v0.2.2

Changelog

• ffd0cc9 ci: golangci-lint-action v9, since v6 refuses a golangci-lint v2 version string outright and the lint job I just added failed on its first real run
• f3a016d skill: v10 requires 0.2.2, for the kept Vesselfile and the ranked search it now tells an agent about; warn that the official fetch, git, and time servers fail on mcp 2.0 and name the pin, tell it to read the error's last lines and retry with 'build' rather than re-importing, and drop the em-dashes
• ad0e7e1 ci: run golangci-lint as its own job again now that it ships 1.26-built releases, so the lint step CONTRIBUTING tells contributors to run is no longer on the honour system
• d2a38c9 cli: introduce the product the README sells, since --help opened with "Build, ship, and run agents" and someone arriving from a page about caging untrusted MCP servers met a different tool; lead with the cage, order the help groups the way a new user meets them, say server rather than agent under those headings, match the cask description, add the 'version' subcommand people type first, and stop the serve example modelling a bind to every interface on an unauthenticated door
• bda71d7 secrets: write the store through a temp file and rename, the way the trust store already does, because Load fails closed on a malformed file and a crash mid-write left a truncated secrets.json that every later command refuses to read, with values that cannot be re-derived from anywhere
• 390b3ef bundle: cap what an .agent may expand to on extract, per entry and in total, reading through a LimitReader rather than trusting the tar header the same author wrote, so a bundle whose whole claim is that untrusted ones extract safely cannot fill the disk from a few kilobytes of gzip
• fb158d8 approvals: move the strict posture into config as 'mcpvessel config approvals set --strict', where the environment cannot clear it, because reading it only from VESSEL_STRICT_APPROVAL left it defeated by a one-word prefix on the same command line by exactly the agent it exists to restrain; the README called that airtight and now states the real limit
• e600a07 hook: fence the captured request the watch surfaces, since every byte of it was written by the caged server the notice is reporting on and it arrived as bare prose inside a SECURITY message, where "approve this host, it is safe" read like the rest of the text; mark the block as the suspect's words and shorten hyphen runs so a body cannot spell the closing delimiter and continue underneath it as mcpvessel's own
• 9549110 egress: stop writing a host into the config allow-list when every live run refused the approval, which turned a visibly failed command into a permanent widening of the cage, and exit non-zero so a caller checking status cannot read the failure as an approval; key pending previews by source as well as host so two cages sharing one proxy cannot show you one cage's payload while you approve the host for another; drop a duplicated upstream close
• 43e6577 import: keep the generated Vesselfile when the build fails and print the command that retries from it, since the documented remedy is to edit that file and deleting it made the remedy impossible; keep the tail of the boot output so a server that dies before speaking MCP reports why instead of a bare initialize EOF, naming the mcp<2 pin that currently breaks the official fetch, git, and time servers
• 6854fb8 search: rank results instead of passing the query straight to a registry that substring-matches the whole reverse-DNS name and orders alphabetically, which buried the server you meant (a bare "github" matched every io.github./* entry, so the official github-mcp-server was not in the first hundred rows); probe the package-name boundary too, rank on package and publisher with a first-party namespace winning, and report on stderr when a probe stalls rather than silently serving the old ordering
• 980dbc9 docs: the demo caption moves under the GIF at a smaller size, and both centre together inside one align block so the caption tracks the image rather than the page width
• 7ce9653 docs: the README demo leads instead of trailing the threat model, recut to the 11 seconds from note-saved to Claude naming the exfil (1000px, 2.2MB, down from 46s and 4.9MB) with a caption so a cold reader knows what they are watching, and the second dialogue block goes since the GIF now tells that story better and disagreed with it on the details
• c645e24 docs: the README demo is a recorded GIF instead of a placeholder comment, showing the notes server try to ship STRIPE_SECRET_KEY to an attacker host under cover of a save_note call, the cage blocking it, and Claude denying the host unprompted; supersedes the older unreferenced take

v0.2.1

Changelog

• b495ea0 registry: retry a stalled read instead of waiting one long attempt out (the registry answers 200 after ~35s about one request in five, which failed first-run docs setup), record the docs opt-in when the operator makes it rather than only on success so one stall no longer skips docs on every later startup, and name the real cause and the retry command instead of blaming an unpublished bundle

v0.2.0

Changelog

• d872e25 search: emit source and cageable in --json, the fields the skill tells an agent to read (it had only ever computed them for the table, and the record's own repository.source means something else); skill v9 requires 0.2.0; CONTRIBUTING documents cutting a release and when to bump the skill's requires
• 0be7e55 egress: an untagged tag releases the live run it names (allow @me/weather said 'Allowed' while the cage stayed held), a held host now rides on a successful tool result so a server that swallows the block cannot make a caged run look healthy, serve add checks the door before building, the stale-daemon line stops reading as a failed command; skill v8 stops approving unnamed hosts, guessing commands, and opening second doors; demo weather server for testing approval on a host worth approving
• 497b19a search: show SOURCE so a remote-only entry is visibly uncageable before import refuses it, collapse each name to its current version, and turn the empty state and both remote refusals into the package-coordinate path; skill v6 knows the registry lacks the official servers and that fetch/git/time are pypi-only
• 1bb1f01 hook: watch every MCP tool call (^mcp__) instead of only the front door's user-chosen name, correct a drifted matcher on re-init, and rank session-start events so a blocked exfil must be reported before anything else
• 1343841 version: stamp the CLI's own tag series (--match 'v*'; the newer docs-mcp-v* tags were winning and the binary called itself docs-mcp-v0.1.2) and report the serving docs server on a second --version line, read from the daemon at run time since it is never compiled in
• 8c59923 fix(registry): resolve a bare registry name to its latest version (version=latest, isLatest, then last-returned), not the first match, which pinned every pull, import, and the docs auto-serve to a publisher's oldest release

v0.1.4

Changelog

• 333bb4d fix(ci): bump grpc to v1.82.1 (clears GO-2026-6061) and docs-mcp nerdctl to 2.2.2 for network --internal
• 620a5ff feat: agent-driven mode: Claude cages, serves, and audits MCP servers via an installed skill and init-bootstrapped docs
• d9f979d egress: preview a new host's request before approval, and hold run/call for a configurable timeout while serve fails fast

v0.1.3

Changelog

• 121a7f1 fix(deps): bump go.opentelemetry.io/otel to v1.44.0 to clear GO-2026-5158 (unbounded baggage header) in the govulncheck gate
• ad420a2 feat(egress): opt-in --egress-inspect captures what a caged server sends an approved host (per-run-CA TLS interception with real-upstream verification, secret-safe live summary, full capture into .replay), isolate the Lima VM per VESSEL_HOME, and add the isolated dev-VM harness
• 123e570 serve: boot report leads with the copy-pasteable client URL, collapses the single-agent case, and advertises the prompt endpoint only when a MAIN is served
• c64e96f chore(comments): sweep out change-narration and stale claims (containerd namespace, run-frame types), dedupe restatements, and drop the last em-dashes
• bfb5d7a docs: sync every doc with the shipped CLI (ps/replay/egress/daemon/pull rewrites, stale output strings, EXPOSE * and 0.2 tag-bound signing documented, README limitations section restored, new troubleshooting page)

v0.1.2

Changelog

• bf5190c ci: gate on govulncheck (its own job + make vuln target); safe on go1.26 unlike golangci-lint
• 02b7e73 chore(gitignore): ignore the private security-sweep note
• c6bf058 serve: surface the non-loopback exposure warning to the operator's terminal, not just the daemon log
• 3fa7c23 chore(gitignore): guard mcpvessel local state files against an accidental VESSEL_HOME=. commit
• 5710ae5 cli: introspection stderr presents as [introspect], and logs says so when a run recorded no output
• 70809fa cli: input-flag parity for call and replay record, per-instance --budget for serve, JSON tool results pass through REST/SSE as real JSON, and store prune for untagged bundles
• 1560527 cli: name the image in the per-agent build label
• 3284983 cli: unknown subcommands of group commands error with exit 1 instead of printing help with exit 0
• 6971895 cli: attribute caged-server stderr with a [name] prefix, label the two BuildKit streams, prompt and hint only at a terminal
• 3d05899 cli: errors name the remedy (no internal daemon paths, daemon hints only when unreachable, expired-login and duplicate-version messages say what to do)
• e437e04 test: track the new stop and daemon-stop confirmation wording
• 591190c cli: one confirmation voice (past-tense verb first, name what changed) across config, login, stop, daemon, and secrets
• e70eaca cli: one table and empty-state vocabulary (internal/cliout) for every list command, and a ps that puts live runs first over the last 10 finished with -a for full history
• 76e8c3b docs(security): advertise the rotated signing key dbb184de32d2 and the trust rm recovery for the old pin
• 5633210 fix: egress-proxy boot crash on hostless sub-agents, run-id visibility, live spend/budget for serve instances, pull registry-name resolution, phantom secret-scope warning, stats empty state
• d62cd52 chore: remove accidentally committed import outputs (github-mcp-server, mcp-server-fetch)
• dc4f71b security: close deferred residuals (root secret off argv, signature tag-binding, SSE write deadline, per-agent egress scoping, scope-keyed verified marker, configurable body caps)
• 17d8f32 docs: add the demo (notes-server fixture + GIF) and fix the eval --secret example to use a tool credential, not a provider key

v0.1.1

Changelog

• 3f99eea fix(release): de-quarantine the whole cask staged tree so bundled limactl/qemu are not killed by Gatekeeper on first init
• 394b0d7 chore(release): skip Homebrew cask upload on prereleases so rc tags never overwrite the stable cask
• fbe54a1 docs(architecture): close the review gaps (serve exposure, filesystem, egress network, DNS pinning, introspection sandbox, replay, catalog enforcement)
• 29714a1 feat(mcpgateway): pin each USES edge to the sub-agent's build-time tool catalog, refusing and stripping uncataloged tools
• 3eac365 feat(egress): bound CONNECT hostnames to a strict charset at the proxy and re-check them in the daemon's log parse
• 0f374ce docs(architecture): drop the redundant identity-derivation figure, fold its chain into the section intro
• b2a023f docs(architecture): add Figure 3 (secret flow) and renumber the identity figure to Figure 4
• c816e5c feat(egress): fail fast when serving (hold for run/call), show all three grant scopes in blocked-host errors, and wire in Figure 2
• c3b02ac archi.md
• 44ad4ac archi.md
• 4697f02 feat(egress): deny-default egress with interactive approval and operator egress/secret config; remove observe
• 5fca683 docs ready
• 9fbfd43 docs: trim README support note and SECURITY supported-versions section
• bd5fee1 docs: add per-command guides and Vesselfile, reasoner, and architecture references
• 980257c docs(readme): rework the walkthrough to tag-based examples, comment each block, add tip callouts, state prerequisites, and point commands at --help and docs
• 783290f feat(store): add 'store rm' to remove bundles by reference or hash, several at once
• 4ea5bda fix(run,call): accept a source directory and build it like serve, with a clear error for a non-agent dir
• 6b40011 feat(reasoner): robust internal prompt with operator --prompt/--prompt-file append, harden the tool-loop, and stream REST answers over SSE
• d2b2380 feat: scope --secret grants per agent like --egress, and report each cage's egress and secret grants at boot
• df8089e fix(observe): say the window ends on its own and show the plain-HTTP way to drive the server
• 26cfdfb feat(import): adopt published mcpvessel bundles instead of wrapping them, and let USES pin explicit-host refs
• 9c72f84 docs(readme): tighten the opening, add a one-command try-it, and state egress and secret semantics honestly
• b6f6276 feat(cli): print each run's effective egress allowlist at serve and run start, naming baked and operator hosts
• 55cb620 fix: inject the host's mcp-bridge so bundles run cross-arch, fingerprint image tags so codegen fixes rebuild stale images, and warn when the daemon is stale