Skip to content

v1.9.6

Latest
Latest

Choose a tag to compare

View all tags
@tsouth89 tsouth89 released this 27 Jul 01:40
v1.9.6
ffebe53

Toolport v1.9.6

Client ownership that stays put, Shared HTTP as a real connect option, code mode that can run real multi-step scripts, native resource subscriptions, and a pile of gateway hardening.

Highlights

Your client config is yours (unless you ask us to rewrite it)

A report from the community (#487) showed Toolport rewriting a hand-edited Claude Desktop toolport entry on every app launch. That is fixed end to end:

  • Launch re-point only touches real gateway binaries (versioned toolport-gateway* / legacy conduit-gateway*). Hand-edited commands like npx mcp-remote are left alone and logged. (#488)
  • Ownership is first-class: Managed / Customized / Absent. Integrations shows a custom-configuration badge and Reset to default (confirm before overwrite). Connect and migrate refuse to clobber a customized entry without an explicit force. (#489)
  • Shared HTTP on Connect. Point a client at the supervised HTTP bridge instead of spawning its own gateway: native url + bearer where the client supports it, or an opt-in npx mcp-remote form for stdio-only clients (Claude Desktop and friends). Tokens are vaulted; ownership records never store bearers. (#491)
  • Machine-wide TOOLPORT_HTTP / CONDUIT_HTTP no longer hijacks client-spawned stdio gateways. When stdin is a pipe, env forms are ignored (with a warning). Prefer --http for scripts and services. (#488)

Code mode grows up

  • Parallel / async tool calls in toolport_run_script: callAsync, Promise.all, bounded host parallelism. (#480)
  • Typed servers.* stubs so scripts can call scoped tools with real names. (#481)
  • Full intermediate results and fetchResult handoff so multi-step scripts stay useful. (#483)
  • Promise drains and edge-case hardening. (#482)
  • On by default, with Settings as the kill switch. Existing registries that already set "codeMode": false stay off. (#485)

Native MCP resources

  • Subscribe / unsubscribe and resources/updated fanout from downstream servers to clients (stdio + HTTP). (#476–#479)
  • Resource templates aggregated and completions forwarded. (#475)
  • Producer verification before fanout so a notification is not blindly broadcast. (#484)
  • Paginated catalogs preserved so large tool lists do not drop pages. (#474)

Gateway performance and correctness

  • Search efficiency and lower routed-call audit overhead. (#472, #473)
  • HTTP confirm and shaped-result stash keyed by stable client id. (#478)
  • Headless secrets.enc load-modify-save is locked against concurrent writers (same idea as registry locking). (#486)

UI and safety polish

  • Profile scope panel shows tool-fetch failures and ignores stale errors after a newer load; tool loading state is scoped per server. (#468)
  • Vendor auth hints match on domain-label boundaries only - spoofed hosts like clerk.evil.com no longer skip the live probe. (#417 / #492)

Thanks

Huge thanks to everyone who filed reports, reviewed, or sent patches this cycle:

If we missed you, open an issue or ping us - credit should follow the work.

Upgrade notes

  1. Install 1.9.6 and open Toolport once so launch migration / re-point can run.
  2. Restart each AI client so it reloads MCP config.
  3. Existing registries with "codeMode": false stay off code mode.
  4. Prefer toolport-gateway --http over a machine-wide TOOLPORT_HTTP for services.

Full changelog

See CHANGELOG.md and the related PRs: #468, #472–#486, #488, #489, #491, #492.

Assets 14
Loading