v0.9.1

Security

• MCP tool calls skipped action policies and spend caps. A call made
  through /mcp was forwarded even when a deny policy, the no_secrets /
  new_destination guards or a spend cap should have stopped it. MCP now
  runs the same checks as the webhook path; a rule that would ask for human
  approval blocks the call over MCP. Upgrade if you use action policies or
  spend caps with MCP clients.
• Calls held for approval stored the agent's raw API key in
  hitl_requests. They now store a prefix and SHA-256 only.
  Migration: run 051_hash_held_call_keys.sql.
• SSO discovery and the Slack approval callback now go through the SSRF
  guard: an org admin could otherwise point the server at an internal
  address.
• Security headers on every response (X-Frame-Options: DENY, nosniff,
  Referrer-Policy, HSTS in production).
• rustls 0.23.45 (RUSTSEC-2026-0285).

Fixed

• MCP audit rows recorded every agent as mcp-agent instead of the
  verified agent id.
• An internal error in the circuit-breaker, usage or spend-cap check left
  the call's dedup slot claimed, so an identical retry got 409 until the
  lease expired.

Image: ghcr.io/sumedhchatse/agentraas:0.9.1. Full history: CHANGELOG.md.