v0.3.0

0.3.0 - 2026-07-21

This release is a security-hardening pass with full remediation of an internal audit, plus a large test and typing investment. Several changes affect behavior of approvals and the approval UI; review the Security section before upgrading a live deployment.

Added

• Added output.redact_patterns for value-level output redaction. Regular expressions are applied to string values at any depth, so secrets and PII embedded inside MCP tool-result text (for example an email inside content[].text) can be redacted where there is no discrete field to target.
• Added audit.hmac_key and audit.hmac_key_env for a keyed audit hash chain. When set, each event hash is an HMAC-SHA256 so an attacker with write access to the log cannot recompute a valid chain after tampering. mcpzt audit verify uses the configured key automatically.
• Added a monotonic sequence number to audit events to help detect gaps.
• Added approvals.require_separation_of_duties (default true): the identity that triggered a call cannot approve its own request.
• Added mypy type checking as a required CI gate, with types-PyYAML and a project mypy configuration.

Changed

• Approvals are now single use. A valid retry is executed and the approval is atomically marked consumed in the same locked step; the same approval_id can no longer be replayed within its TTL.
• The approval UI (mcpzt approve serve) now authenticates every decision through the project auth configuration and derives decided_by from the authenticated identity instead of the request body.
• Approval status transitions are validated: terminal decisions (denied, expired, consumed) are immutable and cannot be flipped back to approved.
• The approval binding now includes method in addition to server, capability, identity and argument hash.
• The HTTP runtime offloads the synchronous pipeline to a worker thread so a slow upstream no longer stalls the event loop for other requests.
• Upstream MCP sessions are cached per downstream session key instead of per server, so sessions are not shared across distinct downstream clients, and the cache is guarded by a lock.
• Hardened ruff configuration (import sorting, bugbear, pyupgrade, comprehension and simplification rules) and enforced 100% coverage in CI with --cov-fail-under=100.
• Retyped the policy engine to use CapabilityMetadata | None and Identity instead of object, and resolved typing issues across the package.
• mcpzt demo now selects free host ports for the fake upstream and gateway instead of hard-coding 3001/8765, the fake upstream fails loudly if it cannot bind, and the runner polls health instead of sleeping. This avoids the demo silently colliding with an already-listening service.

Security

• Hardened the sql_read_only validator against parser-differential bypasses: it now rejects stacked statements, MySQL executable comments (/*! ... */), a broader destructive-keyword list, and host-reaching functions such as load_extension, COPY ... TO PROGRAM and ATTACH.
• Made the filesystem_path validator fail safer: broader sensitive-path defaults (~/.ssh, ~/.aws, /proc, /sys, /root) and case-insensitive comparison so /ETC is caught on case-insensitive filesystems.
• Hardened URL/SSRF checks: decimal, hex and octal IP encodings are normalized and blocked, and reserved, multicast and CGNAT ranges are treated as private.
• Validators now fail closed on unexpected errors, DNS resolution has a timeout, and invalid regex patterns no longer raise.
• The audit log is written with 0600 permissions and appended under an exclusive lock so concurrent writers cannot fork the hash chain.
• Broadened audit and approval redaction to cover more key names and secret-shaped values (AKIA access keys, JWTs, PEM private keys, base64 bearer tokens).
• input allowed-fields validation is now recursive, so an allowed parent no longer permits arbitrary nested keys.
• Approval webhook delivery failures are always logged to stderr, so an alerting-channel outage is never silent.
• Capability-condition evaluation and stdio upstream reads are bounded, avoiding hangs on a stuck upstream.

Tests

• Raised test coverage to 100% (498 tests) and enforced it in CI.
• Added regression coverage for approval single-use replay, approval UI authentication and separation of duties, the SQL and filesystem validator bypasses, keyed audit chains, value-pattern output redaction and recursive input allowlists.

MCP Zero Trust Layer 0.2.0

Added

• Added mcpzt onboard to discover one or more MCP upstreams and generate a conservative starter config with capability mappings, reviewable policies, snapshots and an onboarding report.
• Added SQLite approval storage through approvals.backend: sqlite while preserving the existing approval CLI and approval retry contract.
• Added mcpzt approve serve, a self-hosted approval review UI with human-readable approval review and JSON approval endpoints.
• Added mcpzt audit search for filtering JSONL audit logs by event type, server, decision, policy ID, correlation ID, approval ID and time window.
• Added mcpzt policy coverage, mcpzt policy risks and mcpzt policy unused for policy coverage review, risk detection and stale-policy analysis.
• Added a production-shaped OIDC gateway example with group-based policies, upstream credentials, SQLite approvals and output redaction.
• Added mcpzt client import to wrap existing Claude Desktop, Cursor and VS Code MCP client configs with MCPZT-generated policy and client files.
• Added real MCP discovery handshakes during capability discovery so upstreams that require initialize can be onboarded correctly.

Changed

• Updated generated starter configs to make the approval backend explicit.
• Updated onboarding inference to use MCP tool annotations such as readOnlyHint and destructiveHint when classifying capabilities.
• Updated stdio upstream execution to pass configured environment variables through explicit secret references.
• Updated HTTP upstream handling to retain MCP session IDs across requests to the same logical server.
• Updated production guidance to use SQLite approvals for long-running single-instance gateways and to document the approval UI security posture.
• Expanded rollout guidance with onboarding, policy coverage analysis, audit search and approval UI workflows.
• Updated Docker Compose and Helm release defaults to the 0.2.0 image tag and aligned the Helm example with SQLite approvals.
• Extended PyPI release preflight guidance with onboarding and policy-analysis smoke checks.

Tests

• Added coverage for SQLite approvals, approval UI review, audit search, onboarding config generation and policy analysis commands.
• Added CLI regression coverage for SQLite approval listing, audit search, policy coverage, onboarding from --server name=url and imported client configs.

MCP Zero Trust Layer 0.1.3

Added

• Added mcpzt demo to generate a runnable local demo with a fake MCP upstream, policy config, demo client and shell runner.
• Added mcpzt approve list --format json for automation-friendly approval review.
• Added mcpzt config lint with table and JSON output for insecure or fragile configuration patterns.
• Added stricter doctor modes with mcpzt doctor --strict and mcpzt doctor --production.
• Added release workflow steps for official GHCR container publishing and post-publish PyPI install verification.

Changed

• Updated public install and deployment guidance for the current 0.x line instead of hard-coding stale point-release language.
• Updated Docker Compose and Helm defaults to use the official ghcr.io/686f6c61/mcp-zero-trust-layer image path.
• Clarified that claude-code client config output is a shell command, while json is the machine-readable format.
• Kept generated demo audit and approval state inside the demo directory when running run_demo.sh.
• Avoided creating an approval lock file when listing an empty, not-yet-created approval store.

Container Images

• Published official GHCR tags 0.1.3, 0.1 and latest with linux/amd64 and linux/arm64 manifests.

MCP Zero Trust Layer 0.1.2

MCP Zero Trust Layer 0.1.2

This release focuses on release-readiness, security hardening and operational polish for the first public PyPI path.

Changed

• Refactored policy evaluation, request routing, capability scanning, input validation and CLI diagnostics into smaller internal units with clearer responsibilities.
• Kept policy matching and policy explanation behavior aligned by sharing the same match-failure logic.
• Improved the approval review CLI so mcpzt approve list prints full approval IDs that can be copied directly into mcpzt approve allow or mcpzt approve deny.
• Simplified Docker image construction while preserving the non-root runtime user.
• Added reusable static-analysis project configuration for local and CI quality gates.

Security

• Hardened Helm deployment defaults by disabling automatic service account token mounting for the application pod.
• Added explicit ephemeral-storage requests and limits to the Helm chart defaults.
• Made subprocess execution for stdio MCP upstreams and secret-provider CLIs explicit with shell=False.
• Added a timeout when reading secrets through external secret-provider CLIs so secret resolution fails closed instead of hanging indefinitely.
• Kept URL validation protections for private, loopback, link-local and cloud metadata destinations while making validator internals easier to review.

Validation

• Full test suite: 85 tests passing.
• Release package build and twine check: passing.
• Clean wheel install smoke test: passing.
• Multi-MCP HTTP E2E with GitHub, Postgres, filesystem and CRM simulations: passing.
• Stdio wrapper E2E: passing.
• Docker build/run and Helm template/lint: passing.
• Bandit and pip-audit: clean.
• SonarQube quality gate: OK with 0 open issues.

MCP Zero Trust Layer 0.1.1

Patch release focused on discovery correctness for policies with call-time guards.

Fixed:

• Capability discovery no longer runs call-time validators or required input checks for tools/list, resources/list and prompts/list.
• Tools protected by validators such as sql_read_only now remain visible during discovery.
• Tools with input.required_fields now remain visible during discovery, while actual calls still enforce the input contract.

Verified before release:

• ruff check .
• pytest -q with 84 passing tests
• python -m build
• twine check dist/*
• clean wheel install smoke test
• Docker build and runtime smoke test

MCP Zero Trust Layer 0.1.0

MCP Zero Trust Layer 0.1.0

Initial developer preview of MCP Zero Trust Layer, an open-source and self-hosted Zero Trust policy enforcement layer for MCP servers. MCPZT runs in front of existing MCP servers and gives teams a place to enforce policy, approvals, argument validation, output controls, audit and observability without rewriting the upstream MCP server.

This release is marked as a draft pre-release while PyPI Trusted Publishing is configured. Publishing the release later will trigger the PyPI workflow.

Highlights

• HTTP proxy runtime for MCP Streamable HTTP POST requests.
• Stdio wrapper runtime for command-based MCP servers.
• Multi-MCP routing with per-server policy isolation through /mcp/{server_name}.
• Deterministic policy engine with allow, deny, hide, require_approval, redact, limit, transform and log effects.
• mcpzt policy explain for debugging matched policies, skipped policies and selected decisions.
• Parameter-level policy controls through native input blocks.
• Built-in validators for SQL, filesystem paths, URLs, email, regex, required/forbidden fields and field sizes.
• Human approval flow with approval binding to identity, server, capability, policy and argument hash.
• Output enforcement for JSON-RPC result and error payloads.
• Capability discovery, diffing and deterministic security scanning.
• JSONL audit logging with recursive secret redaction and hash-chain verification.
• Prometheus-format decision metrics.
• Auth modes for none, static token, API key, JWT and OIDC/JWKS.
• Secret references with env:, ${VAR}, file:, op://, aws-sm:// and vault://.
• Optional OPA policy adapter.
• Dockerfile, production Docker Compose recipe and Helm starter chart.
• Public docs for multi-MCP use cases, production operations and PyPI release flow.

Try It Locally

From a checkout:

python -m venv .venv
. .venv/bin/activate
python -m pip install -e ".[dev]"
mcpzt version
mcpzt init --config mcpzt.yaml --force
mcpzt config validate --config mcpzt.yaml

From the attached wheel:

python -m venv /tmp/mcpzt-wheel-smoke
/tmp/mcpzt-wheel-smoke/bin/python -m pip install ./mcp_zero_trust_layer-0.1.0-py3-none-any.whl
/tmp/mcpzt-wheel-smoke/bin/mcpzt version

With Docker:

docker build -t mcpzt:local .
docker run --rm mcpzt:local version

Release Artifacts

• mcp_zero_trust_layer-0.1.0.tar.gz
• mcp_zero_trust_layer-0.1.0-py3-none-any.whl

The source distribution was inspected to ensure internal planning files, local audit files, approval stores, secrets, virtual environments, caches and generated build directories are excluded.

Validation

• ruff check . passed.
• pytest -q passed with 82 tests.
• python -m build passed.
• twine check dist/* passed.
• GitHub Actions CI passed on main.

Known Notes

• This is a developer preview, not a 1.0 stability promise.
• HTTP GET SSE streams are not implemented in this release; the HTTP endpoint returns 405 for GET.
• Request-scoped upstream SSE passthrough is intentionally left for a later release because streaming needs a separate security design.
• The local approval store is file-backed. Horizontal production deployments should use storage with correct locking semantics or wait for a shared approval backend.