# Changelog

All notable changes to this project are documented here. This project adheres to
[Semantic Versioning](https://semver.org/spec/v2.0.0.html) and the
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format. Per-package
changelogs are managed by [changesets](https://github.com/changesets/changesets).

## [Unreleased]

### Changed
- **BREAKING (local default): the stdio server is now read-only by default.** Previously
  `npx @tidbcloud-mcp/server` armed every destructive tool (20 tools, including
  `tidb_delete_cluster`) with no flag. It now starts with 12 read-only tools. Writes are opt-in at
  startup: `--allow-write` adds `tidb_execute` (13 tools), `--allow-admin` adds the cluster,
  branch, and SQL-user mutators (20 tools). `--read-only` wins if both are passed;
  `--allow-admin` implies `--allow-write`. Env equivalents: `TIDB_MCP_ALLOW_WRITE`,
  `TIDB_MCP_ALLOW_ADMIN`.

  Rationale: preflight and `confirmTarget` are filled in by the model, not the human, so they
  are a consistency check rather than an authorization boundary. Our model-in-the-loop evals
  showed a model issuing a delete with `confirm: true` on its first turn, unprompted. A startup
  flag is a real human boundary. This also aligns the local default with the remote endpoint,
  which was already read-only by default.

  No deprecation path: nothing is published to npm yet. To restore the old behavior, pass
  `--allow-admin`.

### Added
- Phase 0 foundation: pnpm monorepo, TypeScript (strict), ESLint + Prettier, Vitest,
  changesets, and CI. Apache-2.0 licensed from the first commit.