Repository navigation
Releases: High-ArchyTech-Solutions/archytan-lite-community
Release list
Archytan Lite 2.6.0
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.6.0The MCP gate relays MCP 2026-07-28. archytan-mcp-gate now passes the 2026-07-28 revision as well as the initialize handshake: server/discover, requests that carry their own capabilities in _meta, input_required round trips for elicitation and sampling, and subscriptions/listen, narrowed to tool list changes. A client that probes with server/discover reaches a server's 2026-07-28 support through the gate and falls back to initialize when the server predates it. Tested with the v2 MCP SDKs (@modelcontextprotocol/client and @modelcontextprotocol/server 2.3.1) in their legacy, auto, pinned and cached-discovery modes, and with the 1.x reference filesystem server.
The host's roots still don't reach the server. Under 2026-07-28 a host restates its capabilities on every request, and a server asks for roots by answering a call with input_required. The MCP gate removes roots (and extensions) from those capabilities, refuses a call the server answers with a roots request, so the host never sees it, and refuses a retry that answers one. The folders you give the server in its command stay the ones it serves.
Each round is a decision. A call that stops to ask the user something is authorized and spent on its own each time the MCP gate forwards it, so it leaves a receipt per round. Refusals to a 2026-07-28 call carry resultType, so a 2026-07-28 client shows the model the reason.
The security fix from 2.5.1. 2.6.0 carries the fix described in the security advisory: the MCP gate refuses a message it and a tool server could read differently.
The gate service is unchanged: no migration, and the same receipts and exports as 2.5.x. Clients stay as they are.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.6.0 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.6.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is attached below. SHA256SUMS covers every binary and is signed by the workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.5.1
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.5.1A security fix in archytan-mcp-gate. Every MCP gate release from 2.2.0 to 2.5.0 could read a crafted message differently from the tool server behind it, which could allow an unauthorized tool call or a receipt that names a different action or resource from the one executed. 2.5.1 refuses those messages before anything is authorized or forwarded: keys that repeat or differ only in case in the message, its parameters or a tool call's arguments, text that isn't valid UTF-8, and unpaired surrogate escapes. A refused request gets a JSON-RPC error that says why. Read the security advisory for who is affected and how.
Upgrade the MCP gate. Replace archytan-mcp-gate with the 2.5.1 download for your platform, attached below. Nothing else changes: no configuration, no migration, and the gate service is the same as 2.5.0, so the image is a rebuild you can take at your next upgrade. 2.5.1 has nothing else from the 2.6 work; 2.6.0, which adds MCP 2026-07-28 support, carries the same fix.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.5.1 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.5.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is attached below. SHA256SUMS covers every binary and is signed by the workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.5.0
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.5.0An MCP agent's trace reaches the gate. MCP carries trace context in a
request's params._meta (SEP-414), and OpenTelemetry-instrumented MCP
clients put a W3C traceparent there. archytan-mcp-gate now sends that
traceparent with the tool call's authorize and redeem, so the version 2
receipt signs the agent's trace id and the gate's log lines carry it as
otel_trace_id, beside the agent's own spans. The MCP gate's own ALLOWED,
REFUSED and CANCELLED lines name the trace too. A value that isn't a
well-formed version 00 traceparent is dropped and the call goes on as it
would have; trace context never changes a decision. The call still
reaches the tool server unchanged, _meta included. tracestate and
baggage aren't read.
Tested checkpoint recipes. The PKCS #11 script now signs a SHA-256
digest with plain ECDSA, so tokens without CKM_ECDSA_SHA256 work, and
reads the PIN from the environment; it's tested against a SoftHSM2 token.
The AWS KMS script is tested against moto's KMS emulation. Both run in CI,
as the Vault Transit script already did. Google Cloud KMS and Azure Key
Vault are still untested, and none has run against a real managed service
or a hardware HSM. Scripts are in checkpoints/.
Clients. No change: 2.1.0 stays current. CI now tests the Node client
on Node 18, 20, 22 and 24 and the Python client on Python 3.10 to 3.14.
The gate itself is unchanged apart from the rebuild: no migration, and the
same receipts and exports as 2.4.0. Upgrading from 2.4.0 needs nothing
else. From an earlier release, read the 2.4.0 notes first.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.5.0 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.5.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is
attached below. SHA256SUMS covers every binary and is signed by the
workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.4.0
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.4.0Upgrade the clients first. 2.4.0 returns version 2 receipts. The Node
and Python clients verify them from 2.1.0; earlier clients can't and deny.
Install @high-archytech-solutions/archytan-lite@2.1.0 and
archytan-lite==2.1.0 before you upgrade the gate, or set
ARCHYTAN_LITE_RECEIPT_VERSION=1 on the gate until you have. Archytan
Strategos reads 2.4's exports and receipts from 1.3.0.
Version 2 receipts. Each receipt also signs what its decision was made
under: the SHA-256 of the policy file and of the callers file in force, the
credential that asked, the resource's tenant, the gate's mode and whether
observe mode turned a refusal into an ALLOW, the caller's W3C trace id, and
the receipt's own id, instance, trace id and time. A client can deny an
ALLOW made under a policy it doesn't expect. The database migrates in
place: receipts already written stay version 1 and keep verifying. Verify a
log with 2.4 or later, and don't move a gate back to an earlier release once
it has written version 2 receipts.
Trace context. Send a W3C traceparent header with a request and every
line the gate logs for it carries otel_trace_id and otel_parent_id, so
your log pipeline can put the gate's decision beside the agent's own spans.
The gate only reads the header.
Checkpoints. The gate can sign its chain's tip with a KMS or HSM key the
gate host can't copy, through a signer command you configure, and logs each
checkpoint as one line for your log pipeline to keep. Rewriting the log
behind a checkpoint then takes live use of that key, which the KMS records,
and contradicts the checkpoints already shipped off the host.
--verify-chain, --export-chain and the export's verifier check them.
Signer scripts are in checkpoints/:
Vault Transit (tested against a Vault dev server), PKCS #11 (tested against
a SoftHSM2 token) and AWS KMS (tested against moto's KMS emulation); Google
Cloud KMS and Azure Key Vault are written from each provider's documentation
and not yet tested. None has been run against the real managed service or a
hardware HSM. The PKCS #11 script shipped with 2.4.0 asked for a mechanism
some tokens don't have; if you pulled it before 2026-10-12, take the current
one from the link above, which signs the same way on more tokens.
Checkpoints are off unless you configure them.
Exports. --export-chain writes a version 2 manifest and
checkpoints.json, and the verifier it includes reads both export layouts.
JSON Schemas for the new formats: receipt.v2.json and
receipts-export.v2.json in schemas/.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.4.0 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.4.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is
attached below. SHA256SUMS covers every binary and is signed by the
workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.3.2
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.3.2Security update. Upgrade from 2.3.1 or earlier. 2.3.2 is built with
Go 1.26.9, which fixes nine vulnerabilities in the Go standard library's
net/http, crypto/tls and net/textproto packages (GO-2026-6603,
GO-2026-6605, GO-2026-6607, GO-2026-6608, GO-2026-6610, GO-2026-6611,
GO-2026-6612, GO-2026-6613 and GO-2026-6617). The gate serves HTTP and
archytan-mcp-gate calls it over HTTP, so both are rebuilt.
Nothing else changes. The gate's behavior, receipts, configuration and
database are the same as 2.3.1, with no migration; upgrading is a plain
image swap, and the same goes for the MCP gate binary.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.3.2 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.3.2 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is
attached below. SHA256SUMS covers every binary and is signed by the
workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.3.1
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.3.1Update archytan-mcp-gate if an MCP host connects through it. MCP
roots let a host tell a tool server which folders to work in, and servers
that honour them replace the folders in their own command with the
host's list. Claude Code sends its whole workspace, so through an earlier
MCP gate the reference filesystem server served that workspace instead of
the folder you configured. Since 2.3.1 the MCP gate keeps roots away from
the server: it removes the roots capability from the host's initialize,
answers a server's roots/list itself with an error, and drops roots
change notifications. The folders in the server's command are the ones it
serves. An initialize the MCP gate cannot read is refused rather than
forwarded.
The policy decides which actions an agent may take, and each receipt
records the resource it named, but the policy does not match paths, so a
file server's reach is set by its own arguments. Keep those as narrow as
the agent needs.
The gate service is unchanged. 2.3.1 has no functional change to
archytan-lite and no migration; upgrading from 2.3.0 is a plain image
swap. Everything in 2.3.0, including the redemption re-check, applies.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.3.1 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.3.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is
attached below. SHA256SUMS covers every binary and is signed by the
workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.3.0
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.3.0A revocation now reaches capabilities already issued. Redeeming a
capability used to check its signature, expiry and scope, and then spend
it. Now it first asks whether the gate would still make the grant, against
the policy and callers in force at that moment: the caller it was issued to
is still registered (in credential-bound mode, under the same role), that
role is still allowed the action, and if the action now asserts
tenant_match, the tenant named on the resource when it was authorized is
the caller's. So a policy reload that removes a role or turns on
tenant_match blocks new requests and also cuts off every unspent
capability minted under the old policy. A restart with a caller removed
from callers.json does the same for that caller's capabilities.
Handle a refused redemption as a normal outcome. A capability that was
valid a moment ago is refused if the policy changed in between. The
actuator must not act; the caller can authorize again, and the current
policy decides. The refusal is the same uniform 403 as any other, and the
reason is in the gate's log with the trace_id and cap_id. A refused
capability is left unspent: if the policy is restored within its lifetime,
it redeems.
What it costs. One primary-key read of the recorded grant, plus
in-memory policy and caller lookups, before the durable write that spends
it. Measured on Linux against 2.2.1: about 0.2ms more at the median, on a
redemption of about 2ms.
Upgrading from 2.2.x. A database migration adds two columns to the
capabilities table. It runs on first start and needs nothing from you, and
2.2.1 still runs on the migrated database if you roll back. Capabilities
issued by 2.2.x cannot be re-checked, so 2.3.0 refuses them and the caller
authorizes again; with the default 30-second lifetime that only touches
requests in flight during the upgrade. Observe mode honours a capability
the current policy would refuse, as it does for authorize, but never one
whose caller is gone or has a different role.
Verify the image:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.3.0 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.3.0 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comarchytan-mcp-gate for macOS, Linux and Windows (amd64 and arm64) is
attached below. SHA256SUMS covers every binary and is signed by the
workflow that built them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comArchytan Lite 2.2.1
docker pull ghcr.io/high-archytech-solutions/archytan-lite:2.2.1Runs from the published image alone. The image now creates /data
owned by the gate's user, so a fresh Docker volume mounted there is
writable. Up to 2.2.0, keygen's first write into a new volume failed with
permission denied, and the docker-compose example hit the same error.
The image also ships the example policy at
/usr/local/share/archytan-lite/examples/policy.json, so a first run needs
no files on the host.
A quickstart that is tested. quickstart/quickstart.sh
and its PowerShell twin start a gate, get a signed ALLOW and a BLOCK,
redeem a capability twice and verify the decision log, checking every
answer. The release pipeline runs both against the image before
publishing it, and this repository runs them against the published image
every week.
Signatures in their own package. The image's cosign signature is now
stored in ghcr.io/high-archytech-solutions/archytan-lite-signatures, so
the image's package page offers the image as its install command (it
offered a signature tag before). Verify with:
COSIGN_REPOSITORY=ghcr.io/high-archytech-solutions/archytan-lite-signatures \
cosign verify ghcr.io/high-archytech-solutions/archytan-lite:2.2.1 \
--certificate-identity https://github.com/High-ArchyTech-Solutions/archytan-lite/.github/workflows/release.yml@refs/tags/v2.2.1 \
--certificate-oidc-issuer https://token.actions.githubusercontent.comMCP gate downloads. archytan-mcp-gate for macOS, Linux and Windows
(amd64 and arm64) is attached below. It puts the gate in front of an agent's
MCP tools: the host launches it in place of a tool server, and every tool
call is authorized, verified and spent as a single-use capability before it
is forwarded. Setup: Gate an agent's MCP tools.
SHA256SUMS covers every binary and is signed by the workflow that built
them:
cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
--certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-lite/\.github/workflows/mcp-gate-binaries\.yml@refs/' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comUpgrading from 2.2.0 needs no configuration change: the gate itself is
unchanged.