chore: bump version to 1.6.0, add changelog

Author: prih

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphmemory/server",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "MCP server for semantic graph memory from markdown files",
   "main": "dist/cli/index.js",
   "bin": {

package.json

@@ -0,0 +1,85 @@
+---
+slug: changelog-1-6-0
+title: "Graph Memory 1.6.0"
+authors: [graphmemory]
+tags: [release, changelog, oauth, mcp]
+description: "Graph Memory 1.6.0 — OAuth 2.0 for Claude.ai connectors, cleaner MCP responses, array syntax for include patterns, and tool naming consistency."
+---
+
+Graph Memory **1.6.0** ships OAuth 2.0 support for AI chat clients, cleaner MCP tool responses, and several developer-experience improvements.
+
+<!-- truncate -->
+
+## OAuth 2.0 for AI chat clients
+
+You can now connect Graph Memory to **Claude.ai** (and any OAuth-capable MCP client) without manually passing API keys. The server implements the OAuth 2.0 **client_credentials** flow — no login pages, no redirects.
+
+### How to connect Claude.ai
+
+1. Open **Claude.ai → Settings → Connectors → Add custom connector**
+2. Enter your server URL: `https://yourserver.com/mcp/your-project`
+3. Under **Advanced settings**, enter:
+   - **OAuth Client ID** — your `userId` from `graph-memory.yaml`
+   - **OAuth Client Secret** — your `apiKey` from `graph-memory.yaml`
+
+Claude.ai handles the rest automatically: it fetches a short-lived token, uses it for all MCP requests, and refreshes it when it expires.
+
+### New endpoints
+
+| Endpoint | Purpose |
+|----------|---------|
+| `GET /.well-known/oauth-authorization-server` | RFC 8414 discovery |
+| `POST /oauth/token` | Issues a 1-hour Bearer JWT |
+
+Requirements: `jwtSecret` must be set in `server` config; a public HTTPS URL is needed for Claude.ai (localhost works for local clients).
+
+Existing API key authentication is fully backward-compatible — Claude Code, Cursor, and Windsurf continue to work unchanged.
+
+## Cleaner MCP tool responses
+
+MCP tool responses no longer include internal graph fields, null values, or empty arrays that were cluttering LLM context:
+
+- `docs_get_node` — removed `fileEmbedding`, `pendingLinks`, `mtime`
+- `code_get_symbol` — removed `fileEmbedding`, `pendingImports`, `pendingEdges`
+- `notes_get`, `tasks_get`, `skills_get` — removed `version`; null fields and empty arrays stripped from output
+- `notes_list` — removed content preview (not in tool description)
+
+This reduces token usage and makes responses easier for models to parse.
+
+## Array syntax for `include` patterns
+
+The `include` field in graph config now accepts a YAML array in addition to a single glob string, consistent with how `exclude` already works:
+
+```yaml
+graphs:
+  docs:
+    include:
+      - "**/*.md"
+      - "**/*.mdx"
+  code:
+    include:
+      - "**/*.ts"
+      - "**/*.tsx"
+```
+
+Single string syntax still works — no migration needed.
+
+## Tool naming and parameter consistency
+
+All 58 MCP tools were audited for naming consistency, parameter names, defaults, and parity with the REST API:
+
+- Tools renamed to consistent `graph_verb_noun` prefixes across all six graphs
+- Parameter names and defaults aligned between MCP tools and REST endpoints
+- Docs, site, UI help text, and the prompt builder updated to match
+
+## Security improvement
+
+Authentication is now checked **before** project lookup in the MCP handler. Previously, unauthenticated requests could determine which project IDs existed by observing 404 vs 401 responses. Now all unauthenticated requests get a consistent 401 with `WWW-Authenticate: Bearer`.
+
+---
+
+Update with:
+
+```bash
+npm install -g @graphmemory/server@1.6.0
+```