0.1.4 (Jul 27, 2026)
FEATURES
- Harden session isolation and stateless mode handling
- Replace incomplete localhost-based TLS bypass with explicit
--insecure-no-tlsflag. The StreamableHTTP server now requires TLS by default for all bind addresses. Users can opt out by passing--insecure-no-tls(CLI) or settingINSECURE_NO_TLS=true(env var) for development and testing environments only.