GML-2210 Release 1.0.4

[chengbiao-jin]

Release 1.0.4. Full detail in CHANGELOG.md.

Added

• Install from Claude Code as a plugin — the repository is now a plugin marketplace, so claude plugin marketplace add tigergraph/tigergraph-mcp followed by claude plugin install tigergraph@tigergraph replaces the three manual steps the docs previously prescribed: installing the package, writing a .env, and hand-writing an MCP client config. Claude Code prompts for the TigerGraph host and credentials, holds the password and API token in secure storage rather than a file on disk, and launches the server with uvx. Connection details can be changed later through Configure options without reinstalling. Requires uv on the PATH; the existing pip and conda installs are unaffected.
• Listed in the official MCP Registry — a server.json describes the published PyPI package, so MCP clients and directories that consume the registry can discover the server. Ownership is proven by a token in the README, which becomes the PyPI description.
• The server reports its own version — an MCP client's serverInfo now carries the tigergraph-mcp version rather than the SDK's, so a session can be traced to a release. The SDK constructor is probed rather than assumed, since the 1.x and 2.x signatures differ.
• run_query accepts parameters — a new params argument supplies values for the parameters an interpreted query declares, such as INTERPRET QUERY (INT top_k) … with {"top_k": 5}. TigerGraph's endpoint always accepted them, but the tool offered no way to pass them.
• run_installed_query can bound a query's time and resources — new timeout_ms, size_limit_bytes, thread_limit, memory_limit_mb, and replica arguments.

Changed

• Minimum pyTigerGraph version raised to 2.0.5 (was 2.0.4). Earlier versions garble run_query parameter values that contain spaces, quotes, &, %, #, or non-ASCII characters.

Fixed

• get_neighbors and get_node_degree handle any vertex ID — an ID containing a double quote broke the generated query, and text after the quote was run as GSQL. IDs are now escaped, and invalid type names are rejected before anything runs.

Notes for operators

The plugin offers the same tool selection shipped in 1.0.3: an optional field at install time accepts the --allowed-tools selectors, and leaving it empty offers all 69 tools. Serving only the tools that read cuts what an agent carries on every request by more than half.

In permission rules, a skill's allowed-tools, or a hook matcher, the plugin's server is named plugin:tigergraph:tigergraph. A pattern like mcp__tigergraph__.* does not match a plugin-provided server.

Release order

The plugin pins the package version it launches, so it only works once 1.0.4 is on PyPI. The publish order is tag, PyPI, conda, then the registry entry.

Verification

641 unit tests pass on pyTigerGraph 2.0.5. Against a live TigerGraph instance, through the MCP server:

• run_query parameters round-trip exactly, including a STRING with %, &, #, quotes and non-ASCII, a 64-bit INT above 2^53, and a VERTEX whose ID contains spaces.
• get_node_degree resolves an ID with spaces, and get_neighbors rejects an injected edge type before running anything.
• run_installed_query runs with time, memory, and thread limits, and the server enforces size_limit_bytes.

The end-to-end MCP workflow test passes at d528f32 against a live instance.

Refs: GML-2206, GML-2207, GML-2304, GML-2305, GML-2306, GML-2310