v2.0.0 — Enterprise platform + comprehensive security audit

v2.0.0 — Enterprise platform + comprehensive security audit

Major release. Adds the identity / governance / connect / managed-runtime planes, refondue dashboard (Operator Slate), and a four-sprint security audit covering everything from JWT to DoS.

+237 tests (1458 → 1695 passing) · 0 regressions · 91 test files

---

What's new

Enterprise platform

• Identity plane — connected accounts, encrypted secrets, workspace ↔ tenant bindings, multi-mode resolution (client / tenant / workspace).
• Governance plane — role bindings (owner, admin, approver, operator, developer, viewer), tool/registry policies, approvals workflow with TTL and self-approval guard, per-workspace quotas (Redis-pluggable).
• Connect plane — exportable profiles, install bundles, remote bundles, smart MCP-registry import, descriptor fetch, relay client, TOML rendering for Claude Desktop / Codex.
• Managed runtime — sandboxed stdio servers, pinned releases, rollout + rollback, health gates, env sanitization.
• conduit connect CLI — install / list / remove Conduit-managed servers from the command line.

Dashboard refonte (Operator Slate)

Linear/Vercel-inspired UI with cyan accent, Inter via Bunny Fonts (RGPD-compliant CSP). 9 reorganized views, underline tabs primitive, asymmetric content padding, responsive sidebar (icon-only ≤ 1080 px, drawer + hamburger ≤ 640 px).

---

Security audit

Sprint	Focus	Items	New tests
3.1	Critical	14	+145
3.2	High	5	+30
3.3	Hardening	7	+34
4	Battle-test / DoS	7	+28

Highlights:

• JWT: alg=none rejection, HS/RSA key-confusion guard, JWKS algorithm whitelist (asymmetric only), audience validation.
• Stdio respawn-loop bound + shutdown drain — exponential backoff, 10-fast-failure ceiling, signal-aware reset, pending requests rejected immediately on shutdown / error.
• SSRF — descriptor redirects (cloud metadata, IPv6 loopback, RFC1918 chains, scheme upgrade), IPv4-mapped IPv6 (::ffff:a.b.c.d, hex form, 6to4), site-local fec0::/10, multicast / reserved IPv4.
• DNS rebinding TOCTOU — new pinnedFetch (node:https / node:http with custom lookup + SNI) wires the descriptor fetcher to the IP validated up front.
• Sandbox — path traversal, env strip (npm_config_, PIP_, AWS_*, GITHUB_TOKEN, CONDUIT_ADMIN_KEY, etc.) even when sanitize_env is false.
• Cache — stampede single-flight, MCP isError skip (no poisoning), L2 write coalescing (200 ms window kills duplicate Redis SETs).
• Rate limiter — auto-prune empty buckets + hard cap (50 000 buckets, insertion-order eviction). Closes the 100k-unique-key OOM vector verified at runtime.
• JSON-RPC — MAX_BATCH_SIZE = 100, per-message Invalid Request errors (spec compliance) instead of all-or-nothing batch rejection.
• Plugin loader — directory allowlist (default ./plugins), blocks loading from arbitrary CWD paths.
• Identity store — explicit NULL discrimination in lookup (defense in depth against COALESCE conflation).
• Admin API — admin.key required when host is non-loopback, Authorization header forwarding now opt-in per server, replica/server URL credential redaction in /conduit/servers, approver impersonation guard, tenant-isolation header spoofing blocked when auth is active.
• Governance — workspace quotas reuse the existing Redis backend for cross-pod enforcement.

---

Migration (1.x → 2.0)

1. admin.key: deployments binding to non-loopback (e.g. 0.0.0.0) must now set admin.key (or CONDUIT_ADMIN_KEY env), or explicitly opt-in via admin.allow_unauthenticated: true. Loopback deployments are unaffected.
2. Authorization forwarding: if your upstream MCP servers relied on the gateway forwarding the client's Authorization header, set forward_authorization: true on the relevant servers[] entries. Default is now no-forward.
3. JWKS algorithms: HS* with JWKS is explicitly disallowed. Use asymmetric algorithms (RS*/PS*/ES*/EdDSA).
4. Plugins: must live under ./plugins by default. Move existing plugin files there, or pass allowedDirs to loadPlugins().
5. isError: true tool responses: no longer cached. Override cache.overrides[tool].ttl if you relied on caching error envelopes.

Full notes and per-line breakdown in CHANGELOG.md.

---

Install

npm install mcp-conduit@2.0.0

v1.1.0 — Windows Compatibility

MCP Conduit v1.1.0

Full Windows support. Conduit now runs on Windows, macOS, and Linux.

What changed

Component	Windows fix
Child process spawn	shell: true + windowsHide: true resolves .cmd files (e.g., npx.cmd)
Process termination	Uses TerminateProcess instead of SIGTERM/SIGKILL
Hot reload	SIGHUP skipped on Windows. Use POST /conduit/config/reload instead
Plugin security	Path blocking includes C:\Windows\, C:\Program Files\
CLI wizard	Platform-aware temp directory
CI	Tests now run on Ubuntu, Windows, and macOS

Install

npm install mcp-conduit
npx conduit init
npx conduit

Full changelog

See CHANGELOG.md.

v1.0.0 — Production MCP Gateway

MCP Conduit v1.0.0

Production-grade MCP gateway with caching, auth, guardrails, plugins, and multi-server routing.

Highlights

• Transparent MCP proxy — HTTP and stdio transport support
• Two-tier caching — L1 in-memory LRU + L2 Redis distributed cache
• Authentication — JWT (JWKS) and API key with constant-time comparison
• AI Guardrails — Rule-based tool call inspection (block, alert, require_approval, transform)
• Plugin system — 5 pipeline hooks, dynamic loading, resilient execution
• Rate limiting — Sliding window (memory + Redis), hierarchical limits
• Multi-server routing — Namespace strategy, load balancing, circuit breakers
• OpenTelemetry — W3C Trace Context, OTLP trace export
• Service discovery — HTTP self-registration, DNS SRV
• Admin dashboard — React SPA with real-time metrics
• Security hardened — SSRF protection, CSRF, field redaction, URL validation

Quick Start

npm install mcp-conduit
npx conduit init     # interactive config wizard
npx conduit          # start the gateway

Or with Docker:

docker run -p 8080:8080 -v ./conduit.config.yml:/app/conduit.config.yml ghcr.io/lacausecrypto/mcp-conduit

Numbers

• 1341 tests across 70 test files, 0 failures
• 46K+ RPS cache hit, 111K+ RPS with all features enabled
• 0.02ms gateway overhead
• 194 files, 45K+ lines of TypeScript

Documentation

• Configuration Reference
• API Reference (40+ endpoints)
• Security Guide
• JSON Schema for autocompletion

Breaking Changes

First public release — no breaking changes.

---

MIT License