Skip to content

v1.0.2

Choose a tag to compare

View all tags
@VoxNode-ux VoxNode-ux released this 28 Oct 11:33
· 2 commits to main since this release
v1.0.2
eb9ff26
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Warning

Superseded: please use v1.2.0 or later.

NullWire-MCP v1.0.2

The recommended stable release. NullWire-MCP is a RAM-only HTTP debugging proxy and MCP server written in Go. AI agents see salted tags, never raw secrets.

What's Changed

  • Fixed: the program now correctly reports its version as 1.0.2. v1.0.1 still reported 1.0.0.
  • Signed build provenance: every release binary now includes a signed attestation, so you can verify it came from this repository's CI.
  • Reproducible builds: all CI build tools and the Scorecard image are pinned to exact versions.

Highlights

  • Zero third-party dependencies: pure Go standard library, built with Go 1.26.
  • RAM-only: a 50-slot circular buffer with zero disk writes.
  • Salted SHA-256 correlation tags: secrets are replaced with tags like [REDACTED_TOKEN#xxxxxx], using a per-process nonce. Agents can see that a credential was reused without ever seeing its value.
  • Dual-spec MCP support: the 2026-07-28 stateless specification, plus legacy 2025-11-25 and 2024-11-05 handshakes.
  • 9 prebuilt static binaries: Linux (amd64, arm64, armv7, riscv64), macOS (amd64, arm64), Windows (amd64, arm64) and FreeBSD (amd64).

Verify your download

  • Checksums: compare against SHA256SUMS.txt.
  • Provenance: run gh attestation verify <file> --repo VoxNode-ux/nullwire-mcp.
  • An SBOM (nullwire-sbom.cdx.json) is attached.

Upgrading

v1.0.0 and v1.0.1 are superseded. v1.0.0 was built with Go 1.23, which has known standard-library vulnerabilities. Please upgrade to v1.0.2.

Full Changelog: v1.0.1...v1.0.2

Assets 14
Loading