v1.4.0

1.4.0 (2026-08-12)

Features

• harness: actuate harness-driven egress OS enforcement via rungs (3859667)
• harness: actuate harness-driven egress OS enforcement via rungs (a6a7422)
• harness: apply the ack's effective config before the tool surface (6b484a2)
• harness: apply the ack's effective config before the tool surface (9f3580b)
• harness: point OS egress enforcement at the announced harness proxy (4588620)
• harness: point OS egress enforcement at the announced harness proxy (4de7832)
• harness: serve the agentweave-harness control channel as a servant (17f4e69)
• harness: serve the agentweave-harness control channel as a servant (337df6e)
• harness: shed the local enforcement stack on a mode-enforce ack (9d4b2d8)
• harness: shed the local enforcement stack on a mode-enforce ack (4ba7ff3)
• scrape: route the fetch through the provisioned egress proxy (0d27e6a)
• scrape: route the fetch through the provisioned egress proxy (35fcbb9)

Bug Fixes

• acceptance: stop overriding weave's answer file (b9c69e0)
• lint: resolve the new-issue base against origin/main, not bare main (c5649c7)

---

Windows binaries (amd64, arm64) are pure Go and require no runtime
dependencies. The transport is stdio only — there is no network listener.

Verify a download against the signed checksum file:

cosign verify-blob \
  --bundle windows-mcp-server_1.4.0_checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deploymenttheory/windows-mcp-server/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  windows-mcp-server_1.4.0_checksums.txt

sha256sum -c windows-mcp-server_1.4.0_checksums.txt --ignore-missing

v1.3.0

1.3.0 (2026-08-05)

Features

• evidence: ship a sealed session bundle off the device (2feac48)
• evidence: ship a sealed session bundle off the device (c412294)
• journeys: infer verbs from UIA patterns and mark assertions while recording (5064441)
• journeys: infer verbs from UIA patterns and mark assertions while recording (803af64)
• journeys: record a run as an OTLP/JSON trace and persist its evidence (cca73b3)
• journeys: rewrite journeys-as-code as a closed, checkable vocabulary (af8175d)
• journeys: rewrite journeys-as-code as a closed, checkable vocabulary (a1c0d55)

Bug Fixes

• contain: record what the OS reported back after isolating (S13) (25fec6c)
• guardrails: audit and adjudicate completion/complete and subscriptions/listen (b4139b2)
• guardrails: close five findings from live validation on a Windows guest (3493451)
• guardrails: close four findings from live validation on a Windows guest (6ec0508)
• guardrails: close four paths that permitted or passed on failure (077df12)
• policy: refuse an inert posture-drift trigger; move the status token off disk (44c9288)
• scrape: vet the address that is dialled, using the checker the proxy uses (e37f26e)
• security: remediate the findings from the security posture assessment (7c456f4)
• tools: annotate the input surface destructive so policy rules reach it (8223506)

---

Windows binaries (amd64, arm64) are pure Go and require no runtime
dependencies. The transport is stdio only — there is no network listener.

Verify a download against the signed checksum file:

cosign verify-blob \
  --bundle windows-mcp-server_1.3.0_checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deploymenttheory/windows-mcp-server/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  windows-mcp-server_1.3.0_checksums.txt

sha256sum -c windows-mcp-server_1.3.0_checksums.txt --ignore-missing

v1.2.0

1.2.0 (2026-08-04)

Features

• toolsets: split persistence tools out of the default system toolset (0f109a6)
• tools: move execution by path out of the apps toolset (964016a)

Bug Fixes

• audit: bound the client-supplied text that reaches the chain (6eb2e87)
• audit: key the chain by default instead of only on request (716035f)
• audit: key the manifest chain so its records cannot be rewritten (993eec3)
• audit: salt argument digests so they cannot be brute-forced (31975fb)
• contain: authenticate the kill sentinel and protect its directory (cffb75d)
• contain: make the kill ladder survive a panic, a nil log and a hang (bfe62db)
• credentials: check the file owner, and allowlist its readers (c35f643)
• credentials: report the injected length as a band, not a count (0535058)
• credentials: require a masked destination before injecting a secret (c1ed116)
• desktop: bound the work one call can queue on the engine thread (3ef2a53)
• desktop: escape WQL metacharacters in Process kill-by-name (42eb8a3)
• desktop: make journey-recorder redaction fail closed (24a8afc)
• desktop: namespace agent recording markers so they cannot forge events (3dfed8f)
• desktop: stop the security banner being dropped on a full overlay queue (5232a0b)
• desktop: withhold the server's own environment from child processes (3a64a29)
• egress: close the proxy's port fail-open, socket leak and lost handshake (31ca2a9)
• egress: restore WinINET settings when no firewall rules were recorded (f9fc850)
• egress: stop the recovery state file being a privilege escalation (03ffdcc)
• enforce: authenticate approval replies and refuse plaintext webhooks (1ec514e)
• guardrails: install receiving middleware in one call so order holds (3b774f6)
• hostmatch: close the IPv6 transition and IANA gaps in ForbiddenAddr (fe75834)
• planner: put a plan-gated plan to a human before applying it (27d3670)
• policy: rank a wildcard tool selector as broad, and clamp require_plan (4d26caf)
• policy: record a required signal that could not be evaluated (d3250ef)
• policy: refuse a telemetry endpoint that would export in clear (7acdedf)
• security: remediate findings from the security audit (619eae2)
• security: remediate medium and low findings from the security audit (3642cc3)
• shell: bind PowerShell arguments as data instead of quoting them (9e486b5)
• status: keep durable device identifiers out of the agent-facing tool (adfcfce)
• status: require a token to bind, and reject cross-origin requests (ee87d0f)
• tools: correct the annotations policy rules match on (215e140)
• tools: fold the Windows spellings that reached past protected paths (a5000d5)
• tools: require Package installers to be local files (319ad28)
• tools: stop the Registry tool globbing across keys (84fc5d1)
• watch: keep the heartbeat watchdog running after it reports a gap (8eb16f0)
• watch: track rug-pull trips per surface, not globally (f319a90)
• web: revalidate every redirect hop in Scrape (ae1a679)

---

Windows binaries (amd64, arm64) are pure Go and require no runtime
dependencies. The transport is stdio only — there is no network listener.

Verify a download against the signed checksum file:

cosign verify-blob \
  --bundle windows-mcp-server_1.2.0_checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deploymenttheory/windows-mcp-server/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  windows-mcp-server_1.2.0_checksums.txt

sha256sum -c windows-mcp-server_1.2.0_checksums.txt --ignore-missing

v1.1.0

1.1.0 (2026-08-03)

Features

• audit: optional HMAC keying and periodic head anchoring to the Windows event log (597a325)

• cli: policy test verb running fixture device states against asserted verdicts (a8ddabc)

• evidence: auto-seal a signed bundle at session end (1e4980d)

• evidence: signed, self-verifying session evidence bundles (2a1aff6)

• journeys: declarative journey files compiled to plans and run deterministically (57eef40)

• journeys: recorder that emits a journey file from a human run (2f9746e)

• plan: Plan and Apply tools with posture re-check and fail-stop execution (90cc432)

• plan: serialisable plan model with whole-plan policy evaluation and change rendering (c4660e2)

• policy: dual control via an on_fail: approve disposition and an approval webhook (304356e)

• policy: require_plan — refuse direct calls to gated tools outside an approved plan (96efacf)

• release: goreleaser config with signed archives, SBOM, and checksums (729fa47)

• telemetry: OTLP export of request spans and policy-decision metrics (cc8705a)

• tools: EventLog and Network diagnostics tools (dfbe7e7)

• tools: Package tool for winget and MSI in an opt-in packages toolset (0f162e9)

• tools: ScheduledTask tool with policy-gated mutation modes (c8a83f3)

Bug Fixes

• audit: file-per-session sinks with a chained manifest and segment verification (d73af47)

• guardrails: refuse credentials alongside shell or filesystem toolsets at startup (ea6cc47)

• inventory: enforce persona boundaries, protect guardrail paths from FileSystem, pin always-served tools (db110ba)

---

Windows binaries (amd64, arm64) are pure Go and require no runtime
dependencies. The transport is stdio only — there is no network listener.

Verify a download against the signed checksum file:

cosign verify-blob \
  --bundle windows-mcp-server_1.1.0_checksums.txt.sigstore.json \
  --certificate-identity-regexp 'https://github.com/deploymenttheory/windows-mcp-server/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  windows-mcp-server_1.1.0_checksums.txt

sha256sum -c windows-mcp-server_1.1.0_checksums.txt --ignore-missing

v1.0.0

1.0.0 (2026-07-31)

Features

• add Enforce HTTPS setting to block plaintext http:// targets (e627c28)

• add session recording capabilities to the Windows MCP server (f34be7c)

• conformance: add the diagnostic fixtures that retire baseline entries (50bddd6)

• conformance: retire the fixtures-pass expected-failure baseline (8b17da3)

• egress: add a device egress proxy with a domain allowlist (a3af588)

• egress: add machine-wide default-deny, system proxy and the kill hook (ddd86c6)

• egress: enforce the allowlist with scoped firewall rules (542b293)

• enhance user-journey testing and improve snapshot management (f8f04a5)

• enterprise guardrails, JIT device posture, and TPM attestation (7085dca)

• full MCP 2026-07-28 conformance, plus prompts, resources and completions (3f0ce6b)

• guardrails: decide every tool call against live device signals (887ba79)

• guardrails: decide every tool call against live device signals (0d33b66)

• implement Windows desktop automation MCP server (1dac239)

• mcp: conform to protocol 2026-07-28 and prove it with the official suite (e6f2a38)

• policy: make the policy document the only security configuration (d4d67a6)

• policy: make the policy document the only security configuration (BREAKING) (413a7c9)

• track MCP spec compliance and add credentials support (96546a9)

Bug Fixes

• AVI 4 GiB overflow and unvalidated input coordinates (d693488)
• bound ffmpeg finalization, separate Graph error semantics, clear the lint tail (5279c33)
• ci: keep the conformance host alive for the pass that uses it (90a53ef)
• conformance: correct the baselines from the first clean run (f703806)
• conformance: drop the stale json-schema entry from the backcompat baseline (a210762)
• conformance: stop one handler killing the evidence run, and emit values as an array (d239ad3)
• conformance: stop one handler killing the evidence run, and emit values as an array (b3ac87e)
• desktop: bound ffmpeg finalization so a wedged encoder cannot block shutdown (2f62047)
• desktop: stop a disk percentage underflowing when free space exceeds size (1878e1b)
• desktop: stop an agent-supplied scroll count from inverting and stalling the engine (abce69d)
• egress: stop a unit test rewriting the developer machine proxy settings (98260a6)
• guardrails: distinguish an unreachable Graph from a device that is not there (f11bb3a)
• guardrails: stop a negative shutdown delay from disabling the kill switch (8e131b7)
• keep the wheel-delta nolint attached to its conversion (a63cf65)
• repo tidy (88a7da0)
• stop selectTargets traversing the same window twice (f8dd59f)
• three integer-overflow defects and clear the gosec G115 backlog (df80535)
• winmcp: bound the attestation nonce; pin the toast command under test (9a816a1)