Skip to content

v9.6.0 — MCP fleet audit + OAuth login

Latest
Latest

Choose a tag to compare

View all tags
@M4NT M4NT released this 31 Jul 18:42
v9.6.0
6dbd628

Summary

MCP fleet security audits for production deployments: batch scan, triage, SARIF, OAuth login, and regression diff. Builds on v9.1 Hemlock Score + intelligence loop.

Highlights (v9.2 → v9.6)

MCP fleet audit (v9.2)

  • hemlock mcp-audit — YAML fleet config, parallel workers, triage (confirmed / suspected / likely false positive)
  • Case-study markdown + per-target JSON
  • examples/mcp-fleet-multipli.yaml, docs/case-studies/README.md

Exports + judge (v9.3)

  • mcp_fleet_audit.sarif for GitHub Advanced Security
  • --with-judge on mcp-audit for HemJudge revalidation
  • Safe MCP HTTP teardown; OAuth targets skip cleanly

OAuth bearer + dashboard (v9.4)

  • auth_mode: oauth_bearer per fleet target
  • Finding deduplication in reports
  • MCP Fleet card on operational dashboard

Triage quality + diff (v9.5)

  • Fix false positives from MCP JSON-schema validation errors (-32602)
  • hemlock mcp-audit-diff — baseline vs current confirmed findings

Real OAuth login (v9.6)

  • hemlock mcp-oauth discover | login | status
  • PKCE browser login, token store + refresh (.hemlock/mcp_oauth_store.json)
  • Fleet audit loads OAuth tokens via oauth_resource in YAML

Install

pip install "hemlock-rag[mcp] @ git+https://github.com/M4NT/hemlock@v9.6.0"

Quick start (real MCP fleet)

export MCP_AUTH_TOKEN="<fleet shared token>"
hemlock mcp-oauth login --url http://your-host:3001/mcp   # OAuth MCPs
hemlock mcp-audit -c examples/mcp-fleet-multipli.yaml -o .hemlock/mcp_audit

See CHANGELOG.md for full details.

Assets 2
Loading