GSH v1.2.0 — Real MCP Proxy Adapter for Hunt-005

What's in this release

• A real MCP JSON-RPC stdio proxy (adapters/mcp_proxy.py, scripts/gsh-mcp-proxy.py). Configure your MCP host to launch this in place of the real server; it spawns the real server as a child process and intercepts actual traffic between the two:
  • Approval-time schema hashing (SHA-256(name||description||schema) per tool) and definition-drift detection against a saved snapshot — catches post-approval tool rug pulls.
  • Semantic scan on every tool description, on every connection including the first, for instruction-bearing language, invisible/zero-width Unicode content, and cross-tool references.
  • Per-call enforcement: blocks calls to tools outside the last-validated definition set, and inspects call arguments for credential patterns, path traversal, and suspicious encoded payloads (reused from Hunt-004).
  • Real blocking: a BLOCK verdict returns a JSON-RPC error to the host instead of forwarding the call; a quarantined server has its tools/list response rewritten to empty rather than silently hanging the connection.
• gsh-probe-eval.py --mode mcp-snapshot — the command the Hunt-005 playbook has documented since v1.1.0 now actually exists, sharing the same hashing logic as the live proxy.
• hunt_005 section added to configs/sentinel-policy-default.yaml — this was missing even though Hunt-005 shipped in v1.1.0.
• 13 tests in tests/test_mcp_proxy.py, including a subprocess-driven integration test that drives the real CLI over stdio exactly as an MCP host would (not just unit tests against library functions).

Verified, not just written

Building this surfaced and fixed two real bugs before release: the semantic-poisoning scan was silently skipped on a server's first connection (a poisoned tool could "become the trusted baseline"), and shlex.split() in POSIX mode was mangling Windows file paths passed via --server-cmd. Both are covered by regression tests now.

Known limitations (read before deploying)

• Only the MCP stdio transport is supported. Streamable HTTP/SSE MCP servers are not handled yet.
• Canary/response-asymmetry comparison is not implemented — the proxy only sees one identity's view of a server, so it can't yet detect a server serving different tool definitions to different callers.
• Tool return values are not scanned — only tool definitions and invocations are inspected; adversarial content in a tool's response is out of scope for this release.
• Splunk/Elastic SIEM output is not implemented yet (tracked in open issues #5 and #7); the proxy's alert emitter falls back to local JSONL file output with a warning until those land.
• Hunt-001 through Hunt-004 (gsh-sentinel-deploy.py) are unchanged in this release and still run on synthetic telemetry by default (see README.md Current Status).

Full Changelog

v1.1.0...v1.2.0