v0.5.0

Read this before upgrading

Session and concurrency caps are now enforced by default. This server
previously had no session or concurrency limits at all. After upgrading, a
deployment that routinely holds more than 128 sessions, or issues more than 16
concurrent requests on a single token, will start receiving HTTP 503 where
it previously succeeded.

Flag	Default
--max-sessions	128
--max-sessions-per-token	16
--max-inflight-requests	64
--max-inflight-requests-per-token	16
--max-inflight-requests-per-target	4

Set any flag to 0 to disable that dimension. The values match
rustjunosmcp's, so the two servers now behave alike out of the box.

--enable-metrics exposes an unauthenticated endpoint. /metrics is off
by default. When you turn it on, bind it where your scrape target can reach it
and callers cannot.

Rate limiting is stricter. The token bucket replaces the old fixed sliding
window, which admitted up to 2× the nominal rate across a window boundary. The
flags are unchanged; clients that survived a boundary burst will now see
HTTP 429.

Added

• Blocklist guardrails for read-only tools. execute_panos_op and
  get_panos_config now evaluate an optional per-inventory blocklist through
  the shared mecmcp-policy engine — the same deny-pattern guardrails Junos has
  had. Previously any <show> command was accepted from a caller holding a
  valid token.

  A deployment with no blocklist configured behaves exactly as before. That
  is asserted directly rather than inferred, by
  unconfigured_blocklist_leaves_execute_panos_op_unchanged and its
  get_panos_config counterpart.

  The engine is fail-open: a command matching no rule is allowed. That is
  the right model for an operator blocklist, but it is the opposite of what the
  mutation path does, so it is worth stating plainly.

• Mutations stay fail-closed and are unchanged. validate_write_xpath still
  requires an XPath to sit under an operator-configured root. A prefix allowlist
  and a glob blocklist are different authorization models, and moving mutations
  onto the blocklist would have silently widened what a mutation token reaches.

Changed

• Inventory loading moved to the shared mecmcp-inventory crate. The
  {"version":1,"devices":[…]} envelope parses exactly as before — the trait was
  built around both servers' existing schemas rather than converging them. Two
  behaviours remain this server's own: an empty devices array is still
  rejected, and api_key: {"type":"env",…} still resolves name-only, so
  token add works without runtime credentials.

• CLI, signal handling, graceful shutdown, and the token subcommands now come
  from the shared mecmcp-runtime crate. No user-visible change: every flag
  keeps its spelling and defaults, state resolve stays PAN-OS-only, and
  mutation-state.json is untouched in format and location handling.

Upgrading

mutation-state.json and tokens.json are compatible with v0.4.0 — preserve
both. Take a snapshot before installing; there is no standby host.

curl -LO https://github.com/fastrevmd-lab/rustpanosmcp/releases/download/v0.5.0/rust-panosmcp-v0.5.0-x86_64-unknown-linux-gnu.tar.gz
curl -LO https://github.com/fastrevmd-lab/rustpanosmcp/releases/download/v0.5.0/rust-panosmcp-v0.5.0-x86_64-unknown-linux-gnu.tar.gz.sha256
sha256sum -c rust-panosmcp-v0.5.0-x86_64-unknown-linux-gnu.tar.gz.sha256

The token file must be mode 0600 or the server refuses to start.

Full changelog: https://github.com/fastrevmd-lab/rustpanosmcp/blob/main/CHANGELOG.md

v0.4.0 — Structured audit logging

Added

• Structured audit logging via the shared mecmcp-audit crate (audit-v0.1.5). One event per tool call with caller attribution, target devices, outcome, and execution duration. Previously the server contained only an AUDIT_TARGET constant with no active logging.
• Change-set lifecycle auditing. create_panos_change_set, approve_panos_change_set, and apply_panos_change_set each emit an audit event. The approval event carries both the change-set id and the fingerprint digest, providing independent evidence that a second principal reviewed the exact digest later applied. Previously mutation-state.json — a file the server itself rewrites — was the only record of approval.
• New CLI flags for audit configuration:
  • --audit-format — choose json (default, machine-parseable) or pretty (human-readable).
  • --audit-log-file — write audit events to a file path.
  • --audit-journald — emit audit events to systemd journal.
  • --audit-redact — HMAC-pseudonymise declared fields (device names, caller identity) so the log can be shipped to a SIEM without leaking operational identifiers.
  • --audit-hmac-key-file — path to the HMAC key for redaction; required when --audit-redact is enabled.
• Structured Attribution (Human/Agent, on_behalf_of, change_ref) carried through the audit path and included in every logged event.

See CHANGELOG.md for complete details.

rust-panosmcp v0.3.0

First release carrying the shared mecmcp-auth authentication crate (auth-v0.1.4).

Before upgrading: the server now refuses to start if tokens.json is group- or world-readable.

stat -c '%a %U:%G' /var/lib/rust-panosmcp/tokens.json   # expect 600
chmod 600 /var/lib/rust-panosmcp/tokens.json            # if it is not

Also preserve /var/lib/rust-panosmcp/mutation-state.json across the upgrade — it holds change-set approval records.

No token needs reissuing and no client needs a new credential.

Fixed — rollback safety

Since adopting the shared crate, main had been writing tokens.json without its version envelope, a field prior releases require. A rollback could not have read the file the newer binary wrote. The version a file is read with is now the version it is written back with.

Reference validation in token add / rotate / revoke — unknown device and tool names, duplicate token names — is also restored; it was briefly lost when the lifecycle operations were reimplemented inline.

Changed

Authentication moves to the shared crate, retiring this repository's own token.rs, store.rs, and file.rs (~1,200 lines). rust-panosmcp-auth is now a thin vendor layer holding the PAN-OS write grant and tool registry. The MCP tool surface, authorization scopes, inventory, and mutation-state interfaces are unchanged.

A new tokens.json is written with envelope version 1 rather than 2; both are accepted on read by this and prior releases.

Security

tokens.json must be mode 0600 — the server exits rather than starting with credentials exposed, and the error names the file, its mode, both uids, and the remedy. Secret zeroing now uses zeroize and the uid lookup uses rustix, so the authentication crate contains no unsafe.

Also

Fixes two README install-path bugs (#48) found by deploying the tarball into a clean LXC and following the instructions verbatim: the archive extracts to rust-panosmcp-v<VER>/, not the triple-suffixed directory, and the binary is at bin/rust-panosmcp.

Full notes: CHANGELOG.md

rust-panosmcp v0.2.2

Dependency-maintenance patch with RMCP 2.2.0, sse-stream 0.2.4, SHA-2 0.11, current patch dependencies and CI actions. No PAN-OS tool, schema, multi-vsys, HA, Panorama, or authorization behavior changes.

rust-panosmcp v0.2.1

rust-panosmcp v0.2.1

v0.2.1 is a narrow maintenance release that makes PAN-OS configuration-lock
state truthful after commit and discard, and records the default-trusted TLS
lab rollout.

Fixes and operational changes

• Treat PAN-OS configuration-lock release as a confirmed state transition.
• Persist config_lock_held=false only after the device accepts unlock.
• Persist failed post-commit or discard unlocks as indeterminate with
  actionable reconciliation details instead of reporting false success.
• Preserve confirmed lock state across state-file restart.
• Deploy a default-trusted Let's Encrypt certificate for
  rust-panosmcp.mechub.org with tested Cloudflare DNS-01 renewal.
• Roll the DNS API credential, retain single-zone DNS-edit scope, verify the old
  token is rejected, and remove plaintext handoff artifacts.

Validation

• Final main CI passed build/lint/test, Rust 1.88 MSRV, supply-chain policy,
  fuzz-target compilation, reproducible archive, hardened container, and
  release-candidate packaging gates.
• The release image workflow published amd64/arm64 GHCR tags with provenance
  and SBOM attestations.
• The PAN-OS 12.1.5 lab completed an independently approved reversible change:
  apply, diff, full validation, and discard returned the candidate to its exact
  baseline with config_lock_held=false and no remaining PAN-OS config lock.
• The attached archive checksum was verified, the binary reports
  rust-panosmcp 0.2.1, and BUILD-INFO identifies commit
  7bb054a18fef06e15f8eba01f7b1c686e6bbc851.

rust-panosmcp v0.2.0

rust-panosmcp v0.2.0

v0.2.0 adds a guarded multi-action change-set and independent approval layer
above the existing PAN-OS candidate lifecycle.

Highlights

• Plan and persist 1–64 ordered set/delete actions without changing PAN-OS.
• Require approval by a different authenticated token identity.
• Bind approval to the exact owner, device, candidate fingerprint, ordered
  actions, XML payloads, and SHA-256 digest.
• Enforce token-specific XPath/action grants and optional token expiration.
• Serialize mutations by canonical PAN-OS endpoint across inventory aliases.
• Apply an approved set once under a PAN-OS configuration lock, with automatic
  admin-scoped revert after partial failure.
• Persist change-set and operation state across restarts; in-flight work becomes
  indeterminate and requires explicit offline reconciliation.
• Add state resolve for recording a manually proven terminal outcome.

New MCP tools:

• create_panos_change_set
• get_panos_change_set
• approve_panos_change_set
• apply_panos_change_set

Upgrade notes

• Configure --state-file /var/lib/rust-panosmcp/mutation-state.json in
  production.
• Token-store v1 remains readable and is written as v2 on the next update.
• The legacy stage_panos_config tool remains for compatibility. Revoke old
  writer tokens and omit that tool when v0.2 approval must be mandatory.
• Protect the state file like sensitive candidate configuration because it
  contains exact planned XML payloads.

Validation

• Full CI, Rust 1.88 MSRV, supply-chain policy, fuzz-target compilation,
  reproducible archive, and hardened multi-architecture container gates pass.
• PAN-OS 12.1.5 lab: independently approved two-action stage/validate/discard,
  followed by committed address-object add/delete cleanup. Final candidate
  fingerprint matched the starting baseline.

rust-panosmcp v0.1.0

rust-panosmcp v0.1.0

The first production-oriented release of the async Rust MCP server for standalone Palo Alto Networks PAN-OS firewalls.

Highlights

• Strict HTTPS PAN-OS XML API client with custom CA and exact leaf pinning.
• Read-only facts, operational-command, and configuration tools.
• Bearer-protected Streamable HTTP with exact device and tool scopes.
• Guarded candidate configuration stage, diff, validation, commit, discard, and reconciliation lifecycle.
• Hardened systemd and distroless-container packaging.
• Reproducible binary archive, supply-chain policy checks, fuzz targets, and benchmark evidence.

Compatibility and scope

• PAN-OS 12.1.5 has real-device strict-HTTPS read, full MCP, and reversible guarded-mutation evidence.
• PAN-OS 10.2, 11.1, 11.2, and 12.1 have representative parser-envelope coverage.
• v0.1 supports standalone firewalls through the XML API.
• Panorama, templates, device groups, commit-all, multi-vsys, HA-aware workflows, SSH/set-format automation, and OAuth discovery are not included.

Binary artifact

The attached archive targets x86_64-unknown-linux-gnu. Verify the attached SHA-256 checksum before extraction.

Archive SHA-256:

bd608858953c61e82a54c4f3f2ec401621b38aae3079917c66e9e4fb2fc06ade

Container image

Published multi-architecture tags:

• ghcr.io/fastrevmd-lab/rust-panosmcp:0.1.0
• ghcr.io/fastrevmd-lab/rust-panosmcp:0.1
• ghcr.io/fastrevmd-lab/rust-panosmcp:latest

Immutable manifest digest:

sha256:4ab600bceb5fe5d7dba98d8cf83992c869b714796ff7232bb783f20704c134f6

The image includes build provenance and an SBOM.

Provenance

• Source commit: 1adcd325efb910481d285b1744491f49091e776c
• Final CI: https://github.com/fastrevmd-lab/rust-panosmcp/actions/runs/29116198694
• Image release workflow: https://github.com/fastrevmd-lab/rust-panosmcp/actions/runs/29117366499

Operational guidance, compatibility claims, backup and restore, upgrades, and rollback procedures are included in the archive and repository documentation.