Skip to content

Releases: scottconfusedgorilla/sncro-relay

Release list

v0.9.4 — initial public release

v0.9.4 — initial public release Latest
Latest

Choose a tag to compare

View all tags
@scottconfusedgorilla scottconfusedgorilla released this 18 Apr 21:23
v0.9.4
1938bab

First tagged release of sncro-relay. Pre-1.0 — active development, breaking changes possible on minor bumps.

What's in the box

  • MCP relay at `relay/` — FastAPI app exposing 9 MCP tools for browser inspection (DOM, console, network, errors)
  • Framework plugins at `middleware/` — FastAPI and Flask drop-ins. Each is a single file with tests.
  • Demo app at `trysncro/` — SportsCrash, a deliberately-broken page for end-to-end testing.
  • MIT license — everything in this repo is free to self-host, fork, or reuse.

MCP tools

`create_session`, `check_session`, `end_session`, `get_page_snapshot`, `get_console_logs`, `get_network_log`, `query_element`, `query_all`, `report_issue`.

Security

This codebase has been through an adversarial static review (the `blackhat/2` engagement, Phases A–I). Every Critical and High finding is line-verified closed. See SECURITY.md for the threat model and reporting path.

Key defences:

  • Three-secret auth (session_key + session_secret + browser_secret)
  • CSRF gate on the enable flow (Sec-Fetch-Site / Origin)
  • Clickjacking headers (X-Frame-Options + CSP frame-ancestors)
  • SSRF guard on domain probes
  • Rate limiting on all public endpoints (slowapi)
  • Stored XSS defences in admin/public rendering paths

Plugins welcome

If you want sncro on Django, Rails, Express, Next.js, ASP.NET, Go, Laravel, or anything else — CONTRIBUTING.md has the full plugin spec and the test template. We will merge well-tested plugins fast.

Runtime

Python 3.11, 3.12, 3.13 supported. CI runs pytest across all three on every push / PR.

Next

Roadmap toward v1.0.0: community-contributed plugins, billing wired up, a month without a security phase.

Assets 2
Loading