archytan-mcp-gate 2.7.0

The MCP gate is now an MCP bundle, listed in the MCP Registry. This release attaches archytan-mcp-gate.mcpb for hosts that install bundles, and it's listed in the MCP Registry as io.github.High-ArchyTech-Solutions/archytan-mcp-gate. The host asks for your mcp-gate.json, the Archytan Lite gate service's URL, the agent's token file and the service's public key. The bundle carries the macOS and Linux builds for amd64 and arm64 and the Windows amd64 build.

The tool server can be named in mcp-gate.json. Add "server": {"command": "node", "args": ["/opt/invoice-server/index.js"]} and the host only has to pass --config, which is what a bundle needs. Name the server in one place: with a server in the config and a command after --, or with neither, the MCP gate refuses to start.

mcp-gate.json is read as strictly as host messages are. A key that repeats or differs only in case, at any depth, and text that isn't valid UTF-8 or escapes an unpaired surrogate now stop the MCP gate at startup. Before, the last of two repeated keys won, so a second server could have quietly picked the program the gate runs. A config that loaded before and has neither still loads.

Verify a download. SHA256SUMS covers every binary and the bundle, and is signed by this repository's release workflow:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-mcp-gate/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

Or build it. go install github.com/high-archytech-solutions/archytan-mcp-gate/v2/cmd/archytan-mcp-gate@v2.7.0. Rebuilding the binaries from this tag with Go 1.26.10 (-trimpath, cgo off), and the bundle with go run ./internal/mcpbundle/build -version 2.7.0, gives the bytes SHA256SUMS lists.

archytan-mcp-gate 2.6.3

Security update. Upgrade from 2.6.2 or earlier. 2.6.3 is built with Go 1.26.10, which fixes CVE-2026-111943: Go's certificate checks now refuse chains through eight intermediates from one certificate authority, on every platform. The MCP gate checks the Archytan Lite gate service's certificate with Go's verifier, and the agent's credential travels on that connection, so with an earlier build someone on the network path holding a certificate from one of those intermediates could read the credential. Decisions couldn't be forged that way: the MCP gate only accepts receipts signed by the service's pinned key.

Nothing else changes. The code is the same as 2.6.2, and upgrading is a binary swap.

Verify a download. SHA256SUMS covers every binary attached below and is signed by this repository's release workflow:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-mcp-gate/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

Or build it. go install github.com/high-archytech-solutions/archytan-mcp-gate/v2/cmd/archytan-mcp-gate@v2.6.3. The release binaries are built with -trimpath and cgo off, so rebuilding them from this tag with Go 1.26.10 gives the same bytes as SHA256SUMS.

archytan-mcp-gate 2.6.2

Archytan Lite's MCP gate is open source. This is the first release built from this repository, under the Apache License 2.0. It behaves the same as 2.6.0, which shipped with Archytan Lite.

archytan-mcp-gate sits between an MCP host and a tool server. Before a tool call reaches the server, an Archytan Lite gate service has to authorize it; the MCP gate verifies the signed receipt for that decision, spends a single-use capability, and only then forwards the call. The README covers setup and everything it does on the wire.

Verify a download. SHA256SUMS covers every binary attached below and is signed by this repository's release workflow:

cosign verify-blob SHA256SUMS --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/High-ArchyTech-Solutions/archytan-mcp-gate/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c SHA256SUMS --ignore-missing

Or build it. go install github.com/high-archytech-solutions/archytan-mcp-gate/v2/cmd/archytan-mcp-gate@v2.6.2. The release binaries are built with -trimpath and cgo off, so rebuilding them from this tag with Go 1.26.9 gives the same bytes as SHA256SUMS.

Security. This release includes the fix for GHSA-9ff5-c4g4-rx92, first shipped in 2.5.1 and 2.6.0. Report vulnerabilities privately, as SECURITY.md describes.

2.6.1 was tagged and built but withdrawn before release: its module path lacked the /v2 suffix Go requires for version 2 tags. 2.6.2 is the same code with the corrected path.