MCPAudit 2.12.0

MCPAudit 2.12.0 Release

Release status: approved
Publication decision: GO

MCPAudit 2.12.0 prepares the 3.0 runway: check reaches legacy scan parity,
migration notices explain the coming boundaries, and release verification is
ready for the future package split. This backward-compatible release authorizes
the exact release-state source for review and publication gating; tag, GitHub
Release, PyPI, MCP Registry, runtime, deployment, adoption, and user-acceptance
claims still require their own live readbacks.

Upgrade notes

• Consumers must tolerate the additive review_source_skipped and
  no_sources_reviewed warning codes in JSON and SARIF. The former identifies
  discovered sources outside check's acceptance limits; the latter identifies
  runs with no accepted config sources. Accepted empty maps still count as
  reviewed. Neither warning establishes completed source coverage.
• The pre-commit hook uses static check --include-discovered --inject-check.
  Existing public 2.11.0 hook refs retain their older grammar until upgraded.
  The Action probes the installed command's capabilities: expanded installs
  use check, while older versions keep legacy scan arguments. In check
  mode, legacy free-form arguments are translated or rejected with a command
  notice; see Continuous integration.
• Every legacy scan run prints one translation notice to stderr only. It
  never changes the exit code, stdout, or JSON/SARIF report output. The notice
  distinguishes preserved option mapping, explicit config-only narrowing, and
  possible coverage loss, or explains why no exact translation exists.
• pin is now a visible, documented alias for baseline pin; existing pin
  commands remain valid. See Pinning.
• Defaults, exit codes, and schema_version remain unchanged. Static check
  remains the default; new connections and higher-reach modes require opt-in.
  fail_on.pin_baseline_withheld defaults off. The MCP tool's static default
  and other breaking boundary decisions are for 3.0.

Known issues

• See Known issues for remaining limitations, including
  redaction, worker cleanup, schema coverage, and legacy v1 pins.

Included capability groups

• check reaches parity with scan's optional detectors, higher-reach opt-ins,
  canary controls, timeout/concurrency tuning, verbose detail, identifier
  redaction, and extended SARIF profile. It applies permission overrides and
  ignores, merges policy and CLI egress hosts, honors per-server allowlists and
  detector pin files, and protects effective pin baselines from report writes.
  Hidden --skip-connect and --config-only flags retain their constraints.
  Canary requires a selected connection from an explicit config with no
  discovery. Synthetic parity tests cover server sets, redacted JSON, SARIF,
  overrides, policy egress merging, and exit codes.
• check --connect-all explicitly connects to the reviewed fleet. Project
  servers, including explicit project .cursor/mcp.json files, connect only
  under --connect-project-configs. Fleet mode conflicts with --connect,
  --server, and --skip-connect, and retains existing concurrency, session
  timeout, canary restrictions, and eligible large-fleet sharding limits.
• Every scan run prints its check translation or the reasons no exact
  translation exists. Source acceptance limits remain explicit: rejected
  discovered sources emit review_source_skipped, and a check run with no
  accepted sources emits the non-fatal no_sources_reviewed warning.
• The MCP scan_mcp_servers tool accepts connect, defaulting to true in
  2.12. connect=false requests a static audit; skip_connect=true still
  disables connections. Its description announces that 3.0 will default to
  static auditing and require explicit connect=true for connections.
• pin is visible in help as an alias for baseline pin. Makefile, CI
  examples, README, and the repository's synthetic smoke instructions use
  check grammar.
• Hidden compatibility commands other than pin emit migration notices.
  Lab help and Proof version output name the 3.0 install commands, including
  the direct uv tool install mcp-audits-proof install needed to expose
  proof-before-action on PATH. Missing optional distribution imports produce
  an install hint and exit 2; unrelated import failures still propagate.
  The 3.0 Python import-path map
  records the future core, labs, and Proof destinations. Deprecated
  mcp_audit.cli scan shims warn; shared client filters, authorization URL
  helpers, and canonical posture encoding live in core, with import-boundary
  coverage and public probe helpers for conformance labs.
• Requested pin checks whose baselines are withheld report partial coverage
  with reason pin_baseline_withheld. The opt-in policy boolean
  fail_on.pin_baseline_withheld gates these checks. Pin warnings name the
  refresh command and the coming 3.0 withholding of v1 baselines even without
  trusted keys; 2.x v1 comparisons remain available.
• Canary reports withheld baselines as partial runtime_security coverage,
  even when its bounded in-session exercise completes.
• Release verification binds every artifact file to the approved commit,
  requires the complete reference-build artifact set, and rejects extra,
  missing, or duplicate requirements. Wheels and sdists must match the
  contracted sources, metadata, build backend, and exact requirements. Tooling
  supports three lockstep distributions, installed-script ownership, flat
  package layouts, and branch-specific 2.x release gates. The
  release checklist records publication
  order and partial-publication recovery; the current package remains unsplit.
• The pre-commit hook uses static check with discovery and injection checks;
  the Action selects its grammar by installed capability and translates or
  rejects legacy free-form arguments. Release metadata, Action, and hook refs
  identify 2.12.0; source references do not prove public availability.
• The 3.0 boundary decisions record Q1–Q9,
  serve reach, distribution names, pin withholding, legacy command handling,
  import paths, and the 120-day 2.x security backport window. The package split
  and breaking changes do not ship in 2.12.

Public-surface boundary and rollback

Release metadata, the Registry descriptor, Action examples, pre-commit example,
and docs/release-state.json identify 2.12.0. Until publication completes,
those source references are proposed release identities rather than proof that
any public artifact or Registry entry exists. Retain mcp-audits==2.11.0 as the
rollback pin and verify installed command identity after rollback.

Compatibility and required closure

The distribution remains mcp-audits; installed commands remain mcp-audit,
mcp-audits, and proof-before-action. Python 3.11–3.13 and the MCP SDK range
mcp>=2.2.0,<3.0 remain supported. Existing 2.x report contracts remain
additive, with schema_version unchanged.

Tag, GitHub Release, PyPI, MCP Registry, runtime, deployment, adoption, and
user-acceptance claims require their own live readbacks.

Local tests and repository consistency establish only the behavior exercised
and release metadata consistency. They do not establish publication, live
third-party interoperability, deployment, adoption, or human outcomes. A clean
canary describes only its bounded in-session exercise.