Skip to main content
Connect your client

Changelog

Releases, incidents, security advisories, and compliance notices for the gotcontext.ai platform — covering the public API, Web Dashboard, MCP Gateway, and SDKs. Every entry carries severity, affected components, and a clear customer-action flag.

Filters

Interactive filtering ships with /security and /incidents in the next release. The full feed is below.

Surface:APIWebMCP GatewayPython SDKClaude Code Plugin
Type:FeatureImprovementBug fixSecurity advisoryIncidentCompliance noticeBreaking changeDeprecation

Latest releases

API v1.52.2permalink
Bug fixLowMCP GatewayAction required: No

gc_lookup: Tailwind CSS false-positive fixed; reingest cron no longer re-stages completed frameworks

gc_lookup was misclassifying Tailwind CSS class strings as markup and refusing to embed them, causing the Tailwind CSS framework docs to return zero results. Separately, the gc_lookup reingest cron was re-staging already-complete frameworks every run.

Show details ▾
  • The markup-detection filter now requires multiple HTML/JSX-style tag structures before classifying a chunk as markup; single utility-class names no longer trigger the filter.
  • The reingest cron now skips frameworks that have already completed ingestion, preventing redundant re-staging on every hourly run.
API v1.52.1 / Web v1.43.1permalink
FeatureInformationalAPIWebAction required: No

One-tap "send test notification" to verify push is wired

After enabling web push, users can immediately verify their device receives notifications. A button in the notification settings calls POST /v1/push/test, which sends a real push event to every active subscription for the account.

Show details ▾
  • POST /v1/push/test delivers a real push message to all active subscriptions for the authenticated user.
  • Response includes the number of notifications sent and a status of "ok", "no_subscriptions", or "push_disabled".
  • Returns push_disabled when the server is not configured for push (self-hosted operators who skipped PWA setup).
API v1.52.0 / Web v1.43.0permalink
FeatureInformationalAPIWebAction required: No

Web push notifications — phone alerts for replies and follows

gotcontext.ai is now an installable PWA with opt-in push notifications. Users who add the app to their home screen can receive native push alerts when someone replies to their comment or follows their profile.

Show details ▾
  • POST /v1/push/subscribe registers a device for push notifications for the authenticated user.
  • DELETE /v1/push/subscribe removes a device subscription (idempotent).
  • GET /v1/push/vapid-public-key returns the server's push public key — public, no auth required.
  • A service worker handles push receipt and notification display in the background.
API v1.51.1permalink
FeatureInformationalMCP GatewayAction required: No

Session-aware result deduplication for gc_lookup and search_semantic

When an agent calls gc_lookup or search_semantic multiple times in a session, results that were already returned in an earlier call are now filtered out automatically. This prevents the same chunk from occupying agent context window space twice across consecutive tool calls.

Show details ▾
  • Each MCP session tracks which results have already been returned; subsequent calls to the same tool skip previously-seen chunks.
  • Pass dedup=false to disable per-call (useful when an agent intentionally re-reads a chunk).
  • If the session store is unavailable the tool returns results without dedup rather than failing.
API v1.51.0permalink
FeatureInformationalAPIMCP GatewayPython SDKAction required: No

compress_tool_output — compress CLI and MCP tool output before re-feeding it

A new Pro-tier MCP tool and REST endpoint that strips ANSI codes, collapses repeated blank lines, elides stack-trace padding, and removes identical-line runs from CLI or tool output. An identifier footer is appended so models can distinguish compressed output from original text.

Show details ▾
  • POST /v1/compress/tool-output accepts { output, tool_name? } and returns the standard CompressResponse shape.
  • Strips ANSI codes, collapses blank lines, elides stack-trace padding, and removes repeated identical lines.
  • An identifier footer is appended so models can distinguish compressed output from original text.
  • Python SDK 0.6.1 adds client.compress_tool_output(output, tool_name=None).
  • Pro plan required; Free plan returns 403.
API v1.50.31permalink
ImprovementInformationalAPIAction required: No

CompressResponse now includes a note field for inputs too small to benefit

POST /v1/compress now returns a non-null note string when the input is under ~200 tokens — the threshold where compression overhead exceeds the savings. Previously the API returned a negative savings_pct with no explanation.

Show details ▾
  • note is null for normal inputs (≥200 tokens).
  • For small inputs note reads "Input is too short for meaningful compression. Paste 200+ tokens for real savings."
  • savings_pct continues to be returned accurately (may be negative for small inputs); the note provides the human-readable context.
API v1.50.30permalink
InternalInformationalAPIAction required: No

Fixed order-dependent test flake in MCP tool catalog tests

An order-sensitive test was mutating the MCP tool catalog without restoring it, causing intermittent failures when tests ran in a different order. No behavior change in production.

Show details ▾
  • Test isolation for the MCP tool catalog is now enforced regardless of test execution order.
API v1.50.29permalink
FeatureInformationalAPIAction required: No

Resend bounce and spam-complaint webhooks auto-set email opt-out

Hard bounces and spam complaints received from Resend now automatically set users.email_opt_out = True for the affected address, preventing future sends and closing a CAN-SPAM compliance gap.

Show details ▾
  • Hard bounces and spam complaints from the email provider now automatically opt affected addresses out of future sends.
  • Soft bounces, delivery confirmations, opens, and clicks are logged and ignored.
  • Webhook signatures are verified before processing; a durable audit record is written for every opt-out change.
API v1.50.28permalink
FeatureInformationalAPIWebAction required: No

Follow users — social graph with follow/unfollow + in-app notifications

Users can now follow each other. Following a user triggers an in-app notification for the target. The dashboard shows follower and following counts on profile pages.

Show details ▾
  • Follow and unfollow are both idempotent — repeating either action is a no-op.
  • GET /v1/users/{username}/follow-status returns whether you follow them plus their follower and following counts.
  • Attempting to follow yourself returns an error.
API v1.50.27permalink
FeatureInformationalAPIWebAction required: No

User activity timeline and in-app reply notifications

A new activity feed and notification store lets users track replies, follows, and system events. The dashboard shows an unread badge on the notifications bell.

Show details ▾
  • GET /v1/activity returns a merged chronological timeline of comments and notifications.
  • GET /v1/activity/notifications returns notifications only with an unread count.
  • Mark individual notifications or all notifications read via dedicated endpoints.
API v1.50.26permalink
FeatureInformationalAPIWebAction required: No

Content flagging and admin moderation queue

Users can flag comments, benchmark submissions, and news articles for review. Flagged content surfaces in a new /dashboard/admin/moderation queue for admins.

Show details ▾
  • POST /v1/content/report accepts { content_type, content_id, reason }.
  • Admin moderation queue shows all pending reports across content types with approve/dismiss actions.
  • Reporting your own content returns 400.
API v1.50.25permalink
FeatureInformationalAPIWebAction required: No

Benchmark comments and source attribution fields

Benchmark submissions now accept source_url and source_label fields for citing original research. Comment threads are now available on benchmark detail pages.

Show details ▾
  • Benchmark submissions now accept source_url and source_label fields for citing original research.
  • Comment threads are now available on benchmark detail pages.
  • Existing benchmark submissions without a source show no citation badge.
API v1.50.24permalink
FeatureInformationalAPIWebAction required: No

Pro plan badges and user avatar upload

Pro and above subscribers now display a Pro badge next to their username in comments and on profile pages. All users can upload a custom avatar (48 emoji options or image URL).

Show details ▾
  • PATCH /v1/account/avatar accepts an image URL or one of 48 supported emoji characters.
  • GET /v1/account/avatar returns the current avatar configuration.
  • Pro badge is displayed alongside the username based on the account's active plan.
API v1.50.21permalink
FeatureInformationalAPIWebAction required: No

Admin price-audit monitor — weekly drift detection for model pricing

A new admin endpoint and dashboard surface shows detected drift between gotcontext's internal model-pricing catalog and live provider pricing. A weekly GitHub Actions cron runs the audit automatically.

Show details ▾
  • GET /v1/admin/price-audit returns a list of models with detected pricing drift vs the latest published rates.
  • Dashboard shows drift alerts with the model name, current cataloged rate, and detected rate.
  • Audit runs weekly automatically; detected drift generates an alert rather than blocking deploys.
API v1.50.20permalink
Bug fixMediumAPIWebAction required: No

Knowledge Hub: phantom "Indexing did not complete" + manual reindex endpoint

Knowledge Hub items that failed mid-embedding could get stuck in an INGESTING state, displaying a permanent "Indexing did not complete" banner in the dashboard with no recovery path. A new reindex endpoint lets users manually re-trigger ingestion.

Show details ▾
  • POST /v1/projects/{id}/knowledge/items/{item_id}/reindex resets a stuck or failed item and queues it for re-embedding.
  • The background indexing job now also automatically clears items that have been stuck in the indexing state for over 30 minutes.
API v1.50.19permalink
FeatureInformationalAPIWebAction required: No

Forum moderation system — content reports, mod actions, user silencing

A full moderation layer for the community feed: users can report comments, admins can act on reports, and repeat offenders can be silenced.

Show details ▾
  • Users can submit reports on comments for admin review.
  • Admin endpoints support listing reports, resolving reports, viewing moderation history, and silencing or unsilencing users.
API v1.50.18permalink
FeatureInformationalAPIWebAction required: No

Rich comments — Markdown, hyperlinks, edit, and delete

Community feed comments now support Markdown formatting and hyperlinks. Comment authors can edit (with an "edited" timestamp) or delete their own comments.

Show details ▾
  • Comment authors can edit their comment; edited comments display an "edited" timestamp.
  • Comment authors can delete their comment; deleted comments are replaced with "[deleted]".
  • Markdown content is sanitized server-side.
API v1.50.17permalink
FeatureInformationalAPIWebAction required: No

Real usernames — choose a handle for community posts

Users can now set a unique username (handle) used in community feed comments and profile links. Existing users' display names remain their account full name until they set a handle.

Show details ▾
  • GET /v1/account/username returns the current username or null.
  • PATCH /v1/account/username accepts a username of 3–32 alphanumeric characters or underscores; returns 409 on conflict.
  • Comment responses now include the author's username for display alongside their display name.
API v1.50.14permalink
Bug fixLowAPIAction required: No

Polar metering errors now surface in error monitoring

Failures in the Polar metering path were logged at a low severity level, making them invisible in error monitoring. They are now reported at error severity so they appear in alerts automatically.

Show details ▾
  • Billing metering failures now surface in error monitoring within the normal alert window.
  • No behavior change for successful meter calls.
API v1.50.13permalink
Bug fixMediumAPIAction required: No

Billing writes: usage-tracking now completes before response is returned

Usage-tracking writes in the billing path were dispatched as fire-and-forget background tasks and could be lost before completing during server suspend. They are now completed inline before the response is returned.

Show details ▾
  • Usage-tracking writes are now guaranteed to complete before the response is returned.
  • No latency regression — the write path completes well within normal response time.
API v1.50.12permalink
FeatureInformationalAPIAction required: No

Automated weekly model-price audit

A new automated job runs weekly to detect drift between the internal model-pricing catalog and published provider rates. Detected drift generates an alert.

Show details ▾
  • The audit compares cataloged model rates against current provider pricing pages.
  • Runs weekly automatically.
  • Drift beyond 5% of any rate triggers an alert.
API v1.50.11permalink
Bug fixMediumAPIAction required: No

Model catalog: Gemini 3.1 Pro and Haiku 4.5 pricing corrected; gemini-3.5-flash added

Gemini 3.1 Pro was cataloged at $1.25/MTok input (should be $2.00). Haiku 4.5 input/output rates were swapped. gemini-3.5-flash was missing from the catalog entirely. All three affected the savings-estimate calculations on /v1/usage/by-model.

Show details ▾
  • Gemini 3.1 Pro: $1.25 → $2.00/MTok input.
  • Haiku 4.5: input $1.00/MTok, output $5.00/MTok (rates were swapped).
  • gemini-3.5-flash added to catalog at $0.075/$0.30 per MTok.
  • claude-opus-4.8 added to catalog at $5.00/$25.00 per MTok.
API v1.50.10permalink
Bug fixMediumAPIWebAction required: No

Opus pricing corrected from $15/$75 to $5/$25 across five surfaces

claude-opus-4 and claude-opus-4.5 had stale $15/$75 per MTok rates in the pricing catalog and across the web UI. Corrected to $5/$25. This lowered the displayed savings estimate for Opus-heavy workloads.

Show details ▾
  • claude-opus-4 and claude-opus-4.5 input rate: $15 → $5/MTok.
  • Output rate: $75 → $25/MTok.
  • Savings estimates for Opus workloads on /v1/usage/by-model and the savings calculator now reflect the correct rates.
API v1.50.9permalink
Bug fixMediumAPIAction required: No

Three latent database query bugs fixed; regression guard added

Three database queries were silently failing in production due to a SQL syntax incompatibility. The affected paths (Knowledge Hub retention sweep and usage governance) were not executing. A regression guard prevents this class of bug from being introduced again.

Show details ▾
  • All three affected queries have been corrected and are now executing as intended.
  • A regression guard catches this pattern before it reaches deployment.
API v1.50.8permalink
Bug fixLowMCP GatewayAction required: No

gc_lookup reingest cron: COMPLETE frameworks no longer re-staged on every run

The gc_lookup framework re-ingest job was re-queuing every framework on every hourly run regardless of whether ingestion had already finished.

Show details ▾
  • The reingest job now skips frameworks that have already completed ingestion.
  • Only frameworks that are pending, failed, or not yet ingested are re-queued.
  • Eliminates redundant background work once all frameworks are fully indexed.
API v1.50.7permalink
Bug fixMediumMCP GatewayAction required: No

gc_lookup Phase B drain: free-tier slot starvation and head-of-line blocking fixed

The gc_lookup tool was using a single shared embedding queue that allowed a burst of free-tier embedding jobs to starve Pro jobs. A large framework (e.g. React docs) at the head of the queue could block all subsequent jobs until it completed.

Show details ▾
  • Pro and Free embedding jobs now run in separate queues so a burst of free-tier jobs cannot delay Pro results.
  • Large framework documents are processed in chunks with interleaved scheduling, eliminating head-of-line blocking.
  • Free-tier throughput is now isolated from Pro-tier response times.
API v1.50.6permalink
Bug fixLowAPIWebAction required: No

Cache-hit savings now show up in your Cache-Adjusted Savings dashboard

Compression calls served from the semantic cache were not being recorded in the usage events behind the Cache-Adjusted Savings view, so cache ROI looked lower than it really was. They are now recorded with full cache attribution. Your billing and usage limits are unchanged — cache hits already counted toward your quota.

Show details ▾
  • Cache hits now write a durable usage event (previously skipped, which left cache ROI under-reported).
  • Both hits and misses now carry their cache status and similarity score, so /v1/usage/by-cache is accurate.
  • Telemetry only — the real-time quota counter already counted cache hits, so nothing about billing or usage limits changed.
API v1.49.0permalink
FeatureInformationalAPIMCP GatewayAction required: No

gc_submit_benchmark: submit a benchmark run straight from your MCP client

A new free MCP tool lets coding agents and Claude Code sessions submit a compression benchmark result directly, without leaving the terminal.

Show details ▾
  • Accepts the six required benchmark fields (model, quantization, hardware, context length, batch size, tokens/sec output) plus eight optional fields.
  • Returns the public URL of the submitted run so it can be shared immediately.
  • Available on all plans at no cost — submissions help build the community benchmark dataset.
API v1.49.1permalink
Bug fixLowAPIWebAction required: No

Fixed a 500 error on the Batch Queue dashboard page

The Batch Queue page returned a 500 for some accounts due to a Clerk user ID being passed where a UUID was expected. The page now loads correctly.

Show details ▾
  • The Batch Queue SSE stream now loads correctly for all accounts.
API v1.48.0 / Web v1.42.0permalink
FeatureInformationalAPIWebAction required: No

Benchmarks community: threaded Q&A, AI moderation, and a percentile ranking chip

Benchmark run pages now support threaded questions and answers, show where a result ranks among similar runs, and include AI-assisted moderation to keep discussions on-topic.

Show details ▾
  • Threaded Q&A comments appear on each benchmark run page; replies nest up to eight levels deep.
  • Comments go through AI-assisted classification (safe / spam / undisclosed promotion / fabricated result) before appearing publicly. Suspected fabricated results always go to human review.
  • A percentile chip shows where the run ranks among similar configurations — hidden when fewer than five comparable runs exist.
  • Authors see a "Pending review" badge on their own comments while moderation is in progress; others see nothing until a comment is approved.
  • Terms of service updated to prohibit undisclosed commercial promotion and fabricated benchmark results.
API v1.47.0permalink
ImprovementInformationalAPIMCP GatewayAction required: No

gc_lookup framework docs now refresh on a schedule

The gc_lookup free MCP tool now returns more complete and accurate answers for Tailwind CSS, LangChain, and SQLAlchemy, which previously had incomplete doc coverage.

Show details ▾
  • A new cron job advances doc ingestion for each framework one small batch per run, avoiding the timeout issues that previously left some frameworks partially indexed.
  • Once all sections are indexed the cron becomes a fast no-op until the next scheduled re-ingest.
  • No change to gc_lookup's interface — existing queries benefit automatically.
API v1.46.0 / Web v1.41.8permalink
FeatureInformationalAPIWebAction required: No

Dashboard feed gains up/down votes and threaded comments

The /dashboard/feed page is redesigned as a community-style stream with voting, threaded comments, and a trending sidebar — unifying AI news, blog posts, and benchmark runs in one place.

Show details ▾
  • Each feed card has a vote rail for up/down votes with optimistic UI and rollback on error.
  • Threaded comments support replies up to three levels deep in the feed view; a dedicated in-page post view renders deeper threads.
  • Hot score is maintained by a database trigger using the Reddit hot-score formula.
  • A sidebar shows the top five trending posts by net score this week.
  • All three content types — news articles, blog posts, and benchmark runs — appear in one unified stream.
API v1.45.5 / Web v1.41.4permalink
ImprovementInformationalAPIWebAction required: No

Knowledge Hub dashboard redesigned with real per-source token metrics

The /dashboard/knowledge page shows a live metrics header (source count, total tokens indexed, average compression ratio) and per-source token counts, using the same token counter as /v1/compress.

Show details ▾
  • Token counts are captured using the product's canonical TokenEstimator at every ingest path so the numbers match what /v1/compress reports.
  • The metrics header shows "N sources · X tokens indexed · Y× compressed"; each clause is omitted when data is absent rather than showing a zero.
  • Existing knowledge items show counts the first time the backfill runs; all new ingests carry them immediately.
  • The sources list was converted from a dense table to card rows while preserving all existing actions: bulk select, rename, preview, MCP toggle, and project membership.
API v1.45.4permalink
FeatureInformationalAPIAction required: No

GitHub push events can trigger per-project compression jobs

Teams with a connected GitHub repository can now have push and pull-request events automatically dispatch a compression job for changed files, using the access token already in their integration settings.

Show details ▾
  • Webhook routing uses HMAC signature verification against each configured integration secret — the payload repository field is never trusted alone.
  • Push events compress changed files; pull-request events compress the PR body and post a compression stats comment on the PR.
  • Dispatched as a background task; a delivery failure does not affect the webhook acknowledgement.
API v1.45.1permalink
Bug fixLowAPIWebAction required: No

New sign-ups now get a Default project automatically

New accounts landed on an empty dashboard with no projects available. The projects endpoint now creates a Default project on first load for any account that has none.

Show details ▾
  • Self-healing: existing accounts with no projects also receive a Default project on their next dashboard load.
  • The auto-created project is plan-agnostic; the existing gate for user-initiated project creation is unchanged.
Web v1.41.2permalink
Bug fixLowWebAction required: No

Fixed an intermittent load race that left dashboard pages blank on hard refresh or fresh login

Around 25 dashboard pages could appear blank on a hard refresh or fresh login because data fetching started before Clerk had finished hydrating. All affected pages now wait for Clerk to be ready before fetching.

Show details ▾
  • Around 25 dashboard pages now wait for the auth session to be ready before fetching data.
  • Covers hard page load and fresh login in addition to client-side navigation.
API v1.45.0permalink
FeatureLowWebAPIAction required: No

A new Feed — your logged-in home for AI news and benchmarks

Signed-in users now land on a Feed: one reverse-chronological stream of the latest AI news and community benchmark runs. News items appear compressed to a short skeleton with a compression-ratio badge, so the feed doubles as a live demo of what gotcontext does. The full tools dashboard stays one click away in the nav.

Show details ▾
  • New /dashboard/feed route is the default landing page after sign-in; the tools dashboard remains in the navigation.
  • Each news card shows a compressed excerpt with a ratio badge (for example, "3.4× compressed").
  • Public GET /v1/feed merges news and benchmark activity into one paginated stream.
  • Read-only for now — voting and comments arrive as the community grows.
  • New auto-published news articles are now cleaned of stock AI phrasing before they go live, with facts and numbers preserved.
API v1.44.0permalink
ImprovementLowAPIMCP GatewayAction required: No

Automatic capacity scaling for steadier performance under load

The API now scales its compute capacity to live demand, so response times stay steady when traffic rises and costs stay low when it is quiet. No action required — this is fully automatic.

Show details ▾
  • A live active-users signal now drives how many machines run, scaling up under load and back down when idle.
  • Behaviour is unchanged for callers — requests are simply served by more capacity when demand is high.
API v1.43.20permalink
Bug fixHighAPIMCP GatewayAction required: No

Compressing a very large document no longer fails

Compressing a large file (multi-megabyte documents producing tens of thousands of chunks) is now reliable. Previously the engine could exhaust memory building its internal similarity graph and the request would fail; memory is now bounded regardless of document size, and compression results are unchanged.

Show details ▾
  • The semantic graph is now built in bounded blocks instead of one large all-pairs matrix, so peak memory scales with document size rather than its square.
  • Output is identical to before — the change is purely how the graph is computed, locked by equivalence + memory-bound regression tests.
API v1.43.19permalink
ImprovementMediumMCP GatewayAction required: No

Framework docs lookups now return real documentation

Looking up Next.js, Pydantic, Drizzle, or FastMCP through the framework-docs tool now returns the actual API documentation with code examples, indexed from each project’s clean machine-readable docs. More frameworks follow.

Show details ▾
  • Four frameworks were re-indexed from their clean documentation and now return relevant prose + code instead of navigation HTML.
  • Indexing now processes large docs in bounded pieces, so re-indexing a big documentation set is reliable.
API v1.43.18permalink
ImprovementMediumMCP GatewayAction required: No

Framework docs re-indexed from clean machine-readable sources

Framework documentation lookups now return real documentation prose for the first set of frameworks (Next.js, Pydantic, Drizzle, FastMCP), re-indexed from their clean machine-readable docs instead of scraped landing-page HTML. More frameworks follow.

Show details ▾
  • Docs are now indexed from each framework’s clean llms-full.txt where available, so results are documentation rather than navigation menus or page chrome.
  • Re-indexing replaces the prior index for a framework cleanly (the old entries are retired, not left to dilute results).
  • A safeguard keeps results compact for any framework not yet re-indexed, so nothing regresses while the rollout continues.
API v1.43.17permalink
Bug fixMediumMCP GatewayAction required: No

Framework docs lookup now returns readable documentation

The free framework-docs lookup tool now returns the actual documentation text instead of a compressed placeholder. Where a framework was already indexed cleanly you’ll see real prose; a broader re-index of the framework catalog is in progress.

Show details ▾
  • Results previously showed a compressed “hidden detail” placeholder rather than the documentation itself.
  • The tool now prefers the raw documentation slice, falling back to the compact form only when a clean source has not been indexed yet — so nothing regresses.
  • A follow-up re-indexes each framework from its clean machine-readable docs so every framework returns real prose.
API v1.43.16permalink
Bug fixMediumMCP GatewayAction required: No

ingest_context now accepts a file_url with no inline text

If you ingest a document by URL through the ingest_context MCP tool, the call now works. Previously a file_url-only request was rejected with a “text cannot be empty” error before the URL was ever fetched; passing inline text was unaffected.

Show details ▾
  • ingest_context lets you supply a document two ways — inline text or a remote file_url — but a file_url-only call was being rejected by an input check that always required text.
  • The check now skips the text requirement when a file_url is provided, so the tool fetches the URL as documented.
  • Inline-text ingestion, and the rule that you pass one of the two (not both), are unchanged.
Web v1.39.19permalink
InternalLowWebAction required: No

Release notes brought current + kept in sync automatically

These public release notes are now caught up to the latest release, and a deploy-time check blocks a release if they fall behind — so this page stays current going forward.

Show details ▾
  • The customer-facing changelog had drifted behind the internal release log; it is now current.
  • The deploy-time sync check was repaired — it had stopped recognising newer releases — and now hard-fails on drift.
API v1.43.15permalink
Bug fixHighAPIAction required: No

Referral credits now apply exactly once — even under concurrent or retried sign-ups

If you refer someone, your Pro period is extended exactly once. Previously a rapid retry of the sign-up event could double-apply the credit, and a separate edge case could under-apply it when two referrals landed at the same moment.

Show details ▾
  • Concurrent or replayed sign-up events no longer double-extend the referrer’s Pro period.
  • Two referrals for the same referrer arriving together now stack correctly instead of one overwriting the other.
  • The billing call that syncs the extended period is bounded by a timeout so a slow upstream can’t stall the credit.
API v1.43.13permalink
ImprovementMediumAPIMCP GatewayAction required: No

More reliable inbound event processing + zero-loss deploys

Billing, referral, and usage events delivered by our providers are now de-duplicated and survive a deploy without being dropped, so dashboard usage and account state stay accurate across releases.

Show details ▾
  • Duplicate provider deliveries (timeout-retries, replays) are now ignored idempotently.
  • A deploy no longer drops in-flight usage rows — the server flushes its write-queue on shutdown.
API v1.43.9permalink
Bug fixMediumAPIWebAction required: No

Billing: plan state refreshes on renewal + clear past-due / canceled warnings

Your plan status now updates correctly when a subscription renews, and the billing page shows a clear banner if a subscription is past-due or canceled instead of appearing active.

Show details ▾
  • A renewal now refreshes the stored subscription row (previously it could go stale on renewal).
  • The billing page surfaces an amber past-due / red canceled banner instead of silently showing an active plan.
Web v1.39.18permalink
ImprovementLowWebAction required: No

Dashboard overview + site accessibility and reliability pass

The dashboard overview plus the security, status, and Agent Context Hub pages got an accuracy, accessibility, and reliability pass — including corrected API code samples, keyboard-focus rings, and a status page that no longer hangs when the API is slow.

Show details ▾
  • Dashboard “first compress” code samples now use the real flat response fields.
  • The status page health check times out and reports “investigating” instead of hanging when the API is slow.
  • Accessibility: visible keyboard-focus rings, screen-reader live regions, and proper table labelling.
Web v1.39.13permalink
FeatureLowWebAction required: No

New per-model token-cost savings pages

Added dedicated pages at /savings-by-model showing measured compression savings and live per-token pricing for each major model (Claude, GPT, Gemini, and more), each with a built-in “try it” compression demo.

Show details ▾
  • Each page shows the model’s measured compression ratio and live pricing.
  • Only models with an honestly-measured ratio are indexed — no projected or fabricated numbers.
API v1.37.8permalink
InternalLowMCP GatewayAction required: No

Maintenance: tensor-grep dependency bumped to 1.13.21

Internal dependency update. tensor-grep >=1.13.21 brings 25+ patches from the 1.12→1.13 minor series. Three MCP tools (gc_agent_capsule, gc_context_render, gc_edit_plan) updated to use the new positional CLI form to maintain compatibility. No user-facing behaviour changes.

Show details ▾
  • Three MCP tools (gc_agent_capsule, gc_context_render, gc_edit_plan) updated to maintain compatibility with the new dependency version.
API v1.37.7permalink
Bug fixLowAPIAction required: No

Internal stability: async background task cleanup

Three background-task sites had cleanup warnings under Python 3.14 that could cause unpredictable shutdown behaviour. All three are now cleaned up correctly.

Show details ▾
  • Background tasks in the News, Batch Queue, and key-revoke broadcast paths now clean up reliably on shutdown.
API v1.37.6permalink
Bug fixLowAPIAction required: No

Internal stability: two compression engine error fixes

Two internal bugs in the compression engine: ACE bullet ingestion could crash on a malformed payload, and a dependency import path was outdated. Both are fixed.

Show details ▾
  • ACE bullet ingestion now handles missing fields gracefully instead of crashing.
  • A deprecated internal dependency import path has been updated.
Web v1.37.4permalink
Bug fixMediumWebAction required: No

Fix: /news command palette showed raw locale key + empty state hid "No articles" message

See the web-v1.37.4 entry for full details.

Show details ▾
  • Command palette /news entry now shows correct label instead of raw locale key.
  • /news empty state now renders "No articles published yet." alongside the newsletter signup form.
API v1.37.5permalink
Bug fixLowAPIAction required: No

Internal stability: billing SDK test isolation fix

Test-environment only — no customer-facing change. The billing SDK now initialises correctly in test environments, eliminating spurious errors during test teardown.

Show details ▾
  • Billing SDK no longer attempts to connect to external services during test runs.
Web v1.29.2permalink
Bug fixMediumWebAction required: No

Fix: /news command palette showed raw locale key + empty state hid "No articles" message

Two customer-visible bugs on the /news surface. (1) The command palette (Cmd+K) entry for /news displayed a raw key string instead of the correct label. (2) The /news empty state (zero articles published) showed the newsletter subscription form but suppressed the "No articles published yet." message.

Show details ▾
  • Command palette /news entry now displays "News / Industry AI news + analysis" (EN) and "Actualités / Actualités et analyses IA" (FR).
  • /news empty state now correctly renders "No articles published yet." alongside the newsletter signup form.
API v1.37.3permalink
Bug fixMediumAPIAction required: No

Fix: multimodal_ingest MCP tool crashed on every call

The multimodal_ingest MCP tool raised an error on every call. The underlying multimodal compression component was missing a required method in its text-encoder adapter. Fixed.

Show details ▾
  • The multimodal_ingest tool now works correctly. The text-encoder adapter now implements all required methods.
API v1.37.2permalink
Bug fixHighAPIAction required: No

P0 hotfix: cache circuit breaker flapping — request amplification fixed

The cache circuit breaker flapped open/closed roughly 80 times over about 12 hours. Auth, rate-limiting, and plan-cache lookups fell back to slower paths on each open cycle, adding latency. The site remained up throughout. Root cause: an internal telemetry counter fired extra cache requests per operation (3× amplification), exhausting the monthly free-tier cap.

Show details ▾
  • Each cache operation now fires exactly one request instead of three.
  • The circuit breaker stabilised after the monthly cap reset.
API v1.37.1permalink
Bug fixHighAPIAction required: No

P0 hotfix: 3 endpoints returned 500 on invalid input

Three API endpoints returned 500 instead of the correct 400 or 404 on invalid or missing input. No data loss. Fixed with proper input validation.

Show details ▾
  • POST /v1/keys/confirm/{token_hash}: now returns 400 on a malformed token, 404 on an unknown token.
  • DELETE /v1/saved-views/{view_id}: now returns 400 on an invalid ID format, 404 on an unknown or unauthorised view.
  • GET /v1/usage/events/{event_id}: now returns 400 on an invalid ID format, 404 on a missing row.
API v1.37.0permalink
FeatureLowMCP GatewayAction required: No

gc_search_docs: hybrid keyword + semantic re-ranking

gc_search_docs now runs a two-stage retrieval: keyword search to find candidate chunks, then semantic re-ranking to promote the most relevant results. Semantically relevant chunks that score lower on keyword search are now promoted to their correct position. Falls back to keyword-only when embeddings are unavailable. Response includes a score_type field ("rrf" | "bm25") indicating which retrieval path was used.

Show details ▾
  • Stage 1: keyword search for candidate chunks — no change to existing behaviour.
  • Stage 2: semantic re-ranking fused with keyword scores. Falls back gracefully to keyword-only when the semantic model is unavailable.
  • New score_type field in the response: "rrf" when hybrid retrieval succeeds, "bm25" on fallback.
API v1.36.0permalink
FeatureLowAPIAction required: No

Knowledge Hub REST API — /v1/kb/* mirrors all 7 MCP tools

Non-MCP clients (curl, Python SDK, server-side fetch) can now use Knowledge Hub via standard REST without wiring an MCP transport. All 7 gc_kb_* operations are available: ingest, list, get, edit (optimistic concurrency), delete, version history, and semantic query.

Show details ▾
  • POST /v1/kb/items — ingest a document (name + content or URL, idempotent by name per project).
  • GET /v1/kb/items — list items with cursor pagination and optional status filter.
  • GET /v1/kb/items/{id} — get item metadata and latest content.
  • PATCH /v1/kb/items/{id} — edit with optimistic concurrency (base_version_id required); returns 409 + current_version_id on conflict.
  • DELETE /v1/kb/items/{id} — soft-delete, returns 204 No Content.
  • GET /v1/kb/items/{id}/versions — full version history with consecutive diffs.
  • POST /v1/kb/query — semantic search returning ranked chunks with cosine scores.
  • Project binding via API key (request.state.project_id) — no project_id in URL, matching MCP tool pattern. Clerk JWT callers receive 422 directing them to /v1/projects/{id}/knowledge/*.
API v1.35.7permalink
ImprovementLowWebAPIAction required: No

Advisory MCP tool calls now visible in dashboard; /news/[slug] gets stale cache + error boundary

Orchestrator sessions that exclusively used advisory tools (gc_pre_flight, tool_help, search_semantic, etc.) showed zero events on the dashboard despite 50+ MCP calls. Advisory tools now write zero-token activity rows so all tool usage is visible. The /news article detail page now serves stale content on transient errors rather than propagating a 5xx to visitors.

Fixed in:
API v1.35.7
Components:
MCP Gateway · Dashboard · News page
Show details ▾
  • Advisory MCP tools (gc_pre_flight, tool_help, search_semantic, gc_blast_radius, gc_lookup, recommend_compression) now appear in the dashboard activity feed.
  • Compression metrics remain unaffected — advisory tool calls do not count against token totals.
  • Dashboard overview adds a "compress only / all activity" toggle (persists across sessions).
  • /news article detail pages now serve cached content on transient errors instead of showing an error page.
API v1.35.6permalink
ImprovementLowAPIAction required: No

/v1/global-savings now sets Cache-Control: public, max-age=60 for Vercel edge caching

The landing page hero counter endpoint is called on every SSR render. Adding a 60s public Cache-Control header lets the Vercel edge layer absorb repeated calls, reducing Fly request rate on the highest-traffic surface without any behavior change to the displayed data.

Fixed in:
API v1.35.6
Components:
API
Show details ▾
  • GET /v1/global-savings now returns Cache-Control: public, max-age=60, s-maxage=60.
  • Vary: Accept-Encoding added for correct CDN content negotiation.
  • Data changes at most once per minute in practice (in-process 1h cache); 60s CDN TTL is safe.
API v1.35.5permalink
Bug fixLowWebAPIAction required: No

llms.txt line 36 stale tool count fixed; /v1/filter-cli documented in API reference

gotcontext.ai/llms.txt now consistently shows 148 tools across all bullets (line 36 previously retained the stale "142" count). docs/architecture/API.md now documents the /v1/filter-cli endpoint which was undocumented since its initial ship.

Fixed in:
API v1.35.5
Components:
llms.txt · API documentation
Show details ▾
  • llms.txt MCP endpoint bullet now shows the correct tool count.
  • /v1/filter-cli endpoint added to the API reference documentation.
API v1.35.4permalink
Bug fixHighAPIMCP GatewayWebAction required: No

Post-ship audit bundle — gc_read_doc HTML fix, NewsArticle type seam, drafter truncation, /news SSR cache

gc_read_doc now returns readable markdown instead of raw HTML. The /news listing page serves stale cache on rate-limit bursts rather than 500ing all concurrent visitors. The news drafter no longer retries (at $0.12/call) when title/excerpt exceed length limits. Frontend NewsArticle type is split to match the backend wire shape, eliminating undefined reads on list vs detail fields.

Fixed in:
API v1.35.4
Components:
MCP Gateway · News pipeline · News page
Show details ▾
  • gc_read_doc now returns readable markdown instead of raw HTML for documentation pages.
  • The /news listing page now serves cached content on rate-limit bursts rather than returning an error to all concurrent visitors.
  • The news drafter no longer enters a retry loop when a generated title or excerpt is too long.
API v1.35.3permalink
Bug fixLowAPIMCP GatewayAction required: No

Reliability bundle — revoke broadcast ordering, document-fetch size limit, cross-document search isolation

Revoked API keys are now reliably invalidated even when the cache-invalidation call fails. The document-fetch size limit now raises an error instead of silently passing. Cross-document search isolation is now confirmed end-to-end.

Fixed in:
API v1.35.3
Components:
API key lifecycle · MCP Gateway
Show details ▾
  • Revoke broadcast now writes the invalidation marker before attempting the cache-invalidation call — a cache failure can no longer leave a revoked key appearing valid.
  • Document-fetch size limit now raises an error explicitly instead of silently allowing an oversized fetch.
  • Cross-document search isolation confirmed end-to-end: results from one document cannot appear in another document's search.
API v1.35.2permalink
Bug fixMediumAPIAction required: No

KB async upload — stuck-INGESTING recovery

File uploads that entered INGESTING but never completed (worker crashed between tx1 and tx2, e.g. on Fly machine suspend) now recover automatically. A new hourly cron sweeps rows stuck in INGESTING for >10 minutes and transitions them to FAILED with a retry message. Previously these rows were invisible to the kb-process-uploads cron (WHERE status='UPLOADED') and sat stuck indefinitely.

Fixed in:
API v1.35.2
Components:
Knowledge Hub
Show details ▾
  • File uploads that entered processing but never completed now recover automatically — they are marked as failed with a retry message after 10 minutes.
API v1.35.1permalink
FeatureMediumMCP GatewayAPIAction required: No

search_semantic and gc_search_docs: hybrid keyword + semantic retrieval

search_semantic and gc_search_docs now fuse semantic and keyword scores for better recall on exact-token queries. Response carries score_type: "rrf" | "cosine" so callers can detect which retrieval path was used.

Fixed in:
API v1.35.1
Components:
MCP Gateway
Show details ▾
  • Keyword and semantic scores are now fused for better combined retrieval quality.
  • Cross-document score isolation is enforced — results from one document cannot skew scores for another.
  • Response includes a score_type field: "rrf" when hybrid retrieval succeeds, "cosine" when falling back to semantic-only.
API v1.34.35permalink
FeatureMediumMCP GatewayAPIWebAction required: No

MCP catalog hot-reload + circuit-breaker telemetry + SSE keepalive + scoped API keys

Operators can now hot-reload the MCP tool catalog without restarting servers (admin-only, rate-limited). Circuit breakers emit Prometheus telemetry. MCP SSE connections survive idle proxy timeouts. Dashboard ships a least-privilege scope picker for minting scoped gc_ keys. Document-fetch paths hardened against requests to private or internal network addresses.

Fixed in:
API v1.34.35
Components:
MCP Gateway · Dashboard · API key lifecycle · Compression API
Show details ▾
  • Admin: POST /v1/admin/mcp/reload hot-reloads the MCP tool catalog without a server restart (admin scope required, rate-limited to once per hour).
  • Observability: circuit breakers for all key dependencies now emit Prometheus metrics (state, transitions, call outcomes).
  • Reliability: MCP SSE connections now send periodic keepalive pings to survive idle proxy timeouts.
  • Security: API key scopes are now enforced end-to-end on all routes.
  • Dashboard: a scope picker lets you mint least-privilege gc_ keys restricted to specific resources and operations.
  • Security: document-fetch paths (ingest_context, Knowledge Hub) now block requests to private or internal network addresses.
API v1.34.34permalink
FeatureLowMCP GatewayAction required: No

MCP tools now signal parallel-dispatch eligibility via readOnlyHint annotation

Three read-only MCP tools (gc_lookup, search_semantic, read_skeleton) are now marked as read-only in their schema, following the MCP spec's readOnlyHint annotation. Compatible MCP clients can use this hint to safely run these tools in parallel.

Fixed in:
API v1.34.34
Components:
MCP Gateway
Show details ▾
  • gc_lookup, search_semantic, and read_skeleton are now annotated as read-only.
  • Compatible MCP clients can use this hint to safely run these tools in parallel.
API v1.34.33permalink
Bug fixMediumMCP GatewayAction required: No

gc_search_docs now matches morphological variants (authentication → authenticate)

gc_search_docs now matches morphological variants of a query term. Previously a search for "authentication" returned nothing when the docs contained only "authenticate" or "auth". Query terms of six or more characters now match by prefix, so "authentication" matches "authenticate" and "compression" matches "compressed". Shorter queries still require an exact match to avoid false positives.

Fixed in:
API v1.34.33
Components:
MCP Gateway
Show details ▾
  • Query terms with 6 or more characters now match morphological variants (e.g. "authentication" matches "authenticate").
  • Short queries still require exact match to avoid false positives.
API v1.34.32permalink
Bug fixHighMCP GatewayAction required: No

Hotfix: gc_search_docs now actually returns results; gc_read_doc respects size limits

Two bugs found immediately after the v1.34.31 release. (1) gc_search_docs returned empty results because it assumed a static documentation-index path that does not exist in production; it now fetches the live index directly. (2) gc_read_doc could return documents large enough to exceed MCP client tool-result limits; responses are now capped to a safe size.

Fixed in:
API v1.34.32
Components:
MCP Gateway
Show details ▾
  • gc_search_docs now fetches the live documentation index directly instead of assuming a static file path.
  • gc_read_doc now caps response size to avoid exceeding tool-result limits in MCP clients.
API v1.34.31permalink
FeatureLowMCP GatewayAction required: No

Search + read gotcontext docs via MCP (free tier) — gc_search_docs + gc_read_doc

First ship of the MCP API parity plan (3-4 week roadmap, CEO-approved). Agents can now search and read gotcontext product documentation without leaving their terminal. Free for all plans, no auth required — top-of-funnel conversion utility per industry research on Context7 + ref.tools precedents. Install the plugin once, ask your AI "how do I authenticate with gotcontext?", and it answers from the live docs.

Fixed in:
API v1.34.31
Components:
MCP Gateway · Claude Code plugin
Show details ▾
  • Two tools: gc_search_docs searches by keyword; gc_read_doc fetches the full content of a specific page.
  • Session-aware deduplication — repeated calls in the same session return new content rather than the same result.
  • Responses longer than 5,000 tokens are truncated to a relevant excerpt with a truncated: true flag.
  • Available on all plans at no cost.
API v1.34.30permalink
ImprovementLowMCP GatewayAction required: No

modulate_region now accepts singular node_id alongside node_ids

Agents calling modulate_region with a singular node_id string previously got a validation error because only the plural node_ids list form was accepted. Now both forms work: a singular node_id string is accepted and treated as a single-element list. Backward compatible — existing node_ids callers are unchanged.

Fixed in:
API v1.34.30
Components:
MCP Gateway
Show details ▾
  • Singular node_id (string) and plural node_ids (list) are both accepted.
  • If both are passed, node_ids takes precedence.
  • Passing neither returns a clear error message.
API v1.34.29permalink
ImprovementLowMCP GatewayAction required: No

batch_ingest_documents MCP schema now exposes scope params (session_id, workspace_id, user_id, agent_id)

Discoverability fix from v1.34.28 F12 verification: the handler already accepted session_id but the MCP tools/list schema for batch_ingest_documents did not declare it (or the other 3 scope params). Agents enumerating the catalog now see these params via the documented schema. Per-session savings tracking from v1.34.28 now works correctly when callers want non-default session scoping. Handler behavior unchanged.

Fixed in:
API v1.34.29
Components:
MCP Gateway
Show details ▾
  • Schema discoverability fix — handler behaviour unchanged.
  • Agents using batch_ingest_documents can now pass workspace_id, user_id, agent_id, and session_id via the documented schema.
API v1.34.28permalink
Bug fixMediumMCP GatewayAction required: No

Per-session savings now reflect read_skeleton, batch_ingest, ingest_directory, and filter_cli_output

v1.34.27 fixed F12 narrowly on ingest_context, but handlers that bypassed it (BatchCompressionManager.compress_batch → compressor.ingest_file_async directly) still skipped the per-session SavingsTracker. v1.34.28 wires the four remaining real-savings producers: read_skeleton, batch_ingest_documents, ingest_directory, and filter_cli_output. The broader F12 class is now fully closed — every agent that calls get_savings_report / get_savings_inline mid-session sees real numbers regardless of which compression tool produced them.

Fixed in:
API v1.34.28
Components:
MCP Gateway
Show details ▾
  • Per-session savings reports now include activity from read_skeleton, batch_ingest_documents, ingest_directory, and filter_cli_output.
  • A tracker error never fails the underlying tool call — savings accounting is best-effort.
API v1.34.27permalink
Bug fixMediumMCP GatewayAction required: No

Per-session savings reports now reflect ingest_context activity

Pre-fix the SavingsTracker was dead infrastructure — _get_tracker existed but was only ever called by .get_report() paths, never .record(). Every agent that called get_savings_report or get_savings_inline mid-session after an ingest_context call saw $0 / 0 tokens saved even after real compression activity. The mismatch with /v1/global-savings (which already showed 1.38M tokens saved across all users from the persistent usage_events table) confirmed the per-session tracker was never receiving the events the report was reading. Agents querying their own savings now see real numbers.

Fixed in:
API v1.34.27
Components:
MCP Gateway
Show details ▾
  • Per-session savings reports now include activity from ingest_context.
  • A tracker error never fails the underlying ingest call.
API v1.34.26permalink
InternalLowAPIAction required: No

Unregistered unused /webhooks/resend route

No Resend webhook is configured, so the registered endpoint was being probed by bots. POST /webhooks/resend now returns 404.

Fixed in:
API v1.34.26
Components:
Webhook delivery
Show details ▾
  • POST /webhooks/resend now returns 404.
API v1.34.25permalink
FeatureLowMCP GatewayAction required: No

Agent-driven gc_ key lifecycle: mint + revoke via MCP

Agents (CI runners, Claude Code sessions, automation) can now manage gc_ API key lifecycle without a dashboard session. Pro+ only.

Fixed in:
API v1.34.25
Components:
MCP Gateway · API key lifecycle
Show details ▾
  • gc_mint_api_key: name (required), project_id (optional), expires_in_days (1-365, default 30), environment (prod|staging|dev), default_model — returns the full key value once at creation.
  • gc_revoke_api_key: key_id (required) — owner-only; cross-user attempts return 403.
  • Key creation and revocation through MCP produce the same audit log entries as the dashboard.
API v1.34.24permalink
InternalLowAPIAction required: No

Internal: reduce observability noise from unconfigured Resend webhook

Reduced error noise from an unconfigured Resend webhook endpoint. The 400 response to inbound calls is unchanged.

Fixed in:
API v1.34.24
Components:
Webhook delivery
Show details ▾
  • 400 response unchanged — inbound callers receive the same rejection as before.
API v1.34.23permalink
Bug fixHighMCP GatewayAction required: No

read_skeleton JSON serialization 500 + ingest_context ENOENT on multi-segment file_id

Two bugs found in internal testing. (1) Calling ingest_context with an inline query parameter returned a 500 error, which broke the recommended ingest-and-query workflow. (2) Calling ingest_context with a multi-segment file_id failed on first write because the parent directories were not created automatically.

Fixed in:
API v1.34.23
Components:
MCP Gateway
Show details ▾
  • ingest_context with a query parameter no longer returns 500.
  • ingest_context with multi-segment file_id paths now creates the necessary directories automatically.
API v1.34.22permalink
Bug fixLowMCP GatewayAction required: No

read_skeleton default mode changed to "auto" + internal test fixes

read_skeleton now defaults to "auto" selection mode, which routes to the best available compression strategy. Previously it defaulted to "baseline".

Fixed in:
API v1.34.22
Components:
MCP Gateway
Show details ▾
  • read_skeleton selection_mode now defaults to "auto" (was "baseline").
API v1.34.21permalink
FeatureMediumAPIMCP GatewayAction required: No

ingest_context now accepts a remote URL to fetch and ingest server-side

MCP agents can now pass a remote HTTPS URL to ingest_context instead of pasting document text inline. The server fetches and ingests the content, with validation that the URL resolves to a public address. text and file_url are mutually exclusive; successful fetches stamp source_url on the response.

Fixed in:
API v1.34.21
Components:
MCP Gateway
Show details ▾
  • file_url accepts any public HTTPS URL; requests to private or internal addresses are rejected.
  • Redirects are not followed.
  • Responses larger than 10 MB are rejected.
  • Only text and document content types are accepted; binary/media responses are rejected.
  • source_url is included in the ingest response for provenance tracking.
  • text and file_url are mutually exclusive — passing both returns a clear validation error.
API v1.34.20permalink
FeatureMediumAPIMCP GatewayAction required: No

gc_rebind_api_key: headless API key project attribution via MCP

CI runners, Claude Code sessions, and automation can now change which project a gc_ API key is attributed to without a dashboard session. Pro+ only.

Fixed in:
API v1.34.20
Components:
MCP Gateway · API key lifecycle
Show details ▾
  • gc_rebind_api_key: rebinds a gc_ API key to a different project, or clears its project binding. Pro/Team/Enterprise only.
  • Owner-only: cross-user rebinds are rejected.
  • Revoked keys cannot be rebound.
  • Rebinding takes effect immediately — no stale cache window.
  • Audit-logged with the same trail as dashboard rebinds.
  • PATCH /v1/keys/{id} response now includes cache_invalidated: true after a project rebind.
API v1.34.19permalink
Bug fixMediumAPIAction required: No

News drafter body substance floor — closes auto-published shitpost gap

The full-site audit caught an auto-published one-word "Bruh" article on /news with full Industry News card treatment. The ingest quality gate (v1.34.0) filters by title regex + ups + comments threshold, but the drafter validator accepted any truthy body — a clickbait-titled high-ups Reddit post with a one-word body cleared both ingest AND drafting. The fix adds a minimum body floor at validation time so future shitposts are rejected before queue insertion.

Fixed in:
API v1.34.19
Components:
News pipeline
Show details ▾
  • Article body must now be at least 200 characters and 30 words to pass drafting validation.
Web v1.29.2permalink
Bug fixHighWebAction required: No

/news/[slug] Clerk middleware crash + /news/editorial-standards redirect

Every uncached SSR render of /news/[slug] threw `Clerk: auth() was called but Clerk can't detect usage of clerkMiddleware()` because src/proxy.ts only wraps clerkMiddleware around protected routes — the (unauth)/news/[slug] paywall added in v1.28.3 called auth() from a route NOT covered by the matcher. Vercel CDN cache masked most events; Sentry surfaced 2 events from manual URL-entry to /news/editorial-standards. The fix uses try-catch so the throw is treated as "no session" (paywall preview path). Also added a permanent redirect /news/editorial-standards → /news/about so external references no longer hit the [slug] catch-all.

Fixed in:
Web v1.29.2
Components:
News page
Show details ▾
  • External references to /news/editorial-standards now redirect to /news/about.
API v1.34.18permalink
ImprovementInformationalAPIAction required: No

News ingest hardening — informal-tone gate + source_slug propagation

Tightened the ingest quality gate to reject overly-informal Reddit titles before drafting, and threaded the source_slug field through the publish path so per-source filters on /news work correctly. Internal-quality improvements — no customer-facing UX change.

Fixed in:
API v1.34.18
Components:
News pipeline
Show details ▾
  • See CHANGELOG.md [1.34.18] for the per-commit detail
API v1.34.2permalink
InternalInformationalAPIAction required: No

News ingest test hardening (internal)

Internal test-suite hardening on the news ingest path — no customer-facing change. Backfilled to satisfy the public-changelog-sync gate (CEO directive 2026-05-19 requires every CHANGELOG.md version to appear on this page).

Fixed in:
API v1.34.2
Components:
News pipeline
Show details ▾
  • See CHANGELOG.md [1.34.2] for the per-commit detail
Web v1.27.9permalink
Bug fixInformationalWebAction required: No

/news round 1 of rate-fix-rate loop — 2 high-confidence fixes (head metadata + inline code)

Two /news fixes: (1) Page head metadata still showed old "AI News" / "Hand-curated" strings after the H1 rename, causing incorrect titles in browser tabs and link unfurls. (2) Inline code spans in news articles were rendering as full-width blocks instead of inline.

Fixed in:
Web v1.27.9
Components:
News page
Show details ▾
  • Page title updated to "Intelligence | gotcontext.ai" (matches the renamed H1).
  • Meta description updated to accurate framing.
  • Inline code spans now render inline.
  • Lab-blog RSS ingest enabled (OpenAI, DeepMind, HuggingFace).
Web v1.27.8permalink
Bug fixInformationalWebAction required: No

RSS feed at /news/feed.xml — aligned with the news strategy ship

The Atom/RSS feed at /news/feed.xml predates the news strategy ship and carried 3 misalignments: (1) channel title "AI News" collided with competitor AINEWS brand (2) channel description still claimed "Hand-curated" — same lie the listing page subhead fixed in v1.27.6 (3) entry links pointed to external source_url instead of on-domain /news/[slug] — the same SEO/attention-leakage problem the listing card title fix addressed. RSS subscribers (power users + LLM agents) now land on our analysis where the source is then linked at the bottom.

Fixed in:
Web v1.27.8
Components:
News page
Show details ▾
  • Channel title: "gotcontext.ai — AI News" → "gotcontext.ai — Intelligence" (matches H1 rename in v1.27.6).
  • Channel description: dropped "Hand-curated" claim; replaced with truthful framing matching the listing page.
  • Entry link: always /news/[slug] (on-domain), never external source_url. GUID always isPermaLink="true".
  • No backend change. Atom/RSS validation: well-formed XML (no schema change).
  • tsc --noEmit clean.
API v1.34.6permalink
FeatureInformationalAPIAction required: No

Multi-source news ingest — infrastructure for lab blogs and HN (disabled by default)

Infrastructure for ingesting news from multiple source types (lab blogs, HN). Disabled by default — production continues on Reddit-only until sources are configured.

Fixed in:
API v1.34.6
Components:
News pipeline
Show details ▾
  • Per-source adapters added for RSS-based lab blogs and HN.
  • Quality gate thresholds adjusted for primary source types that have no community engagement signal.
  • Feature disabled by default; no production behaviour change until sources are configured.
Web v1.27.7permalink
Bug fixInformationalWebAction required: No

Markdown tables now render on news article pages

The news article page was missing support for GitHub Flavored Markdown, so tables, strikethrough, and autolinks rendered as plain text. Cost-comparison tables in articles now display correctly with proper alignment.

Fixed in:
Web v1.27.7
Components:
News page
Show details ▾
  • Markdown tables now render with correct borders, monospace numerics, and overflow scroll on narrow viewports.
  • No backend change.
API v1.34.5permalink
FeatureInformationalAPIAction required: No

Cost-of-Inference weekly column — deterministic cost tables across live model catalog

New weekly article format publishing deterministic per-model cost calculations across the live model pricing catalog. Numbers are formula-derived, not AI-generated — no hallucination risk on cost figures.

Fixed in:
API v1.34.5
Components:
News pipeline
Show details ▾
  • Cost table covers 3 canonical workloads: RAG pipeline, long-context coding assistant, and agent loop.
  • Table sorts cheapest-first; columns: Model | Provider | Cost / query | Cost / day | Cost / year.
  • Duplicate-publish protection ensures each week's article is generated at most once.
API v1.34.4permalink
FeatureInformationalAPIAction required: No

News articles upgraded to 600-900 word structured analysis

Drafted news articles now follow a structured 5-part format (lede, statistics, analysis, forward-looking, sources) at 600-900 words, replacing the previous 400-900 word unstructured format.

Fixed in:
API v1.34.4
Components:
News pipeline
Show details ▾
  • Required structure: factual lede, verbatim statistics, 2-3 paragraph analysis, forward-looking section, inline source citations.
  • Title format tightened to news-lede or analytical-lead style.
API v1.34.3 + Web v1.27.6permalink
FeatureInformationalAPIWebAction required: No

News page — content strategy update, copy improvements, and cost controls

The news section has been repositioned as an analyst surface focused on LLM unit economics and benchmark-backed analysis. Thumbnail generation costs reduced; clickbait headline patterns banned from the drafter.

Fixed in:
API v1.34.3 + Web v1.27.6
Components:
News page · News pipeline
Show details ▾
  • Thumbnail generation rate throttled to reduce daily spend.
  • Removed /news from top nav temporarily; route remains accessible for discovery and sitemaps.
  • Page heading renamed from "AI News" to "Intelligence".
  • Updated page subheading to accurately describe content sourcing.
  • Article listing cards now link to the on-site article page instead of the external source.
  • Source attribution de-duplicated to one location per card.
  • Drafter prompt updated to ban clickbait headline styles.
API v1.34.1permalink
Bug fixInformationalAPIAction required: No

News drafter re-applies quality gate at publish time to clear legacy queue

The quality gate added in v1.34.0 applied only to newly ingested items. Existing queued items were still eligible for publishing. The drafter now re-checks queued items at claim time and skips any that do not meet the current title criteria.

Fixed in:
API v1.34.1
Components:
News pipeline
Show details ▾
  • Previously queued items that fail the current quality gate are rejected and skipped.
API v1.34.0permalink
FeatureInformationalAPIAction required: No

News drafter now filters for important news — quality gate at ingest

Previously the drafter published every post that surfaced from community feeds, including help requests, weekly meta threads, and general questions. Ingest now applies a quality gate: minimum engagement thresholds (upvotes and comments) plus a title blocklist. Both thresholds must pass simultaneously.

Fixed in:
API v1.34.0
Components:
News pipeline
Show details ▾
  • Title blocklist rejects help requests, weekly meta threads, and discussion-tagged posts.
  • Minimum upvote and comment thresholds configurable without redeploy.
  • Primary data source upgraded from RSS to Reddit JSON API (RSS does not expose engagement counts); RSS retained as fallback.
  • Ingest response includes per-source gate pass/reject counts to assist threshold tuning.
Web v1.27.5permalink
Bug fixInformationalWebAction required: No

/news category filter — was showing 0 articles for every category

The category filter showed "All (30)" but every individual category chip showed 0 articles. The filter chip list was hardcoded with categories that did not match what the drafter actually produces. Fixed by deriving the chip list from the articles currently loaded — new categories automatically appear without any code change.

Fixed in:
Web v1.27.5
Components:
News page
Show details ▾
  • Category chips now derived from data rather than a hardcoded list.
  • Unknown categories fall back to a neutral indicator colour instead of rendering broken.
API v1.33.0permalink
FeatureInformationalAPIAction required: No

News drafter — structural rules for AI search citation eligibility

Six structural rules added to the drafter prompt shape every article toward eligibility for citation in AI search results (ChatGPT, Perplexity, Claude, Gemini). Rules focus on lede structure, named sources, concrete statistics, and self-contained excerpts.

Fixed in:
API v1.33.0
Components:
News pipeline
Show details ▾
  • Articles must open with a factual lede answering who/what/when/why.
  • Second paragraph must include a concrete statistic or verbatim claim from the source.
  • Named lab, company, or author must appear in the article body.
  • Excerpt must stand alone as a mini-lede (feeds OG meta and listing cards).
Web v1.27.4permalink
FeatureInformationalWebAction required: No

/news metrics instrumentation — pageview, scroll depth, source clicks, and AI Search referral attribution

Analytics instrumentation added to track which articles get visits and engagement. Captures article pageviews, scroll-depth milestones, source clicks, and referral channel — including distinguishing AI Search (ChatGPT, Perplexity, Claude, Gemini) from traditional search and social.

Fixed in:
Web v1.27.4
Components:
News page
Show details ▾
  • Article pageview fires once per article load; captures category and referral channel.
  • Scroll depth fires at 25/50/75/100% milestones, once per milestone per load.
  • Source click fires when a reader follows the link to the original source.
  • Listing pageview fires on the /news index with article count and referral channel.
  • AI Search referral category tracks ChatGPT, Perplexity, Claude, Gemini, Kagi, and You.com as a first-class channel.
Web v1.27.3permalink
FeatureInformationalWebAction required: No

/news SEO upgrade — NewsArticle JSON-LD enhancements and per-article sitemap entries

Each article page now emits richer JSON-LD structured data (canonical entity URL, article section, language, free-access flag, image as ImageObject). The sitemap now enumerates each published article individually with its last-modified date so search engines can crawl articles directly.

Fixed in:
Web v1.27.3
Components:
News page
Show details ▾
  • JSON-LD now includes canonical URL, category section, language, and free-access eligibility fields.
  • Image structured data upgraded to ImageObject format, resolving Google structured-data tester warnings.
  • Sitemap includes up to 200 article URLs per locale with accurate last-modified dates.
Web v1.27.2permalink
Bug fixInformationalWebAction required: No

/news thumbnails now display at thumbnail size instead of stretching to full-width

Article thumbnails on the news listing and article detail pages were rendering as full-width banners. The listing now shows a fixed-size thumbnail beside article content; the detail page caps the image at a compact width.

Fixed in:
Web v1.27.2
Components:
News page
Show details ▾
  • Listing card: thumbnail is now a fixed 160×100 image displayed beside the article text.
  • Detail page: thumbnail capped at 280px max-width.
  • No backend change; only render dimensions changed.
API v1.32.12permalink
Bug fixInformationalAPIAction required: No

News article thumbnails: retry logic and hourly backfill improve coverage from ~30% to ~80%

Production showed only about 30% of articles had thumbnails. The image generator sometimes returns a text-only response for certain article topics. A retry with a simplified prompt is now attempted, and an hourly backfill cron sweeps recent articles missing thumbnails.

Fixed in:
API v1.32.12
Components:
News pipeline
Show details ▾
  • On a failed image generation, one retry is attempted with a simplified category-only prompt.
  • Hourly backfill cron sweeps articles from the last 48 hours that are still missing thumbnails, capped at 10 per run.
API v1.32.11permalink
Bug fixCriticalAPIAction required: No

P0 — news ingest silently fell back to 1 source after server recycle; 8-subreddit seed now durable

The 8-subreddit expansion shipped in v1.32.10 was seeded via a manual one-time database command rather than a schema migration. Server recycling wiped that data, causing ingest to silently fall back to a single source. The seed is now applied via a migration that survives every deploy.

Fixed in:
API v1.32.11
Components:
News pipeline
Show details ▾
  • Sources seeded: r/MachineLearning, r/OpenAI, r/LocalLLaMA, r/LLMDevs, r/AI_Agents, r/ClaudeCode, r/ClaudeAI, r/GeminiAI.
  • Idempotent seed — safe to run on an already-seeded database.
API v1.32.10permalink
FeatureInformationalAPIAction required: No

News ingest now pulls from 8 subreddits covering AI engineering, Claude, OpenAI, and Gemini communities

Ingest was previously pulling from a single source. It now iterates over all configured sources. The source set expanded to 8 subreddits covering AI engineering practitioners, Claude Code workflows, and official lab feeds. A failed feed does not abort the remaining sources.

Fixed in:
API v1.32.10
Components:
News pipeline
Show details ▾
  • Sources: r/MachineLearning, r/LocalLLaMA, r/LLMDevs, r/AI_Agents, r/ClaudeCode, r/ClaudeAI, r/OpenAI, r/GeminiAI.
  • Cap of 50 entries per source per cycle.
  • Per-source error handling; a bad feed does not block other sources.
API v1.32.9permalink
Bug fixInformationalAPIAction required: No

Hotfix — news thumbnails were uploading to the wrong storage bucket, causing public URLs to 404

Thumbnail generation in v1.32.8 wrote to an incorrect storage bucket, so all generated thumbnail URLs returned 404. Thumbnails now write to the dedicated news-thumbnails bucket.

Fixed in:
API v1.32.9
Components:
News pipeline
Show details ▾
  • Thumbnail storage now uses a dedicated configuration separate from other storage buckets.
  • Previously generated orphaned thumbnails were cleared from affected draft records.
API v1.32.8permalink
FeatureInformationalAPIAction required: No

News drafter now generates an AI-produced hero thumbnail per draft

Every news draft now gets an original AI-generated 16:9 editorial thumbnail at draft time. Image generation runs concurrently with text drafting so wall time is not significantly increased. A monthly budget cap prevents runaway spend.

Fixed in:
API v1.32.8
Components:
News pipeline
Show details ▾
  • Image generation is best-effort; a failure does not block text drafting.
  • Monthly budget cap enforced; thumbnail generation is skipped once the cap is reached.
API v1.32.7permalink
Bug fixInformationalAPIAction required: No

Hotfix — admin "Approve" returned 500 when publishing a news draft

Every admin click on "Approve draft" returned HTTP 500. The publish, edit, and withdraw article paths were passing timestamp strings to the database instead of datetime objects.

Fixed in:
API v1.32.7
Components:
News pipeline
Show details ▾
  • Approve, edit, and withdraw article actions now work correctly.
API v1.32.6permalink
FeatureInformationalAPIAction required: No

News drafts auto-publish 1 hour after entering the queue

Drafts that are not manually reviewed within 60 minutes are automatically published. Human-reviewed drafts continue to publish immediately on click. The audit trail records whether an article was auto-published or human-approved.

Fixed in:
API v1.32.6
Components:
News pipeline
Show details ▾
  • Concurrent auto-publish runs never double-publish the same draft.
  • On a publish failure the draft is rolled back so the next run can retry.
  • Auto-publish and human-approved articles are distinguishable in the audit trail.
API v1.32.5permalink
Bug fixInformationalAPIAction required: No

Hotfix — admin drafts queue showed empty bodies when expanding a draft for preview

The draft list endpoint was omitting the article body from its response. Expanding any draft in the admin queue showed a blank body. Draft bodies now appear correctly.

Fixed in:
API v1.32.5
Components:
News pipeline
Show details ▾
  • Draft body field added to the draft list response.
Web v1.32.4permalink
Bug fixInformationalWebAction required: No

Hotfix — admin pages crashed because the draft list response shape did not match the frontend type

After v1.32.3 fixed admin authentication, both admin pages immediately crashed with a "Cannot read properties of undefined" error. The frontend type expected a wrapped object but the API returns a bare array. Both pages now render correctly.

Fixed in:
Web v1.32.4
Components:
Dashboard
Show details ▾
  • Draft list response now correctly typed as a bare array on the frontend.
API v1.32.3permalink
Bug fixInformationalAPIAction required: No

Hotfix — admin drafts queue returned 403 for every click even with a valid admin session

The public news read path was inadvertently matching the admin sub-path, causing the authentication middleware to skip session validation. Admin endpoints now correctly require authentication while public news reads remain unauthenticated.

Fixed in:
API v1.32.3
Components:
Dashboard
Show details ▾
  • Admin endpoints correctly require authentication.
API v1.32.2permalink
Bug fixInformationalAPIAction required: No

Hotfix — news-draft cron returned 500 due to incorrect timestamp format in database queries

The news drafter cron returned HTTP 500 after the auth bypass was fixed in v1.32.1. Timestamp values were being formatted as strings before being passed to the database, which requires datetime objects.

Fixed in:
API v1.32.2
Components:
News pipeline
Show details ▾
  • News drafting cron now completes successfully.
API v1.32.1permalink
Bug fixInformationalAPIAction required: No

Hotfix — news-draft cron returned 401 on every scheduled run

The news drafter cron endpoint was not correctly configured as a cron route, causing every scheduled run to be rejected before the cron secret check ran. No production cron runs were lost; the fix landed before the first scheduled trigger.

Fixed in:
API v1.32.1
Components:
News pipeline
Show details ▾
  • News drafting cron now runs on schedule.
API v1.32.0permalink
FeatureInformationalAPIWebAction required: No

In-tree AI News drafter pipeline and admin approval queue

An hourly cron now generates publication-ready news article drafts from ingested items, with editorial validation (kill-word checks, ownership-mention scrubbing) and a monthly budget cap. Drafts go to an admin approval queue before publishing.

Show details ▾
  • Concurrent cron runs cannot double-draft the same item.
  • LLM output is validated against a kill-word list and anonymous-ownership rules; two failures auto-reject the draft.
  • Admin queue at /dashboard/admin/news/drafts shows pending drafts with edit-in-place, approve, and reject actions.
  • Email notification sent when new drafts are ready for review.
API v1.31.2permalink
Bug fixInformationalAPIAction required: No

Dependency update — tensor-grep version pin updated; no customer-visible change

Dependency version floor updated. No customer-visible behaviour change.

Show details ▾
  • No subcommand signature changes; all 6 affected subcommands verified against the new version.
API v1.31.1 / Web v1.27.1permalink
Bug fixInformationalAPIWebAction required: No

Hotfix — Vercel production deploys had been failing since 2026-05-19

Production deploys were failing at the prerender step due to an auth hook used inside a component that runs at static-site-generation time where the auth provider is not in scope. The auth-aware navigation swap has been reverted.

Fixed in:
API v1.31.1 / Web v1.27.1
Components:
Dashboard
Show details ▾
  • Marketing nav always shows Sign In and Get free API key CTAs. Signed-in users can access the dashboard via the nav dashboard link, footer, keyboard shortcut, or direct URL.
  • Production deployments are restored.
API v1.31.0 / Web v1.27.0permalink
FeatureInformationalAPIWebAction required: No

News page — discoverability, RSS feed, newsletter capture, markdown rendering, hero image cards

The /news section was not linked from any navigation, footer, or sitemap. This release adds /news to all primary navigation entry points, replaces the empty-state dead-end with a newsletter capture form, adds an RSS feed, upgrades article rendering to full markdown, and adds reading-time, source attribution, and hero image cards.

Fixed in:
API v1.31.0 / Web v1.27.0
Components:
News page
Show details ▾
  • /news added to main nav, footer, sitemap, keyboard shortcut (G N), and dashboard menu.
  • Empty state replaced with a newsletter sign-up form; search and category tabs hidden when no articles are present.
  • RSS feed at /news/feed.xml (RSS 2.0, 50 most recent articles).
  • Article renderer upgraded to full markdown (lists, blockquotes, headings, code blocks, links).
  • Reading-time estimate added to article header and listing cards.
  • Hero image cards added with lazy-load and gradient fallback.
API v1.30.2permalink
Bug fixInformationalAPIAction required: No

Hotfix — news ingest was failing silently; all Reddit items were landing in the error bucket

After v1.30.0 shipped the news ingest cron, all 25 ingested items were being rejected because a timestamp was passed as a string rather than a datetime object. All items now ingest successfully.

Fixed in:
API v1.30.2
Components:
News pipeline
Show details ▾
  • News items now ingest correctly.
API v1.30.1permalink
Bug fixInformationalAPIAction required: No

Hotfix — news ingest cron was returning 401 on every scheduled run

The news ingest cron endpoint was not correctly configured as a cron route, causing every scheduled run to be rejected. No production runs were lost; the fix landed before the first scheduled trigger.

Fixed in:
API v1.30.1
Components:
News pipeline
Show details ▾
  • News ingest cron now runs on schedule.
API v1.30.0permalink
FeatureInformationalAPIAction required: No

In-tree news ingest cron replaces third-party scheduler that was silently not running

The original news ingest architecture used a third-party workflow scheduler that was found to silently fail to register cron jobs. News ingest is now handled by a native API cron endpoint running hourly. Deduplication prevents re-ingesting the same items across runs.

Fixed in:
API v1.30.0
Components:
News pipeline
Show details ▾
  • Hourly ingest from r/MachineLearning RSS feed, capped at 50 entries per cycle.
  • Duplicate items are silently skipped.
API v1.29.1permalink
Bug fixInformationalAPIAction required: No

Hotfix — public news read endpoints were incorrectly requiring authentication

News article listing, category, and individual article read endpoints were requiring authentication, making /news inaccessible to unauthenticated visitors. Read endpoints are now public; write/admin endpoints remain authenticated.

Fixed in:
API v1.29.1
Components:
News page
Show details ▾
  • GET /v1/news, /v1/news/categories, and /v1/news/{slug} are now publicly accessible.
  • Write and admin endpoints remain authenticated.
API v1.29.0 / Web v1.26.0permalink
FeatureInformationalAPIWebAction required: No

AI News Center — storage and read surface for the news feed

New /news public read routes and admin write endpoints ship the storage and read surface for an AI news feed. Articles can be submitted, edited, published, and DMCA-withdrawn. Public reads are unauthenticated for SEO.

Fixed in:
API v1.29.0 / Web v1.26.0
Components:
News page
Show details ▾
  • Public GET endpoints: /v1/news, /v1/news/{slug}, /v1/news/categories.
  • Admin write endpoints for submitting, editing, publishing, and withdrawing articles.
  • DMCA withdrawal support: withdrawn articles return 410 Gone.
  • Article JSON-LD structured data with canonical link to original source on individual article pages.
API v1.28.0 / Web v1.25.0permalink
FeatureInformationalAPIWebAction required: No

Resend bounce webhook, landing CTA analytics, and billing cost accuracy

Three improvements shipped together. Email bounces and complaints now automatically suppress future emails to the affected address. Landing page CTA clicks are now tracked for conversion analysis. A CI gate ensures future billing cost calculations route through the central cost model.

Fixed in:
API v1.28.0 / Web v1.25.0
Components:
Webhook delivery · Dashboard · Billing
Show details ▾
  • Resend bounce/complaint webhook: hard bounces and complaints automatically suppress future emails to the affected address, protecting sender reputation.
  • Landing page CTAs now emit analytics events: hero, sign-up, pricing, calculator, and docs click-through.
  • Billing cost calculations are now routed through a single central model, reducing drift across surfaces.
API v1.27.0permalink
FeatureInformationalAPIWebAction required: No

AI Benchmark Repository — community-standard schema (multi-GPU, Apple Silicon, ITL, speculative decoding)

The benchmark schema now matches the fields used by NVIDIA NIM, vLLM, MLPerf, and the Apple Silicon community — making submitted results directly comparable to numbers published elsewhere. New hardware-class filter tabs (NVIDIA CUDA / AMD ROCm / Apple Silicon / Intel Arc) let you find relevant results without scrolling.

Fixed in:
API v1.27.0
Components:
/benchmarks leaderboard · /benchmarks/submit wizard · /benchmarks/runs/:slug result page · POST /v1/benchmarks/runs · GET /v1/benchmarks/leaderboard
Show details ▾
  • Multi-GPU support: submit results for 1×4090, 2×4090 NVLink, or 8×H100 configs — gpu_count is now a first-class field so outlier detection partitions correctly per configuration.
  • Apple Silicon unified memory: a new memory_type field (discrete_vram / unified_memory / system_ram) gives MLX benchmarks a sensible slot; the M5 Max community benchmark vertical is now fully expressible.
  • Inter-Token Latency (ITL): the canonical generation-phase metric used by NVIDIA NIM, vLLM, BentoML, and AWS Neuron is now capturable alongside tokens/sec, enabling apples-to-apples comparisons with production serving benchmarks.
  • Speculative decoding and Flash Attention flags, perplexity dataset reference (WikiText-2 / PTB / C4 / ShareGPT), and typed runtime fields (cuda / rocm / metal / vulkan / openvino / cpu) added. 5 new diagnostic rules detect common performance pitfalls for ROCm, Apple Silicon, and EXL2 quants.
API v1.26.0permalink
FeatureInformationalAPIWebMCP GatewayAction required: No

AI Benchmark Repository — submit wizard, leaderboard, permalinks, diagnostics, and MCP tool

The complete benchmark surface is now live: a 3-step submit wizard, sortable leaderboard with 4 ranking lenses (tokens/sec · $/Mtok · tokens/sec/watt · value composite), shareable per-run permalinks with automated diagnostics, and a `submit_benchmark` MCP tool so agents can log results programmatically.

Fixed in:
API v1.26.0
Components:
/benchmarks/submit · /benchmarks leaderboard · /benchmarks/:modelSlug per-model page · /benchmarks/runs/:slug permalink · MCP `submit_benchmark` tool · POST /v1/benchmarks/runs · GET /v1/benchmarks/leaderboard · GET /v1/benchmarks/runs/:id_or_slug
Show details ▾
  • Submit wizard: 3-step flow — model / quant / context / batch → hardware autocomplete (supports paste from nvidia-smi -q) → headline metrics + software stack + agent-submission toggle. Cloudflare Turnstile protects anonymous submissions.
  • Leaderboard with 4 ranking lenses and verified badges: cyan = admin-verified, green = community-verified, grey = unverified, red = flagged. The 🤖 badge marks agent-submitted results.
  • Per-run permalink pages include a comparison strip (median / this run / top-10% bar chart with percentile pill), 8 automated diagnostic rules that explain likely causes of underperformance, and a one-click copy of the reproducibility recipe as YAML or cURL.
  • `submit_benchmark` MCP tool allows agents to log benchmark results directly from a CI pipeline or benchmark script. Returns the public permalink and outlier score immediately.
API v1.25.0permalink
FeatureInformationalAPIAction required: No

AI Benchmark Repository — foundation (schema, REST API, outlier detection)

The gotcontext.ai benchmark repository is now open for submissions. Log your inference runs — model, quant, hardware, context length, batch size, tokens/sec — and get a shareable permalink. Anonymous submissions are accepted alongside authenticated ones.

Fixed in:
API v1.25.0
Components:
POST /v1/benchmarks/runs · GET /v1/benchmarks/runs/:id_or_slug · GET /v1/benchmarks/leaderboard · POST /v1/benchmarks/runs/:id/flag · GET /v1/benchmarks/hardware
Show details ▾
  • Six REST endpoints: submit a run, fetch by ID or public slug, leaderboard with 4 ranking lenses, community flag (≥3 flags = flagged status), hardware SKU autocomplete.
  • Outlier detection runs on every submission: rolling p50 ± σ per (model, hardware) pair; outlier_score flags results that are >2σ from the median so you can investigate unusual numbers before sharing.
  • Anonymous submissions are accepted with rate limiting (5/hour per IP); authenticated gc_ key submissions get a higher limit (20/hour). Both receive the same permalink and outlier scoring.
API v1.23.20permalink
Bug fixMediumAPIAction required: No

Billing accuracy sweep — model-aware pricing across all savings surfaces

Savings figures are now consistent and model-accurate across every surface: the weekly digest email, the usage alert suffix in `/v1/usage`, and the per-compression `estimated_cost_saved` field. Customers running Claude Opus were seeing savings understated by up to 5×; Haiku users were seeing savings overstated by up to 3.75×. No customer action required — the fix applies to the next weekly digest and any new compressions.

Fixed in:
API v1.23.20
Components:
weekly digest email · /v1/usage alert suffix · /v1/compress estimated_cost_saved · Pro pricing copy in two email templates
Show details ▾
  • Weekly digest email now derives savings from the most-common model in your 7-day window (same formula as the `/v1/usage/by-model` endpoint), replacing a hardcoded $3/M flat rate.
  • /v1/usage alert suffix now uses the blended-fallback rate ($5/M) instead of always assuming Opus pricing, which was over-promising savings for non-Opus users.
  • /v1/compress `estimated_cost_saved` now delegates to the unified model pricing catalog; unknown models receive the blended fallback instead of null.
  • Two email templates updated from the outdated $29/mo Pro price to the current $49/mo.
API v1.23.18permalink
FeatureInformationalMCP GatewayAction required: No

MCP gateway — ?profile=core (7 tools, ~2K tokens) vs ?profile=full (142 tools)

Clients that only need compression, search, and memory can now connect to `https://api.gotcontext.ai/mcp?profile=core` and receive exactly 7 essential tools using ~2K tokens instead of ~38K. The default unparameterized URL is unchanged and continues to advertise the full 142-tool catalog.

Fixed in:
API v1.23.18
Components:
MCP Gateway · Claude Code plugin
Show details ▾
  • `?profile=core` returns 7 tools: ingest_context, read_skeleton, search_semantic, modulate_region, get_compression_presets, set_compression_profile, get_compression_profile.
  • The Claude Code plugin bundle now defaults to `?profile=core` for new installs, reducing context overhead. Existing installs continue to use the full URL unchanged.
  • Both profile endpoints are fully independent — a failure on one does not affect the other.
API v1.23.15 – v1.23.17permalink
ImprovementMediumMCP GatewayAPIAction required: No

MCP gateway hardening — schema accuracy, SSRF policy errors, and 142-tool coverage sweep

Three reliability improvements to the MCP gateway: the `gc_blast_radius` tool now correctly communicates that `focus_symbol` is required (previously the schema said optional but the underlying tool required it, causing confusing errors); SSRF-blocked requests now return a structured JSON error instead of a bare network message; a 142-tool end-to-end sweep confirmed every tool works as documented.

Affected:
MCP clients using `gc_blast_radius` without `focus_symbol` prior to API v1.23.15
Fixed in:
API v1.23.15
Components:
MCP `gc_blast_radius` tool · MCP `proxy_mcp_server` tool · MCP `check_budget` tool
Show details ▾
  • `gc_blast_radius`: `focus_symbol` is now correctly marked required in the tool schema. Agents that auto-construct calls from `tools/list` will receive a clear validation error instead of a wrapped error response when the field is omitted.
  • `proxy_mcp_server`: requests blocked by the outbound URL policy now return a structured JSON error (`{"error": "ssrf_policy_violation", "reason": "...", "host": "..."}`) so agents can distinguish policy blocks from transient network failures.
  • `check_budget`: the schema now rejects unknown fields with a validation error rather than silently ignoring them, so agents calling with unsupported parameters get immediate feedback.
API v1.23.9permalink
FeatureInformationalMCP GatewayAction required: No

Four new MCP tools for code context — agent capsule, edit plan, callers, context render

Four new Pro-tier MCP tools give agents structured context before making code changes: `gc_agent_capsule` summarises what to change and validates it, `gc_edit_plan` produces a machine-readable edit plan, `gc_callers` finds call sites for a symbol, and `gc_context_render` returns a ranked prompt-ready context bundle for a natural-language query.

Fixed in:
API v1.23.9
Components:
MCP `gc_agent_capsule` (new) · MCP `gc_edit_plan` (new) · MCP `gc_callers` (new) · MCP `gc_context_render` (new) · MCP `gc_blast_radius` (extended)
Show details ▾
  • `gc_agent_capsule`: call before any non-trivial code change. Returns primary targets, code snippets, validation commands, rollback metadata, and a confidence score.
  • `gc_edit_plan`: returns a machine-readable plan listing which files to modify and what to add or remove, alongside validation commands.
  • `gc_callers`: find every call site for a symbol and the test files most likely to be affected — lighter weight than a full blast-radius analysis.
  • `gc_blast_radius` gains 5 new optional parameters: render_profile (full / compact / llm), optimize_context, max_depth, max_files, max_render_chars. The `llm` render profile is designed for direct LLM consumption.
API v1.23.7 – v1.23.8permalink
Bug fixHighMCP GatewayAPIAction required: No

`gc_blast_radius` restored — tool was returning degraded responses for most callers

The `gc_blast_radius` MCP tool was returning a degraded error response for any caller who did not pass `focus_symbol` (which the schema incorrectly marked optional). This affected the majority of real-world uses. The tool now returns a clear, actionable error when `focus_symbol` is missing. Callers who were passing it correctly were unaffected.

Affected:
API v1.23.0 – v1.23.6 (gc_blast_radius callers omitting focus_symbol)
Fixed in:
API v1.23.8
Components:
MCP `gc_blast_radius` tool
Show details ▾
  • The `focus_symbol` parameter was required by the underlying implementation but the tool schema advertised it as optional. Calls without it received an opaque error response rather than a useful error message.
  • Fix: the tool now validates `focus_symbol` on entry and returns a clear error ("focus_symbol is required") when it is missing. The schema was updated to match.
  • Knowledge Hub audit-trail fidelity was also improved: API key identifiers are now captured alongside user IDs in Knowledge Hub write operations, keeping audit logs complete for API-key-authenticated sessions.
API v1.23.5 – v1.23.6permalink
Bug fixMediumWebAction required: No

French locale landing page and sign-up now render in French; billing checkout path fixed

The French-language site (`/fr/`) was displaying English copy despite `<html lang="fr">` being set. Every major landing page section (Hero, Navbar, Features, FAQ, CTA, Footer) and the sign-up page now render in French. Separately, the pricing page CTA (`/sign-up?plan=pro`) now correctly routes new users through sign-up into the Polar checkout — the `plan` parameter was previously dropped silently.

Fixed in:
API v1.23.6
Components:
/fr landing page · /fr/sign-up · /dashboard/billing upgrade CTA
Show details ▾
  • French translations wired across all LandingPage sections. Brand terms (MCP, gotcontext.ai, API key) kept in English; B2B copy uses formal "vous".
  • The sign-up page now forwards the `plan` query parameter through Clerk's redirect flow so users land on the billing page with an active checkout prompt.
  • Billing page: the `?upgraded=1&plan=pro` redirect from Clerk now shows a "Continue to Pro checkout" CTA that posts directly to the Polar checkout URL, closing the activation gap.
API v1.23.2permalink
Bug fixHighAPIAction required: No

Agent payment settlement status now flips correctly after payment verification

When an agent paid for a compression call via Nevermined or Skyfire, the payment was processed but the settlement status remained stuck at "pending" permanently. The reconciliation API now reflects settled payments correctly. This is an infrastructure fix; no end-user action is required.

Fixed in:
API v1.23.2
Components:
Agent payment processing · GET /v1/payments/reconciliation · /v1/compress (agent-payment-authenticated calls)
Show details ▾
  • The settlement status was not updating because the payment lookup relied on a value that was written asynchronously and was not yet available when the update ran.
  • Fix: settlement status lookup now retries up to 3 times to allow the async write to land, then marks the payment settled.
  • Observability: payment verification, scheduling, and retry-exhaustion events are now logged, with vendor and amount tracked (no wallet addresses or signing material logged).
API v1.27.1permalink
InternalInformationalAPIWebAction required: No

Public changelog now auto-synced: CI hard-fails when the page drifts behind CHANGELOG.md

A new CI gate ensures the customer-facing changelog at /changelog is updated with every release. The gate allows exactly one in-flight version (the time between writing a CHANGELOG entry and deploying the page update), but fails the deploy if two or more releases are missing. This release also backfills the public page with 10 entries covering API v1.23.2 through v1.27.0 that were missing.

Fixed in:
API v1.27.1
Components:
/changelog
Show details ▾
  • CI now fails if 2+ releases are missing from the public changelog.
  • Backfill: 10 customer-facing entries added covering versions from API v1.23.2 to v1.27.0.
API v1.23.19permalink
Bug fixMediumAPIWebAction required: No

Analytics savings figures now match the dashboard's top-keys widget

The per-project analytics summary was showing savings figures that did not match the "Top expensive keys" widget on the main dashboard. The two surfaces were using different formulas and different time windows. Both now use the same model-aware pricing and a consistent 30-day window by default.

Fixed in:
API v1.23.19
Components:
GET /v1/analytics/summary · /dashboard/analytics per-project savings · /dashboard Top expensive keys widget
Show details ▾
  • Analytics savings now use the same model-aware formula as the top-keys widget: the most common model in the selected window determines the per-token rate, falling back to the blended average for mixed-model usage.
  • A `days` query parameter was added to `/v1/analytics/summary` (1–365). The dashboard now passes `days=30` by default, matching the top-keys widget window. Omitting the parameter returns the lifetime aggregate (backward compatible).
  • An inline "Last 30 days" badge and tooltip were added to the analytics page so users know what window is displayed.
API v1.23.16 – v1.23.17permalink
ImprovementInformationalMCP GatewayAPIAction required: No

MCP tool schema honesty improvements and 142-tool end-to-end sweep CI gate

The `check_budget` tool now returns a validation error when called with unknown fields (it was previously silently ignoring them). Knowledge Hub MCP tools now explicitly document the requirement for a project-bound API key in their descriptions. A CI job runs the full 142-tool end-to-end sweep against live production after every deploy.

Fixed in:
API v1.23.17
Components:
MCP `check_budget` tool · MCP `gc_kb_*` tools (7 tools)
Show details ▾
  • `check_budget`: calling the tool with an unrecognized field like `{"period": "quarterly"}` now returns a clear error instead of silently ignoring the unknown field.
  • All 7 Knowledge Hub MCP tools now state in their descriptions that they require a project-bound `gc_` API key. Previously this was an opaque runtime surprise.
API v1.23.10permalink
InternalInformationalAPIAction required: No

Internal: CI test fix for Knowledge Hub SQLite compatibility — no customer-visible change

Three consecutive releases were blocked from deploying to production by a CI test failure in the Knowledge Hub test suite. Fixed by correctly skipping Postgres-specific tests when CI runs against SQLite. No customer-visible change.

Fixed in:
API v1.23.10
Components:
CI test suite
Show details ▾
  • Knowledge Hub tests that require Postgres-specific schema now correctly skip in the SQLite CI environment and continue to run in the integration environment against real Postgres.
Web v1.24.1permalink
ImprovementInformationalWebAction required: No

Quality sprint — dashboard accessibility, pricing rewrite, blog standardization

Four dashboard surfaces (Webhooks, Teams, Profiles, Admin) audited to 3/3 convergence for accessibility, focus management, and error semantics. The /pricing page was rewritten in two waves (ROI calculator, SLA matrix, sub-processors list, trust portal); a separate fix corrected the contact form rendering raw HTML. Every blog post now uses the same canonical layout (TOC, cite block, related links, contribute grid) and was scrubbed against an anti-AI-writing rubric.

Fixed in:
Web v1.24.1
Components:
/dashboard/webhooks · /dashboard/teams · /dashboard/profiles · /dashboard/admin · /pricing · /docs · /blog
Show details ▾
  • Dashboard accessibility: modal focus management, keyboard Escape handlers, live error announcements, and focus-visible rings added across Webhooks, Teams, Profiles, and Admin surfaces.
  • /pricing: ROI calculator, SLA matrix, sub-processors list, and trust-portal link added. A separate fix corrected the contact form rendering raw HTML.
  • /docs: the demo Run button was returning errors on the default sample text; fixed. Formatting issues in the Output Style and Sensitive-Content sections corrected.
  • Blog: all posts now use a consistent layout with an auto-generated table of contents, source citations, related-links sidebar, and contribute section. Prose was reviewed and edited across all posts.
  • Top navigation: the "Product" link in the global nav was using a bare `#platform` anchor that only worked from the landing page. Fixed to route correctly from any page; same fix applied to the footer Features link.
  • Dashboard profiles: a mismatch between the API's fidelity options and the dashboard's selector was corrected.
API v1.23.0permalink
FeatureInformationalAPIMCP GatewayAction required: No

Onboarding email drip + free-tier MCP context lookup tool

New users receive a 5-email onboarding drip over 14 days via Resend (feature-flag-gated against the existing welcome path so existing users are unaffected). Free-tier MCP keys can now see `gc_lookup` in `tools/list` (returns 501 stub pending the Phase 2 ingestion pipeline; behaviour will change to a working response without a version bump when Phase 2 ships).

Fixed in:
API v1.23.0
Components:
Email onboarding · MCP Gateway · Free tier
Show details ▾
  • Onboarding emails are scheduled across a 14-day window. The existing welcome email is unaffected.
  • `gc_lookup` MCP tool now appears in `tools/list` for free-tier keys. It currently returns a not-implemented response while the ingestion pipeline is in development; it will become fully functional without a version bump.
Web v1.24.0permalink
FeatureInformationalWebAction required: No

AI news feed and framework context hub

Two new pages on gotcontext.ai for AI context-engineering reference: `/news` (chronological feed of curated AI items across Models, Funding, Tools, Papers, Infrastructure, Agents, Policy) and `/context` (framework hub covering 9 frameworks: Next.js, FastAPI, LangChain, SQLAlchemy, Pydantic, Tailwind, Drizzle, FastMCP, React).

Fixed in:
Web v1.24.0
Components:
/news · /context
Show details ▾
  • `/news` ships with 28 hand-curated AI items at launch and is indexed in the global Cmd+K command palette.
  • `/context` framework pages mirror the same Cmd+K integration so each framework is reachable directly from the keyboard shortcut.
API v1.22.8permalink
Bug fixMediumAPIAction required: No

Budget alert delivery restored for users who re-enabled email alerts

Users who opted out of email alerts and then later re-enabled them were not receiving the 75 / 90 / 100 % project-budget threshold notifications. Fixed in API v1.22.8. No customer action required — the next budget-check tick after the upgrade will deliver the still-relevant alert.

Fixed in:
API v1.22.8
Components:
Project budgets · Email alerts
Show details ▾
  • When a user opted out of email alerts and later re-opted in, the system had already recorded the alert thresholds as delivered, so no further alerts were sent.
  • Fix: opting out no longer marks thresholds as delivered, so re-opting in will deliver any still-relevant alert at the next budget check.
API v1.22.7permalink
Bug fixHighAPIWebAction required: No

GET /v1/projects/{id}/usage returned 500

The per-project usage endpoint had been returning HTTP 500 in production. The dashboard's per-project usage tab and any direct API integration relying on this endpoint were affected. Fixed in API v1.22.7.

Fixed in:
API v1.22.7
Components:
/v1/projects/{id}/usage · per-project usage tab
Show details ▾
  • The per-model breakdown query failed at the database level due to a parameter-handling issue with identical default values.
  • Fix: the query is restructured to avoid the duplicate-parameter conflict.
API v1.22.7permalink
ImprovementLowAPIWebAction required: No

is_default field exposed on /v1/projects responses

The default-project marker is now returned by the API so client code can drive UI gating from server truth instead of inferring it from a project name. No breaking changes — additive field.

Fixed in:
API v1.22.7
Components:
/v1/projects · dashboard project picker
Show details ▾
  • The dashboard's Delete-button gate previously inferred which project was the default by matching `name === "Default"` — a fragile string match.
  • API responses now include `is_default: boolean`. The dashboard reads this directly. Custom API integrations can also consume the field.
API v1.22.3permalink
Bug fixMediumMCP GatewayAction required: No

Removed 5 unimplemented MCP tool stubs from tools/list

Five MCP tools that appeared in `tools/list` had no implementation behind them — calling them returned an error. They have been removed from the listing until the implementations land. Clients that enumerated and called these tools will see them stop appearing in `tools/list`; calls to them would have failed previously anyway.

Fixed in:
API v1.22.3
Components:
MCP `tools/list`
Show details ▾
  • The five tools were listed in discovery but had no working implementation behind them. Calling them returned an error. They have been removed until their implementations are ready.
Web v1.23.4permalink
ImprovementLowWebAction required: No

Usage badge now shown on each project in Dashboard

Each project card in the dashboard now displays a usage badge showing this month's API-call count, so users can see at a glance which projects are active without opening each one. No customer action required.

Fixed in:
Web v1.23.4
Components:
/dashboard/projects
Show details ▾
  • The badge reads from the same per-project rollup the dedicated usage tab uses, so the values match end-to-end.
API v1.22.5 + v1.22.4 + v1.22.2 + v1.22.1permalink
InternalInformationalAPIAction required: No

Internal: per-project FinOps surface hardening — no customer-visible change

Internal cleanup across the per-project FinOps surface (project budgets, per-project usage, project-bound API keys). No customer-visible API contract change. Bundled here for SemVer traceability.

Fixed in:
API v1.22.5
Components:
per-project FinOps internals
Show details ▾
  • Code-quality, internal-test, and refactor work. If any change affects the public API contract, it appears as its own first-class entry above.
Web v1.23.3permalink
InternalInformationalWebAction required: No

Internal: dashboard FinOps audit — no customer-visible change

Internal-only audit pass on the dashboard FinOps surface. No customer-visible UI or behavioural change. Bundled here for SemVer traceability.

Fixed in:
Web v1.23.3
Components:
dashboard FinOps internals

Security advisories · incidents · compliance history

API v1.52.3permalink
Security advisoryHighAPIMCP GatewayAction required: No

Security hardening: account deletion, billing, and webhook fixes

Five fixes from a proactive internal security audit. API keys are now revoked the moment their owner account is deleted; referral credits can only be earned once per referred user; the MCP proxy tool now blocks requests to internal network addresses; key revocation is reliable under concurrent requests; and usage-alert delivery is durable across server restarts. Hosted customers are auto-upgraded — no action required.

Show details ▾
  • Deleting an account now revokes all of its API keys before the account is removed.
  • Referral credit can only be earned once per referred user.
  • The MCP proxy tool no longer forwards requests to private or internal network addresses.
  • Key revocation is now reliable even under concurrent requests, so a revoked key is consistently rejected.
  • Usage-alert delivery is durable and is no longer dropped when a server instance restarts.
API v1.50.23permalink
Security advisoryMediumAPIAction required: No

Forum security: user silencing, safer username conflicts, link sanitization

Three forum hardening fixes: moderators can silence and unsilence users; username conflicts no longer reveal whether a name is already taken by another account; and unsafe links are stripped from comment content.

Show details ▾
  • Moderators can silence a user so they can no longer post comments, and reverse it.
  • Username conflicts are reported without revealing whether the name belongs to another account.
  • Unsafe links are stripped from comment content.
API v1.50.22permalink
Security advisoryMediumAPIAction required: No

Comment sanitizer hardened

The comment sanitizer was rebuilt to strip all HTML tags directly instead of relying on allowlisting, closing a class of HTML-entity edge cases and reducing the dependency surface.

Show details ▾
  • All HTML/XML tags are now stripped from comments; no HTML attributes survive.
  • Plain text and Markdown syntax is preserved.
API v1.50.16permalink
Security advisoryMediumAPIAction required: No

Payment-token audience enforcement

Skyfire payment tokens are now validated against the expected audience, so a token issued for a different service cannot be reused against this API. Agent payments remain off by default.

Show details ▾
  • Payment tokens whose audience does not match this service are rejected.
  • Operators enabling agent payments configure the expected audience as part of setup.
API v1.50.15permalink
Security advisoryHighAPIAction required: No

Secret encryption now fails closed in production

If the encryption key is not configured in production, secret-storage operations now fail safely instead of proceeding — preventing secrets from ever being written unencrypted. Local development behavior is unchanged.

Show details ▾
  • In production, a missing encryption key blocks the operation rather than storing unencrypted data.
  • Local development is unaffected for convenience.
  • Operators who rely on encryption should confirm the key is configured before deploying.
API v1.50.5 / Web v1.42.2permalink
Security advisoryLowAPIWebAction required: No

Hardened HTTP security-header baseline across the API and dashboard

Every API and dashboard response now carries a stronger set of browser security headers — defense-in-depth against clickjacking, MIME-type confusion, and referrer leakage. No customer action is required.

Show details ▾
  • Added X-Content-Type-Options (nosniff), X-Frame-Options (clickjacking protection), a stricter Referrer-Policy, and a Permissions-Policy denying unused device features.
  • Headers are only set when not already present, so nothing a route configures itself is overwritten.
  • A full Content-Security-Policy is being rolled out separately in report-only mode first, to avoid breaking sign-in or analytics.
  • No customer action is required.
API v1.50.4permalink
Security advisoryMediumAPIAction required: No

Per-plan request body-size limits now enforced reliably, including for streamed requests

Request body-size limits are now enforced reliably, including for streamed requests. Over-limit requests are rejected before any route handler processes the body.

Show details ▾
  • Identified through a proactive internal security audit and fixed server-side.
  • All upload styles — including streamed requests — are now subject to the same per-plan size limits.
  • Over-limit requests receive a deterministic 413 response before any route handler processes the body.
  • Within-limit uploads are unaffected.
  • No customer action is required.
Web v1.42.1permalink
Security advisoryMediumWebAction required: No

Dashboard notification rendering hardened against HTML injection

Notification links are now strictly escaped and URL-validated before rendering in the dashboard.

Show details ▾
  • Found through a proactive internal security audit; fixed in the rendering layer.
  • Notification links are now validated as http(s) URLs; invalid URLs render as plain text with no anchor element.
  • No customer action is required.
API v1.50.3permalink
Security advisoryHighAPIMCP GatewayAction required: No

Knowledge-base and tool access restrictions now fail closed on a database error

A database error during API key resolution could reset a key's knowledge-base and tool allowlists to unrestricted. Those restrictions now hold their seeded values when a database error occurs.

Show details ▾
  • Found through a proactive internal security audit as a follow-on to the v1.50.0 hardening.
  • Per-key knowledge-base and tool allowlists are now preserved correctly when a database error occurs during key resolution, rather than resetting to unrestricted.
  • Keys with no allowlist configured remain unrestricted — existing behaviour is unchanged.
  • No customer action is required.
API v1.50.2permalink
Security advisoryMediumAPIAction required: No

GitHub tokens and webhook secrets now encrypted at rest

GitHub personal access tokens and webhook secrets stored for the GitHub integration were previously held as plaintext in the database. They are now encrypted with a server-side key; existing values are transparently upgraded.

Show details ▾
  • Found through a proactive internal security audit and fixed server-side.
  • Integration secrets are now stored as encrypted ciphertext; a database read or backup exposes ciphertext only.
  • Existing plaintext values were re-encrypted during the deployment — no manual step required.
  • Secret encryption now fails closed in production: if the encryption key is not configured, secret-storage operations fail safely instead of proceeding unencrypted.
  • No customer action is required.
API v1.50.1permalink
Security advisoryMediumAPIAction required: No

Outbound webhook URLs validated against internal-network access

User-configured webhook delivery URLs were not validated against internal network ranges, allowing delivery to private or cloud-metadata addresses. Webhook URLs are now checked at creation and re-validated immediately before each delivery.

Show details ▾
  • Found through a proactive internal security audit and fixed server-side.
  • Webhook creation now rejects URLs that resolve to private, loopback, link-local, or cloud-metadata addresses.
  • The delivery path re-validates the target address immediately before each outbound request.
  • HTTP redirects are no longer followed during delivery.
  • No customer action is required.
API v1.50.0permalink
Security advisoryHighAPIMCP GatewayAction required: No

Scoped API keys now strictly enforced; destructive-action confirmation locked to dashboard sign-in

Scoped API keys were accepted by the server but their scope constraints were not persisted or enforced — every scoped key silently ran with full access. Scope restrictions are now applied end-to-end. Separately, the confirmation gate for destructive key operations now requires an active dashboard session.

Show details ▾
  • Found through a proactive internal security audit and fixed server-side.
  • Scope restrictions are now stored and enforced on every request — previously they were accepted at creation but not applied.
  • Existing keys without explicit scopes are treated as legacy full-access keys — no behaviour change for current users.
  • A temporary backend outage during key resolution no longer causes a scoped key to fall back to full access.
  • The confirmation gate for destructive key operations now requires an active dashboard session.
  • No customer action is required.
API v1.45.xpermalink
Security advisoryMediumAPIAction required: No

Analytics CSV export hardened against spreadsheet formula injection

CSV cells beginning with formula-trigger characters (=, +, -, @) are now neutralized so exported files cannot execute formulas when opened in Excel or Google Sheets.

Show details ▾
  • Identified through a proactive internal security review and fixed server-side.
  • Cells that start with =, +, -, or @ are prefixed with a tab character before export, following standard CSV injection mitigation practice.
  • Numeric and date values are unaffected.
  • No customer action is required.
API v1.35.0permalink
Security advisoryHighAPIMCP GatewayAction required: No

Live key revocation across all API servers + outbound URL hardening

Revoked gc_ API keys are now invalidated promptly and reliably across all API servers. Separately, the document-fetch and Knowledge Hub ingest paths now block requests to private or internal network addresses across all known address encoding variants.

Fixed in:
API v1.35.0
Components:
API key lifecycle · MCP Gateway
Show details ▾
  • Revoked API keys are now invalidated promptly across all API servers — revocation no longer requires waiting for a cache TTL to expire.
  • Server restarts no longer cause revocation events to be missed.
  • The document-fetch and Knowledge Hub ingest paths now block requests to private or internal network addresses.
  • Pairs with the v1.34.36 hotfix (cache-invalidation gap in the key confirmation flow) shipped the same day.
API v1.34.36permalink
Security advisoryHighAPIAction required: No

P0 hotfix: revoked confirm-tokens now invalidated promptly across all servers

A revoked key issued through the key-confirmation flow was not immediately invalidated in the shared cache, allowing it to continue authenticating on peer servers until the cache refreshed. The fix invalidates the cache immediately after revoking the key in the database.

Affected:
API v1.34.35
Fixed in:
API v1.34.36
Components:
API key lifecycle
Show details ▾
  • Cache invalidation is best-effort: a cache failure is logged and does not surface as an error to the caller.
Incident · resolved in API v1.23.12026-05-09 17:14 – 17:24 UTC (10 minutes)permalink
IncidentCriticalMCP GatewayAction required: No

MCP tools returned 500 for ~10 minutes

All MCP tool calls failed with HTTP 500 for approximately 10 minutes. No data was lost. Customers using MCP clients (Claude Code, Cursor, Codex CLI, Gemini CLI) saw tool calls fail and could retry after the window closed.

Affected:
API v1.22.4 – v1.23.0
Fixed in:
API v1.23.1
Components:
MCP Gateway · tools/call dispatch
Show details ▾
  • A routing change caused every tool call to reach a code path with a reference that had never existed. The defect was dormant in a prior release but only became reachable after the routing change landed.
  • Resolution: the broken reference was removed and deployed as API v1.23.1.
  • Hardening: automated checks were added to catch this entire class of defect before it ships.
Compliance notice · resolved in API v1.23.1permalink
Compliance noticeHighAPIAction required: No

Unsubscribe endpoint returned 401 for all requests

Between API v1.23.0 and v1.23.1, the `/v1/unsubscribe` endpoint (used for the CAN-SPAM/GDPR-required unsubscribe link in transactional emails) returned 401 Unauthorized for all requests. No unsubscribe records were lost — the endpoint returned a non-200 to clients, which retried or surfaced the error. No customer action required.

Affected:
API v1.23.0
Fixed in:
API v1.23.1
Components:
API · /v1/unsubscribe · transactional email footer
Show details ▾
  • The endpoint now correctly accepts unauthenticated requests as required for the unsubscribe use case.
  • No personal data was processed during the regression window. All requests during the window returned an explicit 401; retrying the unsubscribe link resolves the original opt-out.
Security advisory · resolved in API v1.22.6permalink
Security advisoryHighAPIMCP GatewayAction required: Yes

SSRF: outbound URL fetch paths now block requests to private and internal network addresses

Outbound URL fetches (used by webhook delivery, KB document ingestion, and a small number of MCP tools) could be tricked into reaching loopback or private addresses through address encoding techniques. The webhook/document-fetch paths now block requests to private or internal network addresses. Hosted customers received the fix automatically; self-hosted operators should upgrade to API ≥ v1.22.6.

Action required

Self-hosted operators: upgrade the API container to v1.22.6 or newer. No action required for customers on the hosted gotcontext.ai service.

Affected:
API ≤ v1.22.5
Fixed in:
API v1.22.6
CVE:
CVE pending assignment
CVSS:
7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Components:
Webhook delivery · Knowledge Hub
Show details ▾
  • All outbound URL fetch paths now enforce private/internal network blocking at both validation time and connection time.
  • No active exploitation was observed in production traffic. The advisory is published preemptively.

Older releases are listed above on this page. Follow release announcements on GitHub for change notifications. Security advisories and post-mortems get their own pages in the next release.

Citing a specific change? Use the permalink on each entry (/changelog#<entry-id>). To get notified when a security advisory or breaking change ships, subscribe via the Atom feed or create an account for email notifications.