v0.18.0

What's Changed

Features

• feat(check): emit SARIF 2.1.0 so findings land in the Security tab by @hsdfat in #212
• feat(cli): wrap and unwrap the Claude Desktop config for one server by @hsdfat in #213

Bug Fixes

• fix(store): reject an x-mcp-header the schema cannot statically reach by @kerlenton in #193
• fix(store): decide a scrubbed Mcp-Param header by a flag, not by its bytes by @kerlenton in #194
• fix(proxy): stop key rules scrubbing tool schemas by @kerlenton in #195
• fix: close every blocker a sweep of main found, and check the rules 2026-07-28 states by @kerlenton in #196
• fix: validate and separate null request IDs by @Guflly in #209
• fix: track cancelled calls and late results by @Guflly in #210
• fix(store): report a tool inputSchema that is not an object schema by @DevMello in #216
• fix(store): report non-object inputSchema and surface schema findings by @syf2211 in #215

New Contributors

• @Guflly made their first contribution in #209
• @hsdfat made their first contribution in #212
• @DevMello made their first contribution in #216

Full Changelog: v0.17.0...v0.18.0