v2.1.1

What's Changed

• E20: the source address stays private; app page adopted by @danoszz in #197
• Pin 2.1.0 everywhere by @danoszz in #198
• Register E20: lists stored and hashed by @danoszz in #199
• research: register E20-R, with runner, classifier and study page by @danoszz in #201
• fix: hold the MCP scan scope on every hop; no grade for an empty agents audit by @danoszz in #200
• research: E20-R amendment 1 and deviation 1 by @danoszz in #202
• fix: no false critical on single-page apps, honest exit 0 by @danoszz in #203
• release: 2.1.1 by @danoszz in #204

Full Changelog: v2.1.0...v2.1.1

Share this release

LinkedIn (592 characters)

Penthera v2.1.1 is out: open-source security for the apps and AI systems you ship.


What's new:
• scanurl over MCP now stays in scope on every request and redirect hop, with or without --offline: It reaches the target and hosts you listed with --allow-host
• penthera agents gives no grade when it finds no agent config: It used to report A, 100 and Nothing to fix
• E20-R study tooling (research): A runner and analysis for the planned front-door follow-up, tested on loopback only

npm: https://www.npmjs.com/package/penthera
GitHub: https://github.com/danoszz/penthera/releases/tag/v2.1.1

X / Bluesky (250/280 characters)

Penthera v2.1.1 is out.
• scanurl over MCP now stays in scope on every…
• penthera agents gives no grade when it finds no…
• E20-R study tooling (research)
https://www.npmjs.com/package/penthera
https://github.com/danoszz/penthera/releases/tag/v2.1.1

Drafted from the CHANGELOG. Edit, then post by hand once the npm release is approved.