MCPAudit 2.11.0

MCPAudit 2.11.0 Release

Release status: approved
Publication decision: GO

MCPAudit 2.11.0 is a backward-compatible release for structural argv and OSC 8
redaction, large-fleet scan and report performance, legacy v1 pin migration
warnings, and bounded local schema-header traversal. This document authorizes
the exact release-state source for review and publication gating; tag, GitHub
Release, PyPI, MCP Registry, runtime, deployment, adoption, and user-acceptance
claims still require their own live readbacks.

Upgrade notes

• Reading a legacy v1 pin emits pin_schema_outdated with a migration hint:
  mcp-audit pin --refresh SERVER --apply after review. Preview with
  mcp-audit pin --refresh SERVER, review the proposed changes, then apply.
  Both commands can start the selected configured server. The warning also
  appears in pin --status terminal and JSON output. v1 pin support is
  deprecated and scheduled for removal in 3.0; see Pinning.
• Connected large-fleet CLI scans can emit the additive worker_process_failed
  scan warning code when worker results are missing. Consumers must tolerate
  the new code; explicit failed audits do not establish completed checks.
• Argv elements are now withheld whole when an inline secret assignment would
  otherwise leave part of its value visible: escape-supplied or fullwidth
  delimiters, URL-prefixed elements, or value tails the free-text redactor does
  not cover. A plain --token=value still shows --token=<redacted>. Expect more <redacted> markers in
  those rare cases. Flag names are NFKC-normalized before flag/value pairing;
  argv detection also reads ESC ESC as a terminal does, restarting at the second
  ESC without changing control-stripping semantics.
• Long, terminated OSC 8 terminal hyperlinks now show their redacted URL instead
  of <redacted> for the whole field. The URI goes through URL redaction and
  link text through free-text detection. Malformed frames retain the conservative
  fallback. Redaction remains best-effort; review reports before sharing.

Known issues

• See Known issues for remaining argv and free-text redaction
  edges, worker-crash cleanup limits, sequence rollback limits, schema-check
  coverage, and legacy v1 pins.

Included capability groups

• Structural argv redaction treats each element as a unit: when any reading
  exposes a secret assignment whose value the ordinary redactor would leave
  partly visible, the whole element is withheld; otherwise the label stays and
  only the value is redacted.
  NFKC-normalized flag names govern flag/value pairing, so ordinary options such
  as --format=token preserve following flags. Detection includes terminal-style
  ESC ESC readings and separator-delimited values within one element.
• OSC 8 hyperlinks are parsed structurally, with URL redaction for URI
  credentials and free-text detection for link text. Long plain hyperlinks
  survive instead of triggering wholesale withholding. An escape-dense
  guardrail, bounded reading budgets, and linear-work regressions keep densely
  escaped field redaction linear.
• Connected mcp-audit scan runs of more than 256 servers shard per-server work
  across up to eight worker processes on supported POSIX hosts, for stateless
  options only. Fleet checks and report finalization stay in the parent, with
  the scan-wide connection limit enforced. Stateful pin, canary, LLM, and
  package-verification modes, --skip-connect scans, and library callers retain
  the single-process path. Missing worker results produce failed audits and
  worker_process_failed warnings.
• Single-process analysis and report rendering avoid repeated empty-metadata
  work, coverage construction, config copies, and JSON conversions, reuse short
  keyword matches, and stream JSON audits from a shared redacted snapshot.
  A conservative plain-ASCII report-text fast path is tested for equivalence
  to the full redactor; report fields and formatting are preserved.
• The calibrated hostile-performance gate covers 100,000-server --skip-connect
  scans against the 10 s target, a full 1 MiB description under --ssrf-check,
  and hostile servers within timeout + 4.5 s, with zero leftover processes or
  groups in every profile. Runner calibration scales time ceilings while
  retaining the published targets, RSS, and coverage requirements; these are
  synthetic gate bounds, not universal workstation performance guarantees.
• Legacy v1 pin reads warn with the pin --refresh migration command rather
  than silently retaining reduced coverage. v1 support remains available in
  2.11 and is scheduled for removal in 3.0.
• Static schema header checks follow local $ref, allOf, anyOf, and oneOf
  within bounded depth and work. Unresolved, malformed, cyclic, or exhausted
  branches retain incomplete coverage, while known header-type violations
  survive unrelated unresolved alternatives. No remote schemas are fetched.
• The 3.0 boundary proposal is published for review.
  None of its proposed package splits, command changes, or removals ship in 2.11.
• Release tests derive candidate or published identities from release state.
  A regression test pins the no-cache requirement on publish workflows, and
  transport hygiene failures include process-group teardown diagnostics and
  ps -g output. These checks do not publish or dismiss code-scanning alerts.

Public-surface boundary and rollback

Release metadata, the Registry descriptor, Action examples, pre-commit example,
and docs/release-state.json identify 2.11.0. Until publication completes,
those source references are proposed release identities rather than proof that
any public artifact or Registry entry exists. Retain mcp-audits==2.10.1 as the
rollback pin and verify installed command identity after rollback.

Compatibility and claim ceiling

The distribution remains mcp-audits; installed commands remain mcp-audit,
mcp-audits, and proof-before-action. Python 3.11–3.13 and the MCP SDK range
mcp>=2.2.0,<3.0 remain supported. Existing 2.x report contracts remain
additive, with schema_version unchanged.

Tag, GitHub Release, PyPI, MCP Registry, runtime, deployment, adoption, and
user-acceptance claims require their own live readbacks.

Local tests and repository consistency establish only the behavior exercised
and release metadata consistency. They do not establish publication, live
third-party interoperability, deployment, adoption, or human outcomes. A clean
canary describes only its bounded in-session exercise.