Skip to content

v2.0.0 — Security-hardened, daemon mode, delete & content search

Choose a tag to compare

View all tags
@AugustusW AugustusW released this 25 Jul 09:19
v2.0.0
7ce8653

Breaking: create_shared_file is removed — an arbitrary-path file-sharing tool is a prompt-injection exfiltration vector (.env, keys); removed rather than allowlisted.

Security

  • Rate-limit counters persisted in SQLite (restart no longer resets brute-force counts), cross-process-atomic via BEGIN IMMEDIATE
  • Full security-header set on every viewer response (CSP default-src 'none', nosniff, DENY framing, no-referrer, no-store)
  • README now recommends Tailscale private (tailscale serve, tailnet-only) as the default exposure

Added

  • sharedoc-mcp serve — standalone viewer daemon: selfhost links keep working after your MCP client closes
  • delete_shared_doc — hard delete (link dies AND the record disappears; revoke keeps history)
  • Content search — search_shared_docs gains content_query; empty call = list newest links
  • GET /healthz — identity-aware health probe (also guards against port conflicts minting dead links)

65 offline tests. README · 繁體中文 · CHANGELOG

Assets 2
Loading