Skip to content

v1.2.0

Latest
Latest

Choose a tag to compare

View all tags
@VoxNode-ux VoxNode-ux released this 01 Nov 17:40
v1.2.0
4eb9b0a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

NullWire-MCP v1.2.0

The recommended stable release. NullWire-MCP is a RAM-only HTTP debugging proxy and MCP server written in Go. AI agents see salted tags, never raw secrets.

What's Changed

  • New install command: registers NullWire with Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline, Roo Code, Gemini CLI and Codex CLI. Includes --dry-run, automatic backups and --uninstall.
  • New installers: scripts/install.sh (macOS, Linux, Termux) and scripts/install.ps1 (Windows). Both check the download against SHA256SUMS.txt before installing anything.
  • npm launcher: npx -y nullwire-mcp install --client all
  • Homebrew and Scoop package templates (see packaging/).
  • Scrubber fix: XML secret elements cut off before their closing tag are now redacted.
  • Docker: final image moved to gcr.io/distroless/static-debian12:nonroot.
  • Release transparency: CycloneDX SBOM, signed build provenance and CI test logs are published with each release.
  • The program now reports version 1.2.0.

Highlights

  • Zero third-party dependencies: pure Go standard library.
  • RAM-only: a 50-slot circular buffer with zero disk writes.
  • Salted SHA-256 correlation tags: secrets are replaced with tags like [REDACTED_TOKEN#xxxxxx], so agents can see that a credential was reused without seeing its value.
  • Dual-spec MCP support: 2026-07-28 plus legacy 2025-11-25 and 2024-11-05.
  • 9 prebuilt static binaries: Linux (amd64, arm64, armv7, riscv64), macOS (amd64, arm64), Windows (amd64, arm64) and FreeBSD (amd64).

Verify your download

  • Compare against SHA256SUMS.txt.
  • Verify provenance: gh attestation verify <file> --repo VoxNode-ux/nullwire-mcp
  • The SBOM nullwire-sbom.cdx.json is attached.

Upgrading

v1.0.0 and v1.0.1 are superseded. v1.0.0 was built with Go 1.23, which has known standard-library vulnerabilities. Before switching, you can preview client changes with nullwire-mcp install --client all --dry-run.

Known limits

  • Homebrew and Scoop packages are not published yet.
  • The smoke tests on real operating systems have not yet been run on this version.

Full Changelog: v1.0.2...v1.2.0

Assets 14
Loading