mcp-data-platform-v1.90.1

A maintenance release: a correctness fix for the knowledge review queue, a security hardening of the OIDC logout redirect, and CI/tooling improvements. No new features, no migrations, no config changes; upgrading from v1.90.0 is drop-in.

Bug Fixes

Knowledge review queue counts (#688)

On a memory-backed deployment, apply_knowledge action bulk_review (the default, counts-only response) reported by_category and by_confidence totals that spanned every active insight (pending, approved, and applied) while total_pending and the response note said the counts were pending-only. The itemize: true path was already correct, so the two modes of the same call disagreed.

The memory store maps pending, approved, and applied onto a single active status, so a pending-scoped stats query returned all three; the category and confidence tallies were not re-scoped to the requested status the way the PostgreSQL store scopes every group-by. This release scopes every tally (by_status, by_category, by_confidence) to the requested status, so:

• the default bulk_review counts now sum to total_pending and match the itemize path,
• the memory and PostgreSQL stores return the same numbers for the same query,
• the unfiltered portal "my insight stats" view is unchanged.

Security

OIDC logout open-redirect hardening

Hardened the post-logout redirect in the browser-session OIDC flow. When the identity provider advertises no end_session endpoint, the handler previously redirected to a URL derived from request headers (X-Forwarded-Host / Host), which a client could influence. The fallback now redirects to the configured PostLogoutRedirect, and the request-derived origin is used only on the end_session path, where the provider validates the redirect URI against the client's registered post-logout URIs.

Behavior change: on a deployment whose provider has no end_session endpoint, logout now returns the user to the configured PostLogoutRedirect (which defaults to PostLoginRedirect) rather than the request origin. Deployments whose provider has an end_session endpoint are unaffected.

Tooling and CI

• gosec bumped to v2.27.1 (from v2.22.0), pinned identically in the Makefile and CI so local make verify and CI stay in lockstep. The newer ruleset adds G120 and G710 detection; the new findings were each reviewed and resolved (the SQL sites use parameterized placeholders, the multipart parse is already bounded by http.MaxBytesReader, and the one genuine open redirect is the logout fix above).
• migrate-check readiness hardening. The real-Postgres migration gate now waits for Postgres over TCP rather than the container's unix socket, so it no longer races the image's init-phase temporary server (which previously caused an intermittent connection reset, most visibly when the amd64 image runs under emulation).
• Flaky test fix. connbackfill's insert-coverage test asserted a specific insert order, but the backfill iterates a map; the expectation is now order-independent, matching the sibling test.

Upgrade notes

Drop-in from v1.90.0. The only runtime behavior change is the OIDC logout fallback described under Security, and it affects only deployments whose identity provider exposes no end_session endpoint.

Installation

Homebrew (macOS)

brew install txn2/tap/mcp-data-platform

Claude Code CLI

claude mcp add mcp-data-platform -- mcp-data-platform

Docker

docker pull ghcr.io/txn2/mcp-data-platform:v1.90.1

Verification

All release artifacts are signed with Cosign. Verify with:

cosign verify-blob --bundle mcp-data-platform_1.90.1_linux_amd64.tar.gz.sigstore.json \
  mcp-data-platform_1.90.1_linux_amd64.tar.gz