chore: recover release v0.0.56

[cablate]

Summary

• record the already-published npm version 0.0.56 in package metadata, server.json, and CHANGELOG
• add a manual MCP Registry publishing workflow to finish the interrupted release
• retry MCP Registry publication after npm propagation delays in future releases

Verification

• npm run build
• npm run lint (0 errors; existing warnings only)
• npm run test:unit (22 passed)
• npm test without API key (114 passed)
• workflow YAML parsed successfully

The original release run published npm 0.0.56 successfully, then MCP Registry queried npm before that version became visible. This PR completes that same version and must be merged with a commit message containing chore: release so the normal release workflow does not create 0.0.57.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate workflow and release-recovery findings remain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Recovers npm release 0.0.56 and adds more reliable MCP Registry publication.

Changes:

• Updates package metadata, server metadata, lockfile, and changelog.
• Adds registry publication retries and a manual publishing workflow.

File summaries

File	Review summary
server.json	Updates registry metadata to 0.0.56.
package.json	Updates version; moderate findings remain about the missing tag/release and squash-merge release trigger (1 and 2 votes).
package-lock.json	Synchronizes lockfile version metadata.
CHANGELOG.md	Adds 0.0.56 release notes.
.github/workflows/release.yml	Adds retries; a moderate finding remains about failed recovery after npm publication (1 vote).
.github/workflows/publish-mcp-registry.yml	Adds manual publishing; a critical finding remains regarding unpinned upstream binaries with OIDC access (1 vote).

Review details

Suppressed comments (2)

.github/workflows/release.yml:95

• If all six attempts fail, this step exits before the existing commit/tag steps below it. npm has already published the new version, while the server.json sync is only in the failed job's workspace; rerunning the release workflow will try to publish that same npm version again, and the manual workflow checking out main cannot see the uncommitted metadata needed to publish it. Persist the version/tag before this non-idempotent registry step, or make recovery resume from the already-published version.

            if [ "$attempt" -eq 6 ]; then
              echo "MCP Registry publish failed after $attempt attempts"
              exit 1
            fi

package.json:3

• Because the recovery commit is intentionally skipped by the release job, this version bump never reaches the workflow's existing git tag "v${VERSION}" and GitHub Release steps. The next release will still resolve v0.0.55 as PREV_TAG, so the 0.0.56 changes can be attributed again to 0.0.57 and v0.0.56 remains without a release tag. Please create/push the v0.0.56 tag (and corresponding GitHub release) as part of this recovery, or add a workflow path that does so.

  "version": "0.0.56",

• Files reviewed: 5/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.