# Changelog What changed in JustClaw-It MCP, newest first. ## 2026-11-05 - **Advisories for the libraries a component imports.** `get_component` reports, per imported npm, PyPI, Go or Rust library, how many OSV advisories it has, the worst severity and whether its current release is affected; `check_component_security` checks exact `packages` versions. Pro gets the full advisory detail and an `exclude_vulnerable` search filter ([security advisories](/docs/security-advisories)). - **Error codes and cost on every call.** Refusals and errors now carry a stable code with a retry hint (`error_info` next to the old `error` field, which stays unchanged until 2027-02-03), and every tool result reports `credits_charged`, `credits_refunded`, your `balance` and a `request_id` in its MCP `_meta` ([error codes](/docs/errors)). - **Lockfile licence report (rolling out, not yet on for every account).** The `licence_report` tool reads `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `poetry.lock`, `uv.lock`, `requirements.txt`, `go.mod`/`go.sum` and `Cargo.lock` and returns each dependency's licence class and whether it is sellable as closed source. The summary is free; CycloneDX, SPDX and NOTICE documents cost 5 credits each. Files are processed in memory and never stored ([Lockfile licence report](/docs/licence-report)). - **Batch requests are refused up front.** A JSON-RPC batch (several messages in one POST) is refused with `batch_not_supported` before anything is charged; it used to be charged and then rejected. ## 2026-11-01 - **Sign in with JustClaw-It.** Claude.ai, ChatGPT and other OAuth-capable MCP clients can connect with your account instead of an API key: add `https://justclaw.it.com/mcp/signin` as a connector, sign in by email link (new addresses get a free account) and approve the app on a consent screen. Connected apps use your plan and credits and can be disconnected at [/account](/account#apps) ([Claude.ai](/docs/clients/claude-ai), [ChatGPT](/docs/clients/chatgpt)). - **Free-tier copy.** Pricing and docs now say it plainly: free search, and up to 300 free pulls a month plus 30 on signup. Limits are unchanged. - **`find_similar` works on the public library.** It used to return an empty list behind the licence gate. It now finds neighbours through the same licence-cleared search as `search_components` (still 0 credits), and leaves out the component you asked about. - **Severity on security advisories.** Advisories now come with OSV severity (critical, high, moderate, low) and fixed versions where OSV has them, and the weekly check now covers every public repository in the library (about 500 had advisories when it shipped, up from about 100). `check_component_security` and the `security` object on pulls show them ([Security advisories](/docs/security-advisories)). - **Support desk.** Contact us from [/support](/support). When you write while signed in, the conversation also appears on your [account page](/account). - **Your account page helps you get going.** A short set-up checklist (key, connect, search, pull) until you've used it, a prompt to try today, a link back to your last search, and daily component picks based on what you've pulled. - **Smoother sign-in.** Confirming your signup signs you in straight away. A sign-in link opened on a different device or browser asks you to confirm first ("Sign in on this device?"), so a forwarded link can't sign someone else in. - **Faster pages and category search.** Pages are compressed and cached (the home page HTML is about a third of its old size), and `search_components` with a `category` and the [browse](/browse) pages answer faster. - **Takedowns apply within minutes.** When a component is removed from the public library, it drops out of search, browse and pulls within minutes. - **Honest scoring copy.** The home page no longer calls every component "quality-scored". It states how much of the library has a model-graded review and says the rest carry a static baseline score ([Scores & ranking](/docs/scores)). ## 2026-10-31 - **MCP prompts.** 4 slash-command recipes: `add-feature`, `licence-check`, `starter` and `find-alternative`. Each names the tools it calls and what they cost. Free, no key needed ([MCP prompts](/docs/prompts)). - **Skill + agent pack.** The `justclaw-it` skill and the component-scout, licence-auditor and integrator agents for Claude Code, plus an `AGENTS.md` section for Codex and others: `curl -fsSL https://justclaw-it.com/pack.sh | sh` ([Skill + agent pack](/docs/agents-pack)). Also served as MCP resources. - **Security checks.** New free tool `check_component_security`; pulls with advisories carry a `security` object with links; your account page lists pulled components whose repository has advisories ([Security advisories](/docs/security-advisories)). ## 2026-10-30 - **Search without a key.** `https://justclaw.it.com/mcp` answers `search_components` with no key at all, with a small per-network limit (5 a minute, 50 a day), so you can try JustClaw-It before signing up. Every other tool still needs a free key. - **Clearer tool descriptions.** Every tool now states its credit cost, parameters, what it returns and an example, and is marked read-only for clients that show tool annotations. ## 2026-10-27 - **Self-serve billing.** Cancel, update your card and see invoices from **Manage billing / Cancel** on your [account page](/account#billing). Sales tax is added at checkout where it applies (currently Texas). - **Docs and blog.** New documentation with a page per client and per topic, every page available as Markdown (add `.md`), a "Copy page as Markdown" button, [/llms.txt](/llms.txt), [/llms-full.txt](/llms-full.txt), and a [blog](/blog) with an [RSS feed](/blog/rss.xml). - **Free search, paid pulls.** `search_components`, `find_similar`, `list_categories`, `library_stats` and `list_licenses` now cost 0 credits. `get_component` stays at 1 credit. Searches are rate-limited per key and per network ([limits](/docs/credits#search-limits)). - **Filters in the database.** `language`, `license` and `min_composite` filters now run inside the search query, so filtered searches return full pages and paging goes deeper (up to offset 450). - **MCP App view.** Hosts that support MCP Apps show results and components in an interactive view ([MCP App view](/docs/mcp-app)). - **Security advisories and reputation tiebreaker.** Results from repositories named in published CVE/GHSA advisories carry a `security_advisories` warning, kept out of the ranking. A small positive-only reputation signal breaks ties between well-known repositories ([Scores & ranking](/docs/scores)). - **No overage on any plan.** Every plan is a hard cap; when credits run out, pulls stop until the next refill or an upgrade. - **Legal pages final.** [Terms](/terms), [privacy](/privacy) and [refund policy](/refund) are final. JustClaw-It is a DBA of Two7 Design LLC; the terms are governed by Texas law. ## 2026-10-25 - **Paid plans.** Solo, Indie and Pro subscriptions with Stripe checkout; [pricing](/pricing) shows live plans. - **JustClaw-It name.** The service, the MCP server entry (`justclaw-it`) and the skills now use the JustClaw-It name; the installer migrates older entries. - **Status page.** [/status](/status) and [/status.json](/status.json). - **Free-tier protection.** Signup checks and per-network limits to keep the free tier usable for real people. ## 2026-10-24 - **Pro tools.** `get_component_bundle` (3 credits) and `compose_starter` (10 credits). - **Multiple keys on Pro** (up to 3). ## 2026-10-21 - **Licence gate.** The public library only serves permissive and weak-copyleft code. Every result carries an attribution block, returned source starts with an attribution header, and [/licenses](/licenses) lists every source repository.