Repository navigation
Security
@modelcontextprotocol/sdkmoves to 1.32.1 and@modelcontextprotocol/client,coreandserverto 2.3.1, closing GHSA-6qxp-vccf-f47h (the OAuth client could send credentials to an authorization server chosen by the MCP server). Upstream OAuth goes through the client package, so the gateway was exposed when connecting to an untrusted upstream.
docker pull ghcr.io/k2so-dev/junctio:0.2.5