Release v0.13.0

v0.13.0 (2026-10-14)

BREAKING CHANGE

• GET /ready now memoizes its probe result for
  READINESS_CACHE_SECONDS (default 30 s; a failed probe for 5 s) and may
  report a state up to that old; a probe that has not answered after 10 s
  returns 503. Set READINESS_CACHE_SECONDS=0 / --readiness-cache-seconds 0
  to disable the memo (the timeout and in-flight sharing remain). A
  Honeycomb query whose Create Query Result slot would not free within
  BACKEND_TIMEOUT now fails with HoneycombRateLimitedError instead of
  parking past the timeout; raise BACKEND_TIMEOUT to allow longer waits.
• QUERY_CACHE_TTL_SECONDS / --query-cache-ttl-seconds
  above 86400 or non-finite is now a startup error (previously accepted);
  the cache evicts least-recently-used results beyond 1024 entries
  (QUERY_CACHE_MAX_ENTRIES / --query-cache-max-entries raises it, up to
  100000). Values at or below one day and default-sized caches are
  unaffected.
• credentials embedded in BACKEND_URL (user:password@host)
  are rejected at startup; move them to BACKEND_API_KEY (and
  BACKEND_TEMPO_INSTANCE_ID for Basic auth). httpx request lines are logged
  only at LOG_LEVEL=DEBUG.
• backend responses larger than BACKEND_MAX_RESPONSE_BYTES
  (default 64 MiB decoded) are rejected; raise the variable if legitimate
  large trace queries are refused.
• cross-host redirects from a backend are no longer
  followed; set BACKEND_URL to the host that actually serves the API.
• a manual mcp-registry-publish dispatch no longer accepts a
  ref; it publishes server.json from refs/tags/v only.
• a manual docker-publish dispatch now requires the tag
  input naming an existing vX.Y.Z tag and no longer moves :latest unless
  also_tag_latest is set; dispatching from a branch is refused.
• a search_traces/search_spans call with more than 50
  filters, more than 50 tags, an in/not_in filter with more than 100
  values, or a filter field name longer than 256 characters is now rejected
  with a validation error before any backend request. There is no opt-out;
  callers that need wider queries must split them.
• a filter dict with an unknown key (e.g. logical_operator),
  an empty field name, a non-numeric/non-finite operand under value_type
  "number", a bool under "number", or anything other than a bool or the
  strings "true"/"false" under "boolean" is now rejected with a validation
  error instead of being silently ignored or compared as a no-match. Numeric
  strings under "number" ("5000") and scalars under "string" (500 -> "500")
  keep working. Tempo GT/LT/GTE/LTE filters declared with value_type
  "string" are no longer pushed to TraceQL; they are applied client-side.
• with OTEL_EXPORTER_OTLP_ENDPOINT set, HTTP deployments no
  longer parent the server's spans under a caller's params._meta.traceparent
  by default; set MCP_TRUST_CLIENT_TRACE_CONTEXT=true (or
  --trust-client-trace-context) to restore that behaviour for trusted
  callers. stdio deployments are unaffected.
• X-Forwarded-For from 127.0.0.1 is no longer honoured by
  default. A same-host reverse proxy that previously relied on uvicorn's
  implicit loopback trust to key clients individually must now set
  FORWARDED_ALLOW_IPS=127.0.0.1 (or --forwarded-allow-ips); otherwise all of
  its clients share one rate-limit bucket keyed on the proxy's address.
• a loopback-bound HTTP listener (the new default) now
  answers 421 to any request whose Host header is not a loopback name or the
  bound address. Deployments that reach a 127.0.0.1-bound server through a
  reverse proxy that preserves the public Host must set
  MCP_ALLOWED_HOSTS= (or * to disable Host validation). The
  0.0.0.0 shape (Dockerfile CMD) is unchanged unless MCP_ALLOWED_HOSTS is set.
• streamable-HTTP sessions idle for 1800 s are now closed
  (their id answers 404 and the client must re-initialize) where previously
  they lived until the client deleted them or the process stopped. Operators
  needing longer-lived idle sessions raise --session-idle-timeout-seconds /
  SESSION_IDLE_TIMEOUT_SECONDS.
• --host / MCP_HOST now defaults to 127.0.0.1. --transport
  http on a non-loopback host refuses to start (exit code 2) unless
  MCP_HTTP_BEARER_TOKEN is set or --allow-unauthenticated-http is passed; the
  Docker image (CMD --host 0.0.0.0) therefore needs -e MCP_HTTP_BEARER_TOKEN
  or -e MCP_ALLOW_UNAUTHENTICATED_HTTP=true. Clients of a token-protected
  server must send Authorization: Bearer <token> on every /mcp request.

Fix

• verify: read the archive from the main checkout, timeout pre-#41 server starts, glob the allowlist
• security: never report an empty list_services probe error text
• security: cut percent-encoded matrix parameters from access-log targets
• security: refuse a Host with two or more trailing dots at the request surface
• security: treat a non-list Jaeger services payload as an error, not a character count
• security: trim only ASCII whitespace around Host values on both sides
• security: refuse an allowlist entry with more than one trailing dot
• security: cut fragments, matrix parameters and encoded separators from access-log targets
• security: rebuild the refused credentialed URL from its parsed parts, never from the text
• security: never report an empty health-check error text
• security: strip exactly one trailing dot from a loopback Host name
• security: name the secondary backend's own variables in its configuration errors
• security: anchor the gitleaks fixture allowlist per line, not at the file start
• security: keep a bracketed Host with a trailing dot out of the loopback test
• security: strip the query string of every request line in a pre-rendered access line
• security: make uvicorn's access log an explicit opt-in (--access-log / MCP_ACCESS_LOG)
• security: refuse a Host header with text after an IPv6 literal's bracket
• security: redact a truncated authority only when its visible head carries a colon
• security: bound the backend-chosen host in the origin-refusal text
• security: name the option, not pydantic's validator, in configuration errors
• security: accept underscores in Host allowlist hostname labels
• security: scan a pre-rendered access line linearly and bound its length
• security: release a cancelled leader's slot before the finisher can be joined
• security: bound and escape the exported span status description
• security: ship the image with FastMCP's PyPI update check off
• security: allowlist the bearer-auth test fixture for gitleaks' generic rule
• security: escape control characters in every root-handler log message
• security: redact the truncated authority of a pydantic input_value echo
• security: pin backend requests to the configured origin, not the host
• security: bound triage chains and name a root-less parent cycle
• security: finish a coalesced computation for followers when the leader is cancelled
• security: inflate backend bodies incrementally under the byte cap
• security: spend one retry and redirect budget per logical request
• security: bound every backend request by one total deadline
• security: normalise Host allowlist names and IPv6 literals on both sides
• security: answer /ready failures with an error class, log the detail
• security: apply LOG_LEVEL in doctor so httpx request lines stay at DEBUG
• security: validate host, proxy and rate-limit options at startup
• security: refuse an empty or non-presentable HTTP bearer token
• security: keep query-string tokens out of uvicorn's access log
• security: refuse credentialed URLs before pydantic can echo them
• security: reject dot-segment Honeycomb result ids before polling
• security: fullmatch Honeycomb columns; share limiter per credential
• security: probe readiness with live list_services, never the cache
• security: bound X-Ray boto3 calls to a private 8-thread executor
• security: memoize /ready and cap Honeycomb limiter parking
• security: clamp get_llm_model_stats and correlate fallback limits
• security: clamp every backend search limit at the backend boundary
• security: bound the query cache by entry count and TTL ceiling
• security: shield coalesced cache followers from cancellation
• security: address review for T2 - cap Content-Length digits
• security: address review for T2 - MCPB opt-out for the response cap
• security: address review for T2 - judge the whole exception chain
• security: address review for T2 - harden userinfo redaction
• security: reject BACKEND_URL credentials; redact URL userinfo
• security: cap honoured Retry-After at the 10 s retry budget
• security: cap decoded backend response size at the transport
• security: pin backend requests to the configured host
• security: address review for T7 - pin the TruffleHog scanner version
• security: address review for T7 - describe only the release controls that exist
• security: pin the MCPB launcher to its release and exclude local artifacts
• security: scan whole history weekly and detect Traceloop keys
• security: bind MCP Registry publishes to the release tag and identity
• security: publish GHCR :latest only from an existing release tag
• security: pin uv, hatchling and its build closure for the release build
• security: bind the PyPI and registry publishers to the release env
• security: gate the RELEASE_PAT job on the release environment
• security: build the PyPI release from the bump commit, not main
• security: bump releases with the hash-pinned cz on the runner
• security: hash-pin commitizen in the release job
• security: address review for T6 - clamp degenerate durations in ms
• security: address review for T6 - one error chain, counted ties
• security: cap correlate_trace secondary fan-out at 10 services
• security: cap correlate_trace heuristic search window at 24 h
• security: make error-chain ...

Release v0.12.3

v0.12.3 (2026-10-10)

Fix

• deps: bump pyjwt to 2.15.1 and urllib3 to 2.8.0 to clear new pip-audit advisories
• ci: add explicit restrictive top-level permissions alongside job-level scoping
• ci: scope GITHUB_TOKEN permissions to the job that actually needs them
• ci: stop Codecov's missing-token failure from blocking every Dependabot PR
• ci: align security.yml's Trivy config with ci.yml to stop nightly alert flip-flop
• correct stale backend counts found by a full end-to-end verify
• sync uv.lock's self-referential version pin to 0.12.2
• add codespell false-positive for a deliberate CONTAINS-filter test value
• shorten server.json description under the registry's 100-char limit

Release v0.12.2

v0.12.2 (2026-09-20)

Fix

• sync server.json/mcpb manifest with the real 8-backend list

Release v0.12.1

v0.12.1 (2026-09-20)

Fix

• ci: skip the smoke-test's execution check on non-executable arches
• ci: pin the smoke-test container's --platform explicitly
• ci: scope the Trivy gate to actionable findings, fix 2 real CVEs
• ci: stop the smoke-test step misreading a failed curl as success
• tests: resolve mypy errors CI's stricter mypy . check caught
• resolve 46 findings from a full-repo security/correctness audit

Release v0.12.0

v0.12.0 (2026-09-20)

Feat

• backends: add Honeycomb (Query Data API) as an 8th backend
• backends: add New Relic (NerdGraph) as a 7th backend
• tools: add correlate_trace for best-effort cross-backend correlation
• tools: add triage_trace for agent-native root-cause diagnosis

Fix

• mcp-registry: shorten server.json description under the registry's 100-char limit

Release v0.11.0

v0.11.0 (2026-09-19)

Feat

• deps: upgrade FastMCP 3.2 -> 4.0.5
• backends: add AWS X-Ray backend
• server: add real graceful shutdown/drain for the HTTP transport

Fix

• ci: pin anyio for a real CVE and disable rate limiting in the conformance job

Release v0.10.0

v0.10.0 (2026-09-18)

Feat

• observability: add log-to-trace correlation
• observability: add opt-in OTel metrics self-instrumentation
• backends: add TTL cache + request coalescing for backend queries
• server: add per-IP rate limiting on the HTTP transport

Release v0.9.0

v0.9.0 (2026-09-17)

Feat

• server: add /health and /ready HTTP endpoints
• trace: add detail_level to get_trace, convert to typed output

Release v0.8.2

v0.8.2 (2026-09-17)

Feat

• server: add distinct human-readable title to all 17 tools

Fix

• jaeger: fix typo in null-data comments flagged by codespell
• jaeger: handle explicit null data field from list_services/get_service_operations

Release v0.8.1

v0.8.1 (2026-09-16)

Fix

• server: set destructiveHint explicitly on all 17 read-only tools