v0.4.0

Conduit v0.4.0: security suite, intent search, and 2 more clients

Conduit started as a way to cut your agent's token bill. This release makes it the security layer for your tools too, covering the whole tool-trust boundary (both tool definitions and tool results), plus search by meaning, opt-in agent control, and two more clients.

Security

• Tool-definition integrity (rug-pull + poisoning detection). Conduit fingerprints every tool when you connect a server and flags it if a previously-approved tool's definition later changes, or a known server quietly adds a tool (the "rug pull" signature). It also scans tool descriptions and schemas for injection-like content (tool poisoning / line jumping). Both surface as security notices in Activity. Detection only, never blocks, on by default, fully local.
• Content defense (anti-agentjacking). Scans untrusted tool results for injection and labels flagged content as "external data, not instructions" before the agent sees it. Information-preserving (the original text stays inside the marker), only flagged results are touched, never blocks. On by default.

Search and control

• Semantic tool search (optional). Blends embedding similarity into the lexical ranker so paraphrased needs surface the right tool, not just keyword matches. Off by default; point it at any OpenAI-compatible /v1/embeddings endpoint, with disk caching and automatic lexical fallback, so it can only add signal, never degrade.
• Controllable MCP (opt-in agent control). An Allow agent control switch lets an agent enable or disable servers through the gateway. Off by default, and the destructive-tool block stays user-only, so it can't escalate past your governance.

Clients and catalog

• Hermes (NousResearch Hermes Agent) is now supported, bringing Conduit to 20 clients.
• Firecrawl and OpenRouter (live model intelligence) added to the curated catalog.

Benchmark

• New graded server-sweep harness that grades answers for correctness, not just completion. Re-measured on a frontier model: up to ~91% fewer total tokens at the same task success.

Install

• macOS: signed and notarized (Apple Silicon and Intel .dmg).
• Linux: .deb and .AppImage.
• Windows: .exe installer. Not yet code-signed, so SmartScreen may show "Windows protected your PC". Click More info, then Run anyway. (Code signing ships in the next release.)

Existing installs (v0.3.3+) auto-update.

---

What's Changed

• Add Firecrawl MCP server to curated catalog by @BharadwajKanneveti in #19
• feat(clients): add Hermes client support (YAML mcp_servers format) by @bradhallett in #20

New Contributors

• @bradhallett made their first contribution in #20

Full Changelog: v0.3.19...v0.4.0