midgard 1.0.0-alpha3

Third alpha. Bifrost, the MCP bridge, moves to MCP Server 2.x. The port started from Manuel Garcia's merge request in #2, thanks Manuel.

Before you upgrade

Sites on alpha1 or alpha2 run MCP Server 1.x, which is no longer supported upstream. The steps are in the Bifrost README ("Upgrading from mcp_server 1.x"):

composer require 'drupal/midgard:^1.0@alpha' 'drupal/mcp_server:2.0.0-beta5@beta' 'drupal/mcp_server_oauth:1.0.0-alpha1@alpha' -W
composer reinstall drupal/mcp_server --prefer-install=dist
drush updatedb
drush cache:rebuild

The reinstall line matters: MCP Server 1.x came from git, Composer keeps updating it from git, and a git copy lacks the version line the OAuth companion checks. MCP clients need the new endpoint (/mcp, it was /_mcp), the new tool names (midgard_skill__examples_echo instead of examples.echo) and, over STDIO, an account: drush midgard:bifrost:listen editor.

Security

• A Bifrost client now only gets the tools of the scopes it was registered with (bifrost:read, bifrost:write, bifrost:execute, matching each skill's scope). The scopes were never checked before, so a client registered read-only could also use write and execute skills. drush updatedb gives bifrost:read to clients registered without scopes, and drush midgard:bifrost:clients lists each client's scopes.
• A tool call Bifrost refuses leaves a denied row in the audit trail, with the OAuth client and the reason. Every tool-call row now names the client, and the Hall shows it.
• A guarded skill is no longer exposed over MCP, even with expose_via_mcp: TRUE: a tool call ran it directly, without Heimdall's guard. None of Midgard's own skills is both guarded and exposed.
• A consumer binds to a Bifrost client only by its exact client ID (the lookup compared case-insensitively). The Hall's read endpoints are cached privately (they said public). OAuth dynamic client registration stays closed unless settings.php opens it, and the access mcp server permission is granted to no role.

Fixes

• drush midgard:install could exit 2 with "Doctor reports blocking issues" when it ran again after a good install.

Known issues (from MCP Server 2.0.0-beta5)

• A tool whose skill loads entities answers over HTTP as a server-sent event stream even to JSON-only clients. Clients that follow the spec read it fine; it's fixed in MCP Server after beta5.
• A client that sends the MCP-Protocol-Version: 2026-07-28 header gets a 400. Clients that negotiate 2025-11-25 or earlier work.

The full list is in CHANGELOG.md.