chore(release): bump version to 1.2.0

- Add `bl mcp` command group, security hardening, watermark/flag fixes
- Update CHANGELOG/CHANGELOG_CN with 1.2.0 entry
- Add MCP integration to README features

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,29 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 [中文版](CHANGELOG_CN.md) · [README](README.md) · [Contributing](CONTRIBUTING.md)
 
+## [1.2.0] - 2026-06-05
+
+### Added
+
+- `bl mcp` command group: `bl mcp list` to list MCP servers, `bl mcp tools <server>` to inspect available tools, and `bl mcp call <server>.<tool>` to invoke a tool with `--arg k=v` or `--json`.
+
+### Fixed
+
+- Image/video watermark was always on regardless of config; now respects `bl config set watermark false`.
+- Paired flags (e.g. `--watermark` / `--no-watermark`) are properly mutually exclusive.
+- Null-value flag validation no longer crashes on missing optional arguments.
+- **Security**: credentials no longer leak to on-disk logs; file permissions tightened.
+- **Security**: `base_url` / `console_gateway_url` validated as real HTTP(S) URLs.
+- **Security**: script/JS `code` fields require a string literal (blocks untrusted-code RCE).
+- **Security**: URL path segments are percent-encoded; SSE buffer is bounded.
+- **Security**: pipeline planning, pointer traversal, and concurrency hardened.
+- MCP commands now handle auth _after_ arg validation and dry-run checks.
+
+### Changed
+
+- Flag default-value text is now unified and de-duplicated across all commands.
+- Illegal/unknown flag names surface a clear error instead of silently ignoring.
+
 ## [1.1.3] - 2026-06-02
 
 ### Added

CHANGELOG_CN.md

@@ -6,6 +6,29 @@
 
 [English](CHANGELOG.md) · [README](README_CN.md) · [参与贡献](CONTRIBUTING_CN.md)
 
+## [1.2.0] - 2026-06-05
+
+### 新增
+
+- `bl mcp` 命令组：`bl mcp list` 列出 MCP 服务器，`bl mcp tools <server>` 查看可用工具，`bl mcp call <server>.<tool>` 通过 `--arg k=v` 或 `--json` 调用工具。
+
+### 修复
+
+- 图片/视频水印始终开启的问题，现在正确遵守 `bl config set watermark false` 配置。
+- 成对 flag（如 `--watermark` / `--no-watermark`）现已正确互斥。
+- 可选参数为空时 flag 校验不再崩溃。
+- **安全**：凭据不再泄漏到磁盘日志，文件权限已收紧。
+- **安全**：校验 `base_url` / `console_gateway_url` 为合法 HTTP(S) URL。
+- **安全**：script/JS `code` 字段强制为字符串字面量（阻止不可信代码 RCE）。
+- **安全**：URL 路径段已百分号编码，SSE 缓冲区设上限。
+- **安全**：流水线规划、指针遍历及并发安全加固。
+- MCP 命令现在在参数校验和 dry-run 检查之后才处理鉴权。
+
+### 变更
+
+- 所有命令的 flag 默认值文案统一并去重。
+- 非法/未知 flag 名称现在会报明确错误，而非静默忽略。
+
 ## [1.1.3] - 2026-06-02
 
 ### 新增

README.md

@@ -32,6 +32,7 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 - **Image & video understanding** — Qwen-VL: long-form video analysis, chart/document parsing, visual reasoning, multilingual OCR
 - **Knowledge base & memory** — Multimodal RAG retrieval and cross-session memory for personalized, coherent dialogue
 - **App calls** — Invoke agents and workflows already published on Aliyun Model Studio
+- **MCP integration** — Orchestrate Bailian MCP servers: list services, inspect tools, and invoke any tool directly from the terminal
 - **Web search** — Real-time internet retrieval for up-to-date, accurate answers
 - **Console capabilities** — Browse Bailian apps (`app list`) and check free-tier quota (`usage free`)
 - **Local file auto-upload** — Every URL parameter accepts a local path; uploaded to free temp storage with 48-hour validity

README_CN.md

@@ -32,6 +32,7 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 - **图像与视频理解** — Qwen-VL：长视频解析、复杂图表与文档识别、视觉推理、多语种 OCR
 - **知识库与记忆库** — 多模态 RAG 检索 + 跨会话记忆，提供个性化连贯对话体验
 - **应用调用** — 调用已发布在阿里云百炼平台上的智能体与工作流应用
+- **MCP 集成** — 统一调度百炼 MCP 服务：列出服务、查看工具、直接在终端调用任意工具
 - **联网搜索** — 实时互联网信息检索，提升回答准确性及时效性
 - **控制台能力** — 浏览百炼应用（`app list`），查询模型免费额度（`usage free`）
 - **本地文件自动上传** — 所有 URL 参数同时支持本地路径，免费临时存储 48 小时

packages/cli/README.md

@@ -32,6 +32,7 @@ Equip your AI Agent out-of-the-box with these capabilities, composable across co
 - **Image & video understanding** — Qwen-VL: long-form video analysis, chart/document parsing, visual reasoning, multilingual OCR
 - **Knowledge base & memory** — Multimodal RAG retrieval and cross-session memory for personalized, coherent dialogue
 - **App calls** — Invoke agents and workflows already published on Aliyun Model Studio
+- **MCP integration** — Orchestrate Bailian MCP servers: list services, inspect tools, and invoke any tool directly from the terminal
 - **Web search** — Real-time internet retrieval for up-to-date, accurate answers
 - **Console capabilities** — Browse Bailian apps (`app list`) and check free-tier quota (`usage free`)
 - **Local file auto-upload** — Every URL parameter accepts a local path; uploaded to free temp storage with 48-hour validity

packages/cli/README_CN.md

@@ -32,6 +32,7 @@ _专为 AI Agent 打造，每个命令均可作为结构化工具调用。_
 - **图像与视频理解** — Qwen-VL：长视频解析、复杂图表与文档识别、视觉推理、多语种 OCR
 - **知识库与记忆库** — 多模态 RAG 检索 + 跨会话记忆，提供个性化连贯对话体验
 - **应用调用** — 调用已发布在阿里云百炼平台上的智能体与工作流应用
+- **MCP 集成** — 统一调度百炼 MCP 服务：列出服务、查看工具、直接在终端调用任意工具
 - **联网搜索** — 实时互联网信息检索，提升回答准确性及时效性
 - **控制台能力** — 浏览百炼应用（`app list`），查询模型免费额度（`usage free`）
 - **本地文件自动上传** — 所有 URL 参数同时支持本地路径，免费临时存储 48 小时

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bailian-cli",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "description": "CLI for Aliyun Model Studio (DashScope) AI Platform.",
   "keywords": [
     "agent",

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bailian-cli-core",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "description": "Core SDK for bailian-cli. See https://www.npmjs.com/package/bailian-cli for usage.",
   "homepage": "https://bailian.console.aliyun.com/cli",
   "bugs": {