v0.26.0

New: 1Password Connect Secret Source

iron-proxy can now resolve op://vault/item/[section/]field references from a self-hosted 1Password Connect server — the same URI format already supported for the CLI-backed 1password source. Host and token are read from OP_CONNECT_HOST and OP_CONNECT_TOKEN by default, and can be overridden per-source via host_env / token_env.

secrets:
  sources:
    - type: 1password_connect
      host_env: OP_CONNECT_HOST       # default
      token_env: OP_CONNECT_TOKEN     # default

New: Tool Call Arguments in MCP Audit Log

tools/call audit entries now include the raw JSON arguments passed to each tool, truncated to 64 bytes (with a … suffix) when the payload exceeds the cap. This gives you enough context to identify what a tool was called with — file paths, query strings, etc. — without letting large payloads bloat audit records.

New: Client-Cancelled Requests No Longer Surface as Failures

When a client closes its connection mid-flight, iron-proxy now detects the resulting context.Canceled from the upstream round-trip and records the request as action=client_cancel at INFO level with status 200. Previously these appeared as 502 errors in audit logs, creating phantom upstream failure noise in dashboards and alerting.

Changelog

• 12f9ed8 feat(proxy): detect client-cancelled requests and log as 200 (#113)
• 601ae2d feat(mcp): include tool call arguments in audit log (#112)
• 48f0044 feat(secrets): add 1password_connect source backed by self-hosted Connect server (#114)