Changelog
mcp/sdk to 0.7.1.matomo_report_processed always advertise itself as read-only and idempotent to MCP clients, even when browser-triggered archiving or browser-based segment archiving is enabled, because archive materialization while serving a report is no longer treated as a change to Matomo's state.module/action beside method, report selectors with surrounding whitespace, filterLimit/filterOffset for filter_limit/filter_offset, a parameter object sent as a JSON object string, and expanded, flat or segment sent at the wrong nesting level. See "Argument Handling" in the FAQ for what each tool accepts.parameters: {} and parameters: [] failing with the invalid-parameters protocol error on the matomo_api_call_* tools. Omitting parameters entirely was unaffected.matomo_report_processed calls that sent segment both at the top level and inside apiParameters.-32602 are unaffected.method outside the Module.action form, and for a segment Matomo cannot parse or one naming a field this Matomo does not provide. Neither message repeats the supplied value back, since it may contain personal data.mcp/sdk to 0.7.matomo_report_list for finding reports by name, category, or uniqueId.McpServer.addTools and McpServer.filterTools events so other plugins can contribute or restrict MCP tool registrations.McpServer.serverEvent event so other plugins can observe completed MCP requests, received notifications, and explicit session termination through SDK-agnostic events, with richer payloads for initialization and tool activity.matomo_report_processed tool description.VisitsSummary.get) as well as the report uniqueId form (VisitsSummary_get), whole-bucket shorthand dates are expanded to a full date (period=year with 2026, period=month with 2026-01), stringified numbers are accepted for integer arguments, and search filters ignore spaces, underscores, hyphens, and dots.Origin handling for DNS-rebinding protection: a supplied Origin is validated against Matomo's trusted deployment hostnames ([General] trusted_hosts) and rejected with 403 when it falls outside them, even when [General] enable_trusted_host_check is disabled. This is request validation, not CORS support — direct cross-origin browser MCP remains unsupported. Requests without an Origin (native MCP clients) are unaffected by this validation.mcp/sdk to 0.5.outputSchema for the matomo_api_* tools so the result and defaultValue entries serialize as {} rather than [], matching the MCP requirement that every schema value is a JSON object.plugin.json to reflect the plugin's actual runtime requirement.matomo_report_processed so empty resolvedReport.apiParameters values serialize as {} rather than [], matching the declared MCP output schema.matomo_report_processed and matomo_report_metadata to accept apiParameters: [] as the empty-input compatibility form.destructiveHint, to improve client compatibility and provide explicit tool metadata.matomo_report_processed so MCP clients see it as read-only when Matomo is configured to avoid browser-triggered archiving for normal and segmented report requests, while still keeping the tool non-idempotent.