Skip to content

Toolport v1.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Jul 01:28
· 532 commits to main since this release
v1.10.0
475ded9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Toolport v1.10.0

MCP 2026-07-28 support over stdio in both directions, stale gateways that stop after an upgrade, approvals that re-check against the live gateway, and a batch of transport and code-mode fixes.

Highlights

MCP 2026-07-28 over stdio, both directions, same endpoint

A client on the new revision can talk to Toolport, and Toolport can talk to a server on it. Every existing client and server keeps seeing byte-identical traffic. Both eras run on one stdio endpoint and are detected per connection, so there is nothing to migrate and nothing to configure. (#511)

Three things now work through the gateway that did not before:

  • Progress notifications reach your client. A server reporting progress during a long call has it relayed back, routed to the client that asked for it.
  • Large results keep their full envelope. Shaping an oversized result preserves _meta and any fields Toolport does not recognise.
  • Structured error codes survive the hop, so a client can act on a machine-readable code instead of parsing a message string.

Over Streamable HTTP, Toolport stays on the established revision for now. A modern client gets the response the spec defines as the fall-back signal, so it negotiates down cleanly instead of failing. That half lands with subscriptions/listen.

Old gateway processes stop after an upgrade, on every OS

Upgrading used to leave older versioned gateways (toolport-gateway-1.9.4.exe and friends) running, so security and policy fixes in the new binary never took effect for clients still talking to an old one. Gateway identity is now path-based across Windows, macOS, and Linux. Two platform bugs turned up in the process: on macOS the process listing used an argv Apple's ps rejects, so it saw zero gateways, and on Linux a binary replaced in place was treated as protected rather than obsolete. Settings gains a Stop old gateways action. (SOU-414)

There is one limit, and it decides whether you need to do anything. An AI client caches the gateway command when the client itself starts, so what matters is the path it cached. Where the binary is replaced in place, that path already resolves to the new build and the next spawn picks it up. Where the path is one an upgrade never rewrites, it does not: on Windows the filename carries its version, so an upgrade never has to overwrite a locked file, and on any OS a client can be pinned to an install location you have since moved away from. In those cases, restart the client app. The Stop old gateways description in Settings spells out which case applies. Clients started after the upgrade are unaffected.

An approved tool call is re-checked before it runs

A human approval used to be validated against a snapshot taken before the hold, so a tool that was quarantined, released, or had its definition changed while the approval sat in the queue still executed against the pre-hold view. Approvals now rebind to the live router and fail closed if the definition fingerprint moved or the tool is blocked, with a "this approval is stale" message. (SOU-321, SOU-322)

Vendor auth hints now require an exact domain match. Lookalike apex domains (clerkauth.com, evilgithub.com) could inherit a real vendor's auth hints and token URL through prefix and suffix matching on the second-level label.

Credentials and transport

  • A Continue Shared HTTP bearer now reaches the wire. The token was written under env, which Continue does not forward for remote servers, so a plaintext bearer sat on disk and never authenticated anything. It now goes under requestOptions.headers, matching Continue's contract.
  • Client config backups no longer accumulate live bearer tokens. Every config write copied the previous file and nothing pruned them, so a Shared HTTP client's backups built up carrying working credentials. Capped at five generations per file, matching the registry.
  • The Shared HTTP bridge comes back after the reaper stops it. Reaping a bridge whose binary had been replaced left HTTP and OpenAPI clients with nothing listening until someone reopened Settings.
  • Resource subscriptions clean up when a session is replaced, and a subscriber waiting on another client's open no longer gives up while that open is still succeeding.
  • Code mode budget and isolation. fetchResult shares the call and wall-clock budget instead of paging without limit, async workers reinstall the active session for host calls, and a corrupt registry no longer boots with code mode enabled.

Also in this release

  • Pasting a Crush config no longer fails as a malformed OpenCode one. Both use a top-level mcp key, so the shape of command decides which it is. (#497)
  • Rate-limit counters stay in memory until a data directory is bound, instead of writing a stray counter file into the working directory. (#543)
  • The share-link copy button confirms it copied, and says so when it could not. (#549)
  • Coverage for the import-review shell and private-host classifiers, and for gateway filtering during client migration. (#547, #510)
  • fmtMs and fmtDollars moved into lib/utils with tests. (#548)
  • Error strings, the benchmark write-up, the security notes, and CONTRIBUTING all say what the code actually does. (#539, #545, #546, #540)

Thanks

Patches this cycle came from:

If we missed you, open an issue.

Upgrade notes

  1. Install 1.10.0 and open Toolport once, so the launch pass can stop obsolete gateways.
  2. If an AI client was already running before the upgrade, restart it. Toolport does not yet tell you which ones need it, so if in doubt, restart the clients you had open.
  3. Nothing to configure for MCP 2026-07-28. Era detection is per connection, and clients on older revisions are unaffected.
  4. Shared HTTP users on Continue: reconnect the client once so the bearer is rewritten under requestOptions.headers.

Full changelog

See CHANGELOG.md and the related PRs: #497, #510, #511, #539, #540, #543, #545-#549, #552, #554, #556.

What's Changed

  • chore(release): prepare 1.9.6 by @tsouth89 in #493
  • docs(release): full 1.9.6 notes and contributor thanks by @tsouth89 in #494
  • docs(release): public 1.9.6 notes cleanup by @tsouth89 in #495
  • fix(app): cross-platform path-based stale gateway reaper (SOU-414) by @tsouth89 in #496
  • fix(app): reaper macOS ps argv and Linux (deleted) exe basename by @tsouth89 in #498
  • fix(clients): Shared HTTP lifecycle — bearer write, scope, revoke by @tsouth89 in #499
  • fix(gateway): clean resource subs on session mint + OpenGate timeout (WS1) by @tsouth89 in #500
  • fix(gateway): code mode budget, session TLS, kill-switch tests (WS2) by @tsouth89 in #501
  • fix(security): exact vendor SLD match; reject lookalike apex domains (WS5) by @tsouth89 in #502
  • fix(clients): Continue Shared HTTP bearer under requestOptions.headers (WS3-1) by @tsouth89 in #503
  • fix(gateway): assert code-mode kill switch via real dispatch paths (WS2) by @tsouth89 in #504
  • fix(gateway): OpenGate wait + Linux reaper (deleted) policy (WS1/WS4) by @tsouth89 in #505
  • fix(gateway): rebind live Router after HITL approval (SOU-321/322) by @tsouth89 in #506
  • fix(app,gateway): post-1.9.6 review follow-ups (SOU-432/433/434) by @tsouth89 in #507
  • chore: 1.9.7-rc.1 for multi-OS smoke testing by @tsouth89 in #508
  • fix: disambiguate OpenCode vs Crush mcp shapes in parse_json_snippet (#418) by @Vermitrude in #497
  • test(desktop): cover gateway filtering during client migration by @rohankumardubey in #510
  • fix: normalize 'Could not' error strings to 'Couldn't' by @cyforkk in #539
  • feat(gateway): dual-era MCP 2026-07-28 support on stdio (SOU-443/444/445/446) by @tsouth89 in #511
  • docs: update frontend test file naming in CONTRIBUTING by @HaimiyaWasn in #540
  • docs(benchmark): align prose with the measured tables by @AnayGarodia in #545
  • docs(security): lead with TOOLPORT_* names, keep CONDUIT_* as legacy by @AnayGarodia in #546
  • fix(share): give the copy-link button feedback and surface failure by @AnayGarodia in #549
  • refactor(utils): move fmtMs and fmtDollars into lib/utils with tests by @AnayGarodia in #548
  • test(import-review): cover the runsShell and isPrivateHostUrl classifiers by @AnayGarodia in #547
  • fix: keep unbound rate-limit counters in memory by @snowyukitty in #543
  • docs(contributing): say not to run cargo fmt, and why by @tsouth89 in #552
  • chore(release): 1.10.0 by @tsouth89 in #554
  • chore(release): finish the 1.10.0 release prep by @tsouth89 in #556

New Contributors

Full Changelog: v1.9.6...v1.10.0

Contributors

AnayGarodia, rohankumardubey, and 5 other contributors
Assets 14
Loading