Release Toolport v1.2.0 · tsouth89/toolport

A large security-hardening pass on the gateway, plus several features requested on the r/LocalLLaMA launch thread.

Highlights

Concurrent HTTP gateway. Each request runs on its own worker, so a slow downstream server or a tool call held for human approval no longer blocks other requests, live setting toggles, or config reloads.
Pi coding agent is now a supported client — one-click detect, import, and gateway install, same flow as Cursor and the rest.
Pin a tool as a lazy-discovery prerequisite. A load-bearing tool (auth, list-before-act, or one whose description doesn't match the model's keywords) is always surfaced with its full schema, never hidden behind discovery.
Tool identities (capability provenance). A new Activity panel shows what each model-visible tool name actually maps to: its source server, the profiles that enable it, the fingerprint drift detection checks against, and when it was first seen / last changed.
Discovery panel. See exactly what lazy discovery searched and the tool-definition tokens it saved that turn versus loading the whole catalog. Because Toolport is in the request path, those figures are measured, not estimated.
Teams can require human approval org-wide — a tighten-only policy that forces gated tool calls to be held for a person across every member's gateway.

Closed several code-execution bypasses in the stdio spawn guard (wrapper programs, Deno/Bun remote exec, unlisted interpreters, a node preload, and code-injecting env vars). Normal launchers like npx/node/python/docker are unaffected.
Agent-control enable/disable now respects each client's scope, its "no match" error no longer lists other tenants' servers, and every toggle is audited with proof of the scope decision.
fetch_result is now scoped to the client that produced the result, so result cursors can't be probed across clients.
A malformed fetch_result can no longer crash the gateway, and the stdio transport now catches handler panics (defense-in-depth for the local transport).
HTTP/OpenAPI clients are now scoped on resources and prompts too, not just tool calls.
Closed three tool-supply-chain detection gaps (outputSchema poison-scan, structuredContent injection flagged, corrupt quarantine no longer fails open).
The approval / confirm gate now fails closed on an unresolved tool, and the injection scan is bounded to 512 KB per result so a hostile server can't pin CPU.
Registry durability + auth hardening: fsync before the atomic rename, empty Bearer rejected, constant-time per-client token check.

Clearer client list and import view: connection state is the signal (import backlog moved to a badge), "Move config in" is the emphasized cutover action, and a note warns when importing into an already-connected client would load its tools twice.

macOS: monochrome menu-bar glyph (template image, tinted like every other menu-bar item), and the Dock icon now appears only while a window is open.
Approval prompt is keyboard- and screen-reader-accessible, and its countdown is now exact (counts to the broker's real fail-closed deadline).
Enable-all / Disable-all now respects the active search filter and can't be double-fired; the profile delete dialog names the profile.
Activity and the sidebar now report the same tokens-saved figure (one shared formatter), a failed health probe no longer shows a green "Refreshed", and large fetch_result paging no longer re-scans the whole body per page.

Full changelog: v1.1.0...v1.2.0