blockrunai/blockrun-mcp

v0.25.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 28d MCP Search & Web

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai claude-code llm mcp mcp-server x402

Summary

AI summary

Fixed malformed numeric environment variables causing unexpected behavior.

Full changelog

Hardening for the v0.25.0 opt-in image features (delta-audited, adversarially verified). Both findings low/quality, same root cause: bare Number(env || default) doesn't catch a malformed value.

fix(image) — a typo'd numeric env became NaN and silently changed behavior: BLOCKRUN_CONFIRM_THRESHOLD="$0.05" flipped the confirm gate to ask-on-every-call, and (fail-open) a malformed BLOCKRUN_INLINE_MAX_BYTES removed the inline base64 context cap (data.length > NaN is always false). confirm-spend now reuses the validated parseBudgetLimitEnv; inline-image uses a validating envInt (falls back on non-finite/non-positive, clamps quality 1–100). No change for valid configs.

84 unit tests. Full details in CHANGELOG.md.

Security Fixes

Prevented malformed numeric env vars (e.g., BLOCKRUN_CONFIRM_THRESHOLD, BLOCKRUN_INLINE_MAX_BYTES) from causing misbehavior; added validation and fallback handling.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track blockrunai/blockrun-mcp

Get notified when new releases ship.

About blockrunai/blockrun-mcp

Live data for AI agents — search, research, markets, crypto, X/Twitter. Pay-per-call via x402 micropayments.

All releases →