Skip to content

v0.72.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 06:08
· 10 commits to main since this release
v0.72.0
766655d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release strengthens security with improved quarantine scanning defaults, adds flexible TLS certificate configuration, and delivers numerous stability fixes across authentication, logging, and URL handling.

New Features

  • Quarantine scanning is now the default trust mode with automatic approval for clean-scanned contract changes (Spec 119)
  • TLS certificate customization: serve certificates for custom domains via extra_sans, cert_file, and key_file configuration (Teams)
  • File-based secrets: support ${file:/absolute/path} references in configuration (Spec 111)
  • Rate limiting: per-token call rate limits for agent tokens (Teams)
  • API key from file: read API keys from MCPPROXY_API_KEY_FILE environment variable
  • Signed TPA bundles: cryptographically signed Threat Pattern Archive format with automatic refresh and downgrade protection (Spec 101)
  • Access profile suggestions: mcpproxy access suggest converts blocked calls into profile configuration changes
  • Query string API key blocking: mcp_reject_query_apikey option refuses ?apikey= credentials on MCP endpoints
  • OAuth browser page branding after sign-in
  • Automatic tool rescanning when definitions change (Spec 118)

Bug Fixes

  • Security: prevent upstream tool schemas from loading local files
  • Security: sanitize API keys, tokens, and credentials in logs (GitHub PATs, Anthropic keys, OpenAI keys, JWTs, Bearer tokens)
  • Authentication: drop caller-sent _auth_* arguments before stamping activity identity (Teams)
  • Authentication: case-insensitive Bearer scheme handling for user JWTs and HTTP API
  • URL encoding: properly escape and decode server/tool names in URLs and API paths
  • IPv6: correctly derive registry source IDs from full IPv6 addresses
  • Windows: classify npx.cmd and uvx.exe as package runners in security scanner
  • Observability: label HTTP metrics by route pattern instead of raw paths; mask API keys in spans
  • Storage: fix transaction handling in activity streaming to prevent deadlocks
  • OAuth: keep pending logins alive across quarantine scans; parse resource_metadata per RFC 7235
  • Configuration: read <data-dir>/mcp_config.json and honor MCPPROXY_DATA_DIR
  • MCP protocol: preserve compact tool routing guidance and structured errors
  • UI: distinguish tool approval status from callable readiness
  • NPM: don't cache failed package lookups

Download Installers

Platform Download Notes
macOS (Apple Silicon) Download DMG Signed & Notarized - Recommended for M1/M2/M3/M4
macOS (Intel) Download DMG Signed & Notarized
Windows (64-bit) Download Setup Setup wizard
Windows (ARM64) Download Setup For ARM Windows devices
Linux Debian/Ubuntu (AMD64) Download .deb sudo apt install ./mcpproxy_*.deb
Linux Debian/Ubuntu (ARM64) Download .deb For ARM64 (Raspberry Pi etc.)
Linux Fedora/RHEL (AMD64) Download .rpm sudo dnf install ./mcpproxy-*.rpm
Linux Fedora/RHEL (ARM64) Download .rpm For ARM64
Linux (AMD64) — tarball Download tar.gz Binary only
Linux (ARM64) — tarball Download tar.gz Binary only

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy
Assets 35
Loading