Changed

• Stop defaulting search_media's sort to SEARCH_MATCH for a term-less or whitespace query; it now browses in AniList's own order, and the term is trimmed. 53c4592
• Model get_todays_birthdays' output as a single list instead of a degenerate character | staff union. 3f2f93b
• Reword get_anime_schedule: a manga id is rejected as not-found, not silently returned as an empty schedule. 53c4a8f
• Document AniList's ~5000-entry page-depth cap on paginated connections (search, characters/staff/reviews, activity, comments). 53c4592 513da8d
• Note that donatorBadge reads "Donator" even at donatorTier 0, so it isn't a donator signal. 53c4a8f 0f483e3

Security

• Re-assert 0600 on the token store file on every write, so overwriting a looser pre-existing tokens.json re-tightens it. 53c4592
• Route the fatal startup error through redact(), closing the one stderr path that bypassed credential redaction. 53c4592

Changed

• Reject non-positive AniList IDs locally instead of sending them upstream, where such values always fail anyway. 069bbe4
• Reject negative values locally for numeric fields that can never be negative (counts, years, scores, etc.). 069bbe4 b80f321
• Model activity results as their real type-specific shape (text/list-update/message), not one object mixing every type's fields. 069bbe4
• Validate URL fields (site links, avatar/cover/banner images, the AniList API base URLs) as real http/https URLs, not just strings. 069bbe4 b80f321
• Disclose that add_list_entry/update_list_entry's advancedScores are positional — reordering categories later reinterprets written scores. 0a1aff4
• Disclose that post_thread's response omits categories/isSticky/isLocked — call get_thread afterward to confirm a change applied. 4a2a5ac
• Disclose that post_thread_comment's id and parentCommentId refer to different comments — the branded type can't tell them apart. 4a2a5ac
• Disclose that get_user_recent_activity applies no activity-type filter, same as get_user_activity. 3ce5ca3
• Disclose login_anilist's actual default redirect URI and its ANILIST_OAUTH_PORT override, needed before registering an AniList app. c194eca
• Clarify that get_recommendation's rating/vote is cast on anilist.co directly — this server has no tool to vote itself. a74780b
• Clarify get_media_reviews sorts by rating (a review's community-helpfulness vote), not score (the reviewer's own rating). 628c2df
• Confirm get_site_statistics' pageInfo.total/.lastPage are accurate here, unlike this schema's usual meaning elsewhere. e024968

Fixed

• Fix get_anime_schedule's notYetAired: false description — it swaps to a past-only result set, not an addition to upcoming ones. 628c2df
• Fix get_recommendations_for_media's description pointing to the wrong field path for mediaListEntry. a74780b

Added

• Add PRIVACY.md and SECURITY.md, linked from README.md. 768c458 3b961fe
• Add an MCPB bundle icon using AniList's real brand colors. 4317281 691f05d

Changed

• Raise the minimum supported Node.js version to ≥ 20.11.0 (was ≥ 20). 6adffb4 90c540d

Fixed

• Ship PRIVACY.md in the published npm package — it was missing from package.json's files allowlist. 3342e6c
• Ship SECURITY.md in the published npm package too — README links to it the same way it links to PRIVACY.md, but it was missing from the same files allowlist. 6cf0271
• Exclude dev-only contributor tooling and glama.json from the .mcpb bundle. 1fed97a dd29f14
• Point README.md's docs/ links at absolute GitHub URLs so they still resolve from inside an installed .mcpb extension, which excludes docs/. a645d5b
• Relax post_thread's title/body to required only when creating — omitting either on an update keeps its existing value. c928316
• Disclose that post_thread's mediaCategories is a full replace on update, same as categories. c928316
• Fix search_activity's description and outputSchema, both of which wrongly modeled results as bare IDs — the query already returns full activity content. f1d0d61
• Disclose that get_user_activity/get_user_recent_activity error on an unknown user, unlike search_activity's own user filter, which silently returns empty. 4563fc0
• Cap get_media's ids array at 25 entries — previously unbounded, a batch of hundreds succeeded live with no cap, each entry returning full synopsis/tags/rankings. 8d9eba7
• Disclose that a majority of ids from get_recommendations_for_media 404 on get_recommendation's own lookup — a confirmed AniList-side inconsistency, not a bug in this server. 35a6226
• Correct PRIVACY.md's claim that get_notifications "does not write anything" — its markAsRead: true option resets AniList's real unread-notification badge count. c9485a4
• Correct idempotentHint to false on delete_activity/delete_thread/delete_thread_comment/remove_list_entry — each one errors, not silently succeeds, when retried on an already-deleted id. fc4fc5e
• Document that update_list_entry's customLists replaces the entry's full set of enabled lists, not merges — the same warning add_list_entry's identical field already had. 53f8351
• Document that update_list_entry's hiddenFromStatusLists still counts the entry in statistics — the same clause add_list_entry's identical field already had. eceace6
• Document that post_thread's sticky is confirmed live to silently no-op for a non-mod account, matching locked's existing wording (both were verified together). eceace6
• Document that search_media's onList silently no-ops when not logged in, matching get_recommendations_for_media's excludeInList. ad6d8a7
• Fix update_user's notificationOptions/disabledListActivity to reject a duplicated type, not just check full coverage — a duplicate-plus-full array previously passed silently. 2cfa0fe
• Document that get_studio's name already does AniList's own fuzzy search, so a partial name resolves directly without needing search_studio first. 995e071
• Reject a manga id in get_anime_schedule instead of silently returning an empty schedule; also stop discarding hasNextPage from its output. a3c7664
• Type get_recommendation/get_recommendations_for_media's rating/userRating fields per AniList's actual schema (a plain int and a real 3-value enum), not generic number/string. 9bf34b5
• Reject post_thread calls that omit categories when creating a new thread, matching AniList's own mutation requirement, instead of surfacing an upstream error. 67ec0fc
• Correct update_user's stale claim that disabledListActivity can leave a mutation non-atomic — that trigger is now blocked client-side before any request is sent. 3784af2
• Narrow get_authorized_user's claim that advancedScoring is full-replace like customLists — only customLists is confirmed that way. 3784af2
• Clarify login_anilist's auto_capture only reflects whether this server could bind a local port, not whether the browser is actually local. 6c48045
• Document that get_user_activity returns every activity type (including received messages), not just list updates/text posts as previously stated. 39981cc
• Fix get_notifications' pageInfo output to match its actual query (only hasNextPage is ever returned). 3594f1d
• Document get_user_list's ~11,000-entry AniList-side cap. 902ccb1
• Confirm post_thread's categories is a full replace (not a merge) when set on an update. 0554ff6
• Disclose isFavourite's confirmed read-after-write staleness consistently across get_media/get_character/get_staff/get_studio — previously only get_media had it. 76196f0
• Add get_media's missing mediaListEntry output disclosure, matching get_recommendations_for_media's existing one. 76196f0

Security

• Harden log redaction to also strip JSON-style credentials ("client_secret":"..."), matching the OAuth token exchange's actual request body shape. 0a70a08

Added

• Add an hour-long public cache hint to tools/list/prompts/list/server/discover for 2026-07-28-era clients.
  Safe because every tool/prompt here registers unconditionally, with no runtime/auth-dependent branching. 482bb10
• Add AniList-schema-sourced length/format limits to mutation tool inputs, rejecting invalid values locally instead of an upstream round trip. 307321d

Changed

• Bump @modelcontextprotocol/server/client to the first stable 2.0.0 (from 2.0.0-beta.5).
  No breaking changes — the only two behavior changes since beta.5 don't affect this stdio-only server. 036788f
• Move get_studio's id/name check into its Zod schema — same core message, now wrapped in the SDK's validation-error prefix. 307321d
• Document that update_user's profileColor silently ignores bad values, while rowOrder/timezone reject them with a clear error (confirmed live). 307321d

Everything below is one commit: 48049f6.

Added

• Add pageInfo.lastPage to get_media_tags's response — computed client-side, so unlike AniList-paginated tools it's accurate, not degraded.

Changed

• BREAKING: Rename tools favourite → toggle_favourite and follow_user → toggle_follow_user, matching this server's verb+resource naming.
  Update any pinned tool names in your own configs/prompts.
• Document that update_user's customLists replaces the whole array rather than merging by name.
  Omitting an existing list silently deletes it.
• Document that add_list_entry upserts by media ID rather than always creating a fresh entry.
  Unset fields (including status) keep their previous value on an existing entry, not a new-entry default.
• Document that add_list_entry/update_list_entry's customLists replaces an entry's full set of enabled lists, not merges.
  Naming only a subset silently un-tags every list left out.
• Document a third update_user full-replace exception: customLists, alongside notificationOptions/disabledListActivity.
• Document that reordering/renaming advancedScoring categories silently reinterprets already-stored per-category scores.
• Document that get_user_stats/get_full_user_info statistics can lag behind an account's real list state (AniList's own aggregation).
• Document that post_message_activity is always public — AniList's mutation accepts a private argument this tool doesn't expose.
• Document search_activity's asymmetric user validation: unknown username errors, unknown numeric ID silently returns empty.
• Document that search_thread's categoryId/mediaCategoryId silently filter to an empty result on an unknown ID.
• Document that search_media's genres/tag_in silently filter to no results on an unrecognized name, matching format_in.
• Document that get_user_recent_activity returns full activity content, not just IDs.
• Document that update_user's notificationOptions/disabledListActivity entries require an explicit enabled/disabled value.
  Omitting it writes null on notificationOptions, but fails the whole call with a 500 on disabledListActivity (confirmed live).
• Document that search_user points to specific downstream tools (profile, stats, list, follow), not a generic "profile/list tools."
• Document that get_media_characters/get_media_staff request no explicit ordering, unlike get_character/get_staff's popularity sort.
• Document that get_anime_schedule returns results soonest-airing first.
• Document get_recommendations_for_media's mediaListEntry login-gating, and add its missing pageInfo.hasNextPage to the output schema.

Added

• Add page/perPage pagination to get_site_statistics (previously fixed to the last 7 days); AniList caps perPage at 25 regardless of input. 4af0916

Changed

• Halve get_thread_comments's network round-trips for a given threadId by combining the not-found existence check into the same request as the real query, instead of a separate one. 4268f5f
• Add missing destructiveHint/idempotentHint/openWorldHint MCP tool annotations across write tools, for accurate client-side risk hints. ff469f6
• Document that get_studio's returned titles cap at 10 and get_todays_birthdays's results cap at 50 — both fixed, unpaginated limits. ff469f6
• Document that favourite returns the account's entire current favourites across all 5 categories, not just the toggled item. ff469f6
• Document that get_user_activity doesn't filter by activity type, cross-referencing search_activity for that. ff469f6

Changed

• Rename search_activity's userId parameter to user, accepting a username too — the old name was silently ignored, falling back to the unfiltered global feed instead of erroring. f2b28bd
• Document that delete_activity/delete_thread/delete_thread_comment/remove_list_entry error on an already-deleted id instead of silently succeeding. 8fa063c
• Document that add_list_entry/update_list_entry's advancedScores errors when advanced scoring is disabled or a category name doesn't match. 8fa063c

Fixed

• Surface the real upstream error detail for 5xx/network/timeout/rate-limit/not-modified tool errors instead of a generic message. 2c2fe8b
• Fix get_media's ids and every user-scoped tool's user parameter wrongly saying "is required" for a present-but-wrongly-typed value. 189c21a

Changed

• Halve get_anime_schedule/get_user_activity's network round-trips for a given mediaId or numeric user ID by combining the not-found existence check into the same request as the real query, instead of a separate one. aacfa8b

Fixed

• Fix get_user_activity silently returning an empty activity list for a nonexistent numeric user ID instead of an error, unlike its existing username path. 33a0262
• Fix get_anime_schedule silently returning an empty schedule for a nonexistent mediaId instead of an error. 33a0262
• Fix several single-ID tools (get_activity, get_character, get_staff, get_studio, get_recommendation, get_recommendations_for_media, get_thread, get_media_statistics, get_media_characters, get_media_staff, get_media_reviews, get_media_relations) crashing or silently returning invalid output for a nonexistent ID — they now return a clean not-found error instead. 58ee542
• Fix get_media silently dropping array ids that don't resolve to a real title — it now fills null in that position instead, keeping the result the same length as ids. 58ee542
• Fix get_thread_comments returning a misleadingly-empty success for a nonexistent threadId instead of an error. 58ee542
• Fix not-found tool errors discarding their specific detail (e.g. which ID was invalid) behind a generic "(404)" message. 58ee542
• Fix a 403 error always blaming the authenticated account's permissions, even when it's actually an unrelated upstream security block (e.g. a WAF rejecting unusual request content). 58ee542
• Fix inline GraphQL errors always being classified as a generic bad request, even when AniList embeds a specific status (e.g. 404/401) in the response. 58ee542
• Reject add_list_entry/update_list_entry's advancedScores values outside the documented 0-10 scale, instead of accepting e.g. 15 silently. 58ee542
• Give a clear validation message for get_media's ids and every user-scoped tool's user parameter when missing/malformed, instead of a generic Zod error. 58ee542
• Clarify get_user_profile/get_full_user_info's description: the account settings they return (notifications, list display, etc.) aren't restricted to the caller's own account — AniList returns them for any user looked up. 58ee542
• Clarify favourite's description: AniList doesn't validate that id actually belongs to the given kind — a mismatched pair silently succeeds instead of erroring. 58ee542
• Fix the seasonal_overview prompt ignoring season/year when only one of the two was given, instead of treating them as the independent filters search_media actually supports. 58ee542

Everything below is one commit: 0a537f7.

Added

• Add tag_in, onList, averageScore/popularity/episodes range filters, startDate/endDate range filters, and source_in to search_media.
• Add includeDescription to search_media, returning each result's full synopsis on request (kept off by default — up to 25 results per call).
• Return media/staffMedia filmography (with characterRole/staffRole) from get_character/get_staff.
• Add includeBody to get_media_reviews, returning each review's full text on request (kept off by default — it can be long).
• Return nextAiringEpisode, externalLinks, and (login required) mediaListEntry from get_media; add includeStreamingEpisodes for streamingEpisodes (kept off by default — AniList doesn't paginate this field, so long-running titles can return hundreds of entries).
• Return replyCount/likeCount/isLiked from activity tools, and replyCount/viewCount/likeCount/isLiked from thread/comment tools.
• Add airingNotifications, profileColor, donatorBadge, timezone, activityMergeTime, staffNameLanguage, and restrictMessagesToFollowing to update_user.
• Add rowOrder to update_user, readable back via mediaListOptions.rowOrder.
• Add notificationOptions to update_user — requires all 20 notification types every call, since AniList replaces the entire list rather than merging a partial one.
• Add disabledListActivity to update_user — requires all 6 list statuses every call; AniList rejects a partial list.
• Add animeListOptions/mangaListOptions to update_user (advanced scoring, custom lists, list display settings, and theme) — previously not settable at all; theme's AniList read-back is an untyped, deprecated value, not guaranteed to match what was set.
• Add hiddenFromStatusLists to add_list_entry/update_list_entry, and return it from get_user_list.
• Return isSticky, isLocked, mediaCategories, and childComments from the thread read tools, so a post_thread/post_thread_comment call can actually be verified.
• Return account preferences (options, mediaListOptions) from the user-profile tools and from update_user's own response, so a settings change can actually be verified.
• Return customLists and advancedScores from get_user_list — previously set via add_list_entry/update_list_entry but unreadable.

Fixed

• Stop search_thread from treating an empty/whitespace term differently from an omitted one (same fix already applied to search_media).
• Clear the read cache after every successful mutation — a read immediately after a write could otherwise serve stale pre-mutation data for up to CACHE_TTL_MS.
• Correct add_list_entry's description: AniList defaults an entry with no status to CURRENT (with startedAt set to today), not PLANNING.
• Clarify that search_media's season/seasonYear each work standalone (e.g. every Summer across all years) — the previous "pair with X" wording implied they're only meaningful together.
• Give submit_anilist_redirect a clean, actionable message when the OAuth redirect denied access or had no code, instead of a generic "Unexpected error".
• Reject add_list_entry/update_list_entry's advancedScores when advancedScoringEnabled is false, instead of only checking that a category list exists.
• Fix get_notifications' ACTIVITY_MESSAGE items always coming back with an empty message: AniList nests the DM text one level inside message.message, not directly on message.
• Add the 3 stylised variants (ROMAJI_STYLISED, ENGLISH_STYLISED, NATIVE_STYLISED) to update_user's titleLanguage — the enum only listed half of AniList's actual options.
• Fix get_media with an array of ids returning results sorted by AniList's own default order instead of the input order the tool's own description promises — confirmed live ([154587, 21] came back as [21, 154587]).
• Stop get_media_tags' description from claiming search_media can't filter by tag — it now can (tag_in, added this same release).

Changed

• Bump @modelcontextprotocol/server to 2.0.0-beta.5 (from beta.4).

Everything below is one commit: 194c7d3.

Added

• Add search_thread, post_thread, post_thread_comment, and delete_thread_comment — forum threads were previously read/delete-only.

Fixed

• Stop every pageInfo field (total, perPage, currentPage, lastPage, hasNextPage) from failing output validation when AniList returns null for it instead of omitting it — confirmed live on an emptied thread's comment page.