v11.11.0

MINOR release. Closes three critical advisories reported by @alivirgo, and moves development back to GitHub.

The three share a shape worth naming: in each case the guard existed and was simply not reachable from where it was needed. local_only_tools() was applied by one transport out of three. The SSE auth check was a closure inside another transport's function. The client_credentials hardening from GHSA-5p27-64mv-pr73 checked how a client authenticates but not how it came to exist. Each fix moves the guard to where every caller passes, rather than adding a second copy.

Security

• GHSA-7crr-2r7w-cpfm — memory_harvest and memory_ingest take a caller-controlled filesystem path, and the local_only_tools() filter ran only in the FastAPI JSON-RPC shim. Streamable HTTP and SSE served them to remote callers. The filter now lives in MemoryServer.list_tools() and call_tool(), and call_tool() refuses before the handler resolves.
• GHSA-2hh8-qjxc-43x3 — the SSE transport had no authentication at all. /sse and /messages/ both reach the full MCP tool surface and neither was gated.
• GHSA-6mvm-q4j3-27qg — with Dynamic Client Registration open, a caller could register itself as a confidential client, exchange its own credentials, and hold a read write token the owner never granted.

All three affect every version below 11.11.0, not only the 11.9.0 the reports were checked against. 11.10.0 shipped after the reports and carried them too.

Upgrade notes

Two behaviours change. Both fail loudly rather than degrading quietly, because the configurations they break are the vulnerable ones.

• client_credentials is refused while Dynamic Client Registration is open. Set MCP_DCR_REGISTRATION_KEY and register with it, or use authorization_code with PKCE. That is the flow Claude.ai Remote MCP uses and it is unaffected.
• An MCP transport refuses to start on a non-loopback bind with no authentication configured. Set MCP_API_KEY, enable OAuth with MCP_OAUTH_ENABLED=true, or bind to 127.0.0.1. This covers Streamable HTTP as well as SSE.

Also in this release

Development moved back to GitHub: issues, pull requests, CI, releases and the wiki are all here again, and the four Forgejo workflows were ported to GitHub Actions. Codeberg stays readable as an archive so existing links resolve. Issue and PR numbers below #341 in older entries are Codeberg numbers.

The claude-hooks plugin manifest is at 1.0.5; its marketplace homepage still pointed at the old forge.

Full detail in CHANGELOG.md.