Skip to content

v0.5.2 — MCP Tool Suite + Security Hardening

Choose a tag to compare

View all tags
@ajianaz ajianaz released this 08 Aug 09:00
· 17 commits to develop since this release
v0.5.2
5c125d2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Titen v0.5.2 memperluas MCP tool suite dari 17 menjadi 30 tools dan membawa hardening keamanan menyeluruh pada layer upload_media.

✨ 13 MCP Tools Baru

Tool MCP sekarang mencakup seluruh capability API utama, tidak lagi hanya via REST:

Tool Fungsi
get_post, get_schedule Detail post/schedule
approve_schedule, reject_schedule HITL lifecycle
list_media, upload_media Upload ke S3 + list media
fetch_mentions, list_mentions Mention monitoring
search_keyword Keyword search di Threads
get_post_trend Analytics trend per post
reply_to_comment Reply komentar Threads
exchange_oauth_code, create_account OAuth flow + onboarding

🔒 Security Hardening (6 issues fixed)

Round-by-round security review menemukan dan memperbaiki:

  • SSRF protection: redirect(Policy::none()) + is_private_host() DNS check — blocks 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, IPv6 ::1, fc00::/7 (ULA), fe80::/10 (link-local)
  • Fail-closed DNS: resolution error = unsafe (tidak fail-open)
  • Magic bytes validation: per-format length guards untuk JPEG/PNG/WebP/GIF — tolak extension spoofing
  • Schema/handler alignment: upload_media dan list_media field names konsisten
  • Chunked encoding cap: streaming 50 MB hard cap via resp.chunk()
  • Token expiry dari API: tidak lagi hardcoded 60 hari — exchange_long_lived_token mengambil expires_in sebenarnya

📦 Binaries

Setiap archive berisi 3 binary:

  • titen-api — HTTP server (Threads management API)
  • titen — CLI client
  • titen-mcp — MCP server (stdio)
Platform File
Linux x86_64 titen-x86_64-unknown-linux-gnu-v0.5.2.tar.gz
Linux ARM64 titen-aarch64-unknown-linux-gnu-v0.5.2.tar.gz
macOS ARM64 titen-aarch64-apple-darwin-v0.5.2.tar.gz

🐳 Docker Images

docker pull ghcr.io/codecoradev/titen:0.5.2-api
docker pull ghcr.io/codecoradev/titen:0.5.2-web

Multi-arch (amd64 + arm64) untuk API dan Web.

📊 Validation

  • 58 unit tests passed ✅
  • All GitHub Actions green (8/8) ✅
  • Clippy clean ✅
  • Cargo Audit clean ✅
  • Trivy FS Scan clean ✅

Full changelog: https://github.com/codecoradev/titen/blob/v0.5.2/CHANGELOG.md#052---2026-08-08

Assets 6
Loading