v0.3.20

ToolTrust Scanner v0.3.20 / npm tooltrust-mcp 1.1.13

Added

• Detect Rust MCP server presence for rmcp ServerHandler implementations and handwritten serde_json tools/list handlers. Ignore comments and string examples. This is presence detection, not complete Rust schema extraction.
• Run CLI/MCP user-path verification in CI, including pagination, empty discovery, OSV failures and release packaging checks.
• Refresh reviewed malicious-package intelligence accumulated since v0.3.19.

Fixed

• Empty tool manifests and live discovery now fail explicitly instead of receiving a clean A. Gate cannot bypass missing discovery with --force.
• Failed OSV lookups, invalid responses, timeouts and partial dependency lookup failures now report scan incomplete. MCP returns tool errors and gate refuses installation.
• Update the Go toolchain to 1.26.9 and golang.org/x/text for security fixes.
• Preserve npm wrapper failure exits when a cached binary cannot start, and support an isolated cache via TOOLTRUST_CACHE_DIR.
• Align npm tooltrust-mcp 1.1.13 and registry metadata with scanner v0.3.20; the previous npm wrapper still selected v0.3.17.

Upgrade notes

• Scripts must handle nonzero exit when discovery is empty or OSV is unavailable. No success report is produced for these incomplete scans; a pre-existing output file is not evidence of a successful new run.
• TOOLTRUST_OSV_URL can select a trusted OSV-compatible endpoint (HTTPS, or numeric loopback HTTP for testing). Dependency names and versions are sent to that endpoint.
• MCP HTTP transport, full Rust schema extraction and Cargo dependency scanning remain outside this release.

What's Changed

• ci: bump Go toolchain to 1.26.5 by @brian93512 in #91
• threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #90
• Update Homebrew formula for v0.3.19 by @brian93512 in #77
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #78
• threat-intel: 2 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #79
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #80
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #81
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #82
• threat-intel: 3 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #83
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #84
• threat-intel: 3 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #85
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #86
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #87
• threat-intel: 4 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #88
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #89
• deps: bump x/text for govulncheck by @brian93512 in #93
• threat-intel: 1 MCP/AI-relevant OSV-confirmed malicious package(s) for review by @brian93512 in #92
• test: add executable scanner verification skill by @brian93512 in #110
• fix: detect Rust MCP presence and reject empty tool scans by @brian93512 in #111
• ci: verify user paths and fail incomplete OSV scans by @brian93512 in #112
• release: scanner 0.3.20 and npm 1.1.13 by @brian93512 in #113

Full Changelog: v0.3.19...v0.3.20