v0.9.0

Upgrading to v0.9.0

⚠️ Security fix — GHSA-rp45-5x3v-48mr. Upgrade as soon as possible if you run the http or sse transport.

Update the npm package

npm install argocd-mcp@0.9.0
# or, if invoked via npx
npx argocd-mcp@0.9.0 <command>

Update the Docker image

docker pull ghcr.io/argoproj-labs/mcp-for-argocd:0.9.0
# or
docker pull quay.io/argoprojlabs/mcp-for-argocd:0.9.0

If you reference :latest in a Kubernetes manifest, Compose file, or similar, redeploy to pick up the new image — pinning to 0.9.0 explicitly is recommended.

Changes

• The http/sse listener now binds 127.0.0.1 by default, not every interface. If your deployment relied on the previous default (reachable from outside the container/host with no other config), it will stop being reachable after upgrading — this is intentional; see below to restore access safely.
• A same-Pod sidecar or co-located process is unaffected. Loopback is shared within a Pod's network namespace, so a caller in the same Pod (e.g. an auth proxy sidecar) still reaches the listener with no change on your part — no new configuration is needed if you don't change the bind address.
• MCP_AUTH_TOKEN is a new credential, separate from ARGOCD_API_TOKEN — the latter authenticates this server to ArgoCD and never authenticated callers, even before this fix. When MCP_AUTH_TOKEN is set, callers must send Authorization: Bearer <inbound_token>.
  MCP_AUTH_TOKEN is only required if you widen the bind address (MCP_BIND_ADDRESS/--bind-address set to anything other than loopback, e.g. 0.0.0.0) — the server refuses to start otherwise. At the default loopback bind, no token is required to start. Note this is about the requirement, not enforcement: if you set MCP_AUTH_TOKEN anyway while staying on loopback, it is still checked on every request — there's no bind-address exemption for an already-configured token. To keep the listener reachable via a published port or across hosts, set both:

-e MCP_BIND_ADDRESS=0.0.0.0 -e MCP_AUTH_TOKEN=<inbound_token>

• If something else already authenticates callers (a reverse proxy, service mesh, network policy) and you don't want to manage MCP_AUTH_TOKEN, use --allow-unauthenticated instead when widening the bind.
• Widening the bind without either MCP_AUTH_TOKEN or --allow-unauthenticated now refuses to start (non-zero exit, with the reason logged) rather than silently running exposed.

Full configuration reference: Network Exposure in the README, and Operator Notes in SECURITY.md.

Contributions

• feat: add a new tool to fetch AppProject resources by @leoluz in #133
• fix: bind loopback by default and authenticate inbound requests by @hwwn in 28d15ca

Full Changelog: v0.8.0...v0.9.0