v2.0.2347

✨ Features

• Metabase now exposes its read surface.
• Play Vitals error search now takes a time window.
• Google Ads recommendations can be generated for a brand-new account.
• Service accounts now carry an explicit permission for receiving customer data unmasked.
• Service-account lifecycle and permission changes are recorded in the durable audit log.
• Three engineering rules moved from advisory to enforced.
• Reach-debt ratchet: unreachable source files can no longer be added.
• Fix branches now prove their changes are reachable by tests.
• The reachability sweep now watches for new credential-like required parameters.
• Adds a machine-readable engineering-rules layer (beliefs/) with CI integrity checking.

🔧 Improvements

• The engineering-rules layer now re-proves its own guards instead of trusting a label.
• A scope an action needs is now checked against what the connector actually asks for.
• AGENTS.md update
• Metabase reads are now an explicit allowlist, and one verdict decides whether a call failed.
• Nightly image scan now pages once per advisory.
• Play vitals error search is audited against the right operation, and can now be ordered.
• Container images now carry the distribution's current security patches.
• Connector coverage now notices an operation that disappears upstream.
• Google Analytics report actions are audited against their upstream operation.
• Tighter redaction in the Redis privacy audit report.
• Wider connector vocabulary in the Redis privacy audit report.
• The engineering-rules layer refuses to describe itself incompletely.
• A service-wide hook declaration now reports what it cannot bind.
• Service-wide hook declarations survive the file merge, and a misspelled hook name is reported at load.

🐛 Fixes

• A declarative guard that cannot run now refuses the call instead of being skipped.
• Cached credentials are now scoped to the connector that minted them.
• A refused connector file no longer leaves the connector serving without credentials.
• Pins the hosts that may receive a connector credential.
• A stored instance credential no longer follows an instance to a different address.
• Corrects the recorded threat model for connector declarations.
• The slow-test gate now measures machine load across the whole run.
• The test suite no longer reaches a developer's own Redis.
• A rule's self-check now has to show that a passing check turned failing.
• A connector declaration can no longer choose the host its credential is sent to.
• Short-lived credentials in the auth cache are now encrypted at rest.
• The BI connector's read surface deliberately keeps recently-viewed routes out.
• A check an action declares either runs, or the call is refused.
• The BI connector's request path is now covered by a test that issues a request.
• A connector whose auth block cannot be acted on is now refused at load time instead of calling upstream without a credential.
• The pre-commit suite reports up to five failures per run instead of stopping at the first.
• Each parallel test worker now uses its own data directory.
• Tightens the static audit that catches an advertised-but-unwired parameter.
• Instance-wide guards shipped in a release now reach every replica.
• Tightens the read-only boundary of the BI connector's imported action set.
• One answer to whether a call failed, across every surface that reports it.
• The image-scan alert survives its own edge cases.
• The nightly image scan is harder to silence.
• The GitHub mirror recovers from a merge conflict on its own.
• Self-healing runs no longer share a temporary file.
• Custom methods that hang off the API version now build a reachable URL.
• Operators can now see when the PII rules in force are not the ones on disk.
• Google Ads now targets the current API version.
• The Google Ads long-tail catalogue follows the connector's API version.
• Slack search now reports how many results there are.
• A write is no longer allowed through when the PII configuration cannot be read.
• The observability tools stay reachable when the PII configuration cannot be read.
• The stored-key compliance report no longer prints a plain name.
• The engineering-rules check reports a malformed entry instead of stopping on it.
• A rules file that declares what it is has that honoured.
• Slack admin listings return their data again.
• A malformed hook binding is reported instead of stopping the connector catalogue.
• Slack surfaces every API refusal as a gateway error.
• Slack listings can be paged.
• Slack responses keep their provenance.
• Redirect protection now covers connectors whose credential comes from a pluggable auth resolver.
• Connector error responses now pass through their response hooks.
• Tightens which read-labelled actions count as reads for delegation.
• Delegated callers are recognised by the identity the gateway verified, not by the name a client gives itself.
• Clarifies a note in the Slack reminder hook.
• Async execution refuses a body it can already tell is wrong.
• Slack direct messages and reminder listings hold up at their edges.
• Corrects a stale note in the Slack reminder hook.
• Keeps the full response envelope on filtered Slack reminders.
• Async tool execution answers a malformed request with a client error.
• Document Review admin page now has a contract test.
• Saves that only redirect now report a failed write too.
• A redirect can no longer carry a credential to the host it points at.
• Delegation risk now reads the HTTP method, not only the declared mode.
• Imported connectors stay on their declared server.
• Steadier test suite for contributors.
• One CSV-injection guard for every admin export.
• Passthrough endpoints stay on their own service.
• Config saves now report what they achieved.
• Extends cross-origin write protection to every session-authenticated route.
• Refines cross-origin write protection for programmatic clients.
• Parallel test runs keep a file's tests on one worker.
• Tests hand the process environment back unchanged.
• Write operations no longer report success when the write did not happen.
• Hardens the automations API against malformed requests.
• Provider health counts each connected user once.
• Tightens input handling on the clients admin API.
• Tightens the Organization page save path.
• Sharpens the fix gate's reach verdict and its mutation budget.
• The fix gate no longer accepts a shared symbol name as proof that a test covers a file.
• Clients keep their identity across gateway instances.
• A connection that names no client no longer inherits the previous name.
• Slack direct messages are now discoverable from the tool surface.
• Service-account access tokens now live as long as the work, not a quarter.
• A submodule pointer can no longer move by accident.
• A token's validation record is never kept shorter than the token itself.
• The self-heal worker's gateway client recovers from a rejected token instead of failing every later call.
• The local test suite now gates the push instead of every commit.
• Slack long-tail actions no longer demand an unfillable auth token.
• Signing in no longer leaves behind an access token nobody receives.
• MCP access tokens are recorded with the lifetime their client was told, on the record the request validator actually reads.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2347