Skip to content

Tutor MCP v0.5.0 — security and SaaS hardening

Latest
Latest

Choose a tag to compare

View all tags
@ArnaudGuiovanna ArnaudGuiovanna released this 14 Aug 12:49
· 6 commits to main since this release
v0.5.0
40de3b6
This commit was signed with the committer’s verified signature.
ArnaudGuiovanna Arnaud
SSH Key Fingerprint: 1m2FHL9xwfu6KiwnN2jpZmGQa3swoPrAB1KKBWZp1G4
Verified
Learn about vigilant mode.

Tutor MCP v0.5.0

Tutor MCP v0.5.0 delivers the multitenant SaaS and learning-integrity work
completed since v0.4.1, together with a full security-scanning remediation.
Users of v0.4.1 should upgrade because its published binaries still contain
the older vulnerable dependency set.

Security

  • Close all 35 CodeQL findings without dismissals: SSRF, email-header
    injection, unsafe integer conversions, open redirects, and log injection.
  • Harden CIMD metadata retrieval with strict HTTPS URL validation, one DNS
    resolution, rejection of private and special-use addresses, IP pinning,
    disabled proxies, rejected redirects, bounded responses, and timeouts.
  • Keep SMTP recipients in the envelope only, validate message links, and use
    constant recipient headers.
  • Return only server-side registered OAuth redirect URIs and prevent
    user-controlled scope errors or identifiers from reaching logs.
  • Upgrade the Go toolchain to 1.25.13 and refresh golang.org/x/crypto,
    golang.org/x/net, golang.org/x/sync, golang.org/x/sys, and
    golang.org/x/text.

Platform and learning integrity

  • Add durable multitenant identity, RBAC, service accounts, MFA, billing,
    catalog, governance, support-access, tenant archive, and control-plane
    foundations.
  • Add versioned assessment attempts, durable learning sessions, immutable
    curriculum revisions, learner availability policies, and explicit evidence
    stages from estimated through transferred.
  • Add durable narrative memory, webhook retry/dead-letter handling, retention
    tooling, PostgreSQL operational runbooks, and tenant backup/restore tooling.

Validation

  • Go 1.25.13 builds for Linux and macOS on amd64 and arm64.
  • Full race-detector suite and PostgreSQL 17 integration/load suite.
  • gofmt, module consistency, go vet, staticcheck, and source-level
    govulncheck.
  • CodeQL and full-history secret scanning.
  • SHA-256 checksums for every published archive.

Upgrade

Back up the database and narrative-memory data before upgrading. Forward
migrations run automatically at startup. The stable installer continues to
resolve the latest release:

curl -fsSL https://tutor-mcp.dev/install.sh | sh

Source builds require Go 1.25.13 or newer.

Full changelog: CHANGELOG.md.

Assets 8
Loading