Release v0.12.2-dev

CHANGELOG.md

@@ -1,5 +1,7 @@
 ## Unreleased
 
+## 0.12.2-dev - 2026-06-10
+
 ### Security
 
 - **static_map_image_tool**: Stop embedding the Mapbox access token in tool results. Previously the tool returned a `createUIResource({ iframeUrl })` whose URL carried the caller's `?access_token=` query param, leaking the secret token via the MCP-UI resource item. The credentialed URL is now only used server-side to fetch the image, which is returned inline as base64. The tool's `meta.ui.resourceUri` declaration is removed (the iframe path required the credentialed URL to function and cannot be reinstated without leaking). A regression test asserts the access token does not appear in any content item.

manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "display_name": "Mapbox MCP Server",
   "name": "@mapbox/mcp-server",
-  "version": "0.12.0",
+  "version": "0.12.2-dev",
   "description": "Mapbox MCP server.",
   "author": {
     "name": "Mapbox, Inc."

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/mcp-server",
-  "version": "0.12.0",
+  "version": "0.12.2-dev",
   "description": "Mapbox MCP server.",
   "mcpName": "io.github.mapbox/mcp-server",
   "main": "./dist/commonjs/index.js",

server.json

@@ -6,13 +6,13 @@
     "url": "https://github.com/mapbox/mcp-server",
     "source": "github"
   },
-  "version": "0.12.0",
+  "version": "0.12.2-dev",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "runtimeHint": "npx",
-      "version": "0.12.0",
+      "version": "0.12.2-dev",
       "identifier": "@mapbox/mcp-server",
       "transport": {
         "type": "stdio"