v3.72.0 — MCP 2026-07-28 support + 39 contributor fixes

3.72.0 brings ruflo's MCP server up to the MCP 2026-07-28 revision (ADR-524, #4837). It also merges 39 contributor fixes and tests from the #4775 tracker and the daily security scan through #4825. Thanks to every contributor.

MCP 2026-07-28

ruflo mcp start now serves 2026-07-28 clients and older ones from the same process.

• No more pinned version. initialize used to answer 2024-11-05 whatever the client asked for. It now echoes a supported version (2025-11-25, 2025-06-18 or 2024-11-05) and reports the real ruflo version.
• server/discover is answered, so a 2026-07-28 client's stdio probe finds ruflo.
• Stateless requests. A request that carries its version in _meta gets resultType and serverInfo on the result. An unsupported version is refused with -32022 and the list of versions ruflo supports.
• Stable tool list. tools/list is sorted by name and carries cache hints, so the catalogue is identical on every call and client prompt caches keep hitting.
• Tracing. A W3C traceparent from the client is passed through to the tool call.

The Tasks extension and the HTTP server's move to 2026-07-28 are planned next (ADR-524, Phase 2).

Security

• pre-bash blocks a command it cannot check. Before, late, unparsable or malformed hook input let the command through (#4743, #4826). The input window for pre-bash is now 3 s, so a slow host still gets its commands checked.
• Browser tools accept only http(s) and about:blank URLs. Screenshots are written inside the project. A project's Ollama baseUrl no longer receives your OLLAMA_API_KEY (#4812).
• Statusline runs sqlite3 without a shell and strips control characters from directory and git names (#4745, #4818).
• Imports and federation: memory_import and session_import are capped at 16 MiB, and a gzip bomb is refused. x_federation_join restricts keyFile and relayWs (#4754, #4821).
• Denial of service: exclusion patterns are matched without regex backtracking (ReDoS), and performance_benchmark iterations are capped (#4753, #4820).
• AIDefence: the new RUFLO_AIDEFENCE_PACKS (true, false or a comma list of packs) selects the pattern packs for the MCP server (#4785).

Data integrity

• A corrupt workflow, hive-mind or swarm store is backed up and reported instead of being reset and saved over (#4737, #4779).
• patterns.json is merged under the writer lock, so the daemon no longer erases patterns written by hooks (#4735, #4819).
• daemon.log rotates, and worker metric files are written atomically (#4740, #4816).

Fixes

• Cost tracker 0.31.2: cost-health installs an npx CLI once before running its four checks in parallel, so a cold npm cache no longer breaks the install. A failed memory list is reported as an error instead of "no budget set" (#4711, #4827).
• Hive-mind: maxAgents is enforced; join requires a registered agent and a valid role (#4727, #4813).
• Swarm: swarm_shutdown terminates members, and an unknown id is an error (#4726, #4815).
• Tasks:
  • task_assign refuses finished tasks and unknown agents (#4725, #4778).
  • task_retry honours resetState (#4723, #4807).
• Agents and terminals:
  • The agent_list status filter accepts all, aliases and any case (#4732, #4777).
  • terminal_execute refuses closed sessions (#4730, #4789).
  • A heartbeat for an unknown node is an error (#4731, #4786).
• Embeddings and hooks:
  • embeddings_generate honours normalize:false (#4724, #4780).
  • A confidence of 0 is kept instead of being replaced by the default (#4728, #4790).
  • hooks_model-route honours preferCost/preferSpeed (#4722, #4817).
• CLI flags that the parser camelCases are now read: guidance, neural, ruvector, hooks coverage, worker detect and single-command flags. A lint test stops new kebab-only reads (#4716–#4721).
• Windows: doctor uses os.homedir(); GCS and RVFA paths are native; no 2>/dev/null redirects in execSync (#4768–#4770).

Tests and docs

New tests for MCP tools that had none (#4759–#4767). README counts and the plugin table are refreshed, and there is a ruRE plugin guide. Every plugin manifest has a repository field (#4756–#4758, #4771, #4774).

Packages

@claude-flow/cli, claude-flow and ruflo 3.72.0 on latest. 3.71.5 was never published; its changes ship here. Plugins: ruflo-workflows 0.7.2, ruflo-plugin-creator 0.4.5, ruflo-cost-tracker 0.31.2.

🤖 Generated with RuFlo