Skip to content

mcp-doctor v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Aug 01:35
· 39 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.3.1
This tag was signed with the committer’s verified signature.
olliecee Oliver
SSH Key Fingerprint: mKnucjkvg8hSWOCdCPFRkUhgSum4ttxo1z5gly492A4
Verified
Learn about vigilant mode.
d4db369
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

mcp-doctor v0.3.1

mcp-doctor v0.3.1 is a security patch for authority-bearing local file
inputs and report artifact publication.

The patch binds scenario, custom-CA, snapshot, and aggregate reads to one exact
regular file opened without following a symbolic link or Windows reparse
point. Metadata and size decisions come from that opened handle; a second
no-follow identity check proves the selected path still identifies it before
the original handle is read. Replacement, disappearance, non-regular input,
or an unavailable native identity fails closed without retry or fallback.

Custom CA material is now read and validated before credential environment
resolution, DNS, or connection activity. Existing target, credential, tool,
effect, side-effect, schema, byte, redaction, and cleanup boundaries are
unchanged.

Report publication now records the complete native identity of each opened
stage handle, proves that its pathname still identifies that handle before
linking, and proves that the new destination has the same identity immediately
after linking. Cleanup and rollback remove only paths that still identify an
owned stage or output. A replaced stage or destination therefore fails the
artifact set without accepting or deleting the foreign entry; JSON, JUnit, and
aggregate output retain the same no-overwrite and all-or-nothing behavior.

Users of 0.2.0 or 0.3.0 should upgrade when another process or principal
could replace entries in a directory containing a selected scenario, CA
bundle, snapshot, aggregate input, or report destination. Until upgraded, keep
those files and destinations in directories that cannot be modified by another
principal or concurrent process for the complete diagnostic run.

Install the exact version with Cargo:

cargo install mcp-doctor --version '=0.3.1' --locked

Or build the immutable source through Homebrew on macOS or GNU/Linux:

brew install --build-from-source EnjoyableWork/tap/mcp-doctor

Native archives remain limited to GNU/Linux ARM64 and x64. Source installs are
verified on represented macOS, GNU/Linux, and Windows hosts. The release does
not add a protocol revision, transport, diagnostic, output format, or signing
claim.

See the release integrity guide for the artifact, provenance,
and installed-channel verification contract.

Assets 10
Loading