v0.3.1

Highlights

• Hardened MCP tool discovery, execution, logging, secret loading, containers, and release
  artifacts for safer production deployments.
• Refreshed the embedded documentation for
  vmanomaly v1.30.1
  and aligned recommendations with its online-first model guidance.
• Improved startup and failure behavior with version reporting, accurate exit codes, and
  consistent resource capability advertisement.

Security

• Added a positive tool allowlist and enforced both allow- and denylists during tool
  discovery and execution, preventing a client from directly invoking a hidden tool.
• Added file-based bearer-token loading for container and orchestrator secret mounts.
• Removed tool arguments, results, raw errors, client metadata, and resource URIs from logs
  and metric labels where they could expose sensitive data or create unbounded cardinality.
• Required GitHub-verified cryptographically signed release tags and published GitHub
  build-provenance attestations for release archives.

Improvements

• Refreshed the embedded documentation for
  vmanomaly v1.30.1.
• Updated model-selection guidance to prefer online models and present Temporal Envelope as the
  migration target for supported offline models planned for future deprecation.
• Deferred documentation indexing until the first search and excluded non-served documentation
  images from binaries.
• Stripped release and container binaries, removed local build paths, and ran source-built
  containers as an unprivileged user.
• Added --version and non-zero exit codes for invalid configuration and runtime failures.
• Fixed resource capability advertisement when resources are disabled; documentation search
  remains available independently.

Compatibility

• Existing MCP tools remain compatible with vmanomaly v1.28.3 and newer.
• Time-series characteristics and shared autotune require vmanomaly v1.30.0 or newer.
• This release contains no breaking MCP tool changes.