Skip to content

v0.9.0 - MCP stdio proxy

Choose a tag to compare

View all tags
@AGGIB AGGIB released this 07 Sep 22:06
· 21 commits to main since this release
v0.9.0
467b5cb

Stroq 0.9.0 — MCP stdio proxy

stroq mcp -- <server command> puts Stroq in front of any stdio MCP server, for clients that have no hooks (Claude Desktop, any mcpServers-style client) and as a second layer for the ones that do. Supported today: Claude Code, Cursor, Codex, Copilot CLI, Windsurf (native hooks) · OpenClaw (in-process plugin) · any MCP client (stdio proxy).

Added

  • MCP stdio proxy (stroq mcp --server <name> --client <client> --cwd <dir> -- <cmd…>). Every tools/call is judged before it is forwarded: a deny or a policy ask comes back as an isError tool result on the same id, naming the rule, and never reaches the server; the arguments are scanned whole by the secret egress guard, up to its 256 KiB window, and refused above it. tools/call, tools/list (including inputSchema), resources/read and prompts/get results go through the content scan, taint and provenance, and a suspect tool result is forwarded with one appended warning text item. Everything else is forwarded byte-for-byte, in order, with backpressure in both directions; legacy and 2026-07-28 (stateless, MRTR) servers alike. Fail-closed on malformed, unaddressable, BOM-prefixed-unparseable and batched tools/calls and on engine errors; oversize server lines streamed through unparsed; signals relayed with a SIGKILL escalation.
  • stroq init --agent mcp (--client claude-desktop|windsurf|cursor|claude-code or --config <path>, --unwrap, --dry-run): rewrites each stdio mcpServers entry to start through the proxy, preserves every other key, skips HTTP entries, replaces its own wrapper on re-run, refuses a file whose mcpServers is not an object.
  • stroq doctor gains an mcp proxy line per existing client config, with stale-wrapper detection after an upgrade.
  • Self-tamper protection for claude_desktop_config.json and mcp_config.json.
  • Demo examples/demo/run-mcp-demo.sh (fake stdio server, six asserted scenarios) in CI.

Limits

No ask (rendered as a block naming the rule). stdio servers only; HTTP entries are skipped and unprotected; VS Code and Codex config shapes are not rewritten. Results delivered outside the tools/call response (tasks extension, subscriptions, legacy sampling/elicitation payloads) are not scanned. Session taint is per client, not per conversation. Batches containing a tools/call are refused. The project directory is the one init ran in. .mcp.json and .cursor/mcp.json are not self-tamper protected. Tool arguments whose serialised form exceeds 256 KiB, the secret guard's scan window, are refused fail-closed (mcp-proxy-arguments-too-large); a server result above 8 MiB is forwarded unparsed, unscanned and untainted. Wire handling comes from the specification and three proxies, not a recorded client; Windows untested.

Install

npm install -g @stroq/cli@0.9.0   # once npm's review clears; until then:
npm install -g https://github.com/AGGIB/Stroq/releases/download/v0.9.0/stroq-cli-0.9.0.tgz
stroq init --agent mcp --client claude-desktop

stroq-cli-0.9.0.tgz sha256: 8761a5c2365e14c6467eaf9dcdd05bda770d70ac617463b7edf2023528746480

stroq attack: 12 scenarios, 8 blocked, 4 asked, 0 passed through.

Assets 3
Loading