v1.1.0 - Production Hardening

First minor release after the v1.0.0 stability milestone. mcp-audit is now production-hardened across three deployment surfaces: upstream authentication, dashboard authentication, and audit log lifecycle management. All changes are additive on the config side; one behavioral default was tightened on Authorization forwarding (see migration notes).

What's new

This release groups three operational concerns that became visible after v1.0.0 started seeing deployment traffic:

• Upstream authentication: proxy.forward_headers lets operators explicitly opt-in to forwarding sensitive headers like Authorization to trusted upstream MCP servers, instead of leaking client-side credentials by default.
• Dashboard authentication: bearer-token auth via dashboard.auth.token, with per-IP rate-limiting on failed attempts and Cache-Control: no-store on all JSON responses. The dashboard now binds to 127.0.0.1 by default through dashboard.bind_address.
• JSONL archive lifecycle: size-based and UTC time-based rotation (audit.rotation.max_size_bytes, audit.rotation.interval), composable retention policies (audit.rotation.max_files, audit.rotation.max_age_days). Append-driven, no background timer, no catch-up of missed cutoffs.

Added

• proxy.forward_headers for opt-in forwarding of selected HTTP request headers to trusted upstream MCP servers. Authorization is the only sensitive header that can be opt-in forwarded; Cookie, Set-Cookie, and Proxy-Authorization are always rejected.
• Dashboard bearer-token authentication via dashboard.auth.token. Failed attempts are rate-limited per remote address and all JSON API responses now send Cache-Control: no-store.
• dashboard.bind_address config key, defaulting to 127.0.0.1 to reduce accidental network exposure.
• Size-based JSONL audit archive rotation via audit.rotation.max_size_bytes and archive count retention via audit.rotation.max_files.
• UTC time-based JSONL audit archive rotation via audit.rotation.interval (hourly or daily) and filename-timestamp age retention via audit.rotation.max_age_days. Rotation is append-driven (no background goroutine) and does not catch up missed cutoffs after idle periods or restarts.
• Continue stdio configuration example under examples/continue/.

Changed

• Breaking behavior change: Authorization headers are no longer forwarded to upstream HTTP MCP servers by default. To restore prior behavior, add proxy.forward_headers: [Authorization] to your config. Without this setting, authenticated upstreams may return 401 Unauthorized; mcp-audit forwards that upstream response to the client unchanged.
• Dashboard now binds to 127.0.0.1 by default.
• JSONL Query now reads from rotated audit.jsonl.YYYYMMDDTHHMMSSZ archives in addition to the active file.
• JSONL rotation retention applies max_age_days before max_files when both are configured.
• Go toolchain pinned to go1.22.12 in go.mod for reproducible contributor and CI builds.

Migration from v1.0.0

If your upstream HTTP MCP server requires bearer-token authentication from the client request, opt in to forwarding the Authorization header:

proxy:
  forward_headers:
    - Authorization

If you were relying on the dashboard being reachable from outside localhost, set the bind address explicitly:

dashboard:
  bind_address: 0.0.0.0

All other changes are additive: existing v1.0.0 configurations continue to work without modification.

Stability surface additions

New stable configuration keys (all additive, per STABILITY.md):

• proxy.forward_headers
• dashboard.auth.token, dashboard.bind_address
• audit.rotation.max_size_bytes, audit.rotation.max_files, audit.rotation.interval, audit.rotation.max_age_days

Installation

# Prebuilt binary
curl -L https://github.com/P4ST4S/mcp-audit/releases/download/v1.1.0/mcp-audit_1.1.0_linux_amd64.tar.gz | tar -xz
./mcp-audit --version

# Docker
docker run --rm ghcr.io/p4st4s/mcp-audit:v1.1.0 --version

# Go toolchain
go install github.com/P4ST4S/mcp-audit/cmd/mcp-audit@v1.1.0

See the README for platform-specific instructions.