v0.5.0

backrest-mcp v0.5.0

Security

• Nested policy messages projected through pinned key allowlists (F-04): a field a later Backrest adds to prunePolicy, checkPolicy, forgetPolicy, commandPrefix, schedule or retention is dropped until it is named.
• Restore prefix moved out of /tmp (default ~/backrest-restore/) and refused unless it is a real 0700 directory owned by the server user (#1182).
• Deploy from the lock: install/update with uv sync --frozen --extra dev, not pip install -e ., so production runs the dependency set CI audits.

Added

• list_plans, find_plan_for_path(path) (approximate restic exclude matching), get_backup_freshness(max_age_hours?) with stale_count and unscheduled_count. All read the secret-free projection only.
• scripts/run_live_conformance.py: live tests with credentials read in-process, never on argv.
• NATS credentials: NATS_CREDS_FILE, or NATS_USER + NATS_PASSWORD.

Changed

• src/ layout — an editable install must be redone before python -m backrest_mcp.server works again.
• Bounded dependency ranges and a committed uv.lock; CI installs --frozen and audits the lock.
• Repository standard: SHA-pinned actions, least-privilege workflow permissions, gitleaks, CodeQL, OSSF Scorecard, CODEOWNERS, Dependabot, ruff E F W I UP B SIM RUF + format, coverage floor 96%.

See CHANGELOG.md for detail.

v0.4.1

Security

• get_config no longer returns Backrest secrets. Before this release it passed Backrest's GetConfig response through unchanged. Backrest v1.13.0 masks only auth.users[].passwordBcrypt, so the tool returned:

  • repos[].password (the restic encryption key) in cleartext
  • env values and credential-bearing uri userinfo
  • restic flags and hook targets
  • the multihost sync block

  get_config now returns an allowlist projection built by the new backrest_mcp/redact.py. Unknown keys are dropped by construction. Secret-bearing fields become summaries: envKeys (names only), hasPassword, flagCount, backupFlagCount, and the hook action type.

  • Repo URIs lose userinfo, query strings and fragments, and are fully redacted when the userinfo boundary is ambiguous.
  • restic rclone: inline connection strings are redacted.

  If you called get_config on an earlier version, treat your repo password as disclosed to that session's transcript and any LLM tracing.

• restore_snapshot sends and audit-logs the resolved target path. This narrows a check-to-restore symlink race; it does not close it. restore_snapshot is registered only with BACKREST_ALLOW_DESTRUCTIVE=true.

See CHANGELOG.md for details.

v0.4.0

What's Changed

• fix: point PM2 ecosystem at venv python3, not system python3 by @TadMSTR in #3
• fix: parse forge.env inside ecosystem.config.js, drop --env-file by @TadMSTR in #4
• chore: add Release workflow (tag push → GitHub Release) by @TadMSTR in #5
• fix(observability): make failing telemetry visible, fail fast, and log once by @TadMSTR in #6

Full Changelog: v0.3.0...v0.4.0

v0.3.0 — live Backrest v1.13.0 conformance + HTTP transport

Reconciled the mock-only v0.2.1 against the deployed Backrest v1.13.0 connect-rpc API (forge :9898). Field names target the deployed version, not upstream main (which has since diverged).

Fixed

• Broken standalone entrypoint — added missing if __name__ == "__main__": main() (python -m backrest_mcp.server was a silent no-op).
• get_summary failed-count field backupsFailedLast30days → backupsFailed30days; added warning/scanned fields.
• get_operations repo filter now resolves repo_id → repoGuid and fans out across repos when unfiltered.
• list_snapshots() no-arg HTTP 500 fixed by enumerating + merging repos (Backrest #223).

Added

• get_health, get_logs (Connect server-streaming), get_download_url.
• HTTP/PM2 transport (BACKREST_MCP_TRANSPORT=http) — loopback-only bind + mandatory StaticTokenVerifier bearer token; main() fails closed. stdio remains default.
• CI (ruff + pytest 3.11/3.12/3.13), otel/nats extras, live-conformance tests (BACKREST_LIVE_TEST=1).

Security

• Connect-stream decoder hardening (audit backrest-mcp-modernization-2026-07, Low): 64 MiB buffered-response cap + raises on a malformed frame whose declared length overruns the buffer, instead of silently truncating.

Changed

• list_snapshot_files argument repo_guid → repo_id (resolved to GUID internally; v1.13.0 wire field remains repo_guid).

Full notes: CHANGELOG.md.

v0.2.1

What's Changed

• rewrite: Python/FastMCP, rename to backrest-mcp, expand to 10 tools with safety controls by @TadMSTR in #1

Full Changelog: https://github.com/TadMSTR/backrest-mcp/commits/v0.2.1