v0.67.61

Patch release r437: fix bidi-character false positive downgrade in legitimate pure-data JSON (140-repo corpus verified). Published as mcp-agentgate@0.67.61 / mcp-agentgate-core@0.67.61; clean-environment npx verified.

v0.67.60

Manual release during the GitHub Actions outage (published from main@e0e7e23 per releasing SOP; full local build/test/lint/typecheck green, clean-env npx verification passed).

mcp-agentgate / mcp-agentgate-core 0.67.60 (patch)

• AG-RC-001: mask curl|sh text inside print/log-helper message strings in shell scripts (info "curl … | sh", …_warn_or_fail, multi-line fail "…" messages with command substitutions) — the helper displays its argument, it does not execute it. Findings now attribute to the first genuinely live pipeline; run 'curl … | bash' wrapper idioms and real pipelines stay critical. (#649)
• Advisory MCPA-2026-0096: mcp-grafana X-Grafana-URL header SSRF (CVE-2026-19516, critical) — fixed upstream in 1.1.0. Bundled database grows to 110 advisories. (#651)

v0.67.59

AG-SS-001 grades comment-only cloud-metadata mentions from the first non-comment occurrence: guard modules whose only mention is explanatory comment prose now report low, while a live metadata fetch below a leading comment still reports high (#644).

Manual release during the GitHub Actions outage: published from main@1a50418 with local build+test green and clean-environment npx verification.

v0.67.58

mcp-agentgate / mcp-agentgate-core 0.67.58

Patch release (manually published during the GitHub Actions outage; local build/test/lint/typecheck green + GitGuardian green).

• AG-RC-001: GoReleaser configs (.goreleaser.yaml et al.) are now exempt from source scanning — release-pipeline build automation whose release-notes templates carry install one-liners, same rationale as the existing CI pipeline-config exemption (#640).

mcp-agentgate-config-convert remains 0.14.0.

v0.67.57

mcp-agentgate / mcp-agentgate-core 0.67.57

Patch release consuming the ROUND-421 changeset (#632, versioned by #633):

• AG-TP-001: hidden bidi/invisible characters embedded in defensive detection patterns — a regex character class listing the bidi range (re.compile(r"[\u202a-\u202e…]"), YAML patterns: entries) or a quoted rule-test fixture payload, with hidden-unicode attack prose in the surrounding window or detection-rule filename — are now reported low instead of high. Hidden characters in ordinary source lines stay high.

Published manually per SOP during the ongoing GitHub Actions outage (degraded gate: GitGuardian + local build/test/lint/typecheck green, disclosed on the PRs).

v0.67.56

mcp-agentgate / mcp-agentgate-core 0.67.56

Patch Changes

• The "sidenote" poisoning marker now requires a directing verb ("pass/include/send … as/in a sidenote"), so typographic prose about sidenote page elements no longer reports AG-SK-001/AG-TP-001 findings. conversation_history detection is unchanged. (#629)

Published manually per SOP during the ongoing GitHub Actions outage (ordinary CI/release workflows did not run; degraded gate: GitGuardian + local build/test/lint/typecheck green).

v0.67.55

mcp-agentgate 0.67.55 / mcp-agentgate-core 0.67.55 (patch)

• AG-SS-001 recognizes URL-validator modules and underscore-bounded SSRF identifiers as defensive context (#622, round 413)
• AG-SS-001 recognizes boolean host-classifier predicates (equality comparisons on metadata literals with a nearby boolean return and no fetch on the line) as defensive context (#624, round 415)

Published manually per SOP during the GitHub Actions outage (local build/test green; clean-env npx verification passed).

v0.67.54

mcp-agentgate / mcp-agentgate-core 0.67.54

Patch Changes

• AG-SS-001 defensive-context recognition covers two more real shapes: noun-first module headers ("SSRF Protection page — … IP blocking") and lowercase camelCase block identifiers (blockCases, blockList variants). Defensive SSRF-guard pages and blocklist test harnesses that reference the metadata IP now grade low instead of high; exploitation scripts with no defensive wording keep grading high. (#616)

mcp-agentgate-config-convert unchanged at 0.14.0.

Note: published manually per SOP while GitHub Actions is not triggering (account-level issue under investigation); local build/test/lint/typecheck were green at 08ca8e6.

v0.67.53

Patch Changes

• ccabdbd: AG-SK-001 fence tracking follows CommonMark closing-fence rules: a closing fence must use the same character, be at least the opener's length, and carry no info string. Shorter inner runs (or ones carrying a language tag) inside a longer fence no longer end the block, so quoted injection examples nested in ~~~~-fenced untrusted-text blocks stay graded low instead of escalating to critical.
• Updated dependencies [ccabdbd]
  • mcp-agentgate-core@0.67.53

Published packages: mcp-agentgate@0.67.53, mcp-agentgate-core@0.67.53 (config-convert stays 0.14.0).

v0.67.52

mcp-agentgate / mcp-agentgate-core 0.67.52

Patch Changes

• AG-TP-001 grades trojan-grade hidden Unicode characters low when they sit on a comment line whose surrounding prose discusses hidden-unicode attacks (bidi/RLO/homoglyph documentation in security tooling). Comment lines without attack prose, and code lines anywhere in the file, stay high — the scanner now surfaces the first non-defensive hit instead of stopping at the first hit. (#608)

npm: https://www.npmjs.com/package/mcp-agentgate/v/0.67.52