v0.3.0

mcpprobe 0.3.0: 24 passive checks (from 16), report schema 0.3. New: META-06 tool-annotation lint (readOnlyHint/destructiveHint/openWorldHint missing or contradicting the tool's capability), META-07 toxic-flow warning (private data + untrusted content + external send on one server), six 2026-07-28 protocol checks (TRANS-06..09 server/discover, downgrade acceptance, Mcp-Method mismatch, ttlMs/cacheScope; AUTH-05 RFC 9207 iss, AUTH-06 deprecated DCR), directory readiness (Anthropic, OpenAI, HubSpot) in the JSON report, Retry-After handling with a scan-wide budget and "blocked" (never a false pass), optional Hugging Face judge for META-01 (off by default, extra [hf]), META-01 held-out benchmark in docs/benchmark.md. GitHub Action: result output, annotations and job summary, exit code 3 documented, safe SARIF upload; docs/github-action.md. Known-bad, known-good and trifecta fixtures pin every outcome in CI.

v0.2.0

mcpprobe 0.2.0: accurate results only. New "Not applicable" result (never counts as a pass); AUTH-02 reports missing RFC 9728 metadata; META-01 catches instructions aimed at the model and secret references, with a benign corpus against false alarms; command execution and file read rate High alone, Critical when unauthenticated; one finding per check per root cause; complete proofs, confidence reasons and verify lines on every finding; environment-aware fixes; attack chains; non-MCP URLs end as "Not an MCP server" (exit code 3); known-bad and known-good fixtures pin every outcome in CI; report schema 0.2; Apache-2.0.

mcpprobe 0.1.0

First public release.

• 16 passive checks: authorization (AUTH-01..04), transport (TRANS-01..05), tool metadata and poisoning (META-01..05), errors (ERR-01), bounded resource use (DOS-01).
• Opt-out honoured before any request; active checks require verified ownership and are stubbed in this release.
• JSON, SARIF 2.1.0 and terminal reports; Docker-based GitHub Action.

Install: pipx install mcpprobe-scanner, then run mcpprobe <url>. Full notes in CHANGELOG.md.