MCP Server 1.0.6

Security update for credential policy, request admission and audit reliability.

• Preserve concurrent token revocation, scope reductions and expiry changes across authentication, client creation and revocation. Reload current policy after credential verification and immediately before provider dispatch. Thanks to AndZyk for the private concurrency report and public review.
• Fail closed on unavailable client storage, use atomic per-client request counters, and bound attempts before expensive authentication, including invalid tokens.
• Persist a started audit record before execution; refuse tool execution when that record cannot be inserted. Retain evidence when completion fails and safely represent oversized Unicode request IDs.
• Filter authenticated tool/capability/provider discovery by scope. Restrict PHP/ProcessWire and provider version details to admin clients.

Validation: 195 local checks passed, including 32 real MariaDB storage regressions, 32 HTTP checks and ProcessWire permission checks. GitHub Actions passed on PHP 8.2 and 8.5 with MySQL 8. Concurrency cases use controlled interleaving, not a load benchmark. Provider business rules remain the responsibility of their owning modules.

Install the attached complete runtime ZIP and refresh ProcessWire modules to create mcp_server_limits. Existing token formats remain compatible. Disable the endpoint, drain in-flight requests and retain normal database/files backups before deployment. Review and reapply intended revocations, scope reductions and expiry dates: earlier concurrent writes may have restored old policy.

Authentication admission allows 120 attempts per direct peer and 600 globally per UTC minute, before the separate configured client limit. REMOTE_ADDR selects the peer bucket; arbitrary forwarded headers are not trusted. Review trusted-proxy address handling when deploying behind a reverse proxy.

Keep the endpoint disabled if an immediate upgrade is unavailable or an older runtime is restored. Revocation prevents subsequent dispatch; it cannot cancel provider operations already running.

MCP Server 1.0.5 — security update

Security update: authenticated tool scope bypass fixed.

MCP Server 1.0.4 and earlier installations should update before relying on client scope isolation. Under legacy protocol sessions, JSON-RPC batches could bypass the gateway's envelope-level scope checks and audit recording. A valid bearer credential was required; impact depends on installed provider tools. Reported by MrSnoozles.

• Enforce the authenticated client's scope for the actual registered tool immediately before every provider invocation.
• Audit invocation success, tool errors, exceptions and dispatch denials using the individual request identity.
• Reject JSON-RPC batch bodies for all protocol revisions before SDK dispatch, with bounded audit evidence for denied tool attempts. Single-message legacy clients remain supported.

Validation: 42 contract, 27 behavioral, 41 security, 21 ProcessWire and 29 real HTTP checks passed. Regressions exercise a real bundled-SDK 2025-03-26 handshake and batch dispatch, all scope combinations, audit persistence and denial before execution. PHP 8.2 and PHP 8.5 are checked in GitHub Actions.

Install the attached complete runtime ZIP and refresh ProcessWire modules. Existing tokens keep their format and scopes; no database migration or token rotation is required. Clients using batches must send one message per HTTP request. If immediate upgrade is unavailable, keep the remote endpoint disabled. Do not roll back to an earlier runtime with the endpoint enabled.

MCP Server 1.0.4

MCP Server 1.0.4 addresses the authentication performance, missing Tools workspace and RequestContext documentation feedback.

• Select credential candidates by their stored token prefix before expensive password verification. Preserve full hash verification, legacy hashes, prefix collisions and existing tokens after namespace changes.
• Add the Tools admin route, tab and overview links; retain the combined inventory under Providers.
• Document RequestContext handlers and validated raw arguments in API.md and the operator guide.
• Correct Host allowlist construction, found by the HTTP regression suite.

Validation: 42 contract, 27 behavioral, 21 ProcessWire and 16 real HTTP checks passed on ProcessWire 3.0.259 / PHP 8.5.8. Desktop and mobile browser smoke checks passed. GitHub Actions validates PHP 8.2 and 8.5.

Install the attached runtime ZIP, which includes Composer dependencies and excludes repository-only development files. Replace the complete module and refresh ProcessWire modules. No credential rotation or database migration is required; existing credential hash formats are retained.