Skip to content

RootMind 2.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Oct 18:38
· 33 commits to main since this release
v2.2.0
bcf8fd4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Remote access (ngrok) for cloud assistants (Grok Bot, a cloud-hosted n8n, other web agents), off by default (#27). Settings → RootMind service → Remote access (ngrok) takes an ngrok authtoken (write-only: once saved only "Saved" is shown) and an optional reserved domain; one checkbox, after a confirmation that anyone with the MCP token can read every indexed document and that what a cloud assistant reads goes to its provider, gives MCP over HTTP a public HTTPS address. The status (off, connecting, connected with the public MCP endpoint and Copy, or ngrok's error) is shown in the same place. The tunnel runs inside the RootMind-MCP-HTTP service with ngrok's open-source Python SDK (no ngrok program is installed), forwards only to the MCP server, starts with the service, survives updates, reconnects with growing pauses, and closes within seconds when turned off. Requests through it still need the MCP token and pass the Origin check. Disabled while MCP over HTTP is off; turning MCP over HTTP off also turns remote access off. No administrator approval is needed.
  • REST API: GET /remote-access and POST /remote-access (bearer token). The authtoken is stored in %ProgramData%\RootMind\data\ngrok_authtoken.txt, readable only by SYSTEM, Administrators and the MCP service account, never in config.yaml, never returned and never logged; enabled and domain go to config.yaml (remote_access). The MCP service reports the tunnel's state in data\remote_access.json, the one file in the data folder it may write.
  • The smoke test checks that the packaged backend imports the ngrok SDK and that remote access is off by default; the service end-to-end test checks the new files' permissions.

Changed

  • Docs: "Reach RootMind from cloud assistants" now starts with the built-in remote access; your own tunnel (Tailscale Funnel, the ngrok agent) remains the alternative. SECURITY.md describes the threat model of the public address and how the authtoken is stored.

Downloads

File What it is
RootMind-Setup-x64.exe The Windows app with its background service (41.8 MB). Installs for all users of the computer and sets up the service for your account; needs one administrator approval, no Python.
rootmind.mcpb RootMind for Claude Desktop: double-click it and Claude Desktop installs it. Needs RootMind installed with Serve MCP over HTTP on (the default).
rootmind-backend-windows-x64.zip The backend on its own, for the command line and servers. Not needed for the app.
SHA256SUMS.txt SHA-256 checksums of these files.

Verify the download

The binaries are not code-signed yet. On the first start, Windows SmartScreen may show "Windows protected your PC" (choose More info, then Run anyway), and Smart App Control, when it is on, may block them; it has no exception for a single app. Check the files before you run them. The hash must match the line for the file in SHA256SUMS.txt:

(Get-FileHash .\RootMind-Setup-x64.exe -Algorithm SHA256).Hash.ToLower()
sha256sum --check --ignore-missing SHA256SUMS.txt
gh attestation verify RootMind-Setup-x64.exe --repo cgaeking/rootmind

Every file has a build provenance attestation that ties it to this repository and to the workflow run that built it.

Code signing policy

See CODE_SIGNING.md: the binaries are not code-signed yet; what will be signed, team roles and the privacy policy.

Assets 6
Loading