v1.1.0

[1.1.0] - 2025-11-20

Added

• Asynchronous Query Execution: New async query pattern to work around the 60-second MCP client timeout limitation in TypeScript-based clients like LM Studio

  • fleet_run_live_query_with_results now supports async mode when FLEET_USE_ASYNC_QUERY_MODE=true
  • fleet_get_query_results tool to retrieve results from async queries by campaign ID
  • fleet_list_async_queries tool to list all running and completed async queries with status filtering
  • fleet_cancel_query tool to cancel running async queries
  • Disk-based storage for intermediate query results with configurable retention (default: 24 hours)
  • Future Redis support planned for distributed deployments

• Schema Overrides Feature: Enhanced osquery table documentation with Fleet's curated metadata

  • Automatic download of YAML schema files from Fleet's GitHub repository (schema/tables/)
  • Local caching of schema overrides in ~/.fleet-mcp/cache/schema_overrides.json
  • Intelligent merging of override data with base osquery schemas
  • Prominent display of usage requirements and examples in fleet_get_osquery_table_schema responses
  • Multi-tier loading strategy: cache → download → stale cache fallback
  • 24-hour cache TTL with graceful degradation if downloads fail

• Fuzzy Matching Host Lookup: Intelligent host identifier resolution for flexible host targeting

  • New host_identifier.py utility module for smart host lookups
  • Support for matching hosts by hostname, UUID, serial number, or hardware model
  • Enhanced fleet_run_live_query_with_results to support fuzzy host matching
  • Automatic disambiguation when multiple hosts match

• CVE Filtering Support: Enhanced vulnerability tracking and reporting

  • New CVE filtering capabilities in software_tools.py
  • Filter software by specific CVE identifiers
  • Improved vulnerability tracking across the fleet
  • Updated documentation with CVE filtering examples

• WebSocket-Based Live Query: Complete rewrite of live query execution

  • Replaced fleet_run_live_query with WebSocket-based fleet_run_live_query_with_results
  • New websocket_client.py module for real-time result streaming
  • Improved reliability and performance for live queries

• Docker Support: Containerized deployment option

  • Added Dockerfile for easy deployment and distribution
  • Simplified setup for containerized environments

• Custom Variables Support: Added support for custom variables in Fleet

• Development Tooling:

  • Pre-commit hooks for automated code quality checks (Black, isort, mypy)
  • .pre-commit-hooks-guide.md documentation
  • Updated CONTRIBUTING.md with pre-commit setup instructions
  • Auto-updating pre-commit hook versions

• Security Policy: Added SECURITY.md file with security reporting direction.

Changed

• Query Tool Enhancement: fleet_run_live_query_with_results now returns campaign_id and status immediately in async mode instead of blocking
• Configuration Options: Added three new configuration parameters:
  • use_async_query_mode (default: false) - Enable async query execution
  • async_query_storage_dir (default: .fleet_mcp_async_queries) - Directory for storing async query results
  • async_query_retention_hours (default: 24) - Hours to retain completed query results
• Table Schema Cache: Enhanced TableSchemaCache to support schema overrides with automatic download and caching
• Health Check: Now reports schema override cache status and source (cache/download/none)

Fixed

• Policy Creation: Fixed issue with creating policies globally vs team-specific
• WebSocket Connection: Improved WebSocket connection handling for live queries
• Import Organization: Updated known_first_party in pyproject.toml for better import sorting

Technical Improvements

• AsyncQueryManager: New disk-based query job manager with status tracking (pending/running/completed/failed/cancelled)
• Background Task Management: Async queries run in background tasks with proper lifecycle management
• Code Refactoring: Applied some DRY (Don't Repeat Yourself) principles across the codebase
  • Refactored all tools to use common response formatting functions
  • Created common utilities for pagination parameter building
  • Applied @handle_fleet_api_errors decorator across all tool functions
  • Consolidated error handling and response formatting
  • Refactored activity, device, user, config, team, VPP, and async query tools
• Error Handling: Improved error messages for async query operations with detailed status information
• Code Quality: Temporarily disabled ruff formatter in favor of Black for more consistent formatting
• Package Updates: Updated uv packages and added WebSocket dependencies

Documentation

• Updated usage documentation with async query pattern examples
• Added schema overrides feature documentation
• Enhanced configuration guide with new async query settings
• Added CVE filtering examples
• Added fuzzy host matching documentation
• Enhanced troubleshooting section

Full Changelog: v1.0.2...v1.1.0