Skip to content

v0.4.1

Latest
Latest

Choose a tag to compare

View all tags
@LucasArmstrong LucasArmstrong released this 03 Oct 16:00
· 1 commit to main since this release
v0.4.1
af27efb

What's Changed

🛡️ Security Hardening & Dispatch Token Enforcement

  • Dispatch Token Enforcement: Wired HMAC intention dispatch token verification into load_behavior with canonical params_hash re-computation and behavior name matching.
  • Token Replay Protection: Added in-memory token cache with TTL expiration to prevent token replay attacks.
  • Browser Injector Sandboxing: Hardened runtime injection script generation against script breakout via unescaped identifiers, and restricted default origin allowlists.
  • Schema & Policy Protection: Added prototype key filtering (__proto__, constructor, prototype) in RecordSchema to prevent prototype pollution during dictionary validation.
  • Documentation & Manifest Alignment: Updated security policy contact domains and synchronized package metadata across documentation and schemas.

Pull Request: #4
Full Changelog: https://github.com/putervision/behavior-mcp/blob/main/CHANGELOG.md
Compare: v0.4.0...v0.4.1

Assets 2
Loading