Skip to content

Releases: OzgurH/project-vault-mcp

Release list

v0.2.0 — Security and privacy hardening

v0.2.0 — Security and privacy hardening Latest
Latest

Choose a tag to compare

View all tags
@OzgurH OzgurH released this 26 Oct 11:14
v0.2.0
85edc76

Security and privacy hardening

Upgrade from 0.1.0. This release addresses three concrete weaknesses: retained note content after failed discovery, POSIX replacement-file permission broadening, and quadratic wikilink processing. Existing configuration files load with secure defaults.

  • Current-access/revision checks for cached search, context and links; failed discovery discards cached retrieval.
  • Protected staging/locks and preserved POSIX mode/ownership or Windows owner/group/DACL, with fail-closed metadata errors.
  • Linear wikilink scanner, pre-parse bracket budget, bounded directory/depth/link traversal and process-local request admission limits.
  • Privacy/expiry frontmatter and recognized credential-signature guards for note exposure and candidate writes.
  • Policy-change revocation, minimized metadata-only audit, and acknowledgement-budget checks before mutation.
  • OWASP Top 10:2025 control map, scoped zero-trust design, GDPR/KVKK responsibility map, lifecycle and incident/retention runbooks.
  • Dependabot, scheduled dependency audit and CodeQL; repository secret scanning and push protection enabled.

Verification

  • Local Windows: 143 tests passed; six POSIX-only cases run on relevant CI platforms.
  • Typecheck/build, actual installed-package SDK stdio create/read/update/conflict smoke, repository/example knowledge checks, and dependency audit passed.
  • Independent local Claude Fable implementation/review receipts integrated by Codex; documented Windows ACL restrictions remain fail closed.
  • CI and Security workflows run against the exact release commit. Follow the linked GitHub Actions results for platform-specific evidence.
  • All six Windows/Linux/macOS × Node 22/24 CI jobs passed at 85edc76895d2f18342c5954cedf0370d45919371; CodeQL and dependency audit also passed. Five test-fixture CodeQL race warnings were reviewed and dismissed as false positives without disabling the rule or excluding tests.

Boundaries

Technical safeguards do not certify GDPR/KVKK compliance or a complete enterprise zero-trust architecture. The MCP host/provider controls onward transfers and retention. Windows updates require supported ACLs and the built-in PowerShell helper; foreign ownership or unsupported descriptors can prevent updates. POSIX extended ACLs/xattrs and disk encryption remain deployment concerns. See SECURITY.md and the privacy/control documentation.

Install

Download project-vault-mcp-0.2.0.tgz and verify its SHA-256 against SHA256SUMS, then run:

npm install --global ./project-vault-mcp-0.2.0.tgz
project-vault --help

This is a GitHub release package, not an npm registry publication.

Assets 4
Loading

v0.1.0 - Architecture knowledge that stays with your code

v0.1.0 - Architecture knowledge that stays with your code

Choose a tag to compare

View all tags
@OzgurH OzgurH released this 26 Oct 10:06
v0.1.0
d5a058a

Project Vault MCP 0.1.0

Architecture knowledge that stays with your code: local Markdown, connected notes, and revision-aware updates for AI agents.

Included

  • Eight MCP tools for search, reads, links/backlinks, project context, knowledge status, templates, note creation, and updates.
  • Explicit write gates, previews by default, create-only semantics, and SHA-256 revision preconditions for updates.
  • CLI initialization, knowledge checking, stdio serving, and client configuration output.
  • Optional bounded source-hash checks, safe path policies, and ordinary Markdown/Obsidian compatibility.
  • English documentation, architecture/ADR templates, a generic example project, and an illustrated README.

Install the compiled package

Download project-vault-mcp-0.1.0.tgz from this release, then run:

npm install --global ./project-vault-mcp-0.1.0.tgz
project-vault --help
project-vault init --root ../my-project --apply

Requires Node.js 22.12 or later. SHA256SUMS contains the archive digest. This is GitHub distribution; npm registry publication is a separate milestone.

Verification

  • 94 behavioral tests passed locally with type checking and compilation.
  • All six CI jobs passed: Windows, Linux, and macOS on Node 22 and 24.
  • The packed package was installed separately and exercised through the official MCP SDK stdio client, including create/read/update and stale-revision rejection.
  • The project's own notes and the example knowledge layer passed structural checks.
  • Three concurrent local Claude Code implementation sessions, independent security/correctness reviews, and a scoped fix re-review; integration and publication by Codex.

Source commit: d5a058a482c87aa361a859d690bcae31ae535589.

See SECURITY.md for filesystem trust assumptions and the boundary with noncooperating external editors. Source hashes prove byte equality, not architectural correctness.

Loading