Skip to content

mcp-server-auth-template v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 22:32
· 4 commits to main since this release
v0.6.0
b9ddb57
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.6.0 — MCP Auth Server Template

v0.6.0 promotes the public-server presentation work and upgrades secure container publication to
a verified multi-platform OCI image.

Publish and verify this server release before publishing mcp-client-auth-template v0.6.0.

Highlights

  • Public repository cleanup and presentation polish from PR #24.
  • Real source-level and distributed-trace evidence in the README.
  • Production Dockerfile support for linux/amd64 and linux/arm64.
  • Native Apple Silicon consumption without AMD64 emulation.
  • Continued Docker Desktop/WSL2 and x86_64 Linux compatibility through linux/amd64.
  • Per-platform CycloneDX SBOM, Grype report and vulnerability-policy evidence.
  • GHCR authentication only after both architecture policies pass.
  • Exact scanned local images published under immutable architecture-specific version/commit tags.
  • One final OCI version index and one commit index assembled from the canonical platform digests.
  • image-platforms.json binds the final index to the exact AMD64 and ARM64 manifests.
  • Final-index build provenance plus per-platform SBOM attestations.

Security and supply chain

  • Both architectures must pass vulnerability policy before the workflow receives a GHCR token.
  • Publication uses the exact scanned local images; there is no post-scan rebuild.
  • Version, commit and architecture-specific tags are never overwritten.
  • v0.6.0 and sha-<commit> must resolve to the same two-platform OCI index.
  • Release validation rejects missing, duplicate, unexpected or drifted platform manifests.
  • No latest tag is published.

Compatibility

  • Python: >=3.13,<3.15
  • MCP Python SDK: >=2.0,<3
  • MCP protocol reference: 2026-07-28
  • Transport: Streamable HTTP
  • Authentication: Microsoft Entra ID and generic OIDC
  • Container platforms: linux/amd64, linux/arm64

Upgrade notes

  • OAuth validation, MCP request semantics and application APIs remain compatible with v0.5.0.
  • Apple Silicon consumers can use the native ARM64 image.
  • Windows Docker Desktop continues using the Linux AMD64 image through its Linux-container/WSL2
    backend; this release does not introduce native Windows Server containers.
  • Prefer the immutable multi-platform index digest from image-digest.txt.
  • Do not reuse v0.6.0 after a partial publication; prepare a new version instead.
Assets 16
Loading