2.15.0

What's Changed

Security fixes

2.15.0 fixes four vulnerabilities. The fetch-guard and event-stream fixes affect every v2 release from 2.0.0 through 2.14.0, the mcpdo daemon fix affects 2.10.0 through 2.14.0, and the server.json preview fix affects 2.14.0. Upgrade with npx @modelcontextprotocol/inspector@latest.

• The fetch guard blocks cloud metadata addresses outside 169.254.0.0/16, including 100.100.100.200 and 192.0.0.192 and their decimal and IPv4-mapped IPv6 forms, so neither the /api/fetch proxy nor OAuth discovery can be pointed at them (GHSA-fvg8-f358-w2c8)
• The network tracker caps the body it records for a POST event-stream response, so a server streaming an unbounded response can no longer exhaust the web backend's memory and take down every session (GHSA-9w48-x22j-rrm7)
• The server.json launch preview shows every environment variable's value, flags runtime-control variables such as NODE_OPTIONS and npm_config_registry with a warning, and requires confirmation before the server can be added (GHSA-pp85-586h-2m95)
• mcpdo verifies the connection daemon before sending it anything: the daemon must prove it holds this user's token, so an impostor listening on the daemon's socket or pipe receives no credentials (GHSA-5572-x678-xmv8)

Other changes

• docs(security-advisory): land GHSA fixes through ordinary public PRs by @cliffhall in #2886
• chore(deps): November in-range dependency refresh by @cliffhall in #2887
• feat(docker): smaller, hardened runtime image by @cliffhall in #2888
• fix(cli,mcpdo): send --prompt-args values verbatim as strings by @cliffhall in #2890
• chore(deps): override minimatch to ^11 to clear GHSA-g3hv-75wg-m249 by @cliffhall in #2895
• fix(cli): stop variadic options swallowing a target placed after them by @cliffhall in #2892
• Surface OAuth fetch-guard refusals even when discovery falls back by @cliffhall in #2893
• chore(deps): report a stale Dockerfile base-image digest in the monthly sweep by @cliffhall in #2900
• feat(tui,mcpdo): decode and show access-token claims by @cliffhall in #2891
• feat(web): per-tool run history with re-run and diff by @cliffhall in #2894
• fix: make local:gate pass on Windows, verified by a new Windows CI job (#2748) by @cliffhall in #2906
• feat(cli,mcpdo): --oauth-debug traces each OAuth step to stderr by @cliffhall in #2902
• TUI: handle sampling and elicitation requests from the server by @cliffhall in #2903
• feat(web): list and terminate active backend sessions by @cliffhall in #2901
• feat(load): --load-scenario weighted mix of tools, resources and prompts by @cliffhall in #2896
• feat(load): argument placeholders and --load-args-file so calls are not identical by @cliffhall in #2908
• feat(load): stepped and ramped load to find a server's knee by @cliffhall in #2909
• feat(load): bounded-memory latency histogram, p95/p99.9, and p50/p95/throughput gates by @cliffhall in #2915
• feat(load): progress lines, --load-interval time series and --load-warmup by @cliffhall in #2916
• feat(load): per-call NDJSON samples, a readable text summary and open-loop mode by @cliffhall in #2917
• mcpdo: relay destination-guard refusal warnings from the detached sign-in helper by @cliffhall in #2918
• TUI: multi-select for array-of-choices form fields (#2904) by @cliffhall in #2919
• fix(core): keep a URL-valued secret whole in embedded-URL redaction by @cliffhall in #2920
• feat(load): --load-baseline and --load-max-regression by @cliffhall in #2921
• feat(load): --load-churn session churn mode by @cliffhall in #2923
• chore(deps): upgrade @modelcontextprotocol/ext-tasks to 0.2.3 by @cliffhall in #2925
• fix(core): terminate the Streamable HTTP session on disconnect by @cliffhall in #2926
• feat(load): --load-subscribe notification fan-out load by @cliffhall in #2927
• feat(web): load-test panel on the shared --load engine by @cliffhall in #2929
• perf(web): stop re-rendering the page on every MCP message by @cliffhall in #2931
• feat(load): --load-workers multi-process load generator by @cliffhall in #2930
• Web: mount monitoring-sidebar rows only near the viewport (#2932) by @cliffhall in #2933
• CLI: classify OAuth and fetch-guard failures instead of exiting 1 (#2842) by @cliffhall in #2940
• v2: Block cloud metadata addresses outside 169.254.0.0/16 in the fetch guard (GHSA-fvg8-f358-w2c8) by @cliffhall in #2942
• Fix flaky SkillsScreen verdict-count assertions (#2941) by @cliffhall in #2952
• Cap the fetch tracker's recorded response body (GHSA-9w48-x22j-rrm7) by @cliffhall in #2944
• Show env values in the server.json launch preview and confirm runtime-control vars by @cliffhall in #2945
• mcpdo: authenticate the daemon to the client before sending anything (GHSA-5572-x678-xmv8) by @cliffhall in #2946
• Release 2.15.0 step 1: bump version to 2.15.0 by @cliffhall in #2957
• Docker: bump the node:22-slim base-image digest by @cliffhall in #2966
• chore(release): merge v2/main into main for v2.15.0 by @cliffhall in #2961

Full Changelog: 2.14.0...2.15.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.15.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

• @CloneOfAlex (#2829, #2830, #2831, #2833, #2838, #2839, #2840, #2841, #2842, #2844, #2845, #2846, GHSA-pp85-586h-2m95)
• @jaeminbird (#2859)
• @wenbiyou (#2860)
• @SounLabs (GHSA-9w48-x22j-rrm7)
• @uaminevrm (GHSA-fvg8-f358-w2c8, GHSA-5572-x678-xmv8)