Tokening v0.1.1

Tokening v0.1.1

This release makes refusals easier to read and turns the demo replay into a step-by-step walkthrough. Grant checking, consumption and credential handling are unchanged from v0.1.0.

Refusal reasons now say what the grant allows and what the call did. A call aimed at the wrong post reads "Grant is bound to id 2; call sent id 3." A call to another tool reads "Grant allows wp_update_post; call asked for wp_delete_post." An extra field lists the fields the grant does accept, and a length refusal gives the actual size and the limit. Numbers and booleans can appear in a reason. String values never do, because a bound or sent string can hold private text and reasons are stored in the audit log. Use counts read "1 use" rather than "1 use(s)", including in GET /grant.

The demo replay opens at step 0 with the grant explained. Play, Next step and Previous step move through the run one record at a time. Each step has a short caption and shows the request the agent sent. The post card follows the replay from its starting title to the state verified in WordPress after the run. Long grant IDs are shortened on the page. Add ?embed to the replay URL to hide its own header when it sits inside another page; it then reports its height to that page so the frame fits on phones. The replay still sends no network requests and holds no credentials.

The Docker demo now records each scripted request (tool and short scalar arguments) and the seeded posts before the agent runs. The replay keeps only numbers, booleans and strings of up to 60 characters from those requests.

Download the archive for your operating system and architecture, verify it against SHA256SUMS and read README.md inside it. Archive names have no version, so latest/download links keep working. The limits listed for v0.1.0 still apply: the MCP agent profile is 2025-06-18, responses are buffered to 1 MiB, and stdio targets, OAuth server duties, rate limiting and vault key rotation are outside this release. The review recorded for this release is a project source review, not an external security audit.

Licence: Apache 2.0. Third-party notices are included in every archive.

Tokening v0.1.0

Tokening v0.1.0

Tokening is a self-hosted permission gateway for AI agents. A grant can allow one edit to one WordPress post, bind its ID, limit the fields and expire after fifteen minutes. The real upstream credential stays in the encrypted vault, outside the agent environment. The admin listener must also stay outside the agent's network.

This first release includes REST forwarding and an MCP Streamable HTTP tool profile, saved permission versions, atomic SQLite use consumption, encrypted upstream credentials, an operator CLI, an append-only audit log and a read-only admin panel. Uses are spent before forwarding. Failed or redirected upstream requests do not restore them. Windows, Linux and macOS run the same Go program with CGO disabled.

The disposable Docker WordPress demo uses the official WordPress MCP Adapter. Its deterministic agent receives only narrow grant secrets. The operator checks the actual post state and audit records after the agent finishes. The downloadable demo replay is a self-contained HTML file that sends no network requests. test-results.json contains the measured failure-test results and native archive smoke reports from this release's CI runs.

Download the archive for your operating system and architecture, verify it against SHA256SUMS and read README.md inside it. Archive names have no version so latest/download links remain stable. The source checkout includes make demo; Docker Compose v2 and Python 3 are needed for that demonstration.

The MCP agent profile is 2025-06-18. Upstream initialization supports 2025-11-25 and 2025-06-18. Responses are buffered to 1 MiB, server-to-client requests are not serviced, and long-lived streams need a later transport extension. Stdio targets, OAuth server duties, rate limiting and vault key rotation are outside this release. See docs/mcp.md and docs/server.md for the exact boundaries. This review is a project release check, not an external security audit.

Licence: Apache 2.0. Third-party notices are included in every archive.