Skip to content

v0.0.9

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Apr 22:38
· 3 commits to main since this release
v0.0.9
f810e4a

Highlights

This release hardens VoidMCP's security posture, sharpens the search-first discovery flow, and cleans up the LLM-facing surface based on external reviews (Gemini, Codex) plus internal audits.

Security

  • Persisted bearer token is now encrypted at rest with AES-256-GCM (per-setting AAD)
  • --token and VOIDMCP_TOKEN enforce a 32-character minimum
  • New VOIDMCP_TOKEN env var avoids exposing the token via /proc/cmdline
  • add_mcp no longer accepts auth_token / auth_header — authenticated and stdio servers are CLI-only to keep credentials out of the LLM context and block prompt-injection exfiltration
  • HTTP 401 / 403 responses from upstream MCPs surface a clear CLI workaround to the model

Search & discovery

  • Search limit raised to 50 with an explicit truncation indicator
  • Server names are now matched alongside tool names; empty query or "*" browses everything
  • Inferred output schemas are loaded into search results so TypeScript return types reflect the real response shape (not Promise<any>)
  • Server and tool names that are not valid JS identifiers (hyphens, etc.) are rendered with bracket notation — tools["my-server"]["do-thing"](...) — matching the runtime proxy

LLM ergonomics

  • list_mcps returns each server's tool-name array (the description already promised this)
  • execute_code returns structured JSON (result, logs, tool_calls) instead of free-form text
  • Tool descriptions reworked to make the search-first workflow obvious

Transport

  • HTTP transport automatically re-initializes once on ErrSessionExpired instead of failing the call

Install

go install github.com/voidmind-io/voidmcp/cmd/voidmcp@v0.0.9

Or grab a binary from the assets below.

Full Changelog: v0.0.8...v0.0.9

Assets 8
Loading