v2.27.0

Add Codex and Gemini CLI install targets, MCP progress for long lookups,
display titles, a Claude Code marketplace, and MCP Registry metadata.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes. recon mcp install --client
and recon doctor --client accept codex and gemini.

Added

• Publish MCP Registry metadata for io.github.blisspixel/recon. server.json
  is generated from the project version, and the README carries the PyPI
  mcp-name marker. The declared launch is uvx --from recon-tool recon mcp.
  The release job publishes that pointer with GitHub OIDC after PyPI parity.
  The artifact remains the attested wheel. (#321)
• Install recon for Codex and Gemini CLI. recon mcp install --client=codex
  writes [mcp_servers.recon] in ~/.codex/config.toml or .codex/config.toml,
  preserving sibling tables and comments. --force replaces only that table's
  span. The install does not write tool_timeout_sec or
  default_tools_approval_mode. recon mcp install --client=gemini merges
  mcpServers.recon into ~/.gemini/settings.json or .gemini/settings.json
  and omits autoApprove. recon doctor --client reads both files. (#323)
• Publish a repository Claude Code marketplace named blisspixel-recon.
  claude plugin marketplace add blisspixel/recon and
  claude plugin install recon@blisspixel-recon install the existing plugin,
  including its skills. The plugin still launches recon from PATH, so
  recon-tool remains a separate install. The marketplace file is generated
  from the plugin manifest and the project version. (#322)
• Advertise MCP display metadata. On mcp 2.0.0 and newer, server/discover
  and initialize serverInfo carry title recon, the package description,
  and websiteUrl https://github.com/blisspixel/recon. Every tool, catalog
  resource, and the domain_report prompt has a verb-first title. Names are
  unchanged, and recon publishes no icon. The v1.28.1 rollback pin forwards
  websiteUrl and those component titles. (#320)
• Send MCP notifications/progress from chain_lookup, a cache-miss
  lookup_tenant, build_review_bundle, cluster_verification_tokens, and
  compare_postures. Messages are stage names and counts. A client that
  resets its tool timeout on progress, or raises that timeout, can keep a
  depth 2 or 3 chain lookup alive. (#317)

Fixed

• Ignore a RECON_CONFIG_DIR that is relative or still contains an unexpanded
  ${...} placeholder. Cursor and VS Code leave ${PLUGIN_DATA} literal, and
  recon was writing cache and limiter state into that directory in the working
  directory. recon doctor and recon doctor --mcp warn and name the
  placeholder. An absolute path is unchanged. (#318)
• Advertise only MCP change notifications recon sends. On mcp 2.3.0 and newer,
  server/discover leaves listChanged and resources.subscribe false, and
  recon mcp doctor fails if a later SDK default turns them back on. Older v2
  SDKs still advertise the flags, so the same check warns and the 2.0.0
  compatibility floor stays in place. (#319)

v2.26.1

Fix routine MCP request logging privacy, reject invalid encrypted DNS views,
and correct collection status, capsule determinism, and validation packaging.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes. Maintainer validation
helpers add provider selection and endpoint overrides.

Security

• Suppress MCP server request-level logging by default (runtime level WARNING)
  to protect investigated domains from leaking into client log files. Full
  request logging is opt-in via RECON_MCP_LOG_REQUESTS=1. Preserve root
  logging configuration during MCP SDK construction.
• Reject typos and invalid values in RECON_DNS_VIEW on CLI lookups with exit
  code 2, preventing quiet fallback to unencrypted host DNS when an operator
  intended encrypted resolution.

Fixed

• Prevent offline lookups from exiting 0 when old certificate summaries without
  subdomains exist in cache: when all live DNS queries fail and no services are
  observed, a cached certificate summary without subdomains no longer recovers
  the DNS source, correctly exiting 4 (all_sources_failed). (#312)
• Disentangle certificate transparency status on domains with no certificates:
  soft-empty provider responses without recovered certificates or cache are no
  longer recorded as ct_provider_used, eliminating contradictory degraded and
  recovered status messages. (#313)
• Canonicalize lexical observation example order: sort matching subdomain
  labels alphabetically before choosing examples so identical subdomain
  collections yield deterministic statements and zero false interpretation
  changes during capsule comparisons. (#311)
• Include all tracked validation modules in source distributions: allowlist
  validation/run_path_safety.py, validation/evaluate_catalog_promotions.py,
  and four tracked validation notes in .gitignore so VCS-aware sdist builds
  package all files needed by tests. (#314)

Changed

• Refresh validation model helpers: default to current claude-sonnet-5-5,
  update pricing table and documentation examples with current model identifiers,
  and flag unknown model pricing instead of reporting a misleading $0.00. (#315)
• Support OpenRouter, Google Gemini, and local models (Ollama, vLLM, LM Studio)
  alongside Anthropic, OpenAI, and xAI in validation/agentic_ux and
  validation/triage_llm.py. (#316)

v2.26.0

Add an opt-in encrypted DNS view for CLI lookups and refresh DNS security,
failure diagnostics, and verification tooling.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

Added

• Opt the recon CLI in to encrypted DNS with RECON_DNS_VIEW=caller-safe.
  Lookups then use the same view as the MCP server (saved RECON_DNS_*
  settings, else a recognized host public resolver, else Cloudflare
  DNS-over-HTTPS) and record resolution_vantage: caller-safe. The default is
  unchanged: without the exact opt-in value the CLI keeps the system resolver.
  With the opt-in set, invalid settings exit with code 2 before any collection
  (lookup, review, batch, discover, capsule capture and chain) and never fall
  back to the system resolver; total failure names a possibly blocked
  encrypted resolver. Links in these messages wrap only at word boundaries.

Security

• Require dnspython 2.9.0, which fixes CVE-2026-114605 (GHSA-45c3-73f7-pv4m):
  a crafted DNS message could make name decompression consume excessive CPU.
  recon parses DNS answers controlled by the owner of any queried domain, and
  MCP parses DNS-over-HTTPS responses by default since v2.25.0. Refresh the
  runtime dependency set, including a current Public Suffix List snapshot for
  apex reduction, certifi 2026.10.23 and cryptography 50.0.2.

Fixed

• When every source fails or times out under the caller-safe MCP DNS view,
  say that a network blocking outbound encrypted DNS is one possible cause and
  link the resolver override, instead of only "Try again". Since v2.25.0 a
  DoH-blocking network reached this generic failure rather than a setup
  message. The hint names no resolver and is absent for the operator and
  disabled views.

Tests

• Warm the synthetic MCP launch installation before its timed handshakes:
  precompile the copied package and import the server once, untimed. The MCP
  SDK bounds server/discover at a fixed 10 seconds, and the first launch of a
  fresh install on a loaded Windows runner had spent that budget on one-time
  bytecode compilation and first-run interpreter cost (issue 303).
• Refresh development and mutation tooling, including ruff 0.17.2 (no code
  changes needed), Hypothesis 6.170.9, coverage 7.17.0 and cosmic-ray 8.7.0,
  and regenerate the build constraints. Hypothesis's improved annotations
  repaired five legacy test typing diagnostics, so the exception inventory is
  narrowed: one stateful test drops its file-level control and another keeps
  only its private-contract exception.

Documentation

• Run the local draft-release verifier through the project environment in the
  release runbook; a bare system python3 can lack its dependencies.

v2.25.0

Make MCP DNS collection work without setup, over encrypted DNS by default.

Changed

• MCP DNS collection now works without setup on hosts whose resolver is not
  Cloudflare or Google. Instead of reporting an unavailable capability, the
  server binds encrypted Cloudflare DNS-over-HTTPS (cloudflare-dns.com via
  1.1.1.1 and 1.0.0.1). Saved RECON_DNS_* settings and a recognized public
  service in host configuration still take precedence, the host's enterprise or
  stub resolver is still never used, and failures still never fall back.
  RECON_DNS_VIEW=none disables DNS-dependent MCP tools; partial or invalid
  settings stay unavailable rather than silently using the default. Trusted CLI
  resolution is unchanged.

Documentation

• Renumber the duplicate MCP DNS-view ADR to ADR-0019, record the encrypted
  default as an amendment, and list it in the ADR index. Mark closed issues in
  dated review records and note the live Best Practices result in the badge
  worksheet.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes. No MCP tool, resource or
prompt name changes. The MCP DNS capability declaration keeps its fields; its
unavailable setup text now points at fixing or removing RECON_DNS_* settings.

v2.24.0

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

Added

• Recognize Vercel's documented nonempty verification marker at _vercel.
  Invite contributors interested in catalog validation, independent review,
  and a possible future maintainer role through the contribution guide.

Fixed

• Exclude mail controls made inapplicable by retained Null MX declarations
  from hardening prompts, review candidates, and index allocation. Require
  explicit deny-all SPF and effective DMARC enforcement before excluding
  sender controls, retain declaration proof, and preserve applicability in
  hypothetical simulations.
• Adapt boxed gap, exposure, and delta reports to up to 100 columns with
  hanging continuation indents and whole identifiers. Keep the ASCII help
  example visible and link sparse-result guidance for installed users.
• Report the checked MCP server's DNS capability in both doctors with an
  actionable warning when no caller-safe view is approved. Refuse unavailable
  collection before reserving rate limits, and advertise and enforce the
  chain-depth range without silently changing caller requests.
• Canonicalize merged evidence before interpretation so shuffled DNS answers
  do not create false capsule changes. Preserve literal www hosts with
  --exact, retain balanced CAA record quotes, and normalize CT issuer display
  labels across provider and cache paths. Record normalizer version 2 while
  keeping historical capsule artifacts intact.
• Label caches bound to another DNS policy as non-reusable metadata rather
  than inspection failures, while keeping their payloads inaccessible to the
  current view. Reject empty CT metadata as an offline recovery contribution
  so fully failed lookup and review workflows exit 4.
• Share CNAME DNS-label and regex matching between fresh detection and cached
  replay so cached records cannot gain a provider claim from a lookalike.
  Narrow Fly.io, Railway, and Netlify targets to their documented routing
  boundaries, date ten reviewed rules, and distinguish routing and published
  verification markers from completed verification or active deployments.

v2.23.0

Added

• Publish a harness-neutral catalog maintenance entry point with a runnable
  fictional offline round, private frozen inputs and budgets, durable start
  receipts, one-use holdout accounting and resumable monthly reference reviews.
  Keep review dates genuine and proposal queues bounded; no recurring job,
  customer collection or automatic promotion is activated.
• Add documented Convex custom-domain routing, ImprovMX and Forward Email MX
  routing and SPF policy references, plus Forward Email's nonempty verification
  marker. Preserve record roles, related-host scope and existing suffix grammar;
  no additional probes or active-use claims.

Fixed

• Bound supplied maintenance evaluation files, aggregate bytes, directory work,
  JSON nesting and record counts before reduction or holdout consumption. Hash
  and decode the same admitted bytes and reject incomplete malformed inputs.

• Refresh development-only filelock and virtualenv security floors and locks
  for SQLite side-file handling, shell prompts and exclusive file creation.

• Replace global and suite-wide typing relaxations with exact owned scopes and
  a blocking audit that restores their diagnostics. Check JSON containers and
  OIDC endpoint values, type rate-limit snapshots and shared fixtures, and
  repair canonical test imports without changing ordinary lookup commands.

• Gate cross-slug catalog overlaps with shared synthetic witnesses and reviewed
  retained provenance, including equal patterns and differently written
  regexes. Require exact review dispositions for rule additions, retirements
  and claim/provenance edits while keeping source-check dates distinct from
  editorial changes.

• Characterize shared-response identity deductions and distinguish individual
  model-unit masks from complete source withdrawal. Preserve separately
  supported roles, conflicts and missing observations in offline regression
  cases; clarify explanation limits without changing inference parameters.

• Require current role-observation bindings and effective evidence before
  Bayesian assurance assertions. Repair vacuous grouping, sensitivity and
  conflict-band scenarios, retain generic-vendor negatives, and record a
  reproducible finite sensitivity receipt without changing model parameters.

• Bound batch tenant/name peer projection, token expansion and indexed
  ecosystem pair work independently of qualifying results. Preserve small
  groups and existing JSON array/wrapper shapes, and add explicit diagnostics
  for unavailable comparisons, filtering, truncation and unfinished search.

• Keep unrecorded historical delta sets distinct from explicitly empty arrays.
  Withhold unsupported service, slug and signal changes and report missing
  confidence/domain-count comparisons in the existing incomplete diagnostic.

• Match built-in CNAME motif provider domains at validated DNS-label boundaries
  so deceptive prefixes and appended domains cannot create provider-chain
  observations. Preserve ordered matching, queried-host provenance and legacy
  custom substring markers; custom domain markers can select dns_suffix.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes. Batch JSON adds optional
correlation completeness diagnostics; existing array/wrapper shapes remain.
No MCP tool, resource or prompt names change. Private catalog maintenance
helpers require a source checkout and do not change ordinary lookup setup.

v2.22.0

Protect lower-trust collection on split-horizon networks and finish the build-tool CA remediation.

Security

• Isolate lower-trust MCP collection from the host's split-horizon DNS view.
  Bind DNS and HTTP name resolution to one saved caller-safe startup policy,
  preserve TLS and public-address socket admission, and bind caches to its
  identity/version. Reuse an approved configured public resolver without a new
  chooser; report unavailable capability with one-time server setup guidance
  when approval is missing. Bare CLI lookups keep their existing UX and trusted
  resolver view. Reconcile audit triage by revision and attack path, and correct
  the HTTP pinning fix's release status to v2.19.0.
• Complete the build and publishing toolchain's emSign CA remediation, separate
  from the shipped runtime certifi fix. Select uv 0.13.5 in CI, releases,
  installer bootstraps, local readiness and the digest-pinned container; require
  uv >=0.13.4 for lock updates. Pin PyPI publishing to the verified v1.14.3
  commit with patched sigstore and certifi, preserving trusted publishing and
  artifact provenance gates. Existing tool installations, interpreters, virtual
  environments and custom trust stores require their own update and review.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

v2.21.6

Correct offline artifact boundaries and refresh the security and Python baseline.

Fixed

• Exclude unattempted sources from capsule and review-bundle observation
  opportunities. A disabled opt-in probe no longer claims an empty observation
  or changes the state or instance count of an attempted source role.
• Reject artifact timestamps whose conversion to UTC exceeds the supported
  datetime range as validation errors instead of raising an uncaught overflow.

Security

• Require OpenTelemetry API 1.45.1 or later for the MCP trace-metadata parser
  (CVE-2026-114603). Carry the floor into installed distribution metadata.
• Refresh the development and mutation toolchain to virtualenv 21.14.12,
  GitPython 3.2.1 and pip 26.2.2, including their security and bundled CA fixes.

Changed

• Use Python 3.15.1 as the exact local patch baseline. Keep uv aligned with
  setup-python's selected interpreter throughout CI, including future patch
  updates and the existing supported-version matrix.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

v2.21.5

Preserve CLI option values that happen to spell global flags.

Fixed

• Keep flag-shaped filenames and labels as option values instead of moving
  them into global options or rejecting them as misplaced flags. Follow the
  registered command's option arity, including nested aliases, short-option
  combinations and attached values. A later --help stays a help request and
  does not accidentally become a value that allows collection to start.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.

v2.21.4

Refresh the tested MCP SDK baseline and correct CT maintenance summaries.

Fixed

• Read CT limiter snapshots in maintenance summaries from the runtime's shared
  state-directory resolver, including fresh XDG installations. Preserve legacy
  and explicit override precedence and clarify that persisted counters can
  include earlier runs. This changes validation tooling, not packaged lookups.

Changed

• Refresh the production lock and blocking current-SDK compatibility row to
  MCP 2.3.0 and its matching types. Keep the 1.28.1 rollback and 2.0.0 floor
  rows, the existing supported dependency range, and the passive collection
  boundary. The SDK update includes stdio event-loop and legacy framing fixes.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.