execkit-mcp-v0.4.3

Other

• document MAX_SESSIONS + checkpoint tools + docker; MSRV + lean-build test

execkit-mcp-v0.4.2

Fixed

• (security) exclude .execkit, validate token, redaction coverage, docker -- , document destructive restore
• (security) atomic session cap (close TOCTOU that bypassed MAX_SESSIONS)

execkit-mcp-v0.4.1

Fixed

• (checkpoint) require explicit workspace; configurable + broader ignores

execkit-mcp-v0.4.0

Added

• (mcp) output budget params on session_create/session_exec

Fixed

• (budget) guard HeadTail against untrusted extreme counts (final review)

Other

• output budgets (README, QUICKSTART, mcp README) + truncated doc
• (budget) MCP e2e for output budgets (shape + report + bad regex)

execkit-mcp-v0.3.1

Added

• (mcp) checkpoint/restore tools + auto_snapshot/workspace/paths

Other

• checkpoints feature + git-on-remote prerequisite

execkit-mcp-v0.3.0

Added

• (mcp) checkpoint/restore tools + auto_snapshot/workspace/paths

Other

• checkpoints feature + git-on-remote prerequisite

execkit-mcp-v0.2.0

Added

• Docker transport (Session::docker + MCP transport=docker)

execkit-mcp-v0.1.3

Other

• (mcp) assert server advertises execkit-mcp identity

v0.1.1

Docs-only patch release.

• Rewrote the README to match what's actually shipped (real Rust + MCP usage; dropped illustrative/unbuilt claims).
• Added a Mermaid diagram of the command-through-the-fence flow.
• Normalized typography to plain ASCII across docs and comments.
• Moved internal planning docs out of the public repo.

No code changes; same API and behavior as v0.1.0. Crates: execkit, execkit-mcp.

v0.1.0 — first release

First release of execkit — stateful, structured, safe command execution for AI agents.

Crates

• execkit — the embeddable library (local PTY + SSH).
• execkit-mcp — MCP (stdio) server for Claude Code / Cursor / Gemini CLI.

Highlights

• Persistent, stateful sessions (cwd/env stick) over local PTY and SSH.
• Structured ExecResult — split stdout/stderr, exit code, duration, cwd.
• Safety: advisory command policy, secret redaction, bounded output, SSH host-key verification.
• MCP server so an agent can drive it directly.

Early 0.1.x release — not production-ready. See the README Limitations and ROADMAP.