Skip to content

0.2.0-M8

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Jun 07:31
0.2.0-M8
9754471
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The MCP safety milestone. Every connected server and tool is risk-scored, high-risk and re-exposed tools can require explicit human approval, the bundled default tools are tamper-pinned, and all activity correlates to a stable local identity.

Highlights

  • MCP server & tool risk profiles (L0-L5) — risk derived from transport, auth, catalog-trust, and documentation-completeness signals; per-server and per-tool risk chips, a connection-time tool-poisoning scan, and composed-server roll-up. Risk rides the observability spans.
  • MCP server proxy — the Expose Tools drawer re-publishes selected external tools on the built-in /mcp, each with an alias / description override, risk level, HITL flag, logging, and secret masking, gated by an exposure mode (built-in / composed / both) and a max-risk cap.
  • Human-in-the-Loop (HITL) approval — a per-tool flag pauses a call for explicit approval: a chat dialog for Agentic Chat and MCP elicitation (deny-closed) for external clients, plus session-local chat tool selection.
  • Tamper- & impersonation-proof default tools — canonical name-pinned hashing rejects tampered/impersonated default tools at registration; a trust-on-first-use ledger catches upstream rug-pulls and forces human re-review.
  • YAML-configurable built-in MCP server — set the built-in server's name, description, and exposure mode via config/env.
  • Device-based user identity — a stable per-device id flows into the MDC (user=) across web requests, the persistence executor, and MCP tool-call logs.

Changed

  • Chat rendering moved off Viritin to Vaadin Markdown; server-side avatar color survives re-attach.
  • Trusted-server tools waive the documentation risk penalty; per-server documentation-adequacy now feeds the risk score.

Fixed

  • Chat bodies and avatars survive menu round-trips; scroll pinned after stream; same-conversation reload de-duplicated.
  • Hand-picked built-in MCP exposure survives a restart, and the startup reconcile filters drafts ("no pass, no run").
  • MCP server view refreshes on attach; connection-filter empty state and connection-form polish (OAuth, clearable rows, presets); expose selection capped by base risk; update banner gated on a genuinely newer release.
  • Analytics split — docs site uses its own GA tag; app disables GA when telemetry is off.

Security

  • Default-tool integrity — name-pinned canonical hashing rejects tampered/impersonated defaults; the hash ledger detects rug-pulls and forces re-review.
  • Human-in-the-loop gate — high-risk and re-exposed tools can require per-call approval on both the chat and MCP elicitation paths.
  • Tool-poisoning scan — flags prompt-injection in tool descriptions / parameters and feeds the server risk level.

Build

  • Spring AI bumped to 1.1.7.

Verification

Full unit suite 1197 / 0 failures / 0 errors + checkstyle clean. Pre-release QA sweep across the risk/proxy/HITL/integrity surface and core flows — release-ready.

See CHANGELOG.md for the complete list.

Assets 14
Loading