v0.23.1

Maintenance release cut from v0.23.0. It contains exactly two fixes — a security patch and a dependency compatibility pin — and none of the ongoing v0.24.0 development on main.

🔒 Security

• SSE transport authentication boundary (GHSA-5j8j-256g-vvp5): the /sse and /messages endpoints of --transport sse now enforce the same per-request authentication as the streamable-HTTP transport. Full details in the security advisory published alongside this release. Upgrading is strongly recommended for anyone running the SSE transport.

🐛 Fixed

Confluence

• Pin atlassian-python-api below v5 (#1585, #1589): atlassian-python-api 5.0 removed core Confluence Cloud methods (get_page_by_id, create_page, update_page), so fresh installs that resolved the new major failed with AttributeError on basic page operations. The dependency is now bounded to >=4.0.0,<5.0.0 and a regression test guards the contract. Thanks @breezeFur for the fix and @mihnatova for the detailed report.

Contributors

Thanks to @breezeFur for the dependency fix and @mihnatova for the report that pinpointed #1585.

Full Changelog: v0.23.0...v0.23.1

v0.23.0

This release adds JSM customer-request and internal-comment support, epic hierarchy and dependency tools, PAC/WPAD and mTLS connectivity, external auth passthrough, and Live Docs page creation, plus a broad batch of Jira/Confluence content fixes and security updates to Starlette and FastMCP.

✨ Features

Jira

• New JSM customer request tools — jira_get_request_types, jira_get_request_type_fields, and jira_create_customer_request — let clients list request types, inspect their visible fields, and raise customer requests with participants, base64 attachments, and on-behalf-of support (#1241)
• New jira_get_project_epic_hierarchy groups a project's epics under their cross-project parent issues with direction-aware link classification, and jira_get_cross_project_dependencies maps issue links by target project and link type (#1286)
• jira_get_issue and jira_search accept use_display_names to return human-readable custom field keys such as Story Points instead of opaque IDs like customfield_10243; conflicting names safely fall back to the raw ID (#1156)
• Jira issue and search results now include a browse_url pointing at the issue's /browse/ page, for quick open-ticket-in-browser workflows (#1471)
• jira_update_issue accepts return_fields to trim the post-update re-fetch and cut response tokens; the full-issue default is unchanged (#1466)
• Markdown {expand:Title} blocks in issue descriptions convert to native collapsible sections on Cloud, including nested headings, lists, and code blocks (#1309)
• Development information queries discover case-sensitive application types from the dev-status summary endpoint when application_type is omitted, so custom connectors are found without guessing exact casing (#1329)

Confluence

• GFM task lists (- [ ] / - [x]) convert to native Confluence task macros instead of literal checkbox text, and new page template tools let you list Cloud templates, fetch them, and create pages from them (#1180)
• Page creation accepts a subtype — including live for Live Docs — on Cloud, and page responses expose the subtype (#1479)

Server/Transport

• Opt-in external authentication passthrough: forward an operator-allowlisted set of incoming MCP headers to Jira and Confluence per request, supporting external proxy-managed auth without local Atlassian credentials. Dynamic per-request destinations require MCP_ALLOWED_URL_DOMAINS to prevent credential exfiltration (#1457)
• Opt-in PAC/WPAD proxy auto-configuration for environments where the outbound route is selected by a PAC file. WPAD stays disabled by default, explicit proxy settings take precedence, and the SSRF/DNS-pinning defenses are preserved when PAC routing is enabled (#1367, #1461)
• New cert auth type for Server/DC deployments that use mutual TLS: a client certificate/key pair alone now authenticates — previously setting JIRA_CLIENT_CERT / CONFLUENCE_CLIENT_CERT without a username or token left the service silently disabled (#1196)

🐛 Fixed

Jira

• jira_get_issue_comments no longer crashes with a TypeError on Cloud, where REST v3 returns comment bodies as ADF — bodies are converted to text the same way the add/edit comment paths already do (#1489)
• Transition comments are routed through the correct API version: Cloud uses REST v3 with ADF in one atomic request (so workflows whose transition screen requires a comment now work), while Server/DC keep wiki-markup via v2 (#1355)
• jira_download_attachments returns non-image attachments as TextContent with a JSON envelope (base64 payload, filename, MIME type) instead of an EmbeddedResource blob that some MCP clients reject; images keep the embedded form (#1469)
• Bare Jira issue keys in Cloud markdown are autolinked to the configured /browse/ URL when converted to ADF (#1468)
• jira_add_comment accepts comment as a compatibility alias for the body parameter, so clients sending the older shape no longer fail argument validation (#1467)
• Segmented hyphenated issue keys such as B7-214-68901 (Server/DC) pass validation and are preserved by smart-link extraction (#1476)
• Blocking fetcher calls for jira_get_issue and jira_search are offloaded from the MCP event loop and bounded by JIRA_FETCHER_MAX_WORKERS (default 8), keeping the server responsive under concurrent issue reads (#1459)
• Issue creation prefers an exact Epic issue type match, so custom types like Program Epic are no longer selected by accident (#1370)
• Legacy 24-character hexadecimal Cloud account IDs are recognized regardless of their first character; malformed IDs, emails, and display names still go through normal user lookup (#1164)
• Issue created / updated timestamps are routed through format_timestamp, returning localized timestamps instead of raw ISO strings (#1236)

Confluence

• CQL searches like type=space return results instead of an empty list — space-type result items are now mapped and matched for excerpts (#1119, closes #907)
• CQL search results include created / updated / author metadata again by expanding nested content history and version fields (#1480)
• Comment replies preserve their bodies across API paths: v1 replies use the owning page as container with the parent in ancestors, and Cloud OAuth/PAT route through v2 with a storage-body fallback (#1485)
• Legacy Server/DC timestamps that overflow the platform datetime range no longer crash page and comment formatting — the raw timestamp is returned instead of failing the whole tool response (#1483)
• Updated to markdown-to-confluence 0.6 while preserving attachment handling, code-language normalization, table-layout conversion, and task-list behavior (#1486)
• confluence_set_page_restrictions list parameters now declare an items schema, unblocking VS Code Agent mode, which rejected the generated tool schema entirely (#1487, closes #1455)
• Date lozenges stored as <time datetime="..."> elements survive storage-to-Markdown conversion (#1107)

Server/Transport

• Header-based PAT requests honour *_SSL_VERIFY and proxy settings instead of hardcoding SSL verification on and disabling proxies (#1211)
• Hosts listed in NO_PROXY bypass the proxy even when proxies are explicitly configured on the session (#1191)
• Unexpected tool failures surface detailed ToolErrors instead of generic masked errors, and Confluence search helpers no longer return empty success results for API/network failures (#1316, closes #1315)
• Multi-user token validation results are cached across requests for a configurable TTL (MCP_ATLASSIAN_VALIDATION_CACHE_TTL, default 300s; 0 disables), cutting a validation round-trip from every request. Cache keys are SHA-256 material scoped by service and credential, so raw tokens are never stored (#1481, closes #1405)
• MCP tool annotations align with actual behavior: additive write tools are marked non-destructive, while watcher removal and sprint reassignment keep their destructive annotations (#1458)

🔒 Security

Server/Transport

• Upgraded the Starlette dependency to a patched release (>=1.0.1) for GHSA-86qp-5c8j-p5mr, with a malformed Host header regression test covering the path-based middleware gates (#1470)
• Upgraded the bundled FastMCP framework from 2.x to 3.x, clearing known vulnerabilities in the 2.x line (#1234, #1348). The migration preserves the tool-visibility security boundary end to end: tools hidden by read-only mode, ENABLED_TOOLS, or toolset filtering remain both unlisted and uncallable, and denials are indistinguishable from unknown tools (#1442, supersedes #1388)
• Follow-up hardening of the filter and SSRF defenses: caller-supplied projects_filter values are quoted as JQL literals and grouped so they cannot escape the configured allowlist, caller-controlled destinations stay on the direct DNS-pinned connection path when deployment proxies are configured, and relative redirect locations are resolved before SSRF validation (#1450)

Jira

• New server-side internal-only comment guard for JSM projects: with JIRA_INTERNAL_ONLY_PROJECTS configured, comments created through the add, edit, transition, and issue-link paths in those projects are enforced as internal, so AI-authored comments cannot leak to service-desk customers. The guard fails closed unless Jira explicitly reports the comment as non-public (#1478)
• Hardened JIRA_INTERNAL_ONLY_PROJECTS handling against invisible characters — zero-width characters or a BOM in configured project keys or incoming issue keys could previously make the guard fail open. Keys are now normalized, and entries that cannot match a valid project-key shape produce a warning (#1491)

🧰 Also in this release

Expanded regression coverage for Jira REST API v3 (#1110, closes #338), web and Confluence remote links (#1108), dynamic Epic Link fields (#1113), JSM queue request contracts (#1115), custom field option values (#1464, closes #673), and jira issues/epics (#1497); a deterministic rate-limit throttle test (#1449); a TruffleHog secret-scanning CI workflow (#1265); and setup docs for Autohand Code (#1472).

Contributors

Thanks to @trentzeigler (#1442, #1388), @sanjibani (#1489, #1487), @saidelike (#1367, #1459), @keithxm23 (#1196), @WZHBEDZ (#1316), @Troubladore (#1119, #1107), and @cblacknygc (#1497)!

Additional thanks to the contributors whose original work was carried into this release: @faizbawa, @kbichave, @deniszagitov, @slinkardbrandon, @cedrickcom, @trevorh, @jcbportela, @NickLoeza, @abhinavgaba, @tony-davis, @Niicolaa, @timwinders, and @balcsida.

Full Changelog: v0.22.1...v0.23.0

v0.22.1

🔒 Security

Jira

• Prevented caller-supplied projects_filter values from injecting JQL operators that could escape the configured project allowlist. Filter values with JQL syntax are now quoted as literals, and generated project clauses are explicitly grouped. (#1450)

Transport

• Kept caller-controlled destinations on the direct DNS-pinned connection path when deployment proxies are configured, so proxy-side DNS resolution cannot bypass the SSRF rebinding defense. Operator-configured Jira, Confluence, OAuth gateway, and allowlisted hosts continue to support proxies. (#1450)
• Resolved relative and scheme-relative redirect locations against the response URL before SSRF validation, restoring safe same-host redirects while continuing to block unsafe destinations. (#1450)

Full Changelog: v0.22.0...v0.22.1

v0.22.0

v0.22.0

This release bundles three months of community contributions with a coordinated security hardening pass across the attachment, transport, SSRF-validation, filtering, and OAuth layers.

🔒 Security

A security audit (37 advisories, consolidated into root-cause families) was resolved in this release. Advisories are being published with "fixed in 0.22.0" — highlights:

• Attachment & content-file path confinement — upload_attachment / download_attachment (Jira & Confluence) and the new content_file page input now validate every caller-supplied path against the workspace via validate_safe_path, closing arbitrary file read/exfiltration and an intra-CWD overwrite RCE variant. Note: paths passed to these tools must now resolve inside the server's working directory. (GHSA-wm45-qh3g-v83f, GHSA-vc25-24vv-fxxm, GHSA-93xw-j965-9mx3, GHSA-6cr4-ccf3-x7h4, GHSA-f4p7-qx46-wc5j, GHSA-f6pj-qv47-g96w, GHSA-2xj6-xx86-cwwc, GHSA-mrq8-fv7v-hhjg, GHSA-wv8v-v4c5-v75j, GHSA-p6hp-93wp-fh6p, GHSA-h7wj-5v37-59r2, GHSA-mfv2-4wvm-9pgp, GHSA-f26r-j276-ggg4, GHSA-g5r6-gv6m-f5jv, GHSA-6vmq-24h2-pj7j)
• HTTP transport authentication (critical) — unauthenticated streamable-http requests no longer fall back to the operator's global credentials; the fallback is now opt-in via ALLOW_GLOBAL_CRED_FALLBACK (default off), and unauthenticated requests are rejected with 401 at the transport boundary. (GHSA-wrhw-j3f9-8vc6, GHSA-vc8m-84rp-53hx, GHSA-cc5h-2pwp-pvcc)
• SSRF hardening — redirect validation now covers every client session and auth branch, backslash authority-confusion URLs are rejected, and a DNS-pinning transport adapter resolves each host exactly once (validate → connect on the same address), eliminating the DNS-rebinding TOCTOU against the CVE-2026-27826 fix. Hosts from your configured JIRA_URL / CONFLUENCE_URL and MCP_ALLOWED_URL_DOMAINS are exempt from the non-global-address rejection, so on-prem DC instances on private networks keep working; caller-supplied URLs (multi-user HTTP headers) remain fully guarded. (GHSA-6529-c226-h328, GHSA-hgcf-4mq8-5266, GHSA-v9m3-wfh8-5646, GHSA-5wf4-jqxh-8gm3, GHSA-49xv-9743-pw8w, GHSA-72fm-whvq-jghf, GHSA-489g-7rxv-6c8q, GHSA-6rrj-86cw-gg9j)
• Tool authorization enforcement — tools hidden by ENABLED_TOOLS / toolset / read-only mode can no longer be invoked by name; authorization is enforced at dispatch, not just listing. (GHSA-3r68-hf9h-887v)
• Project/space filter boundary — JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER are now a hard boundary: always ANDed into queries (callers can narrow but never widen), covering search and board issues. Sprint IDs are validated numeric to prevent JQL injection. (GHSA-w66g-j6c4-hcfc, GHSA-rqwg-9346-fjjv)
• OAuth token file permissions — fallback token files are written owner-only (0600, dir 0700). (GHSA-g5xv-mhgm-v5f6, GHSA-76pr-5669-3xf5, GHSA-4596-2p6p-28cv)
• Reflected XSS — the OAuth callback page HTML-escapes its output. (GHSA-g2r2-3j32-j27x)

Each fix ships with permanent regression tests. Thanks to everyone who reported — including @rainfantry for GHSA-g5r6-gv6m-f5jv, and overlapping public reports from @failsafesecurity and @rober15.

✨ Features

Jira

• Dedicated assign_issue tool (#1152) and search_assignable_users for free-form user lookup (#1358)
• jira_move_issue for cross-project moves (#1273) and move_issues_to_backlog (#1333)
• jira_search_projects using the projects picker API (#1247)
• update_version tool (#1349)
• get_issue gains an include param for inline enrichments (#1125)
• Issue type and field discovery tools (#1123)
• ADF/markdown: panel nodes (#1219), task lists - [ ] → taskList (#1280), [~accountid:UUID] mentions (#1307), display-name mentions (#1228)
• account_id exposed in simplified user profiles (#1347)

Confluence

• Inline comment tools with Server/DC v1 payload fix (#1264)
• confluence_update_page_section for lossless partial page updates (#1141)
• content_file input for create/update page (#1275)
• content_base64 input for upload_attachment — upload from in-memory content when the server can't read host file paths (#1366)
• Content and space permission checking tools (#1320)
• get_page resolves Confluence tiny links and page URLs (#1222)
• Table layout, page width, page restrictions, and copy-page support (#1178)

Server/Transport

• Opt-in HTTP hardening: urllib3 retries with Retry-After respect, outbound rate limit, process-wide concurrency cap, circuit breaker, and pagination clamp — all disabled by default, tunable via env (#1310)

🐛 Fixed

Jira

• update_issue: null values clear fields (#1140); loud failure when assignee can't be resolved (#1380); tolerate default comment fields (#1334)
• Pagination: get_worklogs returns all entries (#1223); newest comments first when limiting (#1218)
• 'me' identifier in get_user_profile (#1120); sub-task name match preference (#1331); version field allowed in issue field selection (#1227)
• Version creation uses correct API per deployment (#1339; #1350)
• Markdown: full table block parsing (#1379); no intraword-underscore italics (#1361)
• Embedded media preserved on Cloud description updates (#1224); case-sensitive dev-status applicationType (#1153); simplified get_all_projects output (#1291)

Confluence

• DC/Server attachment upload completed — XSRF header, POST method, versioning fallback (#1253); upload API errors surfaced (#1441)
• Cloud attachment URLs: /wiki prefix on upload/delete (#1386); v1 REST endpoint for downloads (#1369)
• Page tree position sort normalization (#1352); v2 API for page children (#1304); history in get_page_content expand (#1117)
• User mentions: ri:userkey / ri:username handling (#1298); bare-filename img tags become attachment macros (#1176)

Server/Transport & Auth

• Require a FastMCP version with event-store support (#1351)
• Per-user OAuthConfig guarded against BYO global config (#1364)
• Explicit User-Agent on Jira/Confluence sessions (#1326)
• Auth token redacted in unsupported-Authorization logs (#1160)
• Jira Server/DC string response handling + xhtml content format (#1231)

Full Changelog: v0.21.1...v0.22.0

v0.21.1

This release fixes a critical startup crash caused by an upstream dependency break and ships a few community-contributed features that landed on main since v0.21.0.

🐛 Fixed

Server / Transport

• Startup crash on fresh uvx installs: fakeredis 2.35.0 renamed FakeConnection without a backward-compatible alias, breaking pydocket's runtime import and making FastMCP's lifespan fail with ImportError: cannot import name 'FakeConnection' from 'fakeredis.aioredis'. Pinned fakeredis>=2.32.1,<2.35.0 as a downstream constraint until upstream ships a fix. Users no longer need the --with fakeredis==2.34.1 workaround (#1250, fixes #1248).

Confluence

• include_content test coverage and descriptions: Follow-up hardening for the new include_content option (#1099).

✨ Features

Confluence

• include_content on create/update: confluence_create_page and confluence_update_page now accept an include_content flag so callers can skip echoing full page bodies back in responses (#1098).
• confluence_get_space_page_tree: New tool for discovering a space's page hierarchy in a single call (#1090).

Deployment

• Helm: OAuth proxy + client storage configuration: Helm chart now exposes FastMCP auth's OAuth proxy and client storage settings so operators can configure them declaratively (#1084).

Contributors

Thanks to @kimoto, @Poggen, and @Troubladore!

Full Changelog: v0.21.0...v0.21.1

v0.21.0

This release adds 4 new tools (sprint management, page moves, page diffs, comment replies), OAuth proxy support, markdown table rendering, and multiple content processing fixes.

✨ Features

Jira

• Sprint Management: Move issues between sprints with the new jira_add_issues_to_sprint tool (#1078)
• Cloud Search Pagination: jira_search now returns next_page_token for cursor-based pagination on Cloud (#1079)
• Field Options Filtering: jira_get_field_options supports contains, return_limit, and values_only params for targeted lookups (#1074)
• Markdown Tables: Markdown tables in descriptions and comments are now converted to native ADF table nodes on Cloud (#1089)

Confluence

• Move Pages: Relocate pages between parents or spaces with the new confluence_move_page tool (#1080)
• Page Version Diff: Compare two page versions with the new confluence_get_page_diff tool (#1083)
• Comment Replies: Reply to existing comments with the new confluence_reply_to_comment tool (#1070)
• Page Width Layout: Library-level support for controlling page width (default / full-width) on Cloud. Available via the Confluence fetcher API; MCP tool integration planned for a future release (#1091)
• Server/DC User Search: confluence_search_user now supports Server/DC via group member fallback (#1081)

Authentication

• OAuth Proxy: Opt-in OAuth 2.0 proxy with Dynamic Client Registration (DCR), PKCE, consent flow, and grant type hardening (#1054)
• Header Auth Bypass: New IGNORE_HEADER_AUTH env var to ignore proxy-injected Authorization headers and use server-configured credentials (#1073)

🐛 Fixed

Jira

• Code Block Corruption: {code} and {noformat} blocks in Server/DC wiki markup are now protected from markup conversion corruption (#1059)
• Custom Field Preservation: Complex custom field values (nested objects, arrays) are no longer silently converted to strings (#1058)
• Panel Block Handling: {panel} blocks and bare URLs in wiki markup are now correctly converted to markdown (#1055)
• Field Name Matching: fixVersions, issuetype, and other API field names are now correctly recognized in should_include_field checks, fixing field exclusion when users request specific fields (#1076)

Preprocessing

• Code Span Truncation: Inline code spans (<code>) are no longer broken by HTML content truncation (#1094)

🔒 Security

• URL Validation Bypass: Prevented SSRF allowlist bypass where evil-atlassian.net could match the atlassian.net domain check — now uses strict .{domain} suffix matching (#1087)

Contributors

Thanks to @Poggen, @Troubladore, @djb2c, @Lama9, @iiiokojiadbi, @Arbuzov, @solganik, @johnny, @pibylick, @nulvox, @yliu, and @reneleonhardt!

Full Changelog: v0.20.1...v0.21.0

v0.20.1

This release fixes error handling for the ServiceDesk comment API on non-JSM projects.

🐛 Fixed

Jira

• ServiceDesk 403 handling: Non-JSM projects return 403 Forbidden (not 404) from the ServiceDesk API when using the public parameter for internal/external comments. The error message now clearly indicates the issue is not a JSM service desk project or the user lacks permission (#1051)

Full Changelog: v0.20.0...v0.20.1

v0.20.0

This release adds JSM internal comment support, a Kubernetes Helm chart, and fixes for worklog ADF handling and tool parameter naming.

✨ Features

Jira

• JSM Internal Comments: New public parameter on add_comment tool for Jira Service Management issues. Set public=true for customer-visible comments or public=false for internal agent-only comments. Routes through the ServiceDesk API with plain text body (#1049, fixes #867)

Deployment

• Kubernetes Helm Chart: Deploy mcp-atlassian on Kubernetes with a full-featured Helm chart supporting all auth modes, transport types (stdio/SSE/streamable-HTTP), HPA, ingress, PVC for OAuth tokens, and RBAC (#737, #1048)

🐛 Fixed

Jira

• Worklog ADF Comments on Cloud: Worklog comments were silently dropped on Cloud because ADF dicts from _markdown_to_jira() were posted to the v2 API which ignores them. Now routes through v3 API when the comment is ADF, matching the existing pattern in comments (#1047, fixes #1045)

Server

• Tool Parameter Naming: Aligned MCP tool parameter names with their response field names for consistency — comment_body → body, issue_description → description, etc. (#1044)
• Descriptive Error Messages: Tool handlers now return specific error descriptions instead of generic messages (#1010)

📚 Documentation

• Updated parameter names in documentation to match the tool renames (#1046)

Contributors

Thanks to @antweiss, @baumgold, and @hteichmann-strato!

Full Changelog: v0.19.0...v0.20.0

v0.19.0

This release adds toolset-based tool filtering for granular control over which tools are exposed, OS native trust store support for enterprise SSL environments, and Jira issue watcher tools.

✨ Features

Server

• Toolset-Based Tool Filtering: New TOOLSETS env var groups 68 tools into 21 named toolsets (15 Jira, 6 Confluence) for granular control. Supports all, default, and comma-separated names. All toolsets enabled by default — in v0.22.0 the default will change to 6 core toolsets only (#1041, #1043)

Jira

• Issue Watcher Tools: New jira_get_issue_watchers, jira_add_watcher, and jira_remove_watcher tools for managing issue watchers. Write operations respect READ_ONLY_MODE (#1039, fixes #1032)

Authentication

• OS Native Trust Store: SSL connections now verify certificates against the OS trust store (Windows Certificate Store, macOS Keychain, Linux system CAs) via truststore, enabling enterprise environments with internal CAs to connect without disabling SSL verification. Opt out with MCP_ATLASSIAN_USE_SYSTEM_TRUSTSTORE=false (#976)

🐛 Fixed

Jira

• JiraUser Username/Key Fields: JiraUser.from_api_response() was mapping displayName to both display_name and name, discarding the login username needed for Server/DC [~username] mentions. Now preserves username and user_key fields separately (#1038, fixes #1031)
• Underscore in Project Keys: Issue key patterns like D_DEV-123 were not recognized in both server tools and preprocessing due to missing _ in regex character classes (#1030, #1035)
• Windows Timestamp Overflow: Jira DC sentinel dates (year 9999) caused OverflowError/OSError on Windows. parse_date now catches these and returns None gracefully (#1037, fixes #1033)

Authentication

• Truststore Env Var Parsing: Fixed AttributeError when .env contains a bare key (no = sign) — dotenv_values() returns None which broke .lower() at import time (#1036)

Server / Transport

• Allowlisted Domains Bypass DNS: Domains in ALLOWED_DOMAINS now bypass DNS resolution checks, fixing false rejections for internal hostnames (#1005)

🧪 Testing

• Test Reclassification: Mock-based integration tests moved to unit tests, model tests split to match source structure, Cloud/Server pairs parametrized (#1015, #1016, #1021)

📚 Documentation

• Auto-Generated Tool Reference: Full reference pages for all 68 MCP tools with parameters, examples, and toolset tags (#1017)
• New Guides: JQL/CQL query guides, workflow recipes, SLA metrics, Docker deployment, and expanded troubleshooting (#1018, #1019)

Contributors

Thanks to @tsondergaard, @fatherlinux, @alvaroEset, and @bbkmike!

Full Changelog: v0.18.0...v0.19.0

v0.18.1

This release fixes allowlisted domains being incorrectly blocked by the SSRF DNS resolution check.

🐛 Fixed

Server / Transport

• Allowlisted domains bypass DNS resolution check: When MCP_ALLOWED_URL_DOMAINS was set, internal hosts resolving to private IPs (e.g. 10.x.x.x) were still blocked by the DNS check. Allowlisted domains now return early before DNS resolution, while hard-blocked hostnames (localhost, metadata.google.internal) and IP literal checks remain enforced (#1005, fixes #1002)

Contributors

Thanks to @autumnjava for reporting!

Full Changelog: v0.18.0...v0.18.1