Skip to content

v0.64.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 15:23
· 9 commits to main since this release
v0.64.0
7fdeb27
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

⚠️ Security release — please read before upgrading

This release fixes credential-exposure and access-control defects that affect all previously released versions of MCPProxy. Two of them mean shipped versions were weaker than the documentation described. If you have used agent tokens, or connected an OAuth upstream, please read the remediation steps below.

What was wrong

Any agent token could obtain the admin API key (#1180)
GET /api/v1/info returned the global admin API key in its web_ui_url field to any authenticated caller, including a read-only token scoped to a single server. The holder could then act as an administrator.

The practical consequence: allowed_servers was not a security boundary. A scoped token never had to defeat the scope checks — it could read the admin key and stop being scoped. Treat any agent token you have issued as having had administrator-equivalent access.

Upstream credentials were served to unprivileged callers (#1167)
With the opt-in reveal_secret_headers setting enabled, the MCP door correctly required an authenticated administrator, but the REST, SSE and diagnostics doors checked the flag alone. A read-only scoped token received upstream Authorization headers, URL query tokens, command-line arguments and environment values in plaintext from GET /api/v1/servers, GET /api/v1/config and the /events stream.

Token scope was ignored on REST enumeration (#1166)
The MCP surface filtered by allowed_servers; the REST surface did not. Beyond server names, this exposed GET /api/v1/servers/{id}/logs — which serves an upstream server's own stdout/stderr, and therefore anything that server prints — and the activity and tool-call endpoints, which carry tool-call arguments and responses for every configured server.

Credentials were written to the log (#1158)
By severity of exposure, and by the log level required:

Level What was logged
info (the default) OAuth authorization codes, the full OAuth callback query string, and OAuth authorization URLs — which embed the configured upstream URL, including any credential in its query string. Also printed to stdout.
debug Upstream command-line credentials (--api-key …), upstream URL query tokens, and — under Docker isolation, where env is converted to -e KEY=VALUE arguments — upstream environment secrets.
trace Authorization and Cookie headers, request and response bodies (including OAuth token responses), and raw SSE frames.

No non-default configuration was required for the info row. Anyone who has connected an OAuth upstream has authorization codes in main.log and in terminal scrollback. Authorization codes are single-use and short-lived, so the durable risk is the authorization-URL line: if an upstream URL carries a static token, that token is in the log of every OAuth-enabled install.

What you should do

  1. Rotate your MCPProxy API key. Remove api_key from ~/.mcpproxy/mcp_config.json and restart to have a new one generated, or set a new value directly.
  2. Revoke and re-mint every agent token (mcpproxy token list, then mcpproxy token revoke <name>). Any token issued before this release should be assumed to have had administrator-equivalent reach.
  3. Rotate upstream credentials that appeared in logs. In order of likelihood: any credential embedded in an upstream server URL; any credential passed as a command-line argument; and, if you ran with Docker isolation at debug, upstream environment secrets.
  4. Treat existing log files as secret-bearing. ~/.mcpproxy/logs/*.log on Linux, ~/Library/Logs/mcpproxy/*.log on macOS, %LOCALAPPDATA%\mcpproxy\logs\*.log on Windows. Delete them or restrict access; note they may also exist in backups.

Redaction preserves diagnostics — flag names, hosts, paths and parameter names still appear in logs, so debugging a connection is unaffected. Only the credential values are masked.

Reporting

Security issues can be reported privately through GitHub Security Advisories.

This release focuses on comprehensive security hardening to prevent credential exposure and unauthorized access, plus new token usage benchmarking capabilities.

Security Fixes

Critical security improvements - affects both Personal and Teams editions:

  • Fixed credential exposure vulnerabilities - Credentials no longer leak through logs, stdout, structured errors, or connection failure messages
  • Enhanced authentication and authorization - JWT admin roles and scoped agent tokens now properly derived per owner; REST and SSE endpoints now gate access on caller identity and token scope
  • Improved secret masking - MCP server payloads now mask secrets consistently; fixed multiple gaps where raw URLs, argv parameters, and server configurations could expose credentials
  • Closed shared-server leaks (Teams edition) - Per-user endpoints no longer leak data across users; shared servers properly masked
  • Span verification - Span checksums now determine their input; unverified spans are never trusted

See security advisory for complete details on the credential exposure fixes.

New Features

  • Token usage benchmarking - New benchmarking system measures token savings from code execution responses and provides detailed payload decomposition showing where tokens are consumed
  • Enhanced threat detection - Third-party application (TPA) findings now point directly at offending words inline in the tool list
  • Benchmark replay - Can replay and recompute costs over real recorded workloads using live fleet sources

Bug Fixes

  • Stopped retrying deterministic connection failures indefinitely - Connections that will never succeed no longer retry forever
  • Fixed isolation state reporting - Now reports effective isolation state instead of treating "inherit" as disabled
  • Improved activity logging (Teams edition) - Now records redacted mutation payloads and target server information
  • Dependency updates - Bumped transitive dompurify to 3.4.14
  • Container toolchain improvements - Docker isolation now uses git-capable images; container toolchain failures properly classified

Download Installers

Platform Download Notes
macOS (Apple Silicon) Download DMG Signed & Notarized - Recommended for M1/M2/M3/M4
macOS (Intel) Download DMG Signed & Notarized
Windows (64-bit) Download Setup Setup wizard
Windows (ARM64) Download Setup For ARM Windows devices
Linux Debian/Ubuntu (AMD64) Download .deb sudo apt install ./mcpproxy_*.deb
Linux Debian/Ubuntu (ARM64) Download .deb For ARM64 (Raspberry Pi etc.)
Linux Fedora/RHEL (AMD64) Download .rpm sudo dnf install ./mcpproxy-*.rpm
Linux Fedora/RHEL (ARM64) Download .rpm For ARM64
Linux (AMD64) — tarball Download tar.gz Binary only
Linux (ARM64) — tarball Download tar.gz Binary only

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy
Other download options (auto-update URLs, archives)

Auto-update URLs (always points to latest):

Binary archives (this version):

Installation Instructions

Windows

  1. Download the installer for your architecture
  2. Run mcpproxy-setup-*.exe
  3. Follow the installation wizard (requires Administrator privileges)
  4. Launch "MCPProxy" from Start Menu

macOS

  1. Download the signed DMG for your Mac
  2. Double-click the DMG to mount it
  3. Double-click the PKG installer inside
  4. Follow the installation wizard
  5. Launch mcpproxy.app from Applications folder

Linux / Manual Installation

  1. Download the appropriate archive
  2. Extract: tar -xzf mcpproxy-*.tar.gz
  3. Make executable: chmod +x mcpproxy
  4. Run: ./mcpproxy serve
Platform Support & Usage

Platform Support

  • macOS: Full system tray support with menu and icons
  • Windows: Full system tray support with menu and icons
  • Linux: Headless mode only (CLI)

Usage

GUI (Recommended):

  • Launch mcpproxy.app from Applications (auto-starts core server)
  • Manages server via system tray menu

CLI:

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key
Assets 35
Loading