Skip to content

v1.1.0 — See the poison

Choose a tag to compare

View all tags
@maksym-mishchenko maksym-mishchenko released this 31 May 22:57
· 31 commits to main since this release
v1.1.0
This tag was signed with the committer’s verified signature.
maksym-mishchenko Maksym
SSH Key Fingerprint: 5cWs6pLUZqz1nsQ1cliBgrToVFXg7IhcUV3bRhC2STk
Verified
Learn about vigilant mode.
dcdbdcc
This commit was signed with the committer’s verified signature.
maksym-mishchenko Maksym
SSH Key Fingerprint: 5cWs6pLUZqz1nsQ1cliBgrToVFXg7IhcUV3bRhC2STk
Verified
Learn about vigilant mode.

Injection / tool-poisoning heuristics — mcpgate now scans MCP traffic in both directions for prompt-injection and tool-poisoning patterns, as a defence-in-depth signal on top of the deny-by-default policy engine.

Added

  • Heuristic scanner (internal/scanner) — deterministic, versioned signature set: ignore-previous-instructions, jailbreak fragments, and base64 / data-URI / credential exfiltration patterns.
  • heuristics config block — enabled (default true, WARN-only) and block_on_warn (opt-in escalation of ALLOW→DENY). DENY/ASK are never downgraded.
  • Signed warnings — heuristic matches are stored in the tamper-evident audit hash-chain (SHA-256 chain + HMAC) and surfaced as a ⚠ badge in the dashboard. Clean rows hash identically to v1.0 (backward compatible).
  • Inbound content withholding — with block_on_warn, poisoned resources/read results and sampling/createMessage reverse-channel content are withheld from the agent.

Security

  • Outbound (tool-call args), inbound (resources/read results — including the JSON-RPC error channel), and reverse-channel (sampling/createMessage) are all scanned.
  • WARN-only by default: false positives degrade to noise, not outages.
  • SECURITY.md documents the control, its semantics, and the opt-in blocking model.

Full changelog: see CHANGELOG.md.

🤖 Built with subagent-driven development; every task spec- and quality-reviewed, plus a final whole-implementation security review.

Assets 2
Loading