Phantom v1.0.2: security update

Upgrade now. v1.0.0 and v1.0.1 have a critical security flaw (below).

Security: the MCP tool endpoint on port 8080 was not authenticated (affects v1.0.0, v1.0.1 and every earlier build). The embedded MCP server's JSON-RPC endpoint (/api/v1/stream/mcp) accepted requests with no credential at all, and Phantom publishes port 8080 on the host. Anyone who could reach that port could list and call all of the agent's tools: run queries through any configured XSIAM or Cortex instance, start and stop log workers, create scheduled jobs, install or upload connectors. The UI and agent API on port 3000, and every REST route on 8080, were already authenticated and were not affected.

• What changed. The endpoint now requires Authorization: Bearer <MCP_TOKEN> (what the agent itself uses) or an API key that holds the tools:call scope. Anything else gets 401 or 403 before a tool is reached.
• API keys no longer reach beyond their scopes on port 8080. The REST routes there accepted any valid key at any scope, so a key minted for one purpose, say audit:read for a SIEM poller, could also read instances and settings and create jobs. A key is now accepted only where its scope is named (audit:read for the audit log, settings:read / settings:write for settings, approvals:resolve for approvals, tools:call for the tool endpoint; * covers those and nothing more). Everything else on 8080 needs the internal token. The agent API on port 3000 is unchanged.
• The approval-bypass header is honoured only from the agent's own token; from an API key it is ignored.
• If you cannot upgrade yet: block port 8080 from everything but the host itself (a host firewall rule, or publish it as 127.0.0.1:8080:8080 in docker-compose.yml), and treat any key that was ever issued as potentially misused: revoke and re-issue it after upgrading.
• Client note. If you call the tool endpoint from your own MCP client, send the token as Authorization: Bearer <MCP_TOKEN>.

Dependencies. Clears every critical and high dependency alert that GitHub reported on the public repository (2 critical, 9 high, plus the medium and low ones).

Fixed.

• xlog runs on current, patched libraries. It was pinned to 2024-era versions of FastAPI, Starlette, python-multipart, h11 and anyio. It now runs FastAPI 0.143, Starlette 1.7, Pydantic 2, Strawberry GraphQL 0.333, python-multipart 0.0.32, h11 0.16 and anyio 4.14. Three requirements nothing used (ariadne, fastapi-utils, fastapi-cli) were removed because they held the old versions in place.
• The agent's build tooling no longer carries a vulnerable postcss. Next.js pins its own copy; an npm override now points every copy at the patched release. The audit of production dependencies reports 0 vulnerabilities. One dev-only package (braces, used by Tailwind and ESLint) is rated high but has no patched release anywhere and is not part of the shipped image.
• The request after a failed chat no longer gets an empty 400. The TLS proxy in front of the UI reused upstream connections, and a chat stream that ended with an error (for example before any model provider is configured) left a connection behind that the next request picked up and Next rejected. Each request now uses its own connection to the backend.
• Settings refuse a value of the wrong type. The settings API stored whatever it was given, so a number for a text setting or the text "false" for a yes/no setting was saved and then read back as the wrong type. A value must now have the same JSON type as the setting's default; a mismatch is reported in the response's rejected list and nothing is stored for that key.
• xlog starts reliably on a fresh database. Its server runs several processes, and on a brand-new database file they could collide on the first SQLite setup step, killing one worker at startup (the supervisor restarted it). The step now retries briefly while another process holds the lock.

Docs. /help/architecture#authentication (API keys on the two ports), /help/user#api-keys (the scope table, now enforced) and the scope text on /api-keys.

To move from v1.0.0 or v1.0.1, download phantom-installer below and run it with sudo on the host. It keeps your data, secrets and settings. Verify the download against phantom-installer.sha256. After upgrading, revoke and re-issue any API key that was ever issued.