v9.6.0 — MCP fleet audit + OAuth login

Summary

MCP fleet security audits for production deployments: batch scan, triage, SARIF, OAuth login, and regression diff. Builds on v9.1 Hemlock Score + intelligence loop.

Highlights (v9.2 → v9.6)

MCP fleet audit (v9.2)

• hemlock mcp-audit — YAML fleet config, parallel workers, triage (confirmed / suspected / likely false positive)
• Case-study markdown + per-target JSON
• examples/mcp-fleet-multipli.yaml, docs/case-studies/README.md

Exports + judge (v9.3)

• mcp_fleet_audit.sarif for GitHub Advanced Security
• --with-judge on mcp-audit for HemJudge revalidation
• Safe MCP HTTP teardown; OAuth targets skip cleanly

OAuth bearer + dashboard (v9.4)

• auth_mode: oauth_bearer per fleet target
• Finding deduplication in reports
• MCP Fleet card on operational dashboard

Triage quality + diff (v9.5)

• Fix false positives from MCP JSON-schema validation errors (-32602)
• hemlock mcp-audit-diff — baseline vs current confirmed findings

Real OAuth login (v9.6)

• hemlock mcp-oauth discover | login | status
• PKCE browser login, token store + refresh (.hemlock/mcp_oauth_store.json)
• Fleet audit loads OAuth tokens via oauth_resource in YAML

Install

pip install "hemlock-rag[mcp] @ git+https://github.com/M4NT/hemlock@v9.6.0"

Quick start (real MCP fleet)

export MCP_AUTH_TOKEN="<fleet shared token>"
hemlock mcp-oauth login --url http://your-host:3001/mcp   # OAuth MCPs
hemlock mcp-audit -c examples/mcp-fleet-multipli.yaml -o .hemlock/mcp_audit

See CHANGELOG.md for full details.

v9.1.0 — Hemlock Score, intelligence loop, continuous security

Hemlock v9.1.0

First GitHub release after v4.5.0, bundling continuous-security work from v5.0 through v9.1 on master.

Highlights (v8.9–v9.1)

• Hemlock Score — pipeline-native 0–100 security metric with CI badge (hemlock score-pipeline, hemlock gate)
• Intelligence loop — auto replay capture, threat intel advisories, optional auto red-team after orchestrated scans
• Dashboard — Hemlock Score card, score trend chart, new attack techniques panel

Since v4.5.0 (summary)

• v5.x — SDK, red-team campaigns, genetic fuzzer, threat intel, OTel, marketplace
• v6.x — distributed scanner, fingerprinting, auto red-team, policy-as-code, benchmark registry, cloud prep
• v7.x — security baseline, finding lifecycle, executive reports, model inventory, attack replay, provider comparison, playbooks, scan orchestrator, risk scoring, framework adapters
• v8.x — operational CLI (orchestrate, risk-score, executive-report), operational dashboard, leaderboard, policy+risk gate, LLM judge, continuous security CI workflow, trend charts, org overview

Install

pip install "hemlock-rag @ git+https://github.com/M4NT/hemlock@v9.1.0"

Tests

1550+ pytest scenarios (mock mode, no API keys required for core suite).

Full per-version notes: CHANGELOG.md.

v4.5.0 — Dashboard, Hub, Compliance, Auto-repair, Multi-tenant

hemlock-rag v4.5.0

Completes the v4.x platform arc — hemlock now has a web UI, plugin ecosystem, compliance reporting, auto-repair, and multi-tenant support.

---

What's new in v4.1–v4.5

Version	Feature	Highlights
v4.1	Web Dashboard	Chart.js gauge + history at /dashboard; hemlock dashboard CLI
v4.2	Plugin Hub	hemlock hub search/install/list/info — PyPI-backed community plugins
v4.3	Compliance Mapping	OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF; report.to_compliance()
v4.4	Auto-repair	HemRepairer — LLM-driven code patch proposals; hemlock repair
v4.5	Multi-tenant	TenantStore + TenantMiddleware; teams, projects, API keys; hemlock tenant

---

Install

pip install hemlock-rag==4.5.0

# With REST API + dashboard
pip install "hemlock-rag[api]==4.5.0"

Quick start

# Web dashboard (starts server + opens browser)
hemlock dashboard

# Compliance report
hemlock compliance --framework owasp-llm --output markdown

# Auto-repair (dry-run)
hemlock repair --dry-run

# Multi-tenant setup
hemlock tenant create-team my-team
hemlock tenant create-project <team-id> my-project

# Plugin hub
hemlock hub search injection
hemlock hub install hemlock-sqli-attack

v4.0.0 — Plugin Registry + REST API Server

hemlock-rag v4.0.0

Major release — hemlock transitions from a security lab to an extensible platform.

---

What's new in v4.0

• Plugin registry (hemlock/plugin_registry.py) — discover community attacks and defenses via Python entry points (hemlock.attacks, hemlock.defenses). hemlock plugin list/info.
• REST API server (hemlock/api_server.py) — FastAPI server exposing /health, /scan, /eval, /report. Run with hemlock serve. Optional dep: pip install hemlock-rag[api].

---

Full changelog since v3.0

Version	Feature
v3.1	AttackMonitor — real-time LangChain callback injection detection
v3.2	Report templates — executive/technical Markdown + remediation_hints()
v3.3	SwarmAttack + SwarmDefense — multi-agent mesh, majority-vote consensus
v3.4	EvalBenchmark — 0–100 score per attack category, hemlock eval
v3.5	HemJudge + SelfHealingAdversary — LLM-as-Judge, iterative payload healing
v3.6	AttackChain — sequential multi-hop attack composition
v3.7	EvalComparison — multi-model benchmark side-by-side
v3.8	DefenseSynthesizer — auto-build defenses from a HemReport
v3.9	HemWatcher — continuous monitoring, webhook alerts
v4.0	Plugin registry + FastAPI REST server

---

Install

pip install hemlock-rag==4.0.0

# With REST API server
pip install "hemlock-rag[api]==4.0.0"

Quick start

# Unified threat assessment (no API keys)
hemlock threat-model

# Eval benchmark
hemlock eval

# Generate executive report
hemlock report --template executive

# Start REST API server
hemlock serve