Androjack MCP Server

[1.6.4] – 2026-03-18 Security HTTP session isolation — startHttpServer now accepts a factory function (() => McpServer) and creates a fresh McpServer + StreamableHTTPServerTransport instance per MCP initialize request. Shared server state across concurrent HTTP sessions is no longer possible. Fixes the session-reuse vulnerability in v1.6.3 (http-server.ts). Changed Server factory — Extracted all 21 tool registrations and the androjack_grounding_gate prompt into src/server-factory.ts. Both stdio.ts and serve.ts are now thin entrypoints that call createAndroJackServer(). Zero behavior change — same 21 tools, same tool names, same input schemas. SDK floor raised — @modelcontextprotocol/sdk declared dependency floor raised from ^1.12.1 to ^1.27.1. Installer UX — Kiro and JetBrains AI (Android Studio) now show "detected (MCP not yet configured — open the IDE once to initialize)" when the IDE is installed but its config directory has never been created, instead of silently showing "not found". (Reported by @kmayoral in issue #2.) HTTP server return type — startHttpServer() now returns { close(), address: { host, port } } for cleaner testability. Dependencies @modelcontextprotocol/sdk: ^1.12.1 → ^1.27.1