diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index a36bf1fa..045aff17 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,4 +1,4 @@
 {
   ".": "0.45.2",
-  "mcp-package": "0.1.2"
+  "mcp-package": "0.1.3"
 }
diff --git a/mcp-package/CHANGELOG.md b/mcp-package/CHANGELOG.md
new file mode 100644
index 00000000..8a1c699a
--- /dev/null
+++ b/mcp-package/CHANGELOG.md
@@ -0,0 +1,8 @@
+# Changelog
+
+## [0.1.3](https://github.com/grafana/plugin-validator/compare/mcp/v0.1.2...mcp/v0.1.3) (2026-07-27)
+
+
+### 🐛 Bug Fixes
+
+* **security/critical/mcp-package:** update dependency tar to ^7.5.21 [security] ([#656](https://github.com/grafana/plugin-validator/issues/656)) ([2426e36](https://github.com/grafana/plugin-validator/commit/2426e36a6a8e0618a25b044a354097816312fb26))
diff --git a/mcp-package/package.json b/mcp-package/package.json
index 845fd32c..dc7e757e 100644
--- a/mcp-package/package.json
+++ b/mcp-package/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@grafana/plugin-validator-mcp",
-    "version": "0.1.2",
+    "version": "0.1.3",
     "description": "Model Context Protocol (MCP) server for Grafana Plugin Validator - provides AI assistants with validation capabilities",
     "main": "index.js",
     "repository": {
@@ -34,7 +34,7 @@
         "urlTemplate": "https://github.com/grafana/plugin-validator/releases/download/mcp/v{{version}}/plugin-validator-mcp_{{version}}_{{platform}}_{{arch}}.tar.gz"
     },
     "dependencies": {
-        "tar": "^7.5.21"
+        "tar": "^7.5.16"
     },
     "engines": {
         "node": ">=18.0.0"