Skip to content

MCP Zero Trust Layer 0.1.2

Choose a tag to compare

View all tags
@686f6c61 686f6c61 released this 14 Jun 09:42
v0.1.2
d2386f4

MCP Zero Trust Layer 0.1.2

This release focuses on release-readiness, security hardening and operational polish for the first public PyPI path.

Changed

  • Refactored policy evaluation, request routing, capability scanning, input validation and CLI diagnostics into smaller internal units with clearer responsibilities.
  • Kept policy matching and policy explanation behavior aligned by sharing the same match-failure logic.
  • Improved the approval review CLI so mcpzt approve list prints full approval IDs that can be copied directly into mcpzt approve allow or mcpzt approve deny.
  • Simplified Docker image construction while preserving the non-root runtime user.
  • Added reusable static-analysis project configuration for local and CI quality gates.

Security

  • Hardened Helm deployment defaults by disabling automatic service account token mounting for the application pod.
  • Added explicit ephemeral-storage requests and limits to the Helm chart defaults.
  • Made subprocess execution for stdio MCP upstreams and secret-provider CLIs explicit with shell=False.
  • Added a timeout when reading secrets through external secret-provider CLIs so secret resolution fails closed instead of hanging indefinitely.
  • Kept URL validation protections for private, loopback, link-local and cloud metadata destinations while making validator internals easier to review.

Validation

  • Full test suite: 85 tests passing.
  • Release package build and twine check: passing.
  • Clean wheel install smoke test: passing.
  • Multi-MCP HTTP E2E with GitHub, Postgres, filesystem and CRM simulations: passing.
  • Stdio wrapper E2E: passing.
  • Docker build/run and Helm template/lint: passing.
  • Bandit and pip-audit: clean.
  • SonarQube quality gate: OK with 0 open issues.
Assets 2
Loading