Tavsin v0.4.0

Tavsin 0.4.0 — the enterprise MCP and plugins release (Sep 13 → 14, 2026).

Tavsin as an MCP client, for every server in the ecosystem

• Streamable HTTP transport (2025-06-18 spec) beside stdio: session ids, SSE responses, per-request timeouts, bounded responses. Bearer and OAuth auth — on a 401 one refresh grant, then a clear "re-authorize", never a retry loop; rotated tokens are persisted through the same sealed store as provider keys.
• Tool annotations honoured: a read-only tool fans out with other reads, a destructive one asks before it runs.
• Import the servers you already have from Claude Code, Claude Desktop, Cursor and Codex; a Test button connects and lists tools before a server is used mid-task. Connectors card with transport badge and remote-server form.
• MCP resources and prompts, and per-instance templated server URLs.

The Tavsin MCP server, enterprise grade

• The same 23 tools over stdio (unchanged) and Streamable HTTP, with sessions or stateless.
• Auth: none (loopback only), API keys (hashed, scoped, revocable — tavsin-mcp keys), or OAuth with RFC 9728 metadata and tavsin:read|write|admin scopes.
• Policy: read-only / read-write / admin modes with allow and deny lists; a filtered tool is absent from tools/list, not registered-and-refusing.
• Audit and limits: every call redacted and logged to a bounded ring and a per-session trace; per-identity rate limit and in-flight cap; body cap; DNS-rebinding guard; multi-project binding.

Plugins v2 — a superset of the ecosystem's formats, with the checks nobody else runs

• Reads Claude Code plugins, Agent Plugins 1.0 (Codex, Cursor, Copilot), MCP server.json and both marketplace formats; 31 normalised categories; Browse by category.
• Declared and enforced permissions: undeclared means restrictive defaults; a connector outside the declared network is never a tool; an undeclared destructive hook blocks enabling.
• Runtime verification: a plugin hook or a "read-only" MCP tool that changes the tree is flagged on the trace and the card, never auto-disabled.
• Plugin MCP servers are bridged into the agent as deferred tools, with ${secret:} / ${config:} placeholders resolved from a sealed per-plugin config (Configure form, secrets masked) and a Test button.
• Enterprise policy (allowed registries and publishers, denied plugins, verified-only or locked), sha256-verified installs, outcome stats ("used in N runs, M verified"), and a catalog of 88 verified plugins over 128 official MCP servers.

Memory

• Citation validation reaches autonomous runs: the workflow and task-graph runners now re-check a surfaced memory's cited files against the tree they edit, so a memory about deleted code is marked stale for a night-shift feature or a fleet task exactly as it is in chat.

Also

• fleet.last — the last fleet's spend and pass/fail shown under the cost cap in Settings.
• Continuous verification: typecheck, lint and the full suite run in CI on every push and pull request.
• Signed Windows installers built and signed in CI with Azure Trusted Signing; tavsin.xyz/downloads with checksums.

Install: macOS — open the .dmg and drag Tavsin to Applications (Apple Silicon, signed and notarized). Windows — run Tavsin-Setup-0.4.0.exe (x64, signed).

Tavsin v0.3.0

Tavsin 0.3.0 — the harness release. 173 commits since 0.2.3 (Aug 4 → Sep 13, 2026).

Agents that land their work

• The Fleet — give N tasks in one prompt; N agents run in their own git worktrees and the passing diffs are landed on one integration branch with the project's check green. Conflicts and red checks are backed out and reported, never merged silently. Each task's diff size, files touched by more than one task, and large diffs are named for the reviewer.
• Night shift — tavsin night and the desktop's Runs work through a backlog unattended for hours: one feature per fresh session, verified by the outcome contract and an independent reviewer that reads the real diff. Provider rate limits back off instead of burning attempts; a fatal provider error stops the night and keeps the queue.
• Mid-turn steering, parallel tool batches, sub-task results back into the turn, typed inter-agent messages, critical-path dispatch, re-planning after a failed root, graphs that grow mid-run.
• Cross-project view — the Agents panel lists running agents across every open project, with a switch, badges on the workspace switcher, and stores that close cleanly.

Cost and context

• Per-task cost caps that degrade to a cheaper model before stopping; cost by tool on every trace; deferred tool schemas (~85% fewer tool tokens per step); prompt caching on Anthropic.
• Compaction that keeps the working set (files edited, last check, loaded tools, open plan steps); a recall ledger so nothing cleared is lost; stuck-loop guard; repeated-read short-circuit.

Memory

• Memory across projects (~/.tavsin/user.sqlite, promote/demote from the Memory view), citation validation (a memory whose cited files vanished is surfaced as stale), unused-memory proposals, and correct + import in the UI.

Debugging and verification

• test.run failures-only targeted runs, the debug-fast skill, runtime instrumentation with exact removal, an independent finish evaluator, tool.before hooks.
• Visual QA — accessibility snapshots with refs, computed CSS, viewport and dark-mode emulation, screenshots the model can see.
• Skill evals — tavsin skills eval runs a skill's cases through the real agent in worktrees, graded by assertions, persisted as evals.

Safety

• OS sandbox on every agent-path command (seatbelt on macOS, bubblewrap on Linux), opt-in workspace-write scoping, and policy that blocks the ways an agent discards work: stash drop, force branch delete, whole-tree checkout, force worktree removal.

Also

• SKILL.md skills from .tavsin, .claude, .agents and user roots; layered AGENTS.md / CLAUDE.md; roles with enforced tool budgets; a checked design contract; Linux builds.

Install: macOS — open the .dmg and drag Tavsin to Applications (Apple Silicon). Windows — run Tavsin Setup 0.3.0.exe.