v1.4.3

MCP-GATE is now open-source launch ready.

MCP tools make AI agents useful, but they also create a new privilege boundary. mcpgate is a zero-trust gateway for the Model Context Protocol: it sits between an agent and an MCP server, evaluates sensitive calls against a deny-by-default YAML policy, writes an audit record before forwarding, and can park risky calls for human approval.

What is included

• Public issue templates, code of conduct, README badges, and launch announcement copy.
• Release binaries for Linux, macOS, and Windows on amd64/arm64.
• checksums.txt for SHA-256 verification.
• GitHub artifact attestations for release archives and checksums.
• Release provenance guide with gh attestation verify commands.
• 60-second narrated showcase video and demo GIF assets.

Verify a binary

shasum -a 256 -c checksums.txt --ignore-missing
gh attestation verify ./mcpgate_1.4.3_darwin_arm64.tar.gz --repo maksym-mishchenko/mcpgate

See docs/RELEASE_PROVENANCE.md for full verification instructions and docs/SHOWCASE.md for the demo walkthrough.

v1.4.2 — Complete the tool

Highlights

• Adds richer authenticated /health runtime metadata for operations and demos.
• Hot-reloads policy decisions and heuristic settings with last-known-good semantics.
• Documents release-binary installation and clarifies that MCP server transport settings remain startup-only.

Validation

• PR checks passed: CI/Test, CI/Lint, CI/GoReleaser check, agent-state-freshness, GitGuardian.

v1.4.1 — Harden the gate

v1.4.1 — Harden the gate

Patch release for the showcase hardening pass.

Added

• Runtime audit signing with --audit-key / MCPGATE_AUDIT_KEY_FILE.
• File-backed dashboard tokens with --token-file / MCPGATE_TOKEN_FILE.
• Server response bounds for HTTP transports and proxied MCP responses.

Changed

• Keyed audit verification now fails closed for missing signatures, non-contiguous sequences, and forged non-bootstrap GENESIS rows.
• Policy constraints preserve typed JSON arguments instead of flattening values.

Fixed

• Dashboard pending approval rendering no longer uses inline event handlers for untrusted request IDs.

v1.4.0 — Govern the gateway

Highlights

• Adds conservative audit-based policy discovery with mcpgate discover.
• Improves governance UX with approval-source audit metadata and dashboard filtering.
• Adds structured argument constraints, symlink-aware path checks, audit retention guidance, and reproducible audit review handoff docs.
• Polishes showcase documentation, screenshot/GIF assets, operational secrets guidance, and release checklist.

See CHANGELOG.md for the full release notes.

v1.1.0 — See the poison

Injection / tool-poisoning heuristics — mcpgate now scans MCP traffic in both directions for prompt-injection and tool-poisoning patterns, as a defence-in-depth signal on top of the deny-by-default policy engine.

Added

• Heuristic scanner (internal/scanner) — deterministic, versioned signature set: ignore-previous-instructions, jailbreak fragments, and base64 / data-URI / credential exfiltration patterns.
• heuristics config block — enabled (default true, WARN-only) and block_on_warn (opt-in escalation of ALLOW→DENY). DENY/ASK are never downgraded.
• Signed warnings — heuristic matches are stored in the tamper-evident audit hash-chain (SHA-256 chain + HMAC) and surfaced as a ⚠ badge in the dashboard. Clean rows hash identically to v1.0 (backward compatible).
• Inbound content withholding — with block_on_warn, poisoned resources/read results and sampling/createMessage reverse-channel content are withheld from the agent.

Security

• Outbound (tool-call args), inbound (resources/read results — including the JSON-RPC error channel), and reverse-channel (sampling/createMessage) are all scanned.
• WARN-only by default: false positives degrade to noise, not outages.
• SECURITY.md documents the control, its semantics, and the opt-in blocking model.

Full changelog: see CHANGELOG.md.

🤖 Built with subagent-driven development; every task spec- and quality-reviewed, plus a final whole-implementation security review.