Skip to content

v2.0.0 — Enterprise platform + comprehensive security audit

Latest
Latest

Choose a tag to compare

View all tags
@lacausecrypto lacausecrypto released this 30 Apr 08:40
· 1 commit to main since this release
v2.0.0
12361e2

v2.0.0 — Enterprise platform + comprehensive security audit

Major release. Adds the identity / governance / connect / managed-runtime planes, refondue dashboard (Operator Slate), and a four-sprint security audit covering everything from JWT to DoS.

+237 tests (1458 → 1695 passing) · 0 regressions · 91 test files

What's new

Enterprise platform

  • Identity plane — connected accounts, encrypted secrets, workspace ↔ tenant bindings, multi-mode resolution (client / tenant / workspace).
  • Governance plane — role bindings (owner, admin, approver, operator, developer, viewer), tool/registry policies, approvals workflow with TTL and self-approval guard, per-workspace quotas (Redis-pluggable).
  • Connect plane — exportable profiles, install bundles, remote bundles, smart MCP-registry import, descriptor fetch, relay client, TOML rendering for Claude Desktop / Codex.
  • Managed runtime — sandboxed stdio servers, pinned releases, rollout + rollback, health gates, env sanitization.
  • conduit connect CLI — install / list / remove Conduit-managed servers from the command line.

Dashboard refonte (Operator Slate)

Linear/Vercel-inspired UI with cyan accent, Inter via Bunny Fonts (RGPD-compliant CSP). 9 reorganized views, underline tabs primitive, asymmetric content padding, responsive sidebar (icon-only ≤ 1080 px, drawer + hamburger ≤ 640 px).

Security audit

Sprint Focus Items New tests
3.1 Critical 14 +145
3.2 High 5 +30
3.3 Hardening 7 +34
4 Battle-test / DoS 7 +28

Highlights:

  • JWT: alg=none rejection, HS/RSA key-confusion guard, JWKS algorithm whitelist (asymmetric only), audience validation.
  • Stdio respawn-loop bound + shutdown drain — exponential backoff, 10-fast-failure ceiling, signal-aware reset, pending requests rejected immediately on shutdown / error.
  • SSRF — descriptor redirects (cloud metadata, IPv6 loopback, RFC1918 chains, scheme upgrade), IPv4-mapped IPv6 (::ffff:a.b.c.d, hex form, 6to4), site-local fec0::/10, multicast / reserved IPv4.
  • DNS rebinding TOCTOU — new pinnedFetch (node:https / node:http with custom lookup + SNI) wires the descriptor fetcher to the IP validated up front.
  • Sandbox — path traversal, env strip (npm_config_, PIP_, AWS_*, GITHUB_TOKEN, CONDUIT_ADMIN_KEY, etc.) even when sanitize_env is false.
  • Cache — stampede single-flight, MCP isError skip (no poisoning), L2 write coalescing (200 ms window kills duplicate Redis SETs).
  • Rate limiter — auto-prune empty buckets + hard cap (50 000 buckets, insertion-order eviction). Closes the 100k-unique-key OOM vector verified at runtime.
  • JSON-RPC — MAX_BATCH_SIZE = 100, per-message Invalid Request errors (spec compliance) instead of all-or-nothing batch rejection.
  • Plugin loader — directory allowlist (default ./plugins), blocks loading from arbitrary CWD paths.
  • Identity store — explicit NULL discrimination in lookup (defense in depth against COALESCE conflation).
  • Admin API — admin.key required when host is non-loopback, Authorization header forwarding now opt-in per server, replica/server URL credential redaction in /conduit/servers, approver impersonation guard, tenant-isolation header spoofing blocked when auth is active.
  • Governance — workspace quotas reuse the existing Redis backend for cross-pod enforcement.

Migration (1.x → 2.0)

  1. admin.key: deployments binding to non-loopback (e.g. 0.0.0.0) must now set admin.key (or CONDUIT_ADMIN_KEY env), or explicitly opt-in via admin.allow_unauthenticated: true. Loopback deployments are unaffected.
  2. Authorization forwarding: if your upstream MCP servers relied on the gateway forwarding the client's Authorization header, set forward_authorization: true on the relevant servers[] entries. Default is now no-forward.
  3. JWKS algorithms: HS* with JWKS is explicitly disallowed. Use asymmetric algorithms (RS*/PS*/ES*/EdDSA).
  4. Plugins: must live under ./plugins by default. Move existing plugin files there, or pass allowedDirs to loadPlugins().
  5. isError: true tool responses: no longer cached. Override cache.overrides[tool].ttl if you relied on caching error envelopes.

Full notes and per-line breakdown in CHANGELOG.md.

Install

npm install mcp-conduit@2.0.0
Assets 2
Loading