# Roadmap

## 🎯 Project Status

**Current Version:** v1.0.0 (release branch ready)
**MCP Registry Status:** Published

### ✅ Completed Features

#### Core Infrastructure
- [x] FastMCP streamable HTTP transport migration (v0.2.0)
- [x] Docker containerization with multi-stage builds
- [x] Environment-based configuration with dual .env support
- [x] Enhanced error handling and structured logging
- [x] Comprehensive test suite (unit, integration, security tests)
- [x] GitHub Actions CI/CD pipeline
- [x] Stale issue management workflow (auto-close inactive issues)
- [x] Lock closed issues workflow (prevent zombie threads)
- [x] Remove autoclose label workflow (respond to user activity)
- [x] PyPI package publishing as `redmine-mcp-server` (v0.4.2)
- [x] MCP Registry preparation with validation (v0.4.3)
- [x] Console script entry point for easy execution
- [x] .env loading from current working directory for pip installs (v0.7.1)

#### Redmine Integration
- [x] List accessible projects
- [x] Get issue details with comments and attachments
- [x] Create and update issues with field resolution
- [x] List issues with flexible filtering (project, status, tracker, assignee, priority) (v0.11.0)
  - Selective field returns via `fields` parameter (~96% token reduction)
- [x] Search issues by text query with pagination and field selection (v0.7.0)
- [x] Global search across all Redmine resources (v0.9.0)
  - Search issues, wiki pages, and other resources with `search_entire_redmine()`
  - Server-side pagination with configurable limit and offset
  - Requires Redmine 3.3.0+
- [x] Wiki page retrieval with version history (v0.9.0)
  - `get_redmine_wiki_page()` for retrieving wiki content
  - Optional version parameter for specific page versions
  - Attachment metadata support
- [x] Wiki page editing — create, update, delete (v0.10.0)
- [x] Centralized error handling with 12 error types and actionable messages (v0.10.0)
- [x] Server-side pagination with token management (v0.4.0)
- [x] Project versions/milestones listing with status filtering (v0.12.0)
  - `list_redmine_versions()` with open/locked/closed filtering
- [x] Required custom field autofill with auto-retry on validation errors (v0.12.0)
  - Opt-in via `REDMINE_AUTOFILL_REQUIRED_CUSTOM_FIELDS=true`
  - Fills from Redmine defaults or `REDMINE_REQUIRED_CUSTOM_FIELD_DEFAULTS` env var
- [x] Download attachments with HTTP URLs
- [x] Smart project status summarization with activity analysis
- [x] Automatic status name to ID resolution
- [x] Project members listing with roles (v1.0.0)
  - `list_project_members()` returns user/group info with assigned roles
- [x] Time tracking — full CRUD (v1.0.0)
  - `list_time_entries()` with filtering by project, issue, user, date range
  - `create_time_entry()` — log time against projects or issues
  - `update_time_entry()` — modify existing time entries
  - `list_time_entry_activities()` — discover valid activity IDs
- [x] Journal pagination on `get_redmine_issue` (`journal_limit`/`journal_offset`) (v1.0.0)
- [x] Include flags on `get_redmine_issue` (watchers, relations, children) (v1.0.0)

#### Security & Performance
- [x] Path traversal vulnerability fix (CVE, CVSS 7.5)
- [x] UUID-based secure file storage
- [x] Automatic file cleanup with configurable expiry
- [x] HTTP file serving endpoint with time-limited URLs
- [x] Server-controlled storage policies
- [x] 95% memory reduction with pagination
- [x] 87% faster response times
- [x] MCP security fix (CVE-2025-62518) via mcp v1.19.0 (v0.6.0)
- [x] SSL/TLS certificate configuration support (v0.8.0)
  - Self-signed certificates (`REDMINE_SSL_CERT`)
  - Mutual TLS/mTLS (`REDMINE_SSL_CLIENT_CERT`)
  - SSL verification control (`REDMINE_SSL_VERIFY`)
  - Dynamic test certificate generation (removed private keys from repo)
- [x] Prompt injection protection with `<insecure-content>` boundary tags (v1.0.0)
  - `wrap_insecure_content()` wraps user-controlled content in unique boundary tags
  - Applied to descriptions, journal notes, wiki text, excerpts, version descriptions
- [x] Read-only mode via `REDMINE_MCP_READ_ONLY` env var (v1.0.0)
  - Guards all write tools; read tools and local operations unaffected

#### Authentication
- [x] API key authentication
- [x] Username/password authentication
- [x] OAuth2 per-user authentication mode (v1.0.0)
  - `REDMINE_AUTH_MODE=oauth` with Bearer token validation
  - OAuth discovery endpoints (RFC 8707, RFC 8414)
  - Token revocation endpoint (RFC 7009)
  - Per-request client isolation via ContextVar
  - Requires Redmine 6.1+ (Doorkeeper)

#### Documentation & Quality
- [x] Complete API documentation with examples
- [x] PyPI installation instructions
- [x] PEP 8 compliance with flake8 and black
- [x] Comprehensive README with tool descriptions
- [x] CHANGELOG with semantic versioning
- [x] Separated documentation structure (v0.5.2)
  - `docs/tool-reference.md` - Complete tool documentation
  - `docs/troubleshooting.md` - Comprehensive troubleshooting guide
  - `docs/contributing.md` - Developer guide
  - `docs/oauth-setup.md` - OAuth2 multi-tenant setup guide (v1.0.0)
- [x] Test coverage tracking via Codecov integration (v0.8.1)
- [x] GitHub issue templates (bug report, feature request) (v0.8.1)
- [x] Dependabot integration for automated dependency updates (v0.8.1)
- [x] 689 tests passing (v1.0.0)

#### Python Compatibility
- [x] **Support Python 3.10+** (v0.5.0)
  - Tested with Python 3.10, 3.11, 3.12, 3.13
  - `requires-python = ">=3.10"` in pyproject.toml
  - CI tests multiple Python versions

### 📋 v1.0.0 Release Checklist

- [x] Remove deprecated `list_my_redmine_issues` (breaking change)
- [x] Prompt injection protection with `<insecure-content>` boundary tags
- [x] Read-only mode via `REDMINE_MCP_READ_ONLY` env var
- [x] Journal pagination on `get_redmine_issue`
- [x] Include flags on `get_redmine_issue` (watchers, relations, children)
- [x] OAuth2 per-user authentication
- [x] Project members tool
- [x] Time tracking tools (list, create, update, list activities)
- [x] Rebase release/1.0.0 onto develop with all features
- [x] Version bump to 1.0.0, Development Status → Production/Stable

### 📅 Planned Releases

#### v1.1.0 — FastMCP v3 Core Migration ✅
*Priority: High | Effort: Low | Status: Implemented on `feature/fastmcp-v3`*

- [x] `pyproject.toml`: replace `mcp[cli]>=1.25.0,<2` with `fastmcp>=3.0.0,<4`
- [x] `redmine_handler.py`: update import from `mcp.server.fastmcp` → `fastmcp`
- [x] `redmine_handler.py`: remove `host=_server_host` from `FastMCP()` constructor (DNS rebinding protection removed entirely from v3 — no behaviour change for Docker deployments)
- [x] `main.py`: replace `mcp.streamable_http_app()` with `mcp.http_app(stateless_http=True)`; remove `mcp.settings.stateless_http = True`
- [x] `test_main.py`: remove `mock_mcp.settings.stateless_http` assertion; delete `test_dns_rebinding_protection.py`
- [x] `list_redmine_issues` / `search_redmine_issues`: convert `**kwargs` → explicit typed parameters (FastMCP v3 rejects `**kwargs` tool functions); extra filters still available via `filters={}`/`options={}` dict params

#### v1.2.0 — OpenTelemetry Observability
*Priority: Medium | Effort: Low*

- [ ] Add optional `opentelemetry-sdk` dependency
- [ ] Document OTEL configuration in `docs/contributing.md`
- [ ] Zero overhead when unconfigured; production-grade tracing (tool calls, Redmine API latency, error rates) when OTEL SDK is present

#### v2.0.0 — Native FastMCP v3 Auth Migration
*Priority: High (security) | Effort: Medium*

Replace `RedmineOAuthMiddleware` with FastMCP v3's native `auth=` constructor parameter (`JWTVerifier` / `OAuthProxy` / `MultiAuth`). Closes the medium-likelihood `custom_route` auth bypass risk identified in the compatibility analysis.

- [ ] Evaluate `JWTVerifier` vs `OAuthProxy` fit for Doorkeeper OAuth flow
- [ ] Migrate `RedmineOAuthMiddleware` Starlette middleware to native `auth=` parameter
- [ ] Verify OAuth discovery endpoints remain functional
- [ ] Full auth integration tests

### 🔮 Future (Only if Users Request)
- [ ] YAML response format option
- [ ] User instructions file (`REDMINE_INSTRUCTIONS`)
- [ ] Bulk operations

### 🔧 Maintenance Notes

- Monitor GitHub issues for actual user problems
- Only add features/fixes based on real user feedback
- Keep the codebase simple and maintainable

---

**Last Updated:** 2026-03-21 (v1.0.0 released; FastMCP v3 migration implemented on `feature/fastmcp-v3`)
