g. 'vercel/nextjs' or 'vercel/next-js'). Returns the union of product / source detail fields depending on the entry kind. Source entries list tracked CHANGELOG files by path and byte size. Pass `include_changelog: true` to inline the root CHANGELOG, or `changelog_path` / `changelog_offset` / `changelog_limit` / `changelog_tokens` to embed a specific file or slice — heading-aligned, supports per-package files in monorepos (e.g. `packages/next/CHANGELOG.md`), and emits `totalTokens` / `sliceTokens` for LLM context budgeting. Files over 1MB are flagged as truncated so you know the tail is missing.

  Paramètres, retour & exemple (6)

  Paramètres

  • identifier · string · requis
    Catalog entry identifier: prod_ id, src_ id, or org-scoped coordinate orgSlug/slug (e.g. 'vercel/nextjs'). Bare slugs without an org prefix are not accepted.
  • changelog_path · string · optionnel
    Specific CHANGELOG path for a source-kind entry (e.g. 'packages/next/CHANGELOG.md'). Passing this implies include_changelog.
  • changelog_limit · number · optionnel
    Target slice size in characters. Slice ends at a heading boundary. Defaults to 40000 when slicing without a token budget. Passing this implies include_changelog.
  • changelog_offset · number · optionnel
    Character offset into the selected CHANGELOG. Snapped forward to the next heading unless 0. Passing this implies include_changelog.
  • changelog_tokens · number · optionnel
    Target slice size in tokens (cl100k_base). Takes precedence over changelog_limit. Recommended brackets: 2000, 5000, 10000, 20000. Passing this implies include_changelog.
  • include_changelog · boolean · optionnel
    When true, inline the root tracked CHANGELOG for a source-kind entry. Ignored for products.

  Exemple d'appel

  {"name": "get_catalog_entry", "arguments": {"identifier": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_collection≈ 157 tokens

  Detail for a single collection — name, description, and the ordered list of member organizations. Hidden / on-demand orgs never leak through; only publicly visible orgs appear in the member list.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    Collection slug (e.g. 'frontier-ai-labs').

  Exemple d'appel

  {"name": "get_collection", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_collection_releases≈ 354 tokens

  Interleaved cross-org release feed for a collection — same shape as `get_latest_releases` but scoped to the collection's member orgs. Cursor-paginated: pass `limit` for slice size (default 20), `cursor` to continue from a prior call. The result's `_meta.pagination` carries `kind: 'cursor'`, `hasMore`, and `nextCursor` when more rows exist; the response text echoes `nextCursor` so an LLM caller can chain without parsing `_meta`. Cursors are stable under inserts.

  Paramètres, retour & exemple (4)

  Paramètres

  • slug · string · requis
    Collection slug (e.g. 'frontier-ai-labs').
  • limit · integer · optionnel
    Slice size (1–200). Defaults to 20.
  • cursor · string · optionnel
    Opaque continuation token from a prior call's `_meta.pagination.nextCursor`. Stale cursors are silently ignored — the call returns a fresh head of the feed.
  • include_prereleases · boolean · optionnel
    Include prerelease tags (alphas, betas, RCs). Defaults to false so the feed matches the public web view.

  Exemple d'appel

  {"name": "get_collection_releases", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_latest_releases≈ 891 tokens

  Get the most recent releases, optionally filtered by product or organization. Excludes prereleases (canaries / alphas / betas / RCs) by default — pass `include_prereleases: true` to include them. Cursor-paginated: pass `limit` for slice size (default 10), `cursor` to continue from a prior call. The result's `_meta.pagination` carries `kind: 'cursor'`, `hasMore`, and `nextCursor` when more rows exist; the response text echoes `nextCursor` so an LLM caller can chain without parsing `_meta`. Cursors are stable under inserts — a release added between calls won't shift the slice.

  Paramètres, retour & exemple (11)

  Paramètres

  • kind · string · optionnel · platform | sdk | mobile | desktop | docs | integration | tool
    Filter to releases from sources of a specific kind. Resolves through `source.kind ?? product.kind`, so an SDK repo with no own kind still matches its product's kind. Omit to include all kinds.
  • type · string · optionnel · feature | rollup
    Filter by release type: 'feature' for individual releases, 'rollup' for seasonal/quarterly catch-all posts. Omit to include both.
  • limit · integer · optionnel
    Slice size (1–200). Defaults to 10.
  • since · string · optionnel
    Keep only releases published at or after this bound. Accepts an ISO date/datetime (`2026-01-01`) or relative shorthand (`90d`, `4w`, `6m`, `2y`). Filters `published_at`; undated releases are dropped.
  • until · string · optionnel
    Keep only releases published at or before this bound. Same input formats as `since`; a bare date (`2026-06-25`) includes that whole UTC day.
  • cursor · string · optionnel
    Opaque continuation token from a prior call's `_meta.pagination.nextCursor`. Pass to fetch the next slice. Stale cursors are silently ignored — the call returns a fresh head of the feed.
  • product · string · optionnel
    Filter to a product's cross-source release feed. Accepts a prod_ id (expands to ALL sources under the product), a src_ id (single source), or an org-scoped coordinate in the form orgSlug/productSlug (e.g. 'vercel/next-js'). Bare slugs without an org prefix are not accepted. Mirrors the REST ?product= expansion — multi-source products (e.g. Next.js with GitHub releases + blog) return releases from all of their sources interleaved.
  • organization · string · optionnel
    Filter to sources belonging to this organization. Accepts an org_ id, slug, or registered domain.
  • minImportance · integer · optionnel
    Only include releases with an AI-scored `importance` >= this value (1-5; 5=landmark, 1=housekeeping). Releases with no score (unscored) are excluded when this is set. Mirrors the REST `?minImportance=` filter.
  • include_coverage · boolean · optionnel
    Include releases grouped as coverage of another (e.g. marketing posts that re-announce a platform release). Defaults to false so each underlying launch appears once.
  • include_prereleases · boolean · optionnel
    Include prerelease tags (alphas, betas, RCs, canaries). Defaults to false so the feed matches the public web view.

  Exemple d'appel

  {"name": "get_latest_releases", "arguments": {"kind": "platform", "type": "feature", "limit": 1, "since": "texte", "until": "texte", "cursor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_organization≈ 240 tokens

  Get detailed information about a single organization — accounts, tags, sources, products, aliases. When an AI-generated overview exists the response includes a short preview; pass `include_overview: true` to inline the full briefing (with a stale warning if the content is older than 30 days since last write).

  Paramètres, retour & exemple (2)

  Paramètres

  • identifier · string · requis
    Organization identifier. Accepts an org_ id, slug, domain, name, or account handle.
  • include_overview · boolean · optionnel
    When true, inline the full AI-generated overview instead of the default first-paragraph preview.

  Exemple d'appel

  {"name": "get_organization", "arguments": {"identifier": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_personalized_feed≈ 256 tokens

  Your personalized release feed — recent releases from the organizations and products you follow, newest first. Requires a signed-in user. Same item shape as `get_latest_releases`, scoped to your follows. Each item prints `URL:` (the original source — cite that) before `Web:` (the releases.sh copy), when present. Cursor-paginated: pass `cursor` from a prior response's `_meta.pagination.nextCursor` and optional `limit` (1–100, default 30).

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
    Entries per page (1–100). Defaults to 30.
  • cursor · string · optionnel
    Opaque cursor from a previous page's `_meta.pagination.nextCursor`.

  Exemple d'appel

  {"name": "get_personalized_feed", "arguments": {"limit": 1, "cursor": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_release≈ 204 tokens

  Fetch the full content of a single release by id. Release ids are returned by search or get_latest_releases — pass them here to read the whole entry (e.g. to quote a specific Next.js release note). Accepts the full rel_<nanoid> form or the bare 21-char nanoid. Cite `URL:` (the original source) ahead of `Web:` (the releases.sh copy). Structured `url` and `webUrl` carry the same pair.

  Paramètres, retour & exemple (1)

  Paramètres

  • id · string · requis
    Release id — 'rel_<nanoid>' or a bare 21-char nanoid

  Exemple d'appel

  {"name": "get_release", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_catalog≈ 397 tokens

  List catalog entries — products and standalone sources combined into one list with an `entryType: 'product' | 'source'` discriminator per row. Orgs that group multiple sources under a product (e.g. Vercel → Next.js, Turborepo) surface those products; orgs with a single source that isn't part of a product surface it directly as an `entryType: 'source'` entry. Either shape is a reasonable thing to pass to `search(entity: ...)`. Paginated: defaults to 50 entries per page. Pass `page: 2` for the next slice. The footer surfaces the total when more pages exist.

  Paramètres, retour & exemple (4)

  Paramètres

  • kind · string · optionnel · platform | sdk | mobile | desktop | docs | integration | tool
    Filter to catalog entries of a specific kind. Matches each row's own kind (a product's kind, or a standalone source's kind) — no source→product inheritance on this catalog surface. Omit to include all kinds.
  • page · integer · optionnel
    1-based page number. Defaults to 1.
  • limit · integer · optionnel
    Entries per page (1–200). Defaults to 50.
  • organization · string · optionnel
    Organization to scope to. Accepts an org_ id, slug, domain, or name.

  Exemple d'appel

  {"name": "list_catalog", "arguments": {"kind": "platform", "page": 1, "limit": 1, "organization": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_collections≈ 227 tokens

  List curated collections — named cross-org playlists (e.g. 'Frontier AI Labs') independent of the fixed category taxonomy. Use `get_collection` for a collection's full member list, or `get_collection_releases` for the interleaved cross-org release feed. Paginated: defaults to 50 entries per page; pass `page: 2` for the next slice.

  Paramètres, retour & exemple (2)

  Paramètres

  • page · integer · optionnel
    1-based page number. Defaults to 1.
  • limit · integer · optionnel
    Entries per page (1–200). Defaults to 50.

  Exemple d'appel

  {"name": "list_collections", "arguments": {"page": 1, "limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_follows≈ 87 tokens

  List the organizations and products you follow (newest first). Requires a signed-in user.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_follows", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_organizations≈ 369 tokens

  List all indexed organizations, optionally filtered. Paginated: defaults to 50 entries per page; pass `page: 2` for the next slice. Orgs with zero indexed releases are hidden by default (curator-stub noise); set `include_empty: true` to see them.

  Paramètres, retour & exemple (6)

  Paramètres

  • page · integer · optionnel
    1-based page number. Defaults to 1.
  • limit · integer · optionnel
    Entries per page (1–200). Defaults to 50.
  • query · string · optionnel
    Search across org name, slug, domain, and account handles
  • category · string · optionnel
    Filter to a single category slug (e.g. `ai`, `devops`). Aliases (e.g. `e-commerce`) resolve to their canonical category (`commerce`); unknown values are ignored (unfiltered).
  • platform · string · optionnel
    Filter to orgs with an account on this platform
  • include_empty · boolean · optionnel
    Include orgs with zero indexed releases. Default false — empty orgs are stubs from in-flight discovery or broken parsers and surface as noise on the public catalog.

  Exemple d'appel

  {"name": "list_organizations", "arguments": {"page": 1, "limit": 1, "query": "texte", "category": "texte", "platform": "texte", "include_empty": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_webhooks≈ 278 tokens

  List your outbound release webhooks, personal or workspace. Requires a signed-in user (a `relu_` user key or an OAuth token). With no `workspace`, lists your personal webhooks (`GET /v1/me/webhooks`) and includes a short list of your workspaces (id, slug, role) so you can target one next. Pass `workspace` (an id or a slug) to list that workspace's webhooks instead. Pass `id` to see one webhook plus its 10 most recent deliveries. Pass `enabled` to filter by enabled/disabled state.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · optionnel
    Show one webhook (with recent deliveries) instead of the full list.
  • enabled · boolean · optionnel
    Filter to enabled or disabled webhooks.
  • workspace · string · optionnel
    Workspace id or slug. Omit for your personal webhooks.

  Exemple d'appel

  {"name": "list_webhooks", "arguments": {"id": "texte", "enabled": true, "workspace": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• lookup_domain≈ 261 tokens

  Resolve a domain to the org or product that owns it. The domain is normalized first (scheme, `www.`, path, and trailing slash stripped, lowercased), so `https://vercel.com/about` and `vercel.com` both look up the same row. Returns the matching org (with primary-vs-alias distinction) and any products whose alias targets the same domain. Pure resolution — does not probe the domain or materialize anything; unknown domains surface a 'no match' message. Use `lookup_domain` when you have a URL-shaped input; use `get_organization` when you already have a slug or id.

  Paramètres, retour & exemple (1)

  Paramètres

  • domain · string · requis
    Domain to resolve. Any URL-shaped form is accepted; the server normalizes it.

  Exemple d'appel

  {"name": "lookup_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• manage_webhook≈ 760 tokens

  Create, update, delete, test, or rotate the signing key of an outbound release webhook — personal or workspace. Requires a signed-in user. This tool sends requests to an external URL you supply and can delete or disable delivery, so treat it as a write. Pass `workspace` (an id or slug) to act on a workspace's webhooks instead of your personal ones; workspace webhooks are always org-scoped (`scope: "follows"` is personal-only and is rejected up front). Only workspace owners and admins can create, update, delete, or rotate a workspace webhook — any member can test one. `action: "create"` needs `url` and `format` (`json`, `slack`, or `discord`), plus either `scope: "follows"` (personal only — everything you follow) or an org-scoped target: `org` (an org slug or `org_…` id), optionally narrowed by `product` (slug or `prod_…` id) or `source` (slug or `src_…` id). `action: "update"` needs `id` plus any fields to change; pass `source: null` or `product: null` to clear a filter. `action: "delete"`, `action: "test"`, and `action: "rotate_secret"` need only `id`. `create` and `rotate_secret` return a one-time `signingKey` for `json`-format webhooks — store it now, it will not be shown again. `slack` and `discord` deliveries aren't signed, so those formats never return one.

  Paramètres, retour & exemple (12)

  Paramètres

  • id · string · optionnel
    Webhook id — required for update, delete, test, and rotate_secret.
  • org · string · optionnel
    Org slug or org_… id. Required for an org-scoped create.
  • url · string · optionnel
    Delivery URL. Required for create.
  • scope · string · optionnel · org | follows
    Create only. "follows" is personal-only and defaults org-scoped when omitted.
  • action · string · requis · create | update | delete | test | rotate_secret
  • format · string · optionnel · json | slack | discord
    Delivery format.
  • source · ? · optionnel
    Source slug or src_… id to narrow an org-scoped webhook. null clears it on update.
  • enabled · boolean · optionnel
    Update only. Enable or disable delivery.
  • product · ? · optionnel
    Product slug or prod_… id to narrow an org-scoped webhook. null clears it on update.
  • workspace · string · optionnel
    Workspace id or slug. Omit to act on your personal webhooks.
  • description · string · optionnel
    Freeform label for the webhook.
  • releaseType · string · optionnel · feature | rollup
    Optional filter on release taxonomy type.

  Exemple d'appel

  {"name": "manage_webhook", "arguments": {"action": "create"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search≈ 1254 tokens

  Unified search across the registry and release content. Returns up to four sections — organizations, catalog entries (products + standalone sources folded into one list), curated collections (cross-org playlists), and releases with CHANGELOG chunks interleaved by relevance. Use `type` to narrow the surfaces you want and skip the expensive paths. For example, pass `type: ['catalog']` to look up a known entity by name (fast, registry-only); pass `type: ['releases']` when you only care about release content and want to avoid entity lookups. Omit `type` to search all four. Collections surface via two paths: a direct match on the collection's name/description (lexical in every mode, plus a vector match in hybrid/semantic mode) and a member rollup that includes every collection containing one of the matched orgs. Member rollups carry a list of result-set org slugs that triggered the rollup so a UI can render an "includes X" hint. Use `entity` (product slug / prod_ id OR source slug / src_ id) to scope release results to one catalog entry. Product identifiers expand to every source under the product. Use `organization` to scope to a whole org. Release retrieval defaults to hybrid (FTS5 + semantic vectors fused via RRF); it silently degrades to lexical when vector infra is unavailable and flags the result.

  Paramètres, retour & exemple (13)

  Paramètres

  • kind · string · optionnel · platform | sdk | mobile | desktop | docs | integration | tool
    Filter to a specific source/product kind. Release hits resolve through `source.kind ?? product.kind`; catalog hits filter on the row's own kind. The orgs and collections sections are unaffected; changelog chunk hits are unaffected.
  • mode · string · optionnel · lexical | semantic | hybrid
    Release-retrieval strategy. 'hybrid' (default) fuses FTS + vector results. 'lexical' is legacy FTS only. 'semantic' is vectors only. Falls back to lexical if vector infra is unavailable.
  • type · array · optionnel
    Which sections to return. Omit to return all four. Use to skip expensive paths — e.g. ['catalog'] for registry-only lookups, ['releases'] for pure release search, ['collections'] for a quick playlist lookup.
  • limit · number · optionnel
    Max results per section (default 20)
  • query · string · requis
    Search query
  • since · string · optionnel
    Keep only release hits published at or after this bound. Accepts an ISO date/datetime (`2026-01-01`) or relative shorthand (`90d`, `4w`, `6m`, `2y`). Filters `published_at`; undated releases are dropped. Only the releases section is affected — great for capability-discovery queries like 'who added X in the last 90 days'.
  • until · string · optionnel
    Keep only release hits published at or before this bound. Same input formats as `since`; a bare date (`2026-06-25`) includes that whole UTC day.
  • domain · string · optionnel
    Scope to the org owning this domain. Input is normalized (scheme/path/www stripped, lowercased), so `https://vercel.com/` and `vercel.com` both work. Falls back to a 'no match' message when the domain isn't owned by anything indexed. Use this instead of `organization` when you have a URL-shaped input.
  • entity · string · optionnel
    Scope release results to one catalog entry. Accepts a prod_ id (expands to every source under the product), a src_ id, or an org-scoped coordinate in the form orgSlug/slug (e.g. 'vercel/nextjs'). Bare slugs without an org prefix are not accepted.
  • product · string · optionnel
    Scope release results to a specific product's sources. Accepts a prod_ id or an org-scoped coordinate in the form orgSlug/productSlug (e.g. 'vercel/next-js'). Bare slugs without an org prefix are not accepted. When both `entity` and `product` are supplied, `entity` takes precedence. The resolved product coordinate is echoed on `_meta.search.product`.
  • organization · string · optionnel
    Scope release results to sources belonging to this organization. Accepts an org_ id, slug, or registered domain.
  • include_empty · boolean · optionnel
    Include orgs with zero indexed releases in the `orgs` section. Default false — empty orgs are stubs and surface as noise. Scoping by `domain` ignores this and always returns the resolved org.
  • include_coverage · boolean · optionnel
    Include releases grouped as coverage of another (e.g. marketing posts that re-announce a platform release). Defaults to false so each underlying launch appears once.

  Exemple d'appel

  {"name": "search", "arguments": {"query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• unfollow≈ 149 tokens

  Stop following an organization or product. Requires a signed-in user. `entity` is an `org_…` or `prod_…` id. Idempotent: unfollowing something you don't follow is a no-op.

  Paramètres, retour & exemple (1)

  Paramètres

  • entity · string · requis
    Entity to unfollow — an `org_…` or `prod_…` id.

  Exemple d'appel

  {"name": "unfollow", "arguments": {"entity": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• whats_changed≈ 443 tokens

  Given a package and a `from`/`to` version, return the changelog entries between them — `(from, to]`, from exclusive, to inclusive — with summaries and breaking-change verdicts. One call instead of reading N changelog pages to plan an upgrade. `package` is a tracked source slug or a GitHub `owner/repo` coordinate (set `ecosystem: "github"` for a bare coordinate). Reads already-indexed releases only. If the package isn't in the catalog you'll get a clear 'not tracked' answer (npm/PyPI names may not be mapped to a source yet). Each entry prints `URL:` (the original source — cite that) before `Web:` (the releases.sh copy), when present. Structured results still include both `url` and `webUrl`.

  Paramètres, retour & exemple (5)

  Paramètres

  • to · string · requis
    Version you're upgrading TO (inclusive).
  • from · string · requis
    Version you're upgrading FROM (exclusive).
  • package · string · requis
    Package identifier — a source slug or a GitHub "owner/repo" coordinate.
  • ecosystem · string · optionnel · npm | pypi | github
    Optional resolution hint; "github" enables matching a bare owner/repo.
  • minImportance · integer · optionnel
    Only include entries with an AI-scored `importance` >= this value (1-5; 5=landmark, 1=housekeeping). Entries with no score (unscored) are excluded when this is set.

  Exemple d'appel

  {"name": "whats_changed", "arguments": {"to": "texte", "from": "texte", "package": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://agents.releases.sh/mcp