Skip to content
This repository was archived by the owner on Sep 8, 2026. It is now read-only.

v1.1.0 — Security Hardening

Choose a tag to compare

View all tags
@aid-ninja aid-ninja released this 11 Apr 21:11
· 70 commits to main since this release
v1.1.0
ede4b20

Security

  • MCP directory containment — dir parameter now validated against workspace root with path.sep prefix check. Prevents path traversal to arbitrary directories.
  • CSP meta tag — Content Security Policy added to landing page.
  • Gitignore — Added .farmer-token, .farmer-state.json, .farmer.pid, .farmer-audit*.jsonl, .claude/.

What's included

The wheat MCP server is the core engine for evidence-tracked research sprints. This release hardens the tools/call handler to reject directory parameters outside the workspace boundary.

Full changelog: v1.0.0...v1.1.0

Assets 2
Loading