As Decided v0.27.0 adds strict controls to the shared MCP server and the release process.
The server now rejects invalid requests before it processes them. The server also stops if it cannot write a required audit record.
Important change
You must use --behind-proxy when you bind the HTTP server to a non-loopback address.
The proxy must provide TLS, authentication, principal-header replacement, rate limits, network controls, and request limits.
You do not need this option for loopback use.
Changes
- The HTTP server rejects requests that are too large or take too long. It also rejects invalid origins, incompatible protocol versions, and invalid JSON-RPC messages.
- The server limits each response to a specified byte size. The server stops if it cannot write a required audit record.
- A multi-file rename operation now changes all files or no files. If one change fails, As Decided restores the files.
- Shared test data now checks the MCP protocol and the six public tools.
- The release process runs all native tests before it publishes files or images. It creates checksums, provenance records, an SBOM, and third-party notices. GitHub OIDC signs the OCI images. Dependency checks block known advisories and prohibited network dependencies.
Install
The release process adds native archives to this page after all tests pass.
docker pull ghcr.io/asdecided/core:v0.27.0
docker pull ghcr.io/asdecided/core:mcp-v0.27.0
Cargo and the official MCP Registry use separate release checks.
The MCP server is read-only and does not use a database. As Decided does not upload your decision files or store them in a hosted service.
Full change list: https://github.com/asdecided/core/compare/v0.26.2…v0.27.0