Skip to content

0.2.0 — an HTTP transport, and a container to run it in

Choose a tag to compare

View all tags
@BeneODev BeneODev released this 22 Aug 19:34
· 16 commits to main since this release
v0.2.0
2e76a20
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The server learns a second transport and gets a container to run in. Everything from 0.1.0 is unchanged: nothing is enabled until the policy file names it.

An HTTP transport

--transport streamable-http or sse, beside the stdio one that stays the default. A bearer token is required, not offered — without LXO_MCP_BEARER_TOKEN an HTTP transport refuses to start, because anyone who can reach the port would otherwise be reaching an accounting API. The SDK's DNS-rebinding guard checks Host and Origin on top, with the loopback names always allowed and --allowed-hosts adding a container or proxy name.

stdio is untouched: there the client owns the process and nothing else can reach it.

A container

docker pull ghcr.io/benethos-hub/lexware-office-mcp:0.2.0
docker compose up -d                      # the server, on 127.0.0.1:8770
docker compose --profile setup up -d      # add the configuration interface

Published for linux/amd64 and linux/arm64. The README covers both Compose and plain docker run.

  • Nothing has to be prepared. The container generates its own bearer token on first start and writes it into the config volume — no secret is baked into an image that every copy would share.
  • A setting saved in the browser reaches the running server. Settings are read once at startup, so the container ends its process when its settings file changes and Compose starts it again.
  • The configuration interface is a second container behind a setup profile. It has no login and it takes an API key, so a plain up leaves it out.

For the client and the type checker

Every tool now carries the MCP annotations — readOnlyHint, and for a writing tool whether it destroys what was there and whether calling it twice is safe. They are derived from the same classification the policy file is written against, and they decide nothing: the file remains the only gate, consulted twice, reading no annotation.

The package also ships py.typed, so code importing it gets its annotations checked instead of skipped.

Verified

Against a live account, including a client reaching it through the pulled image over HTTP, and against a fresh installation that offers no tools until a policy file says otherwise.

The full list of changes is in CHANGELOG.md.

Assets 2
Loading