Skip to content

Releases: farchanjo/merkle

Release list

v0.2.1

v0.2.1 Latest
Latest

Choose a tag to compare

View all tags
@farchanjo farchanjo released this 11 Jul 00:40
v0.2.1
939b97e

Merkle v0.2.1

Fixes

  • status: keychain reachability probe times out in 1.5s so merkle status no longer hangs behind SecurityAgent
  • reveal: sealed vault returns 412 agent_sealed before handle lookup
  • CLI: human-readable db_size_bytes / disk_free_bytes and warnings
  • MCP: tools renamed vault_* (underscores) for clients enforcing the MCP name pattern
  • Tests: lifecycle smoke isolation, e2e doctor output, BDD fail-closed audit asserts

Artifacts

Platform Archive
macOS aarch64 (Apple Silicon) merkle-0.2.1-aarch64-apple-darwin.tar.gz
Linux x86_64 merkle-0.2.1-x86_64-unknown-linux-gnu.tar.gz

Checksums: SHA256SUMS.txt

Install (macOS)

tar -xzf merkle-0.2.1-aarch64-apple-darwin.tar.gz
sudo install -m 755 merkle-aarch64-apple-darwin /usr/local/bin/merkle
sudo install -m 755 merkle-agent-aarch64-apple-darwin /usr/local/bin/merkle-agent
sudo install -m 755 merkle-mcp-aarch64-apple-darwin /usr/local/bin/merkle-mcp
Assets 5
Loading

Merkle v0.2.0

Merkle v0.2.0

Choose a tag to compare

View all tags
@farchanjo farchanjo released this 01 Jul 18:53
v0.2.0
941d303

Merkle v0.2.0

First tagged release of Merkle — a local-first MCP secret vault. A long-running
daemon (merkle-agent) owns all key material, SQLite storage, and a tamper-evident
audit chain, exposed over a single Unix-socket driving port (the Companion Socket).
The CLI (merkle) and the stdio MCP server (merkle-mcp) are thin clients that never
touch keys, storage, or domain logic.

Architecture

  • Hexagonal (DDD + ports/adapters): merkle-types ← 6 domain bounded contexts ←
    merkle-ports ← adapters + merkle-application. Daemon binary is the composition root.
  • One inbound port: HTTP/1.1 over a Unix domain socket, peer-credential auth (same-UID only).
  • Spec-as-source-of-truth: CUE / MADR ADRs (0001–0029) / Rego / Gherkin / Structurizr / TLA+.

Highlights

  • Identity & sealing — init ceremony with dual-wrapped VRK (AEAD under MasterKey +
    ECIES under recovery pubkey); Sealed → Unsealing → Unsealed state machine.
  • Secret storage — versioned secrets, per-blob XChaCha20-Poly1305, FTS5 search with
    weighted BM25 ranking (ADR-0027).
  • Tamper-evident audit chain — BLAKE3 hash chain + keyed HMAC + pinned head; truncation
    and rewrite detection.
  • Trusted audit baseline (ADR-0029) — key-provenance recovery: merkle audit rebaseline
    • baseline-aware chain verify, so a legitimate key change no longer reads as tampering.
  • Access mediation — single-use, TTL-bounded use-tokens; OOB confirmation (desktop /
    TTY / localhost) with Ed25519 resolution signatures; proxy materialization (SSH exec/copy/
    port-forward, HTTP request/download/upload, spawn, crypto sign/decrypt) — secrets never
    returned to the LLM.
  • MCP adapter — 30 tools + 4 prompts (/merkle-doctor|show|reveal|rollback), at-most-one
    bind per session (ADR-0026).
  • Keychain — cross-OS backend with write+verify+delete probe and actionable auto-fallback
    to an age-encrypted file keystore.

Security hardening

  • Operator confirmation bound to MCP _meta provenance, not a forgeable tool argument (MERK-001).
  • SSRF / DNS-rebind defense on the HTTP egress proxy, fail-closed at connect time (MERK-004).
  • Peer-credential auth enforced on every socket connection (fail closed).
  • OOB test backdoors ignored in release builds; secrets redacted from logs; env/shell-injection
    closed on the SSH/subprocess path.
  • File keystore written 0600 atomically; age scrypt work factor pinned.
  • Supply-chain gate (cargo deny) repaired; vulnerable protobuf pull-in dropped; time bumped
    to 0.3.47 (RUSTSEC-2026-0009); quinn-proto advisory closed (GAP-008).

Dependencies

  • Migrated rmcp 0.3 → 1.8, age 0.10 → 0.11, rand → 0.10, config 0.15, prometheus 0.14,
    cucumber 0.23, tower-http 0.7.0.

Rust 2024 edition, MSRV 1.85. Apache-2.0.

Loading