1.8.2

Important

This release fixes a security vulnerability in iMCP 1.8.1 and earlier that let another process on your Mac intercept an MCP client's session with iMCP, or connect as a client that you trusted (GHSA-q4pc-f59f-9xmw). Please update now: choose "Check for Updates..." in iMCP's menu (in 1.5.0 and later), run brew upgrade --cask imcp, or download iMCP below.

Thanks to @islandbitcoin for reporting this.

After you update

• For Claude Desktop, choose "Configure Claude Desktop" in iMCP's menu and click "Set Up", which adds a credential to its settings. Then quit and reopen Claude Desktop and your other AI apps, so that they start the new imcp-server.
• Clients that you trusted before need your approval again. iMCP lists them under "Approve Again" in "Settings" > "Clients". To trust a client again, select "Always trust this client" when you approve it. For a client other than Claude Desktop, iMCP then shows a credential once; add it to the client's MCP settings as IMCP_CLIENT_CREDENTIAL (how).

Security

• imcp-server connects to iMCP over a Unix domain socket instead of finding it with Bonjour, and each side checks the other's code signature before it sends anything. imcp-server no longer needs Local Network access.
• iMCP trusts a client by a credential that iMCP issued, stored as a hash in your Keychain, instead of by the name that the client reports.
• Approval requests are limited in number and expire, iMCP refuses connections while "Enable MCP Server" is off, and Return no longer clicks "Allow".
• If its connection to iMCP ends in the middle of a session, imcp-server now exits instead of reconnecting, so the "Method not found" errors from the 1.8.1 known issue no longer happen. To connect again, restart the iMCP server in your AI app.