v0.14.0

HTTP MCP Server Support for Agent Profiles

Added support for configuring, inspecting, and enforcing HTTP MCP servers in agent profiles.

Agent profiles can now define named MCP servers with their endpoint, credential binding, authentication headers, and tool access policies.

Example configuration

[secrets.LINEAR_API_KEY]
env = "LINEAR_API_KEY"

[[secrets.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
binding = "LINEAR_API_KEY"
allow_tools = ["search_issues", "get_issue"]

Custom authentication headers are also supported:

[mcp_servers.example]
url = "https://mcp.example.com/mcp"
binding = "SHARED_TOKEN"
header = "X-API-Key"
value_template = "{value}"

Tool access is denied by default. Use an explicit wildcard to allow all tools:

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
allow_tools = ["*"]
deny_tools = ["delete_issue"]

Deny rules always take precedence over allow rules.

MCP commands

Inspect a configured MCP server and its available tools:

stashbase agent mcp tools \
  --profile linear \
  --server linear

Inspect a server through a remote Agent Proxy session:

stashbase agent mcp tools \
  --remote \
  --profile linear \
  --server linear

Interactively configure the tools allowed for a server:

stashbase agent mcp configure \
  --profile linear \
  --server linear

Check a tool against the configured policy without contacting the server:

stashbase agent mcp check \
  --profile linear \
  --server linear \
  --tool search_issues

Verify configured tool names against the server’s tools/list response:

stashbase agent mcp verify \
  --profile linear \
  --server linear

Security and enforcement

The Agent Proxy now:

• Supports named HTTP MCP servers in agent profiles.
• Filters denied tools from tools/list.
• Rejects unauthorized tools/call requests.
• Enforces MCP rules in both local and remote sessions.
• Separates MCP tool authorization from credential injection permissions.
• Supports remote binding resolution.
• Records MCP tool information in audit events.
• Supports paginated tools/list responses.
• Validates MCP server URLs, bindings, headers, and tool policies.
• Provides improved diagnostics and error handling.

MCP policies apply to HTTP-based transports, including Streamable HTTP. Stdio MCP servers are not covered because their JSON-RPC traffic does not pass through the HTTP proxy.