v0.1.8: Multi-architecture Docker builds

Multi-architecture Docker builds

• Run architecture-neutral compilation and ATT&CK data preparation on the native builder while preserving target-specific runtime images.

CHANGELOG v0.1.8

v0.1.7: mcp-ts-core 0.12.3 and SDK v2 maintenance

mcp-ts-core 0.12.3 and SDK v2 maintenance

• MCP SDK v2 serving with strict tool inputs, JSON Schema 2020-12, and advertised error envelopes
• Declared recovery hints and complete/truncated map metadata now reach MCP responses
• TypeScript 7 test typechecking, Bun 1.4 packaging, supply-chain controls, community files, and vendored workflow updates
• deps: @cyanheads/mcp-ts-core ^0.10.9 → ^0.12.3; typescript ^6.0.3 → ^7.0.2 (+ dev-dep bumps)

CHANGELOG v0.1.7

v0.1.6: mcp-ts-core ^0.10.9 maintenance

mcp-ts-core ^0.10.9 maintenance

Framework-maintenance release — adopts the mcp-ts-core 0.10.7–0.10.9 tooling. No source or behavior changes.

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.6 → ^0.10.9
• @types/node ^25.9.3 → ^26.0.0
• vitest ^4.1.8 → ^4.1.9

Added:

• check-dependency-specifiers devcheck step — fails on floating specifiers (latest/*/dist-tags) in package.json deps and bun.lock workspaces (cyanheads/mcp-ts-core#246)
• Plugin marketplace manifest checks in lint-packaging (check 10) — description, identity, and install-arg correctness; gated by packaging.pluginManifests (cyanheads/mcp-ts-core#240)

Changed:

• Vendored devcheck scripts re-synced: fresh-scaffold git guards, empty-changelog --check exit, worktree-deletion guard in check-skill-versions (cyanheads/mcp-ts-core#237, #242, #243)
• Fourteen vendored skills refreshed to 0.10.9 (cyanheads/mcp-ts-core#238)

128 tests pass; bun run devcheck clean.

v0.1.5: mcp-ts-core 0.10.6 adoption — identity, enrichment, packaging

mcp-ts-core 0.10.6 adoption — identity, enrichment, packaging

Adopts @cyanheads/mcp-ts-core 0.10.6: explicit createApp identity, the renamed ValidationError code, and an overflow enrichment signal. Hardens the MCPB bundle and Docker image.

Added:

• createApp({ name, title }) pinned to pentest-mcp-server (served identity = machine name)
• ctx.enrich.truncated() from pentest_map_techniques when matches exceed limit
• scripts/clean-mcpb.ts — strips node_modules agent-docs the bundle pack cannot exclude
• Dockerfile /healthz HEALTHCHECK + APP_VERSION OCI label

Changed:

• pentest_analyze_response / pentest_encode / pentest_guide / pentest_map_techniques error codes InvalidParams → ValidationError
• .mcpbignore dev-dir patterns anchored to root (no longer strip nested node_modules runtime paths)
• lint-packaging.ts + check-framework-antipatterns.ts gain bundle-content, identity, and z.coerce.boolean() guards
• Vendored skills re-synced; added the techniques skill

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.9.21 → ^0.10.6
• typescript ^5.9.3 → ^6.0.3
• @biomejs/biome ^2.4.16 → ^2.5.0
• @types/node ^25.9.1 → ^25.9.3
• tsc-alias ^1.8.16 → ^1.8.17
• vitest ^4.1.0 → ^4.1.8

128 tests pass; bun run devcheck clean.

v0.1.4: pentest_lookup_group + WAF bypass expansion

pentest_lookup_group + WAF bypass expansion

Adds ATT&CK threat group/software lookup and expands the WAF bypass dataset from 10 to 34 entries with 3 new WAF products.

Added:

• pentest_lookup_group — looks up ATT&CK intrusion sets (G-prefix) and software (S-prefix) by ID or name; returns aliases, type, description, and up to 20 technique-use entries with procedure context (#3)
• AttackGroup index in attack-service — groupById/groupKeywordIndex maps from intrusion-set/malware/tool STIX objects; lookupGroupById() and searchGroups() methods

Changed:

• WAF bypass dataset: 10 → 34 entries; new WAF coverage: F5 BIG-IP ASM, Nginx ModSecurity, Fortinet FortiWAF; new categories per existing WAF products (#4)
• pentest_generate_payloads waf_profile enum: f5_bigip_asm, nginx_modsecurity, fortinet_fortiwaf added

128 tests pass; bun run devcheck clean.

v0.1.3: mcp-ts-core 0.9.21 framework adoption

mcp-ts-core 0.9.21 framework adoption

Adopts @cyanheads/mcp-ts-core 0.9.21 with log context, secret-stripping, and retry improvements. Syncs 8 updated skills plus new api-mirror and orchestrations skills from the framework release.

Changed:

• @cyanheads/mcp-ts-core ^0.9.16 → ^0.9.21 — HTTP transport per-request log context fix (logs and traces carry fresh request + trace/span IDs instead of the frozen boot context); fetchWithTimeout strips query-string secrets (e.g. ?api_key=) from error messages and logs; withRetry fails fast on non-retryable errors; ctx.fail auto-populates the retryable flag.

Dependencies:

• @cyanheads/mcp-ts-core ^0.9.16 → ^0.9.21
• @biomejs/biome ^2.4.7 → ^2.4.16 (dev)
• @types/node ^25.6.0 → ^25.9.1 (dev)
• tsc-alias ^1.8.16 → ^1.8.17 (dev)
• vitest ^4.1.0 → ^4.1.8 (dev)

100 tests pass; bun run devcheck clean.

v0.1.2: Populate ATT&CK v17 detection graph; word-boundary truncation

Populate ATT&CK v17 detection graph; word-boundary truncation

Both fixes address data-extraction bugs in attack-service.ts.

Fixed:

• Detection fields (summary, data_sources, indicators) were empty for every technique; ATT&CK v17 removed x_mitre_detection/x_mitre_data_sources from attack-patterns. Now walks the v17 detection-strategy graph: detects relationship → x-mitre-detection-strategy → x-mitre-analytic → x_mitre_log_source_references. (#1)

• Technique/mitigation/procedure text was hard-cut mid-word via .slice(N) with no indicator. New truncate() helper cuts on word boundaries and appends an ellipsis; applied in attack-service.ts and both tool files; mitigation cap raised 300 → 600 chars. (#2)

100 tests pass; bun run devcheck clean.

v0.1.1: Public hosted endpoint at https://pentest.caseyjhand.com/mcp

Public hosted endpoint at https://pentest.caseyjhand.com/mcp

Adds the public Streamable HTTP endpoint to server.json remotes[] and README Getting-started section. No source changes.

Added:

• Public hosted endpoint at https://pentest.caseyjhand.com/mcp — streamable-http, no auth required

91 tests pass; bun run devcheck clean.

v0.1.0: Initial release — offline methodology engine for authorized pentesting, CTF, security research, and education

Initial release — offline methodology engine for authorized pentesting, CTF, security research, and education

Offline offensive security tool suite for use on authorized targets only. Embeds ATT&CK Enterprise v19.1 and OWASP TG v4.2 data; no external API calls.

Added:

• pentest_guide — methodology playbook for 15 attack vectors; phase filtering; OWASP TG v4.2 test case IDs and ATT&CK IDs cross-referenced; stack/WAF-aware target context
• pentest_analyze_response — structured HTTP response analysis; fingerprinting summary feeds into guide/map tools
• pentest_lookup_technique — ATT&CK lookup by ID or keyword; detection indicators, mitigations, procedure examples
• pentest_map_techniques — target profile → ranked ATT&CK techniques + OWASP test cases; transparent relevance scoring
• pentest_generate_payloads — annotated payload templates; 14 categories, 16 injection contexts, WAF profile variants; each template carries detection + mitigation
• pentest_encode — encoding chain transformer; 10 types, up to 6 chained steps; decode walkthrough + bypass rationale; detection_note in every response
• authorized_use_reminder required field on all methodology/payload tools — rendered as first line of every response
• Detection + mitigation parity — non-optional on every technique, finding, and payload object
• scripts/refresh-attack.ts — fetches latest ATT&CK Enterprise JSON; run quarterly

91 tests pass; bun run devcheck clean.