v0.2.0 — Tool filtering, observability, security hardening

🚀 v0.2.0 — tool filtering, observability, and security hardening.

Highlights

• 🔧 Tool filtering — optional per-server tools allow/deny lists. Disallowed tools are stripped from outbound tools/list responses, and inbound tools/call requests for them are answered with a JSON-RPC error (-32000) and never reach the MCP server.
• 📊 Observability — optional /health and /metrics (Prometheus-format) HTTP server via --metrics-port. Counters for messages, reconnects, malformed frames, blocked tool calls, plus a connected gauge. Binds to loopback (127.0.0.1) by default.
• 🔒 Token redaction — the Xiaozhi JWT in the WebSocket endpoint is scrubbed from logs at every level, including third-party (e.g. websockets) DEBUG output.
• 🛡️ Hardened — 11 issues found by an adversarial multi-dimension review were fixed: secure-by-default metrics bind, graceful metrics-port failures, correct non-zero exit on startup failure, HTTP method/reason-phrase compliance, accurate metrics semantics, clean teardown.

Install

pip install -U mcp2xiaozhi
# or
uv tool upgrade mcp2xiaozhi

Quick example: expose only some tools + monitor

# mcp_config.json: { "mcpServers": { "calc": { "type": "stdio", "command": "python", "args": ["calc.py"], "tools": {"allow": ["add","sqrt"]} } } }
export MCP_ENDPOINT='wss://api.xiaozhi.me/mcp/?token=...'
mcp2xiaozhi run calc --metrics-port 9100
curl localhost:9100/health     # {"status":"ok","servers":[...]}
curl localhost:9100/metrics    # Prometheus format

Links

• 📋 Changelog
• 🔧 Tool filtering
• 📊 CLI metrics flags
• 🐍 PyPI

Full Changelog: v0.1.0...v0.2.0