ShipKit 5.1.0

ShipKit 5.1.0 hardens the MCP server shipped in 5.0.0 after an independent review, and records where a change came from in the logs. If you use 5.0.0, update.

Requires shipwithian/shipkit-core 5.1. A project created from 5.0.0 updates the package with composer update shipwithian/shipkit-core; the template's own changes are code you own, so UPGRADE.md lists what to copy.

Security

• AI client registration only redirects to trusted places. 5.0.0 accepted any redirect address, so any site could register as "Claude" and collect a user's consent. A self-registering client may now redirect only to claude.ai, chatgpt.com, or localhost. Add more origins with MCP_REDIRECT_DOMAINS (a * is ignored). The consent screen now shows where the app will return the user.
• Registration fails closed. Registering an AI client and limiting it to the mcp:use scope is one transaction, rolled back on an error response, a missing client id, or a failure to limit it, so a client can never exist with unrestricted scopes.

Fixes

• Confirmation: a repeated confirmation that arrives while the first is still running answers "still being processed" instead of an internal error, and the lock lasts at most two minutes (it was ten seconds). A call carrying a confirmation token always goes through the confirmation, so a replay returns the first result instead of running again.
• update_my_profile is marked destructive and confirms an email change, naming every change in the summary, before applying it. Its tool name, title, and annotations are explicit.

Logs

• A profile change now records whether it came from the web, the API, or an AI client (with the client's name): UpdateProfileAction takes the Channel and logs it. ShareChannel shares only the trustworthy client id; the name an AI client gave itself is looked up for logs.

For agents and maintainers (shipkit-core 5.1)

• Stricter MCP tool checks. A tool is now found by what it extends, not its file name, and needs a snake_case #[Name], a #[Title], an explicit read-only or destructive annotation, and registration in a server. It must authorize with Gate::forUser($user)->authorize() before anything but $user = $request->user();. This is a minor release because the checks apply only to MCP tools, which no project had before 5.0.0, and ShipKit's own tools pass.
• make:feature {Name} --mcp works on a feature that already exists, and adds the tool path and glob to its rule file and rules index.
• ChannelKind replaces the Channel::WEB, API, and MCP constants.

Full details: CHANGELOG.md and shipkit-core's changelog.