Skip to content

mcp-check v0.4.0

Choose a tag to compare

View all tags
@vigneshakaviki vigneshakaviki released this 10 Jul 21:47
v0.4.0
2523542

Regression and official-guidance hardening release.

Highlights:

  • Adds MCP011 for local HTTP transport hardening and wildcard network binds
  • Reclassifies localhost MCP transport URLs as transport-hardening findings instead of SSRF
  • Detects OAuth tokens/client secrets in URL query strings
  • Detects OAuth metadata that does not advertise PKCE S256 support
  • Filters placeholder URLs out of capability summaries
  • Adds regression examples for local HTTP transport, wildcard binds, and OAuth token query strings

Validation:

  • 13 tests passing
  • All shipped examples and fixtures scanned
  • Public GitHub sample configs rescanned
  • Package build succeeds
  • GitHub workflow/action YAML validation succeeds
Assets 2
Loading