Skip to content

v0.67.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Sep 07:41
· 34 commits to main since this release
v0.67.0
edbdfbf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔒 Colon-named tools are approved by their exact name — one-time review after upgrade

A tool's approval record, search-index entry and callability are now keyed by the exact name its server reports, colons included. Earlier releases filed a namespaced tool such as ns:erase under the text after its first colon, so it shared — and silently inherited — the approval of a sibling erase on the same server. Every dispatch path (call_tool_*, direct-name dispatch on /mcp/all, call_tool() inside code execution), preflight and describe_tool now resolve exactly the server:tool pair they dispatch.

What changes for you

  • On manual (default) and scan trust, colon-named tools on a server that already has an approved baseline become pending once, under their own names, on the first discovery after upgrade. They stay uncallable and out of retrieve_tools until you approve them: mcpproxy upstream inspect <server> to review, mcpproxy upstream approve <server> <tool>, the quarantine_security MCP tool, or the Web UI. trust_mode: auto servers and installs with quarantine_enabled: false auto-approve them; no other tool is affected.
  • Blocks carry over. A tool you had disabled under the old collapsed name stays disabled under its own name until you enable it there; the log records the carry-over at WARN with both names. A tool that was locked pending review is pending under its own name and is unlocked by approving it by that name — nothing else is needed, and nothing is deleted. A namespaced tool you had toggled in the UI keeps its old review lock (with the before/after evidence) under its own name until you approve it; if its old record approved a different definition than the server reports now, it is held as changed for review, and if it had no old record it is pending under an active gate — a toggle never approves a definition nobody reviewed.
  • Unresolved names are refused for everyone. A call to a tool that a connected server's discovered tool set does not contain is refused before any upstream call, for administrators too — while the server's discovery has not completed, retry shortly; afterwards, refresh with retrieve_tools and retry with a listed name. Quarantined, disabled and disconnected servers keep their existing answers: a call to a disconnected server still gets the not-connected / reconnect_on_use answer, and once the server reconnects and completes discovery, a name that result does not list is refused as unresolved — it is never dispatched.

Details: Security Quarantine → Namespaced tool names and Agent Tokens → Target tool tier.

This release focuses on bug fixes and improved tool identity enforcement, enhancing reliability and security across both editions.

New Features

  • Exact tool identity enforcement - MCPProxy now enforces exact raw-name tool identity on every dispatch path, ensuring tools are precisely identified and invoked according to Spec 105 (FR-009). This enhances security and prevents ambiguous tool resolution. (Both editions)

Bug Fixes

  • Improved search matching - Fixed search functionality to correctly match non-contiguous underscore segments in tool names, making it easier to find tools with complex naming patterns. (Both editions)

  • Token quota enforcement - Fixed per-owner agent token quotas to properly enforce limits, preventing agents from exceeding their allocated token budgets. (Teams edition)

  • Windows stability - Resolved a critical heap crash issue on Windows caused by recovered panics, and fixed a race condition in Pass-2 temporary directory handling that could cause build instability. (Both editions)

Download Installers

Platform Download Notes
macOS (Apple Silicon) Download DMG Signed & Notarized - Recommended for M1/M2/M3/M4
macOS (Intel) Download DMG Signed & Notarized
Windows (64-bit) Download Setup Setup wizard
Windows (ARM64) Download Setup For ARM Windows devices
Linux Debian/Ubuntu (AMD64) Download .deb sudo apt install ./mcpproxy_*.deb
Linux Debian/Ubuntu (ARM64) Download .deb For ARM64 (Raspberry Pi etc.)
Linux Fedora/RHEL (AMD64) Download .rpm sudo dnf install ./mcpproxy-*.rpm
Linux Fedora/RHEL (ARM64) Download .rpm For ARM64
Linux (AMD64) — tarball Download tar.gz Binary only
Linux (ARM64) — tarball Download tar.gz Binary only

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy
Other download options (auto-update URLs, archives)

Auto-update URLs (always points to latest):

Binary archives (this version):

Installation Instructions

Windows

  1. Download the installer for your architecture
  2. Run mcpproxy-setup-*.exe
  3. Follow the installation wizard (requires Administrator privileges)
  4. Launch "MCPProxy" from Start Menu

macOS

  1. Download the signed DMG for your Mac
  2. Double-click the DMG to mount it
  3. Double-click the PKG installer inside
  4. Follow the installation wizard
  5. Launch mcpproxy.app from Applications folder

Linux / Manual Installation

  1. Download the appropriate archive
  2. Extract: tar -xzf mcpproxy-*.tar.gz
  3. Make executable: chmod +x mcpproxy
  4. Run: ./mcpproxy serve
Platform Support & Usage

Platform Support

  • macOS: Full system tray support with menu and icons
  • Windows: Full system tray support with menu and icons
  • Linux: Headless mode only (CLI)

Usage

GUI (Recommended):

  • Launch mcpproxy.app from Applications (auto-starts core server)
  • Manages server via system tray menu

CLI:

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key
Assets 35
Loading