v2.0.2425

✨ Features

• Four Apple Ads recommendation actions are now available.
• An operation whose request body is a JSON array can now be declared.
• The DNS connector can read a service licence's run-time.
• A vendored spec can now come from a source that requires a credential.
• Documentation-derived OpenAPI specs.
• Templated operator header values.
• Apple Ads connector.
• Connectors can declare that a 404 means "nothing there", not "the call failed".

🔧 Improvements

• A safeguard against unreported configuration writes now tracks each place individually.
• The check that keeps a stored credential off a redirect now covers two more ways of declaring one.
• The redirect safeguard's documented scope now matches what it checks.
• A build interrupted before it started is retried instead of losing the whole run.
• An unrecognised client no longer arrives anonymously.
• A refused parameter now names the action that accepts it.
• Correction to the note that shipped with the attachment-download fix.
• A second count in the gateway's engineering notes now checks itself.
• A number in the gateway's own engineering notes is now read from the code instead of typed in.
• A safety check for encrypted storage no longer depends on someone remembering to update a list.
• A new internal check reported a stronger guarantee than it could keep.
• A count in the gateway's own engineering notes had quietly gone out of date.
• Nine internal checks had not run for five months, and nothing said so.
• A tenth internal check turned out to be dead, and it was the quiet kind.
• Two new internal checks no longer slow the test run down.
• The internal population scan is no longer the slowest thing in the test run.
• A hook-resolved tenant host is declared, not inferred from a name.
• Secondary requests a hook makes are bounded like the action's own.
• Deploy notifications name who actually wrote the fix.
• Deploy notifications recognise both self-healing runtimes.
• The numbers a rule states about itself are now re-derived on every run instead of written down once.
• An internal flag no longer shares its name with a different setting.
• Path encoding is declared per parameter.
• MCP 2026-07-28 is now listed among the supported protocol versions.
• MCP tool calls now record the protocol version they ran under.
• Two internal checks that could pass without reading anything now have to prove they read it.
• A parameter a connector action offers is now checked to actually reach the request.
• Stored records that expire are checked to keep their expiry when edited.
• Tests that check a whole set of things now have to prove the set was not empty.
• The concurrent-edit safeguard now covers both code trees, and can keep a record's lifetime.
• The expiry safeguard now covers both code trees and matches how the store actually behaves.
• A second component claiming an already-registered name is now announced instead of silently replacing the first.
• Every enforced engineering rule now records what a violation costs.

🐛 Fixes

• Auto-generated retest blocks are derived from the report, not from attached logs.
• Vendored specs derived from a vendor's documentation site keep what the documentation says.
• Auto-generated retest blocks are derived from the report, not from attached logs.
• The DNS connector records why it has no spec source.
• A spec source that needs a credential is refused rather than fetched anonymously, and the connections page no longer tries.
• Apple Ads connector hardening.
• Collections named result are now recognised.
• Apple Ads verified against the live API.
• Hardening from a review round on the Apple Ads connector.
• A documentation-derived spec no longer blocks the whole refresh.
• A documentation-derived spec is now refused when the crawl was incomplete.
• The reverse coverage baseline now records this connector's five unreachable operations.
• Vendored API specs are now watched in both directions.
• Spec-coverage reporting now checks the vendor endpoint it was asked about.
• Resetting the destructive-governance page to defaults is fast again.
• The message shown when a setting could not be written now describes what actually happened.
• Resetting the destructive-governance page to defaults now reports what it did not manage.
• A reset that only partly succeeded now reports how far it got.
• A configuration change that did not reach disk now shows up in the interface.
• A mistyped action name can no longer trigger a change.
• Turning a service's extended action set on or off now says whether the change survives a restart.
• Tightening the high-risk approval gate can no longer fail silently.
• A failed configuration save no longer reports success.
• A misspelled action name is refused rather than guessed at.
• Jira attachment downloads now return the file instead of an empty result — the media redirect is followed.
• A containment test for user-supplied rule names now proves it examined something.
• An admin action whose author cannot be resolved no longer records a name.
• Four imports of the gateway's own code named modules that do not exist.
• The diagnostic MCP endpoint now checks the token it was given.
• The token list now shows the name a client declares for itself.
• A long-lived connection no longer expires early on the gateway's side.
• A spreadsheet download could arrive as an error page without anyone noticing, and a vector image could be refused although it was correct.
• A recurring error opened a new tracking issue every time instead of adding to the existing one.
• A text or HTML file attached to a ticket could not be downloaded.
• A capital letter in an email address could hide a user's saved service credentials from them.
• The YAML-vs-description coverage audit no longer credits an action with an unrelated operation.
• An endpoint a hook supplies in full is no longer credited with an operation it has nothing to do with.
• 111 Google Play long-tail actions addressed a doubled path and could not reach the API.
• A project path is stored once and encoded once.
• 274 long-tail actions could not reach their API, and the guard that exists for this skipped them.
• Metabase schema hints now cover ClickHouse's whole unknown-identifier family.
• A path parameter may contain dots again.
• Grafana passthrough reaches nested paths again.
• Read-only mode now blocks an action that changes something, even when it is offered as a read.
• An action can no longer describe itself as both safe to read and destructive, and one that deletes over a read request now asks first.
• Metabase: a query that failed on an unknown name now says where the schema is.
• The check on connector parameters now measures the same surface the client is shown.
• A connection failure now tells the caller what actually failed.
• Service account edits no longer overwrite each other.
• Self-healing now reports what actually failed when it cannot reach the gateway.
• The check that finds tests which pass on an empty result now measures what it claimed.
• A rule's own self-check no longer accepts a malformed repair recipe.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2425