v1.0.3

Full Changelog: v1.0.2...v1.0.3

v1.0.2

Full Changelog: v1.0.1...v1.0.2

v1.0.1

Bug-fix release for token handling when several sessions share a profile.

• tmi-mcp processes that share a profile now take turns logging in and refreshing tokens. A per-profile lock file sits next to the token files. TMI refresh tokens can only be used once, so two processes refreshing at the same moment could leave one of them holding a rejected token and opening a needless browser login. While one process has a login open, another process's calls wait for it to finish instead of opening a second browser.
• When several calls get a 401 at the same time, they now share one token refresh instead of each doing its own.
• Logging out while a login or refresh is still running no longer lets that login save its tokens after the logout deleted them.

Upgrade with brew upgrade tmi-mcp.

v1.0.0

First release of tmi-mcp, a local stdio MCP server that lets AI agents do threat-modeling work against a TMI server.

Install (macOS)

brew install ericfitz/tap/tmi-mcp
tmi-mcp init

tmi-mcp init registers the server as tmi with Claude Code, Codex, and Grok Build (whichever are installed) and prints a sample ~/.config/tmi-mcp/config.yaml if you have none. Elsewhere: go install github.com/ericfitz/tmi-mcp/cmd/tmi-mcp@latest.

What's in it

• Tools: auth, threat_models, threats, diagrams, assets, documents, notes, repositories, metadata, projects, teams.
• OAuth (PKCE) browser login on first use; tokens persist in the OS keychain (mode-600 file fallback); automatic refresh and one retry on 401.
• Multiple TMI servers via config profiles; optional fixed callback_port for servers with a fixed-port callback allowlist.
• Server instructions tell the agent how the tools fit together.
• Several harness sessions can share one login: a process that loses a refresh-token race picks up the tokens the winner saved instead of opening a browser.