Skip to content

v0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@fastrevmd-lab fastrevmd-lab released this 27 Jul 02:19
· 71 commits to main since this release
v0.5.0
54b5927
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Read this before upgrading

Session and concurrency caps are now enforced by default. This server
previously had no session or concurrency limits at all. After upgrading, a
deployment that routinely holds more than 128 sessions, or issues more than 16
concurrent requests on a single token, will start receiving HTTP 503 where
it previously succeeded.

Flag Default
--max-sessions 128
--max-sessions-per-token 16
--max-inflight-requests 64
--max-inflight-requests-per-token 16
--max-inflight-requests-per-target 4

Set any flag to 0 to disable that dimension. The values match
rustjunosmcp's, so the two servers now behave alike out of the box.

--enable-metrics exposes an unauthenticated endpoint. /metrics is off
by default. When you turn it on, bind it where your scrape target can reach it
and callers cannot.

Rate limiting is stricter. The token bucket replaces the old fixed sliding
window, which admitted up to 2× the nominal rate across a window boundary. The
flags are unchanged; clients that survived a boundary burst will now see
HTTP 429.

Added

  • Blocklist guardrails for read-only tools. execute_panos_op and
    get_panos_config now evaluate an optional per-inventory blocklist through
    the shared mecmcp-policy engine — the same deny-pattern guardrails Junos has
    had. Previously any <show> command was accepted from a caller holding a
    valid token.

    A deployment with no blocklist configured behaves exactly as before. That
    is asserted directly rather than inferred, by
    unconfigured_blocklist_leaves_execute_panos_op_unchanged and its
    get_panos_config counterpart.

    The engine is fail-open: a command matching no rule is allowed. That is
    the right model for an operator blocklist, but it is the opposite of what the
    mutation path does, so it is worth stating plainly.

  • Mutations stay fail-closed and are unchanged. validate_write_xpath still
    requires an XPath to sit under an operator-configured root. A prefix allowlist
    and a glob blocklist are different authorization models, and moving mutations
    onto the blocklist would have silently widened what a mutation token reaches.

Changed

  • Inventory loading moved to the shared mecmcp-inventory crate. The
    {"version":1,"devices":[…]} envelope parses exactly as before — the trait was
    built around both servers' existing schemas rather than converging them. Two
    behaviours remain this server's own: an empty devices array is still
    rejected, and api_key: {"type":"env",…} still resolves name-only, so
    token add works without runtime credentials.

  • CLI, signal handling, graceful shutdown, and the token subcommands now come
    from the shared mecmcp-runtime crate.     No user-visible change: every flag
    keeps its spelling and defaults, state resolve stays PAN-OS-only, and
    mutation-state.json is untouched in format and location handling.

Upgrading

mutation-state.json and tokens.json are compatible with v0.4.0 — preserve
both. Take a snapshot before installing; there is no standby host.

curl -LO https://github.com/fastrevmd-lab/rustpanosmcp/releases/download/v0.5.0/rust-panosmcp-v0.5.0-x86_64-unknown-linux-gnu.tar.gz
curl -LO https://github.com/fastrevmd-lab/rustpanosmcp/releases/download/v0.5.0/rust-panosmcp-v0.5.0-x86_64-unknown-linux-gnu.tar.gz.sha256
sha256sum -c rust-panosmcp-v0.5.0-x86_64-unknown-linux-gnu.tar.gz.sha256

The token file must be mode 0600 or the server refuses to start.

Full changelog: https://github.com/fastrevmd-lab/rustpanosmcp/blob/main/CHANGELOG.md

Assets 4
Loading