Skip to content

Web Debug MCP v0.5.0

Choose a tag to compare

View all tags
@MarlonJD MarlonJD released this 30 Aug 20:59
· 11 commits to main since this release
v0.5.0
4c0cb07

Web Debug MCP 0.5.0

0.5.0 adds bounded Angular and Vue runtime evidence and closes two security/reliability defects found during final-release review without expanding the 13-tool MCP catalog.

Highlights

  • Adds evidence-schema-3 Angular 21 development snapshots through documented window.ng globals, with bounded DOM-host component/state/change evidence and no private-Ivy traversal.
  • Adds Vue 3 development snapshots through a safely chained DevTools hook, with bounded app/component trees, props/state changes, source hints, and optional Vite HMR provenance.
  • Keeps React, Vite, Next.js, Chromium, Safari, replay, and schema-version-4 adaptive verification behind the existing single MCP facade.
  • Promotes the Codex/ChatGPT/Claude Code plugin and its bundled runtime to immutable web-debug-mcp@0.5.0.

Security and reliability corrections

  • Replaces token-only raw text redaction with deterministic sensitive-assignment parsing. Authorization/Proxy-Authorization and Cookie/Set-Cookie logical fields, camel/underscore aliases, raw/escaped quoted values, multiline values, JSON-style quoted keys, and marker-prefix suffixes are redacted while unrelated lines and sibling fields remain intact.
  • Makes process-registry session accounting an absolute projection of live SessionManager state during the existing locked request-finalization update. Failed bookkeeping no longer replaces a completed MCP result, and repeated/concurrent close or later artifact deletion cannot decrement another active session.

Compatibility and boundaries

  • Evidence bundles use schema version 3; scenario and verification results remain schema version 4.
  • Angular runtime evidence is development-only and Chromium-only. Angular CLI's internal Vite server is not treated as the Web Debug Vite endpoint.
  • Vue support targets the verified Vue 3 DevTools-hook contract and has no DOM-private fallback. Safari keeps generic browser evidence and explicit framework-enrichment warnings.
  • Node 20+ remains declared; exact locally verified runtime/framework versions are recorded in ../COMPATIBILITY.md.
  • The package remains a local stdio development tool. This release is not a provider-backed production attestation and does not add unattended remote-browser authority.

Verification

The release candidate passed 124 deterministic tests, source/test typecheck, build, native and zero-error formal harness checks, independent security bypass/regression review, focused MCP/Next redaction and lifecycle-accounting fault tests, plugin/skill validation, an exact 116-entry archive/fresh-prefix handshake, Node 20/22/24 distribution handshakes, Chromium, React/Vite, Vue/Vite, Angular, Next, Safari 26.6.2, local-fidelity, and all six comparison scenarios. Safari evidence includes WebDriver DOM/action/screenshot, BiDi console, explicit debugger/profile limitations, and disclosed Performance Resource Timing network fallback. Public-registry, GitHub, and installed-plugin evidence is recorded in the complete-0-5-0-release ExecPlan as each external gate completes.

Assets 2
Loading