Skip to content

V1.19.0

Choose a tag to compare

View all tags
@SepineTam SepineTam released this 09 Jun 05:50
· 8 commits to master since this release
v1.19.0
29f406a

Stata-MCP v1.19.0

Release Date: June 9, 2026
Type: Security

What's New

Multi-layer security hardening across ado installation, Stata help, and Stata do execution, plus optional timeout support for do-file runs.

Changes

  • Security (Ado Install): Moved ado_package_install behind the unsafe MCP server profile; the tool is no longer available in core or all profiles, requiring explicit opt-in via --unsafe
  • Security (Ado Install): Added entry-point approval layer so stata-mcp install must explicitly approve ado installation capability before the tool becomes usable
  • Security (Ado Install): Enforced alphanumeric package name validation to prevent command injection through malformed package names
  • Security (Ado Install): Closed multiple security bypasses in the ado installation flow, including direct loader validation and centralized Stata command input validation
  • Security (Stata Help): Hardened Stata help lookup with direct loader validation and refreshed help cache behavior to prevent unauthorized command execution paths
  • Stata Do: Added optional timeout parameter for stata_do execution to prevent runaway Stata processes
  • Stata Do: Use Stata return codes for install status detection instead of string parsing
  • Dependencies: Bump starlette from 1.0.0 to 1.0.1
Assets 2
Loading