Skip to content

Release v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 03:27
· 22 commits to master since this release
v0.4.0
9c970af
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ashlar 0.4.0 brings Ashlar bricks to your editor and your CI: an MCP brick host, GitHub bricks that answer "what is blocking this pull request or release?", and a free GitHub Action that runs them on every pull request.

Your agents decide what to do. Ashlar decides what is allowed to run, and keeps the receipt.

Highlights

  • MCP brick host (Ashlar.Mcp.Server.Host, new). Run it with dnx Ashlar.Mcp.Server.Host@0.4.0 --yes, or install it as the ashlar-mcp .NET tool. It exposes only the bricks you allowlist to MCP clients such as GitHub Copilot in VS Code, Claude Code, Cursor and Visual Studio. Every call, refusals included, writes one audit record; the records form a hash chain, and a call whose record can't be written returns no result. See the host README.

  • GitHub bricks (Ashlar.Bricks.GitHub, new). github.blockers returns a verdict for a pull request or release, each blocker with an evidence link, and every fact it could not read, with the reason. Version 1.1.0 reads required checks and reviews without admin rights. github.pr-status and github.ci-status cover pull request state and CI runs.

  • A free check for PR blockers (actions/pr-blockers). A GitHub Action that writes the github.blockers verdict to the job summary. No account, no API key, no telemetry: it reads GitHub with the job's own token, and a run that gets no answer fails instead of reading as ready.

    - uses: IanFrelinger/Ashlar/actions/pr-blockers@v0.4.0

  • Lighter authoring. Ashlar.Authoring no longer brings the host. A new brick project's first restore on an empty cache goes from 144 packages and 998 MiB to 30 packages and 144 MiB.

Hardening from the MCP host's adversarial audit

  • Calls to unlisted tools and calls the policy gate denies are recorded, and the caller gets the auditId.
  • Arguments over Ashlar:Mcp:Bricks:MaxArgumentBytes (64 KiB by default) are refused and recorded before the brick runs.
  • No record, no result: a call whose audit record can't be written returns an error, not a result.
  • Audit files are no longer pruned after ten server starts.
  • Text read from GitHub (check names, status descriptions, reviewer logins, refs) reaches answers and the job summary as one inline code span each, capped and stripped of control characters. Evidence links are kept only for absolute http(s) URLs.

Measured

In our token benchmark, one github.blockers call cost 87–94% less than an agent using the official GitHub MCP server's tools, on three workloads with caching on, with the same verdicts. The accuracy study, published after the release, grades the 1.1.0 brick shipped here: 211 of 211 true blockers across 100 pull requests in 10 public repositories.

Upgrading

  • A host that referenced only Ashlar.Authoring and calls AddAshlar() now also adds Ashlar.Hosting.Bundle.
  • CLI image: ghcr.io/ianfrelinger/nexo-cli:0.4.0 (linux/amd64 and linux/arm64).
  • Packages, symbols, nuget-publish-manifest.json and per-package .sha256.txt files are attached to this release.

Full details are in the 0.4.0 changelog.

Assets 57
Loading