Skip to content

v0.2.0: init, tool pinning, fetch and git policies, signed provenance

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 20:06
· 10 commits to master since this release
v0.2.0
c66520d

mcp-runtime-authz is a firewall between an MCP client (Claude Code, Claude Desktop, Cursor) and the MCP servers it uses. It checks every tool call before it runs.

New

  • authz init -- <server> drafts a policy from a server's real tool list. It classifies each tool and adds the rules that fit. When unsure it fails safe: tools it can't classify, and tools the server calls destructive, start refused.
  • Tool pinning (--pin tools.lock). A tool whose definition changes after you trust it, or a new tool, is hidden from the agent and refused until you accept the change with --repin.
  • authz audit audit.jsonl shows the audit log as a readable table.
  • Starter policies for the official fetch and git servers, each verified end to end against the real server:
    • fetch: only hosts you list; localhost, private and cloud-metadata addresses are refused even if listed; no credentials or keys in URLs.
    • git: credential files can't be staged or read back from history; sweeping pathspecs are refused; no secrets in commit messages.

Fixed

  • Windows paths walked past filesystem.yaml. A shell had silently turned [\\/] into [\/], which matches forward slashes only, so C:\p\.env was allowed. If you use filesystem.yaml on Windows, update it.
  • A URL's login part posed as its host. http://allowed.test:x@evil.test/ passed the host check as allowed.test. Hosts are now parsed properly, and where URL parsers disagree, every possible host must be allowed.

Supply chain

  • Signed build provenance. Each archive ships with a .sigstore.json bundle. Verify a download with: 
    gh attestation verify <archive> --repo Wazza0/mcp-runtime-authz
  • CI checks:
    • every dependency against the RustSec advisory database (cargo-deny)
    • fuzzing of the decoder, the policy loader and the decision path
    • property tests
    • CodeQL on the code and the workflows
    • all actions pinned to exact commits, with an OpenSSF Scorecard published

Found a way past it? Report it privately via SECURITY.md.

Assets 11
Loading