Skip to content

v0.3.0 — MCP 2026-07-28, official conformance suite, security pass

Latest
Latest

Choose a tag to compare

View all tags
@wellknownmcp wellknownmcp released this 26 Oct 11:25
· 1 commit to main since this release
v0.3.0
87c04e5

Protocol

  • MCP 2026-07-28 (stateless) served on /mcp next to the initialize path, chosen per request: server/discover, no session, Mcp-Method / Mcp-Name validated against the body, -32022 / -32020 refusals, resultType + serverInfo + cache hints on results (private whenever the result depends on the caller).
  • 2025-11-25 negotiated by initialize, next to 2025-06-18 and 2025-03-26.
  • Official conformance suite in CI (@modelcontextprotocol/conformance), against the production build with real JWT verification: 22 of 32 server scenarios pass. The other 10 exercise optional capabilities the gateway does not declare, listed with the reason in scripts/conformance/baseline.yml.
  • tools/call relays MCP content blocks (image, audio, embedded resources) from backends that return a CallToolResult, and reports backend failures as tool execution errors (isError: true) the model can read.
  • tools/list is sorted by name.

Security — docs/security.md §6–§9

  • resources/read is checked against the scope of every template the URI matches. It used to be unchecked.
  • A backend may only declare scopes under its own prefix (mcp:<id>: by default) and claim its own URI schemes; prompts are prefixed <app>_<name> like tools.
  • The caller's token only reaches backends the caller holds a scope on (whoami and ticket fan-out used to reach all of them). Token forwarding and its replay surface are documented plainly; per-backend audiences (RFC 8693) are on the roadmap.
  • cortex://architecture and the server instructions name only the caller's backends, and no backend URL.
  • CORTEX_REQUIRED_POOL refuses tokens without the claim, on POST, GET and DELETE.
  • Dev bypass hardened (constant time, exact loopback, no implicit admin role); 503 when CORTEX_CANONICAL_URI is missing in production; X-Forwarded-For read only with CORTEX_TRUSTED_PROXY_HOPS; tickets bounded and rate-limited per identity; audit purge by header-only POST.
  • Next 15.5.28 (three unauthenticated RCE advisories fixed since 15.5.20) and patched transitive dependencies: npm audit reports 0.

Upgrading from 0.2.x

  • A backend whose scopes do not start with mcp:<id>: loses those tools until CORTEX_BACKEND_<ID>_SCOPE_PREFIXES is set.
  • Prompt names gain the backend prefix on the agent side; backends still receive their own name.
  • Behind a reverse proxy, set CORTEX_TRUSTED_PROXY_HOPS (1 behind a single nginx).
  • /api/cron/purge-audit: send CRON_SECRET in the x-cron-secret header of a POST; the query-string and GET forms are gone.

Image: ghcr.io/wellknownmcp/cortex-gateway:v0.3.0

Assets 2
Loading