Safeguard MCP Server 0.0.1-rc.4

Changes:

• c1f7f34 Merge pull request #24 from OneIdentity/fix-github-release-connection
• c3d6943 Create GitHub Release via OneIdentity GitHub App connection
• ca1d518 Verify published npm package signatures post-publish
• 8b50487 Merge pull request #23 from OneIdentity/switch-image-to-dockerhub
• 05091fe Add npm, Docker Hub, and license badges to README
• 8ebd895 Publish container image to Docker Hub instead of GHCR
• eead89d Merge pull request #22 from OneIdentity/fix/docker-smoke-safeguard-host
• 7b70240 Fix Release docker smoke: set SAFEGUARD_HOST for --http container
• c04a83c Merge pull request #21 from OneIdentity/fix/osx-apple-cert-reprotect
• 2160466 Fix osx-arm64 signing: re-protect Apple cert before keychain import

See More

• 3f1efab Merge pull request #20 from OneIdentity/fix/win-x64-signtool-x86-thumbprint
• 0b1d081 Fix win-x64 signing: use x86 signtool and /sha1 thumbprint matching
• 8e50e4f Merge pull request #19 from OneIdentity/fix/stdio-smoke-flush-race
• c4166cf Fix stdio smoke race: hold stdin open so server flushes responses
• 098652c Merge pull request #18 from OneIdentity/fix/drop-linux-arm64
• 8ab9f75 Drop linux-arm64 from the release matrix
• 728e1dd Merge pull request #17 from OneIdentity/fix/publish-tag-only
• 4d1d4b8 Make all registry publishing tag-only
• 016fc83 Merge pull request #16 from OneIdentity/fix/npm-publish-isrelease-gate
• 06e79c6 Fix golden drift: pin chart to LF and regenerate checksum
• d9b74b7 Validate deploy manifests with kubeconform instead of kubectl
• 5e986e4 Gate npm publish steps on isRelease
• 23ff9f2 Set version 0.1.0
• 2142c70 Merge pull request #15 from OneIdentity/bugfix/cleanup-test-garbage
• d093009 All sorts of cleanup problems
• 3b95888 Merge pull request #14 from OneIdentity/feature/agent-skills-2
• 3aae503 Fix Suite4 password lifecycle test to use Safeguard_RetrieveCredential
• 65f5f4d Consolidate QueryHelp/Workflows/Enum into section-addressable Safeguard_Reference
• 34a8e2f Relocate cut tool guidance into common-patterns resource
• 46a7c5c Trim MCP tool descriptions to identity + safety pointers
• 4dcd59a Use http instead of https when creating winrm assets
• 7048ed4 Merge pull request #13 from OneIdentity/feature/mcp-triage-cont3
• 6bbcf75 docs: add appliance-diagnostics example and terminology row for uptime
• 297a21f errors: prioritize service-prefix directive over suggester in 404 hint
• 0945c75 execute: reject /service/{name}/ prefix at pre-flight; describe path contract
• b8925bb discover: require a narrower; alias query=search; add appliance diagnostic synonyms
• 81b5652 Merge pull request #11 from OneIdentity/dependabot/nuget/src/SafeguardMcp/nuget-minor-patch-011feaa46d
• d6ed0ca Merge pull request #12 from OneIdentity/feature/mcp-error-triage-cont2
• 9e0ae46 Soften RetrieveCredential audience-split docs to match MCP spec semantics
• bd8a0ce Fix Safeguard_RetrieveCredential to accept string access-request ids
• 310eec0 Correct tool count in README to match the registered tool surface
• 057fd0f Emit session_token_issued_offer_to_launch notice on InitializeSession
• cc8d6e5 Drop PendingReview-only gate in CloseAccessRequest planner
• 90e6c36 Align agent-visible bulk-ops docs with the renamed recipe
• 6c75f6c Make bulk asset/account operations discoverable, hint at 50104 blockers
• 4be9443 Safeguard_Discover: split compact and verbose modes with size guard
• 0e64f0b Suggest catalog paths and supported methods on 404/405
• af59dd0 Parse Safeguard error bodies via SafeguardDotNetException.Response
• 9ab917e Lead HTTP-mode auth-failure messages with MCP client OAuth flow
• af709e8 Remove redundant Safeguard_Status tool
• b5d9bb4 Surface specific guidance when device-code grant is disabled
• 9901970 Stop disposing the SDK-owned access-token SecureString
• 15c37aa Bump the nuget-minor-patch group with 3 updates
• 26f69c2 Merge pull request #10 from OneIdentity/feature/mcp-error-triage-cont
• 80fed09 Remove internal-plan jargon from code comments and test fixtures
• 18cde3b Link to the MCP spec section that defines audience annotations
• 401573b Document Safeguard_CloseAccessRequest, Safeguard_RetrieveCredential, and the audience-split credential delivery contract
• 49be49d Add count and summarize workflow recipes
• f5ac730 Add recent-activity and partition-schedule recipes; broaden account-discovery
• 46c9004 Wait briefly for auto-approval in Safeguard_OpenAccessRequest
• 6514b19 Add Safeguard_RetrieveCredential tool with two-block audience-split response
• 773e801 Add Safeguard_CloseAccessRequest composite tool
• ee8cc07 Lock AccessRequest close-state dispatch table
• 4bc9f17 Drop OldValue/NewValue by default on ObjectChanges list routes
• 6f34a7f Remove the static catalog that is no longer needed
• 4f503b2 example for recommended approach
• 1b126bd Merge pull request #9 from OneIdentity/feature/mcp-error-triage
• 2730e8a Document agent-correctness techniques in the README
• 583a3d2 Fold PAM vocabulary into the access-request synonym group
• 8c80bcd Rename composite tool to Safeguard_OpenAccessRequest
• 1f0b253 Cross-link workflow recipes and composite tools from Discover and Execute
• b9bcf81 Add Safeguard_LaunchAccessRequest composite tool
• 6186d64 Rank workflow recipes ahead of raw endpoints in Safeguard_Discover
• 35b06fc Add 'did you mean' suggester for filter/orderby/fields errors
• 5312713 Update integration tests for response envelope
• d639b30 Add CSV output hygiene tests
• 0381fce Wire envelope into Safeguard_Execute and truncate at whole-record boundaries
• 72ee807 Add structured response envelope builder for Safeguard_Execute
• 264504b Fix bogus not_in operator in query syntax reference
• b71dc05 Surface dotted-path closure for entities through Safeguard_Schema
• 76114c6 Surface enum vocabularies from swagger and add Safeguard_Enum tool
• 26c202a Track readOnly handling per schema and surface write-endpoint responses
• a11b485 Surface per-parameter contract on discovered endpoints
• 6bf1774 Add error-trace replay eval suite under IntegrationTests
• b65d9a0 Merge pull request #8 from OneIdentity/feature/repo-and-docs
• 5c001f3 docs+stdio: add docs/CLIENT-SETUP.md, correct multi-appliance and SSL docs, add in-session TLS-trust elicitation for self-signed certs
• b3a14a6 doc quickstart and installation updates
• e08d8da Merge pull request #7 from OneIdentity/feature/authN-rework
• 053db64 CONTRIBUTING: refresh project tree and env-var table
• 583902f Rename docs/usage.md to docs/EXAMPLES.md and link from README
• ab8c743 README cleanup: tool count, logout fallback, security up front
• b394f35 Treat missing parent directory as input not found in logout
• a8df2b3 Document bearer token handling in README Threat Model
• 00f1b6c Add safeguard-mcp logout subcommand to pair with login
• d46fe09 Document BRIDGE_TRUSTED_PROXIES in deploy artifacts
• 73bebeb Add regression tests for well-known headers and forwarded-headers trust
• 39a1904 Migrate forwarded-headers trust to System.Net.IPNetwork
• 14c9249 Update deploy artifacts and docs for optional MCP_PUBLIC_URL/RSTS_CLIENT_ID
• 1d98e49 Update tests for per-request URL inference
• 62fdfe3 Build bridge endpoint URLs per-request via BridgeUrlResolver
• 100fd7a Make BridgeOptions URL fields optional overrides
• 65d858a Add BridgeUrlResolver and ForwardedHeaders middleware
• 77baa60 Map MCP HTTP transport at /mcp to match documentation
• bc444de Polish device-code elicitation message and field
• 5ebc350 Fix device-code elicitation dialog stuck on Enter
• 643f3e3 Scrub residual internal task-number references
• d0561e8 Fix stdio crash when a second safeguard-mcp process starts (shared log file)
• bdb1a2d Rewrite README for HTTP-relay model; add Threat Model and replica-fleet shapes
• e964669 Scrub internal plan-document references from public files
• 93804b2 Add Compose deployment, deploy/ README, and CI manifest validation
• 577785b Add safeguard-mcp Helm chart parameterizing the k8s reference manifests
• 304f16d Add deploy/k8s reference manifests for HTTP relay + OAuth bridge
• 7eba584 Pin OAuth bridge cross-cutting acceptance gates
• 3821c55 Add RFC 7591 dynamic client registration endpoint
• 93b690e Add OAuth bridge POST /token endpoint
• e31a3f0 Fix catalog load: enable gzip + deterministic await in fixtures
• 3020880 Add /authorize and /authorize/callback OAuth bridge endpoints
• a86bbe4 Add Access-Control-Max-Age: 3600 to well-known preflight
• dd67432 Extract WriteJson helper in WellKnownMetadata
• 7b5b527 Factor ConfigureRedactingLogging helper out of Program.cs
• d699510 Return NullScope from BeginScope; scrub full exception chain
• 57ab64c Add OAuth metadata-bridge configuration and well-known endpoints
• 1f9ca37 Redact bearer tokens, JWTs, and OAuth codes from all log sinks
• 8b7be8d Add HTTP-mode startup lockdowns and pin error-mapping wording (Phase 1.8, 1.9, 1.D)
• 16b9b9a Add safeguard-mcp login subcommand with restrictive --output ACL (Phase 1.7, 1.E)
• bf5ed19 Replace SafeguardConnectionManager with per-mode ISafeguardSession (Phase 1)
• f9a6fbc putting these straight on main
• 9829815 Merge pull request #6 from OneIdentity/feature/ci-smoke-tests
• f827f90 ci(smoke): npm pack + global install + --version before publishing
• ce48acc ci(smoke): assert docker image stays under 80 MB uncompressed
• aa6141e ci(smoke): exercise docker --http /mcp with JSON-RPC initialize before push
• c33ced8 ci(smoke): assert published linux-x64 binary returns 6 expected tools via stdio
• cd2d09d Merge pull request #3 from OneIdentity/dependabot/nuget/tests/SafeguardMcp.IntegrationTests/multi-f6c42fbeeb
• 305e06a Merge branch 'main' into dependabot/nuget/tests/SafeguardMcp.IntegrationTests/multi-f6c42fbeeb
• 11176f8 Merge pull request #2 from OneIdentity/dependabot/nuget/src/SafeguardMcp/nuget-minor-patch-521468e36e
• 36c39fe Merge pull request #4 from OneIdentity/dependabot/nuget/tests/SafeguardMcp.IntegrationTests/multi-09b5c16e7b
• fa1133a Merge pull request #5 from OneIdentity/feature/mcp-improvements
• 858242e refactor(catalog): extract static resources to embedded .md files
• 7f16b9f feat(passwords)!: remove RandomPassword tool; steer agents to server-side password ops
• 8581438 feat(discover): hint when search asks for batch but no /Batch endpoint exists
• 5ec7799 feat(query-help): explain to-one vs to-many relationship navigation
• cc10bd6 feat(schema): expand nested complex types one level in Safeguard_Schema
• 6f8877f docs(query): guide agents to direct queries over Reports endpoints
• aa89fc8 docs(query): warn against OData-style orderby; targeted 400 hint
• 7d12401 docs(query): warn against OData-style orderby; targeted 400 hint
• 660cfde metadata for random password tool -- not sure if valuable yet
• dd3d495 surface ModelState field validation in 400 responses
• 4efc3d3 Bump Microsoft.NET.Test.Sdk from 17.14.1 to 18.6.0
• defbc29 Bump coverlet.collector from 6.0.4 to 10.0.1
• 75625b7 Bump the nuget-minor-patch group with 3 updates
• 6804c41 Merge pull request #1 from OneIdentity/feature/restructure-and-release
• 2b29a9c build(aot): treat trim/AOT warnings as errors
• dc1b63a chore(deps): bump OneIdentity.SafeguardDotNet packages to 9.0.0-pre40181
• 42ef8eb chore(deps): bump OneIdentity.SafeguardDotNet packages to 9.0.0-pre40008
• 0d2b9e5 docs: polish README and CONTRIBUTING for AOT distribution
• 9091567 feat(http): expose /healthz endpoint for liveness/readiness probes
• 41d3cbd feat(cli): add --version/--help with reflection-free generated constant
• 2ffaf2c feat(auth): harden device-code UX, plumb CancellationToken, re-auth on expiry
• 837017a ci(signing): cosign-sign image with Azure Key Vault HSM key
• cf61243 ci(release): publish SHA256SUMS for release archives
• 5e1f104 ci(signing): codesign and notarize osx-arm64 AOT binary
• ac082f2 ci(signing): Authenticode-sign win-x64 AOT exe via SSL.com eSigner CKA
• f9589c7 feat(docker): multi-arch buildx with build attestations and prebuilt AOT binaries
• 2e0c077 feat(docker): run as built-in nonroot app user; clarify HTTP transport
• 4a5f180 feat(dist): add linux-arm64 platform package and pipeline job
• e37e15e build(versioning): stamp all manifests + drift guard in versionnumber.ps1
• 8bcffce chore(deps): add dependabot config for nuget, npm, docker
• 3e27986 chore(server.json): canonical schema URL, validate against MCP Registry
• 17c2c03 chore(server.json): drop nuget package entry (dotnet-tool channel removed)
• d534a18 test(auth): inject connection factory and cover device-code branch
• 7989f6c docs(readme): device-code default; drop dotnet-tool and PKCE docs
• 35ce5a9 build(ci): split AOT publish per OS; drop NuGet tool packaging
• 6aa91be build(docker): multi-stage AOT image on chiseled runtime-deps
• 0a9bb4e refactor(aot): use Utf8JsonWriter for response truncation
• 370c09c refactor(aot): replace IConfiguration.GetValue with TryParse
• 76f2b2c build(aot): explicit MCP registration and tighten tool visibility
• 0a559a0 feat(auth): default to DeviceCodeLogin, keep PKCE fallback
• 4c13255 build(aot): convert SafeguardMcp.csproj to Native AOT
• 7b09bae Rework documentation and connection options, esp. ignoring TLS validation
• 96e2ef1 Fix product code and tests to pass all 96 integration tests against live appliance
• 81cefdc test: add Suite 6 edge cases and resilience tests (10 scenarios)
• 309f063 test: add Suite 5 error guidance tests (6 scenarios)
• c98760e test: add Suite 4 workflow-guided multi-step tests (4 scenarios)
• 562be98 test: add Suite 3 schema-guided execution tests (6 scenarios)
• edf86ec test: add Suite 2 schema quality tests (12 scenarios)
• b1a5da9 test: add Suite 1 discovery quality tests (18 scenarios)
• 910babc test: add DiscoverAssertions static helper for endpoint validation
• 6b618bd test: add SchemaBodyBuilder for naive schema-to-body resolution
• 327cd25 test: add AgentSimulationFixture for blind-agent integration tests
• f22976a docs: add entitlement discovery step to password-access-request workflow
• b1151d0 docs: add batch endpoint documentation to bulk-asset-import workflow
• bd6176c feat: expand TerminologyMap with 15 PAM vocabulary alias groups
• 74171bc feat: add SchemaHints for agent-guided property discovery
• 00933cb More integration tests
• c66c60d Replace static catalog literals with embedded text resource
• 1e9edb9 Add dotnet tool packaging and NuGet publishing
• 3f74559 Add CI/CD pipeline, npm distribution, Docker, and server.json
• 4641bef documentation improvements
• fc5b7ca Add integration test project with live appliance tests
• b785f21 Add unit tests, CONTRIBUTING guide, and usage documentation
• f00c7e2 Add MCP resources for query syntax, API overview, and common patterns
• 4e80fe2 Add HTTP transport support via --http flag
• 23da522 More workflows for guided operations
• d23164f Add workflow recipe tool with 10 guided operations
• 8757a44 Add terminology mapping between product UI and API names
• 963434b Implement unified dispatcher, schema tool, and query help (also terminology mappings)
• 4204374 Base ignore SSL behavior on initial connection option
• fde6d48 Add dynamic API catalog and schema extraction from swagger
• 381ba25 Replace custom OAuth with SafeguardDotNet SDK authentication
• a4c64b0 Replace source references with NuGet packages

This list of changes was auto generated.