Releases: NTLx/ServerFS_MCP
Release list
ServerFS MCP v0.6.0
ServerFS MCP v0.6.0 adds an optional TypeSafe Jev advisory suite to the host-side Agent Bridge while preserving ServerFS's deterministic authorization and provider-native approval boundaries.
Highlights
- Adds Agent Task Preflight: structured Jev evaluation of task atomicity, mutation scope, stop conditions, verification evidence, and execution fit.
- Adds Runtime Router advice across
direct_serverfs_tool,codex,claude, andhuman_reviewwithout addingruntime=autoor changing the explicitly requested runtime. - Adds Approval Advisor for real provider approval requests, scoring necessity, bounded scope, destructive/irreversible risk, sensitive access, and external side effects while leaving the final approval decision explicit.
- Minimizes Jev traffic: Preflight + Runtime Router share one task-submission request; Approval Advisor runs only when a provider creates an approval; identical approval payloads within one task reuse cached advice.
- Jev remains opt-in, advisory-only, and fail-open. Empty
SERVERFS_JEV_API_KEYmeans no TypeSafe client and no Jev requests. Jev cannot authorize workdirs, override runtime allowlists, bypass writer leases/provider safety checks, or auto-approve/deny. - Pins
jev-1.13.0withtypesafe-sdk==0.7.1for reproducible calibration. Bothserverfs-mcpandserverfs-agent-bridgepackages are version 0.6.0. - Updates the English/Chinese website and documentation with the Jev architecture, configuration, data-minimization rules, live validation, and request-economy model.
Upgrade
- The MCP public tool schema is unchanged; no ChatGPT plugin refresh is required solely for v0.6.0.
- Existing deployments remain Jev-free when
SERVERFS_JEV_API_KEYis empty. - To enable Jev, configure the key in the existing untracked repository
.env, update the user-scoped Agent Bridge with the normal installer flow, and restart the Bridge only after confirming no active writer-lease tasks. - Production container deployments should pin
SERVERFS_IMAGE=ghcr.io/ntlx/serverfs_mcp:0.6.0. The main MCP container still has no Internet egress.
Validation
- Root test suite: 803 passed
- Agent Bridge: 102 passed
- Ruff lint/format: pass for root and Agent Bridge
- Site build: 19 pages
- Compose Agent overlay render: pass
- Edge Container workflow: success (
35756109776), digestsha256:d447b37b5b1b80edf95a5fbac8e25ad2e580a7b541f4c81b134371621b5ab279 - Stable tag Container workflow: success (
35756224477), digestsha256:625d6f141930adde74cbd31ab816222bafd8653932ad0d9ce1842c37f03cec37 - Both published image manifests passed linux/amd64 + linux/arm64 verification.
ServerFS MCP v0.5.0
ServerFS MCP v0.5.0 adds ChatGPT-native file-parameter ingress for binary uploads while keeping the main MCP container without Internet egress.
Highlights
upload_binary_filecan now accept a ChatGPT/OpenAIfileparameter when optional file ingress is enabled, while strict RFC 4648data_base64remains available for generic MCP clients. Exactly one source is accepted, and the explicit ServerFSpathremains authoritative.- New optional
serverfs-file-ingresssidecar isolates temporary-file HTTPS retrieval from the MCP container. It has no workdir mounts, OpenAI/tunnel credentials, or published ports; accepts HTTPS/443 only; and enforces exact-host or explicitly enabled constrained OpenAI Azure Blob host-family policy, public DNS validation, IP pinning with original-host TLS verification, redirect revalidation, byte limits, and timeouts. - Streamable HTTP request-body sizing now derives from the effective binary-transfer ceiling so the advertised 8 MiB raw whole-file Base64 path is not truncated by the MCP SDK default request-body limit.
- Agent Bridge remains an independent frozen host-side contract; v0.5.0 keeps the existing writer-lease, revision, atomic mutation, no-shell, no-main-container-egress, and capability-gating boundaries intact.
Upgrade
The upgrade is backward-compatible by default: file ingress remains disabled unless explicitly enabled.
For ChatGPT file parameters, enable binary transfer plus file ingress and the constrained OpenAI Blob family, then start Compose with the file-ingress profile. If Agent Bridge is enabled, keep compose.yml + compose.agent.yml and add the profile rather than replacing the Agent overlay. No workdir data migration is required.
Validation
- Root test suite: 802 passed
- Agent Bridge: 83 passed
- Ruff lint/format: pass
- Site build: 17 pages
- Four required Compose render variants: pass
- Real ChatGPT file-parameter PNG round trip: byte-for-byte SHA-256 integrity verified
- Release Container workflow: success; multi-arch
0.5.0,0.5, andlatestimages published for linux/amd64 and linux/arm64
ServerFS MCP v0.4.0
ServerFS MCP v0.4.0
This release adds bounded binary file transfer and hardens the Streamable HTTP transport while preserving the opt-in Agent Bridge deployment model.
Highlights
- Optional bounded whole-file
download_binary_fileandupload_binary_filetools, disabled by default. Uploads require a writable workdir; overwrite is limited to one existing regular file and requires an expected revision. - Binary downloads return the raw bytes together with size, MIME, SHA-256, and revision metadata. The download output schema is now exposed correctly for MCP clients.
- Global workdir policy defaults and per-workdir overrides are resolved into one effective policy, including binary-transfer and Agent settings. The existing Agent Bridge remains optional; the base
compose.ymlstays Agent-free, while Agent deployments usecompose.ymlwith the explicitcompose.agent.ymloverlay. - Streamable HTTP transport security now explicitly enables DNS-rebinding protection, accepts only the fixed internal Host
serverfs-mcp:8000, and rejects non-empty unapproved Origins before MCP dispatch. Docker internal networking and the unpublished port remain additional layers.
Issue 10 transport-security concern was validated through regression coverage and the protected OpenAI Secure MCP Tunnel path. See the repository documentation for the full deployment and acceptance details.
ServerFS MCP v0.3.1
ServerFS MCP v0.3.1
This is the v0.3 release-closeout patch. It contains the final acceptance/documentation closeout, release-state consistency updates, and package/version metadata updates to 0.3.1. It does not add a new Agent runtime feature.
Final acceptance evidence
- 673 root tests and 83 Agent Bridge tests passed.
- 46/46 E2E checks passed.
- 19-tool optional Agent surface verified.
- HITL approvals/questions, continuation, steer, and cancel verified.
- Credential isolation and the active no-egress probe verified.
- v0.3.1 container workflow verified multi-architecture build/push and image manifests.
The v0.3.0 Agent Bridge runtime and Phase E deployment contracts remain unchanged and frozen.
ServerFS MCP v0.3.0
ServerFS MCP v0.3.0
This release adds the optional v0.3 Agent Bridge while preserving the default 11-tool filesystem-only surface.
Highlights
- Provider-neutral long-running task core with human approvals/questions, continuation, steer, cancel, audit records, and cross-process workdir writer leases.
- Native Codex App Server adapter and Claude Code Agent SDK adapter.
- Eight provider-neutral Agent MCP tools, exposed only when the Agent Bridge is explicitly enabled; the optional surface is 19 tools total.
- Phase E user-scoped deployment through the Compose overlay and systemd user lifecycle, with measured peer identity, shared runtime permissions, provider-environment documentation, container-to-Bridge verification, and rollback/release documentation.
- Security boundaries remain explicit: fail-closed Agent configuration, local Unix-socket authorization, workdir-relative path policy, credential isolation, and no generic shell/argv/env MCP tool.
The v0.3.0 implementation and Phase E acceptance are frozen at the v0.3.0 tag. The maintainer waiver for the 11-tool rollback/re-cutover drill is recorded in the acceptance/deployment documentation.
