Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Oct 10:11
· 9 commits to main since this release
v0.6.0
1d94bf8

What's new

  • Poisoning checks cover resources and prompts. MCP201–MCP205 now scan the resource URI/name/description/MIME type and prompt name/description/arguments, not only tools.
  • Schema risk heuristics (MCP304–306). For a live server with no source available, free-form command, URL (SSRF) and path parameters are flagged. Parameters constrained with enum, const or pattern are left alone.
  • Baselines. --baseline report.json accepts findings from a previous -f json report; only new findings affect the score and the gate, while accepted ones stay listed under suppressed for audit.
  • Go SAST. vet reads mcp-go AddTool callbacks and traces arguments into exec.Command, http.Get/NewRequest and os/ioutil file sinks, and checks for hardcoded secrets.

Built-in rules rise from 30 to 33. SHA256 checksums for every archive are in checksums.txt.

Assets 8
Loading