v1.5.0

Changelog

• 538050e feat: support Umami Cloud via API key authentication

v1.4.1

Features

• Team-based website discovery — New UMAMI_TEAM_ID env var for self-hosted instances where websites are assigned to teams. Also supports X-Umami-Team-Id header for HTTP transport.

v1.3.1

Changelog

• Accept ISO 8601 date strings (e.g. 2026-03-23, 2026-03-23T14:30:00Z) in addition to Unix timestamps — prevents LLM timestamp calculation errors (#21, thanks @juliendoclot)

Closes #20

v1.3.0

Security Hardening (HTTP Transport)

• Credentials moved from URL query params to X-Umami-* headers (query params still supported as deprecated fallback)
• Configurable CORS origin restriction via ALLOWED_ORIGINS env var
• 1MB request body size limit to prevent OOM
• Session limit via MAX_SESSIONS env var (default 1000)
• websiteID validation to prevent path injection

Breaking Changes

HTTP mode clients should migrate credentials from query parameters to X-Umami-Host, X-Umami-Username, X-Umami-Password headers. Query parameters still work but are deprecated and will log a warning.

Closes #19

v1.2.1

Changelog

• f602e81 feat: serve landing page from Docker and document remote usage
• e36710b fix: Umami v2 API compatibility for stats, team websites, and metric types
• 06b75e0 fix: allow README.md through .dockerignore for landing page build
• aea30d1 fix: extract path metric type constant for goconst linter

v1.2.0

Changelog

• 2e1d460 feat: add MCP prompts and resources capabilities (#12)

v1.1.2

Changelog

• c6f40a0 Merge pull request #14 from Macawls/feat/server-card-endpoint
• 6c7a827 feat: add server card endpoint for Smithery discovery

v1.1.1

Changelog

• 58b5973 Merge pull request #13 from Macawls/fix/smithery-compliance
• f425807 fix: Smithery deployment compliance

v1.1.0

Changelog

• fac23fa Add glama.json
• 54d9c28 Merge branch 'main' of https://github.com/Macawls/umami-mcp-server
• 75ff900 Merge pull request #11 from Macawls/feat/streamable-http-transport
• 18d4c86 Update README.md
• 409232a feat: add Streamable HTTP transport for Smithery deployment
• 9c77b70 fix: address golangci-lint findings
• e5255a2 fix: pin golangci-lint and Go versions in CI
• 3c7b9f1 fix: remove always-constant status param from writeJSONRPCError
• ef78412 fix: rename writeJSONRPC to writeJSONRPCError, remove unused param
• 3e9eb67 slight refactor

v1.0.5

Changelog

• 66c2c5c fix: remove unused nolint directive