Skip to content

2.42.5

Choose a tag to compare

View all tags
@deviantony deviantony released this 09 Jun 04:16
2.42.5
4bfeecb
This commit was signed with the committer’s verified signature.
deviantony Anthony Lapenna
GPG key ID: 4CA4CBA1CB008662
Verified
Learn about vigilant mode.

2.42.5 — Targets Portainer 2.42.x

Warning

Breaking change for HTTP-transport deployments.

The HTTP credential model is now per-user passthrough. The bearer token is only an access gate; each caller must send their own Portainer API key in the X-Portainer-API-Key header.
PORTAINER_API_KEY now hard-fails at startup under PORTAINER_MCP_TRANSPORT=http — it is a stdio-only credential.

Migration: remove PORTAINER_API_KEY from your HTTP deployment and have each client send X-Portainer-API-Key alongside the existing Authorization: Bearer <gate-token>. stdio transport is unaffected.

Added

  • TLS posture enforcement on non-loopback HTTP binds (#67). The server
    won't boot on a non-loopback bind unless you declare a cert
    (PORTAINER_MCP_TLS_CERT/_TLS_KEY), proxy TLS attestation
    (PORTAINER_MCP_TRUST_PROXY_TLS=1 + ..._FORWARDED_ALLOW_IPS), or the loud
    plaintext opt-out (PORTAINER_MCP_DANGEROUSLY_ALLOW_PLAINTEXT_HTTP=1).
    Loopback exempt; self-signed certs warn but don't block.

Changed

  • Per-user Portainer API-key passthrough over HTTP (#66) — see the warning
    above. Validation is cached positive-only (PORTAINER_MCP_AUTH_CACHE_TTL,
    default 60s); the per-user key is never logged.
  • Bumped fastmcp to >=3.4.2, dropped the direct starlette pin (CVE floor
    now carried transitively).

Documentation

  • Hygiene skill: an edge agent's health comes from its heartbeat, not its
    Status field (#70).

Full changelog: https://github.com/portainer/portainer-mcp/blob/2.42.5/CHANGELOG.md

Assets 2
Loading