Skip to content

v1.3.0

Choose a tag to compare

View all tags
@a-akimov a-akimov released this 02 Aug 11:48
v1.3.0
06cf033
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Any-language release: local MCP servers in Go, Java, C#, Rust — any runtime —
can now be audited over stdio via --stdio, with secret-safe --env
configuration. Plus resource-template collection with three new catalog
rules, a new readiness rule for supportedVersions, and a tightened
unsupported-version error check.

Added

  • --stdio: audit local MCP servers written in any language. The flag
    launches an arbitrary stdio command — a compiled Go binary,
    java -jar server.jar, dotnet run --project … — and audits it exactly
    like a .py/.js target. It consumes the rest of the command line (the
    server's own flags included), runs the command directly with no shell, and
    pairs with the new repeatable --env for server configuration
    (merged over the SDK's minimal default environment; values are never
    logged or reported). --env NAME=VALUE sets a value inline for
    non-sensitive config; the value-less --env NAME copies the value from
    mcpscore's own environment, keeping secrets off every command line. Library consumers get the same via the new StdioCommand
    dataclass accepted by MCPClient.detect_and_connect. The positional
    .py/.js/URL target is unchanged.

  • Collect and fully paginate MCP resource templates, preserving partial evidence
    and reporting incomplete listings when pagination fails, loops, or exceeds its
    safety bound.

  • Three resource-template rules validate RFC 6570 URI-template syntax, unique
    uriTemplate identifiers, and non-blank names without reading resources or
    invoking tools.

  • New HIGH readiness rule readiness_2026_supported_versions: a
    server/discover DiscoverResult must name at least one supported protocol
    version (all strings) — the schema requires supportedVersions: string[]
    but has no minItems constraint, and an empty list makes version selection
    impossible.

Changed

  • readiness_2026_unsupported_version_error now requires the full
    UnsupportedProtocolVersionError shape, not just the -32022 code: the
    error's data must carry supported (a non-empty list of version strings
    to retry with) and requested, as the schema requires. A bare -32022 now
    fails with a dedicated message. Era detection is unaffected: the -32022
    code alone still counts as modern-era evidence.
Assets 4
Loading