v0.7.0

Changelog

• 2e881d4: Add reproducible dist build script (build_dist.sh) (@HUA503)
• 15849a4: Harden detection, reports, process lifecycle and terminal UI (v0.7.0 work) (@HUA503)
• f427ee1: Harden secrets, poisoning detection and probe egress; fix Windows test build (@HUA503)
• fccb525: Tidy layout: move translated READMEs to docs/i18n; add pre-commit hook (@HUA503)

v0.6.1

Trustworthiness fixes from an independent review.

• SAST: a path is confined only when the guarded variable reaches the sink. Bare filepath.Clean (Go) and unrelated resolve/startsWith (JS) no longer silence MCP803.
• Config: every Claude Code projects entry is parsed and servers are sorted, so repeated runs scan the same set instead of a random subset.
• Dynamic: follows nextCursor pagination; enumeration failures surface as MCP502 instead of an empty clean list.
• scan is static by default; live probing is opt-in via --dynamic (vet keeps --probe) and should run in a sandbox.
• Tests: sast confine regression, protocol pagination, CLI static-by-default.

v0.6.0

What's new

• Poisoning checks cover resources and prompts. MCP201–MCP205 now scan the resource URI/name/description/MIME type and prompt name/description/arguments, not only tools.
• Schema risk heuristics (MCP304–306). For a live server with no source available, free-form command, URL (SSRF) and path parameters are flagged. Parameters constrained with enum, const or pattern are left alone.
• Baselines. --baseline report.json accepts findings from a previous -f json report; only new findings affect the score and the gate, while accepted ones stay listed under suppressed for audit.
• Go SAST. vet reads mcp-go AddTool callbacks and traces arguments into exec.Command, http.Get/NewRequest and os/ioutil file sinks, and checks for hardcoded secrets.

Built-in rules rise from 30 to 33. SHA256 checksums for every archive are in checksums.txt.

v0.5.0

Changelog

• e427c41: feat: source-code review (SAST) for MCP server implementations (@McPrism)

v0.4.0

Changelog

• e52d81a: feat: add vet for one-line, no-config server review (@McPrism)

v0.3.0

Changelog

• 5a0de4e: feat: redesign TUI and add HTML report risk dashboard (@McPrism)

v0.2.0

Changelog

• 4e4bcb7: feat: policy as code, enterprise report formats, stronger secret detection (@McPrism)

v0.1.0

Changelog

• 677d495: feat: initial mcprism release (mcprism contributors mcprism@users.noreply.github.com)
• ad3ac77: fix(ci): adopt GoReleaser v2 checksum/formats schema (mcprism contributors mcprism@users.noreply.github.com)