v1.8.1

Release v1.8.1

Release type: stable
Release line: 1.8.x
Branch: release/1.8.x

Installation

npm install @frontmcp/sdk@1.8.1

Security

1.8.1 completes the fixes for these advisories. We recommend that every 1.x user upgrade. Thank you to the researchers who reported them responsibly:

Advisory	Summary	Reported by
GHSA-6w3j-82v5-6qrr	CodeCall: tool-access policy enforced on every execution and discovery path	@manop55555
GHSA-r848-p7wf-96rc	Approval: approval check registered by ApprovalPlugin.init(), and a recorded denial always wins	@manop55555
GHSA-4r57-gvgj-5crm	skilled-openapi: SSRF guard classifies every IPv6 spelling of an internal address	@tonghuaroot
GHSA-hwfp-xv2f-fr8g	throttle.ipFilter enforced on every HTTP route, including when the client IP is unknown	@SystemCallBeam, @manop55555
GHSA-p3qf-fcwm-35x4	Client IP resolved from the platform peer address on edge runtimes	@manop55555
GHSA-rhr9-vhpf-jqp7	uipack: tool output escaped in widget rendering; per-call widgets no longer served to other callers	@manop55555

It also hardens advisories first fixed in 1.8.0:

• GHSA-xx4w-33pp-cmw4: reported by @manop55555; the JWKS path was also flagged by @manus-pi
• GHSA-qh67-4345-cw2q: reported by @manus-pi
• GHSA-xp6r-ggxc-j7q8, GHSA-r6v6-p4r8-p936, GHSA-225p-f8jh-f3rh and GHSA-gf7p-j3hr-h5h4: reported by @manop55555

What's New

CHANGELOG

Features

• Introduced a new Approval Gate feature in the demo-e2e-approval app, enhancing security by requiring explicit approval for certain operations. This ensures that only authorized actions are executed, reducing the risk of unauthorized deployments.
• Added Admin Tools in the demo-e2e-codecall app, including an admin purge users tool, allowing administrators to manage user data more effectively by purging users and wiping configurations.
• Implemented Feature Flag Management in the demo-e2e-feature-flags app, enabling dynamic control over resource visibility and tool availability based on feature flags. This provides greater flexibility in managing application features.

Improvements

• Enhanced the Audit Plugin in the demo-e2e-hooks app with refined hook priority management, ensuring more predictable execution order for pre- and post-execution hooks. This improves the reliability and clarity of audit logs.
• Updated the Jest Configuration for the demo-e2e-dts-consumer app to improve testing efficiency and coverage, ensuring robust validation of TypeScript definitions.

Bug Fixes

• Corrected the runFrontmcpCli function in the demo-e2e-cli-exec app to accept a configurable current working directory, enhancing the flexibility of CLI command execution in different environments.

Breaking Changes

• The CodeCall Plugin now includes a stricter access policy, which may impact existing integrations that rely on unrestricted tool access. Users must update their configurations to align with the new policy settings.

What's Changed

• test(sdk): fail when a security control is wired to nothing by @frontegg-david in #551
• refactor(codecall): delete two security services that were never wired by @frontegg-david in #553
• docs: record that PRs target the active release branch, not main by @frontegg-david in #556
• feat(codecall): emit the audit events the docs already promised by @frontegg-david in #554
• fix(skills): install inline/URL skill instructions, and make --from-entry resolve project deps by @frontegg-david in #560
• fix(sdk): point initialize instructions at skill URIs the server serves by @frontegg-david in #561
• fix(cli): name reserved-expansion template flags properly, and expand them per RFC 6570 by @frontegg-david in #562
• test(sdk): add an in-process MCP 2026-07-28 client for specs by @frontegg-david in #566
• fix(sdk): keep the caller's token in-house, and give every request its own context by @frontegg-david in #567
• fix(auth): read signed-in callers as signed in, and keep anonymous callers out of 'authenticated' by @frontegg-david in #568
• fix(sdk): keep entry error codes and messages, mask internal ones in production, and log each failure with its error id by @frontegg-david in #569
• fix(guard): enforce declared limits and throttle defaults, stop timed-out work, and key sessionless callers stably by @frontegg-david in #570
• fix(sdk): validate tool results strictly, list input schemas by input type, keep repeated references, and base template content URIs on the read URI by @frontegg-david in #573
• fix(sdk): validate 2026-07-28 elicitation answers, keep anonymous callers' requestState, hide the fallback tool from 2026-07-28 clients, and stop treating browser workers as edge runtimes by @frontegg-david in #574
• fix(sdk): make Around hooks wrap their stage, run hooks declared on entry classes and app providers, and scope app plugin hooks to their app by @frontegg-david in #577
• fix(sdk): publish declarations that type-check in a consumer: typed @Tool and @Agent, optional prompt arguments, documented prompt returns, and no monorepo paths by @frontegg-david in #578
• fix(testing): record server notifications and progress, send progress tokens, and match tool error codes in toBeError by @frontegg-david in #580
• docs: match tool results, output types, errors, providers, URI templates, elicitation, log levels, the default port and the testing wrappers to the SDK by @frontegg-david in #581
• test(e2e): serve the OpenAPI perf spec from a local mock instead of the hosted mock by @frontegg-david in #602
• fix: harden outbound address checks, redirect handling and widget rendering by @frontegg-david in #593
• fix(guard): enforce ipFilter on every HTTP flow and give edge runtimes a client IP by @frontegg-david in #594
• fix(plugins): enforce CodeCall, approval, cache, remember and feature-flag policies on every path by @frontegg-david in #595

Full Changelog: v1.8.0...v1.8.1