chore(deps): bump @discourse/mcp from 0.2.9 to 0.3.1 in the dependencies group

[dependabot]

Bumps the dependencies group with 1 update: @discourse/mcp.

Updates @discourse/mcp from 0.2.9 to 0.3.1

Changelog

Sourced from @​discourse/mcp's changelog.

0.3.1 (2026-08-25)

Changed

• Simplify write-mode opt-in and deprecate read_only=false
  • --allow_writes now enables mutation tools by itself; the redundant --read_only=false CLI/profile setting is deprecated, has no effect, and emits an informational migration notice
  • Migration note: an existing command or profile with allow_writes=true and no read_only value previously remained read-only; it now enables mutation tools as its name indicates
  • Keep writes disabled when allow_writes is omitted or false, and retain toolset selection, authentication, authorization, confirmation, and call-time access checks unchanged

Breaking Changes

• Reject contradictory allow_writes=true and read_only=true configuration at startup instead of silently hiding mutation tools; remove read_only=true to enable writes, or remove allow_writes=true to remain read-only

0.3.0 (2026-08-21)

Features

• Complete bounded category and group directories with structured MCP output

  • Paginate lazy-loaded category/group endpoints with stable ID deduplication, cancellation/deadline/page budgets, short-lived site/auth/option-isolated caching, and truthful completeness/truncation metadata
  • Keep discourse_list_categories isolated to opt-in administration; make empty-input discourse_list_groups exhaustive under opt-in groups while preserving explicit page/filter one-request behavior
  • Add parent_category_id while retaining legacy pid, and keep deprecated category/group resources correct through shared fetchers and bounded permission enrichment
  • Advertise output schemas and identical JSON-text fallbacks; malformed upstream records now produce normal tool errors

• Add the dedicated opt-in tag_groups lifecycle toolset

  • Add public Guardian-filtered search, authoritative staff list/detail, deterministic optimistic state hashes, and explicit {group_id, access} permission entries that are machine-readable in MCP JSON Schema and converted to Discourse's numeric map only at the HTTP boundary
  • Add guarded create, complete-state update, and hard delete with local ID/name/hash preflights, tag-creation/replacement/cascade confirmations, non-retried writes, and authoritative post-state/absence verification; tolerate blank optional parent_tag placeholders as omission while reserving explicit null for update-time clearing
  • Report uncertain post-dispatch outcomes without structured success or blind-retry advice; document scoped-key, plugin-dependency, tagging-setting, and deletion-cascade limits

• Add top-level CLI metadata and cross-platform profile home expansion

  • --help/-h/help and --version/-v/version exit successfully before profile/site/transport startup
  • Expand only a leading current-user ~, ~/, or ~\ in profile paths; do not expand ~otheruser or upload allowlists

• Make the loopback HTTP transport contract explicitly one stateful client per process

  • Retain random session IDs, reject missing/unknown sessions and second initialization, bound pre-read request bodies to 4 MiB, and close active transports during shutdown
  • After DELETE, expose a clear restart-required MCP/health response instead of leaving a closed transport behind a healthy endpoint

• Add opt-in, admin-sensitive webhooks and site_settings toolsets

  • Add secret-safe webhook inspection, bounded/redacted delivery diagnostics, guarded lifecycle operations, ping, and exact single-event redelivery with fresh destination preconditions and no automatic mutation retries
  • Harden site-setting reads against upstream-secret and credential-like values, support directly listing only currently overridden settings, and add one-setting-at-a-time updates with live metadata validation, expected-value conflict checks, no-retry writes, and exact verification reads
  • Keep external delivery, bulk operations, secret/structured setting mutation, user backfills, and generic admin-route passthrough outside the supported surface

• Add the opt-in, admin-sensitive themes toolset

  • Add bounded list/detail reads and write-gated local creation, metadata/composition changes, field/setting/translation editing, Git/archive installation, remote synchronization, asset upload, and guarded single deletion
  • Require explicit confirmations for executable code, migrations, default and component-graph changes, source replacement, archive replacement, forced placeholders, reverts, uploads, and deletion
  • Keep local files beneath symlink-resolved allowed_upload_paths, bound source/archive/asset responses, redact credentials and private-key-like data, and avoid retries for multipart and non-idempotent create/delete requests
  • Advertise mutually exclusive text/upload/delete field variants and nested repository/base64-archive/path-archive variants so clients do not invent placeholder upload_id or archive values
  • Intentionally exclude private-repository keys, source repointing, export, bulk deletion, arbitrary themeable site-setting mutation, and generic controller pass-through

• Add a cohesive Discourse evidence and analytics layer

  • Add bounded topic-stream selection, reply relationships, latest-post feeds, post-level search, and daily topic view statistics with truthful upstream cursor and limit semantics

... (truncated)

Commits

• bacb67c FEATURE: simplify write mode opt-in (#53)
• aa14829 FEATURE: support workflow and ai toolsets (#51)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.