Skip to content

v4.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 18:21
· 10 commits to main since this release
v4.0.0
5c02a72

Changelog - v4.0.0

All notable changes to the law-scrapper-mcp project for version v4.0.0 will be documented in this file.

The format is based on Keep a Changelog 1.1.0,
and this project adheres to Semantic Versioning 2.0.0.

[v4.0.0] - 2026-08-31

BREAKING CHANGES

  • Default HTTP bind moved from 0.0.0.0 to 127.0.0.1 — A deployment relying on the implicit wildcard bind becomes unreachable until LAW_MCP_HOST is set explicitly.
  • Binding beyond loopback now requires authentication — Setting LAW_MCP_HOST to a non-loopback address requires LAW_MCP_AUTH_MODE set to bearer or oauth. A container configured with 0.0.0.0 and no token refuses to start instead of exposing an unauthenticated MCP endpoint.

Added

  • Static bearer token authentication — LAW_MCP_AUTH_MODE=bearer validates incoming requests against LAW_MCP_AUTH_TOKEN or LAW_MCP_AUTH_TOKEN_FILE; correctly handles bracketed IPv6 hosts in the self-named issuer URL and never echoes the token value in configuration validation errors
  • OAuth resource server verification — LAW_MCP_AUTH_MODE=oauth verifies bearer tokens against an OAuth issuer via LAW_MCP_AUTH_ISSUER, LAW_MCP_AUTH_AUDIENCE, and LAW_MCP_AUTH_RESOURCE_SERVER_URL, tolerating malformed JWKS/discovery documents without crashing
  • Per-client HTTP rate limiting — Bounds request throughput per client on the Streamable HTTP transport. Enabled by default: 60 requests per 60s window, burst of 10; tune via LAW_MCP_RATE_LIMIT_ENABLED, LAW_MCP_RATE_LIMIT_REQUESTS, LAW_MCP_RATE_LIMIT_WINDOW, LAW_MCP_RATE_LIMIT_BURST, and LAW_MCP_TRUSTED_PROXIES for client identification behind a proxy
  • Network and auth settings surfaced in configuration — LAW_MCP_HOST and the auth settings above are validated at startup with Polish-language errors for misconfiguration; LAW_MCP_ALLOWED_HOSTS and LAW_MCP_ALLOWED_ORIGINS (recognizing bare IPv6 loopback) are enforced per request by the MCP SDK's transport-security layer, protecting against DNS-rebinding and cross-origin access
  • Authenticated deployment documentation — Deployment docs cover bearer and OAuth setup for non-loopback binds
Assets 5
Loading