Skip to content

v0.3.0

Choose a tag to compare

View all tags
@churichard churichard released this 14 Jul 05:46
· 52 commits to main since this release
v0.3.0
b9a7ff5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Breaking change: download_attachment no longer accepts savePath or returns contentBase64. It now returns the file as an embedded MCP resource. Clients that call this tool directly must read the resource content instead. The default attachment limit is 10 MB and can be changed with FLUXMAIL_MAX_ATTACHMENT_MB, up to 25 MB.

Added

  • Added read-only, read-write, and full permission profiles for stdio connections and HTTP API keys, plus custom capability lists with repeated --allow options. Existing connections and keys keep the full profile.
  • Added commands to list MCP capabilities and change the permissions on an existing API key.

Changed

  • MCP clients only see tools and actions allowed by their connection's permission policy.
  • Telemetry events are batched and flushed when Fluxmail shuts down, including when a stdio client closes its input stream.

Security

  • Attachment downloads no longer accept server-side output paths. Fluxmail returns attachment bytes through MCP and enforces a configurable size limit.
  • Mailbox organization actions cannot use move destinations or Gmail system labels to bypass the dedicated archive, trash, and delete permissions.

Full Changelog: v0.2.1...v0.3.0

Assets 2
Loading