Notechondria

Version: 0.1.16 Build Date: 2026-04-09T00:00

What's Changed

MCP Server (Model Context Protocol)

  • Added mcp Django app implementing the MCP 2025-03-26 specification over Streamable HTTP transport (JSON-RPC 2.0).
  • MCP endpoint at POST /mcp/ supports initialize, ping, tools/list, and tools/call methods.
  • 21 MCP tools covering all user-facing operations:
    • Profile: get_profile, update_profile
    • Notes: list_notes, get_note, create_note, update_note, delete_note, search_notes
    • Courses: list_courses, get_course, create_course, update_course, delete_course
    • Activity: get_heatmap, get_recent_activity
    • Planner: list_events, create_event, update_event
    • Versions: list_note_versions, snapshot_note
    • Attachments: list_attachments

API Key Authentication

  • Added api_key_hash and api_key_prefix fields to the Creator model (migration 0027).
  • New ApiKeyAuthentication DRF backend authenticates requests with Authorization: Bearer ntc_<32hex> headers.
  • POST /api/v1/auth/rotate-api-key/ generates a new API key (returns plaintext once; only SHA-256 hash is stored).
  • api_key_prefix exposed in the settings GET response so the frontend can display a masked key.
  • API key auth registered globally in REST_FRAMEWORK.DEFAULT_AUTHENTICATION_CLASSES.

Bug fixes (from previous session)

  • Fixed GitHub OAuth binding 400 error: added "bind" to intent choices in both OAuth serializers.
  • Optimized /front-page and /notes API performance: eliminated N+1 excerpt queries, annotated subscriber counts, deduplicated serialization.
  • Fixed avatar CORS: R2 media URLs rewritten to same-origin /media/ paths with a proxy view fallback.
  • Added SendIdentityCodeApiView for email-based identity verification before password/email changes.
  • Applied blur backdrop to change-email and change-password dialogs.
  • Removed duplicated metabolite name labels in splash screen (all 3 apps).
  • Added missing from django.conf import settings import in notes/api.py.

Files Changed

  • backend/mcp/__init__.py -- New MCP Django app
  • backend/mcp/apps.py -- App config with tool auto-registration
  • backend/mcp/protocol.py -- JSON-RPC 2.0 dispatch and MCP protocol handler
  • backend/mcp/views.py -- Streamable HTTP transport view (POST/GET/DELETE)
  • backend/mcp/urls.py -- URL routing for /mcp/
  • backend/mcp/tools.py -- 21 MCP tool implementations
  • backend/mcp/tests.py -- 39 tests covering auth, protocol, and all tools
  • backend/mcp/migrations/__init__.py -- Migrations package
  • backend/creators/models.py -- Added api_key_hash, api_key_prefix to Creator
  • backend/creators/migrations/0027_creator_api_key.py -- Migration for API key fields
  • backend/creators/authentication.py -- ApiKeyAuthentication DRF backend
  • backend/creators/api.py -- Added RotateApiKeyApiView, api_key_prefix in settings, "bind" intent, identity code verification
  • backend/notechondria/settings.py -- Added mcp to INSTALLED_APPS, ApiKeyAuthentication to DRF auth classes
  • backend/notechondria/api_urls.py -- Added rotate-api-key/, send-identity-code/ URL routes
  • backend/notechondria/urls.py -- Added /mcp/ route at root, media proxy
  • backend/notechondria/urls_test.py -- Added /mcp/ route for test runner
  • backend/notechondria/api_views.py -- Added media_serve proxy view for R2 CORS fix
  • backend/notes/api.py -- Added settings import, optimized queries, R2 URL rewrite
  • frontend/editor_app/lib/core/client.dart -- Added sendIdentityCode, updated changePassword/changeEmailRequest signatures
  • frontend/editor_app/lib/modules/settings.dart -- Identity verification flow, blur dialogs
  • frontend/editor_app/lib/app_shell.dart -- Wired new callback signatures
  • frontend/editor_app/lib/components/avatar.dart -- Error logging for failed image loads
  • frontend/*/lib/components/splash_screen.dart -- Removed duplicate metabolite name labels (all 3 apps)
  • docs/versions/0.1.16.md -- This version document
  • VERSION -- Bumped from 0.1.15 to 0.1.16