v1.3.0

A security and correctness release: 48 security fixes, 164 bug fixes and 54 additions across the agent, the MCP server and client SDK, the runtime, MCPcast, memory, caching, observability and the reasoning engine. Several defaults now fail closed, so read Upgrading from 1.2.x before you upgrade with pip install -U promptise.

Upgrading from 1.2.x

1.3.0 is a security and correctness release. Most of it needs no code changes, but several defaults now fail closed. Check this list before upgrading:

• MCP servers listen on 127.0.0.1 by default. server.run(transport="http") without host= is no longer reachable from other machines or containers. In Docker or behind a load balancer, pass host="0.0.0.0" and set allowed_hosts. A public bind without AuthMiddleware or allowed_hosts logs a warning at startup.
• CORSConfig(allow_origins=["*"], allow_credentials=True) raises ValueError. List the origins that may send credentials.
• Resources and prompts go through auth, guards and middleware like tools. require_auth=True, require_tenant, router auth and guards, and rate limits now also cover resource reads and prompt requests, so a client without a token gets an MCP error where it used to read them. Resources and prompts can take auth=, roles= and guards= like tools.
• Guardrails fail closed. guardrails=True / PromptiseSecurityScanner.default() needs transformers and torch. If a model-backed head cannot run, scans are blocked instead of passed.
• Sandbox fails closed. build_agent(sandbox=...) raises when the sandbox cannot start (no Docker client, Docker not running, gVisor missing) instead of building the agent without sandbox tools. The default network is "none".
• Identity credentials fail closed. When an agent's identity cannot get a token (IdP down, expired file), the call fails with MCPCredentialError; nothing is sent unauthenticated.
• Runtime transport and API need a token on public binds. RuntimeTransport(host="0.0.0.0") without auth_token raises (pass allow_unauthenticated=True to opt out). OrchestrationAPI rejects an empty auth_token. On loopback, both refuse browser-originated requests (cross-site Origin, non-loopback Host).
• ProcessConfig, TriggerConfig and TriggerDeliveryConfig reject unknown keys, and ProcessConfig.journal is off by default.
• MCP tool errors raise. An MCP tool that returns an error result raises MCPToolError when called directly (tool.ainvoke(...)); inside an agent the model still sees the server's message, and the call counts as failed.
• Event webhook signatures changed. Receivers must verify the new t=...,v1=... header with promptise.events.verify_event_signature(); the old bare-hex signature is gone.
• Webhooks to private addresses are refused at send time, including after DNS changes. Set allow_private_networks=True on the sink or handler for internal receivers.
• Semantic cache stores less. Follow-up turns and turns that called tools are not cached by default (cache_multi_turn=True, cache_tool_turns=True for read-only tools), scope="per_session" needs a user_id, and build_agent(cache=...) raises ImportError when the cache's packages are missing.
• Cross-agent delegation. broadcast_to_agents is opt-in (include_broadcast=True), the model can no longer pick a timeout, and delegation stops at max_delegation_depth (default 3). .superagent files reject auth: on HTTP servers (use bearer_token: / api_key:), and promptise validate fails on missing environment variables.
• Reasoning Graph. Pydantic structured outputs are dicts in result.output and state.context; a PromptNode stops at its own max_iterations (default 10); unknown agent_pattern names raise ValueError.
• Observability redacts secrets and personal data in traces by default (ObservabilityConfig.redact_sensitive=False to turn it off), and prompt text is recorded only at FULL unless record_prompts=True.
• Audit logs. AuditMiddleware(log_path=...) with signing on needs a key (PROMPTISE_AUDIT_SECRET or hmac_secret=); without one it raises instead of signing with a random per-process key nobody could verify. A restarted server continues the file's chain instead of starting a new one, and entries carry seq. Verify a file with verify_audit_log() or promptise audit verify.
• RAG. rag_to_tool(format="json") returns {"notice": ..., "results": [...]} instead of a bare list, and markdown/text output is fenced as untrusted data. Indexing a document again replaces its chunks. A RAGPipeline is one shared corpus: scope retrieval per caller yourself (see Who can retrieve what in the RAG guide).
• Adaptive strategy keeps lessons per caller (scope="per_user"); lessons saved by 1.2.1 or earlier carry no scope and are no longer shown. Re-add the ones you need.

Highlights

Multi-tenant safety. The invoking user's token reaches MCP servers per call, and server-side caches, @cached, the job queue, adaptive-strategy lessons, conversation flows, Mem0 memories and the agent's semantic cache are all scoped per caller. Cached answers never skip an approval gate.

Secure by default. MCP servers bind 127.0.0.1, resources and prompts pass through auth and guards like tools, guardrails and the sandbox fail closed, identity credentials fail closed, and the runtime's control APIs need a token on public binds and refuse browser-driven requests on localhost. Outbound webhooks (events, approval, escalation) are pinned to the checked address on every send.

Approval you can rely on. Classifier rules see the real arguments while reviewers see the redacted copy, deny rules win, every decision reaches on_decision, and cross-agents keep their own approval when delegated to.

Things that now actually work. Streaming after tool calls, agent.astream(), FallbackChain with tools, runtime restart policy, journal and budgets, trigger filters and webhook signatures, agent_pattern="peoatr", lossless graph YAML, token usage in reports, and MCPcast servers that advertise the spec's full schema.

Verifiable audit logs. verify_audit_log() and promptise audit verify check a signed log file for edits, deletions, reordering and insertions, across restarts and rotated files.

Windows. .superagent paths, the server startup banner under redirected output, duration timers and OpenAPI spec encoding are fixed on Windows; CI covers Python 3.10–3.13 on Linux, macOS and Windows.

Full changelog: https://github.com/promptise-com/foundry/blob/main/CHANGELOG.md