Skip to content

v1.34.5 — per-identity IP grace + welcome order_id hardening

Choose a tag to compare

View all tags
@UPinar UPinar released this 02 Jul 17:11
v1.34.5
c8e138c

Keyless onboarding: per-identity IP grace

Replaces the per-(identity, tool) first-swipe exemption with a single 24h grace window per keyless identity. A new caller can now exercise every cost==1 MCP tool freely during the window instead of exhausting the shared hourly quota partway through a discovery pass; once the window elapses the identity falls back to the standard free hourly limit.

  • Composite (multi-source) tools, API-key callers, and REST requests are never graced.
  • IPv6 identities are bucketed to a /64; in-window traffic is metered against a separate high per-identity ceiling as a DoS backstop.
  • The window's start is recorded once and never reset.

Fixes

  • /welcome: the order_id query parameter is normalized to its canonical UUID form, making key lookups robust to non-canonical spellings (upper-case / braces / urn:) and closing a CodeQL log-injection alert on the render-failure path.

Internal

  • Tests: the first-swipe suite is replaced by a 22-case IP-grace suite; full suite 2602 passing.
  • MCP surface unchanged: 54 tools, 7 Resources, 3 Prompts.
Assets 2
Loading