Back to Browse

Release Notes MCP Server

Developer ToolsLow Risk8.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

A small, generic MCP server for combining GitHub/GitLab/Gitea releases into product release notes

About

A small, generic MCP server for combining GitHub/GitLab/Gitea releases into product release notes

Security Report

8.2
Low Risk8.2Low Risk

A well-designed MCP server for aggregating release notes with proper security practices. Authentication is correctly delegated to environment variables, permissions are appropriately scoped to configured repositories, and input validation prevents unauthorized access. Minor code quality suggestions exist (exception handling specificity, logging) but do not present security risks. Package verification found 1 issue.

4 files analyzed · 4 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

What You'll Need

Set these up before or after installing:

Config (repos + contextSources) as inline JSON, e.g. {"repos":["myorg/web"],"contextSources":[]}. Use this for uvx/hub launches with no file to mount. Either this or RELEASE_MCP_CONFIG is required.Optional

Environment variable: RELEASE_MCP_CONFIG_JSON

Absolute path to a config.json file (alternative to RELEASE_MCP_CONFIG_JSON). Used when mounting a real file, e.g. in Docker.Optional

Environment variable: RELEASE_MCP_CONFIG

Auth token for the provider (GitHub PAT / GitLab / Gitea token). Optional for public repos.Required

Environment variable: TOKEN

Forge to read releases from: github | gitlab | gitea. Defaults to github.Optional

Environment variable: PROVIDER

API base URL — only for self-hosted GitLab or Gitea/Forgejo.Optional

Environment variable: BASE_URL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-vaggeliskls-release-notes-mcp": {
      "env": {
        "TOKEN": "your-token-here",
        "BASE_URL": "your-base-url-here",
        "PROVIDER": "your-provider-here",
        "RELEASE_MCP_CONFIG": "your-release-mcp-config-here",
        "RELEASE_MCP_CONFIG_JSON": "your-release-mcp-config-json-here"
      },
      "args": [
        "release-notes-mcp"
      ],
      "command": "uvx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

release-notes-mcp

A small, generic MCP server that combines GitHub releases from several repositories into a single product release note. The server just fetches and bundles raw data; the LLM synthesizes the final notes.

Nothing is architecture-specific:

  • provider — which forge to read releases from: github (default), gitlab, or gitea/Forgejo. Release fetching goes through a small adapter, so adding a forge means normalizing its release JSON — a contained change.
  • repos — the repos the server is allowed to read releases from.
  • contextSources — arbitrary URLs loaded as background context (a style guide, a versions file, feature names — anything). The server assigns no meaning; what each source is is decided by what you put behind the URL.

Configuration

Config holds no secrets — only the repo set and context. Provider and auth come from the environment.

// config.json — non-sensitive (required; the server errors if it's missing)
{
  "repos": [
    "myorg/auth-service",
    "myorg/web"
  ],
  "contextSources": [
    {
      "name": "release-info",
      "url": "https://example.github.io/whatever/release.json",
      "description": "Extra context to consult when assembling release notes"
    }
  ]
}

Environment (provider-agnostic, set in .env or your shell):

VarPurposeDefault
TOKENAuth token for the provider — never in config(empty; ok for public repos)
PROVIDERgithub | gitlab | gitea (overrides config)github
BASE_URLAPI base — only for self-hosted GitLab / Giteaprovider default
  • format on a context source is optional — auto-detected from Content-Type / URL extension / content sniffing. Override only when wrong.

Token permissions

The server only ever reads releases (GET /repos/{owner}/{repo}/releases…), so give TOKEN the minimum read scope — never write access.

ProviderPublic reposPrivate repos
GitHub — fine-grained PATno token neededContents: Read-only (releases live under Contents), for each repo you list
GitHub — classic PATno token needed (or public_repo)repo scope
GitLabno token neededread_api scope
Gitea / Forgejono token neededread:repository scope

For GitHub, a fine-grained PAT scoped to just the repos in config.json with Contents → Read-only is the tightest setup and is all this server requires.

The config (repos + contextSources) must come from one of two places — the server errors on startup if neither is set:

SourceUse it for
RELEASE_MCP_CONFIG_JSONThe config as inline JSON. No file needed — ideal for uvx / MCP hubs where everything is an env var.
RELEASE_MCP_CONFIGPath to a config.json file (default ./config.json). Used by the container, which mounts a real file.

Inline JSON wins when both are set. Copy config.example.json to get started with the file approach.

Tools

ToolPurpose
list_repos()The configured repos
list_releases(repo, limit)Recent releases for one repo
get_latest_version(repo)Newest release for one repo
get_release(repo, tag)Full notes for one tag
compare_releases(repo, from_tag, to_tag)All releases between two versions
gather_release_notes(selections[])Bundle raw notes from N (repo, tag) pairs (concurrent)
get_context(name?)Load configured context URLs (auto-detected format)

Selection is dynamic — you (or Claude) pass the (repo, tag) pairs to combine. The server's instructions tell Claude to call get_context() first.

Run

The server runs in a container over HTTP transport on localhost:8000. First create the config and env files (both runs need them):

cp config.example.json config.json   # edit repos + contextSources (no secrets)
cp .env.example .env                  # set TOKEN (+ PROVIDER / BASE_URL if needed)

Normal run

docker compose up -d

Local development — docker compose watch

For local dev, docker compose watch keeps the server live while you edit:

docker compose watch
ChangeAction
server.pysync + restart — copied into the container, process restarts
requirements.txt, Dockerfilerebuild — image is rebuilt automatically
config.jsonbind-mounted (live); run docker compose restart to reload it

Run with uvx (no clone, no container)

The server is published to PyPI, so a client can launch it on demand with uvx — no checkout and no Docker:

uvx release-notes-mcp

uvx talks to the server over stdio (the default transport). Since there's no file to mount, pass the config inline as JSON via RELEASE_MCP_CONFIG_JSON (everything is env-only — ideal for MCP hubs):

RELEASE_MCP_CONFIG_JSON='{"repos":["myorg/web"],"contextSources":[]}' \
  TOKEN=ghp_... uvx release-notes-mcp

Prefer a file? Point RELEASE_MCP_CONFIG at an absolute path instead (uvx runs from an unknown working directory, so a relative path won't resolve):

RELEASE_MCP_CONFIG=/abs/path/config.json TOKEN=ghp_... uvx release-notes-mcp

Register with Claude Code

HTTP (container) — point Claude Code at the running server by its URL:

claude mcp add --transport http release-notes http://localhost:8000/mcp

stdio (uvx) — let Claude Code launch the server as a subprocess:

claude mcp add release-notes \
  --env RELEASE_MCP_CONFIG=/abs/path/config.json \
  --env TOKEN=ghp_... \
  -- uvx release-notes-mcp

Then ask Claude: "Combine the latest releases of auth-service and web into a product release note."

Reviews

No reviews yet

Be the first to review this server!