Skip to content

cameronrye/activitypub-mcp

v3.1.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Data & Storage
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

activitypub fedify fediverse mcp mcp-server webfinger

Affected surfaces

rce_ssrf deps

ReleasePort's take

Light signal
editorial:auto 1mo

v3.1.0 blocks full IPv6 private‑range SSRF attacks and adds Misskey/Foundkey read support, normalizing results to Mastodon shape.

Why it matters: Blocks high‑severity (90) IPv6 private‑range SSRF attacks; introduces new Misskey/Foundkey API integration with medium severity impact.

Summary

AI summary

Updates 3.1.0] - 2026-06-04, piped, and link-local across a mixed release.

Changes in this release

Security Critical

Blocks full IPv6 private-range SSRF attacks.

Blocks full IPv6 private-range SSRF attacks.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Feature Low

Adds Misskey / Foundkey read support for several endpoints, normalizing results to Mastodon shape.

Adds Misskey / Foundkey read support for several endpoints, normalizing results to Mastodon shape.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Medium

Corrects install command to use `npx -y activitypub-mcp`.

Corrects install command to use `npx -y activitypub-mcp`.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Low

Adds stderr hint when stdio server is waiting for a client.

Adds stderr hint when stdio server is waiting for a client.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Bugfix Low

Reconciles getting‑started docs with actual code, removing phantom env vars and settings.

Reconciles getting‑started docs with actual code, removing phantom env vars and settings.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Refactor Low

Enables automatic publishing of releases via reusable GitHub Actions workflows.

Enables automatic publishing of releases via reusable GitHub Actions workflows.

Source: llm_adapter@2026-06-04

Confidence: high

 —
Full changelog

[3.1.0] - 2026-06-04

Added

  • Misskey / Foundkey read support. search, get-trending-hashtags, get-trending-posts, and get-public-timeline now work on Misskey-family instances. Reads are routed per instance by NodeInfo software detection through a new read adapter and normalized into the same Mastodon-shaped results, so these tools no longer silently fail on platforms already supported for writes.
  • Authentication guide on the docs site covering the activitypub-mcp login (Mastodon OAuth2 / Misskey MiAuth) flow, credential storage, and multi-account usage.

Fixed

  • Install command on the site. The "Quick install" step shipped npx activitypub-mcp install, a subcommand the CLI does not dispatch — it silently started a stdio server that blocked on stdin. Corrected to npx -y activitypub-mcp.
  • Interactive runs no longer look hung. Starting the stdio server directly in a terminal now prints a one-line stderr hint that it is waiting for an MCP client; the hint never appears for a connected (piped) client.
  • Getting-started docs reconciled with the code. Removed phantom env vars (ACTOR_/INSTANCE_/TIMELINE_CACHE_TTL, CONCURRENT_REQUESTS), a removed HEALTH_CHECK_EXTERNAL_PROBE setting, and non-existent npm scripts; corrected the REQUEST_TIMEOUT/CACHE_TTL defaults and a false CORS "renamed from" claim. A new drift test fails CI if a config page documents an env var the code never reads.

Security

  • Full IPv6 private-range SSRF blocking. The private-range checks used literal-prefix regexes that matched only the canonical address, leaving most of fc00::/7 (unique-local) and fe80::/10 (link-local) reachable — e.g. https://[fc12:3456::1]. Replaced with leading-hextet masks covering each block in full, plus deprecated site-local fec0::/10.
  • All GitHub Actions pinned to commit SHAs, so a retagged or compromised third-party action can no longer run in the credential-bearing release jobs.

Changed

  • Releases now publish automatically. release.yml and publish-mcp.yml are reusable workflows that auto-release calls inline after tagging, removing the manual workflow_dispatch step the GITHUB_TOKEN anti-recursion rule previously required.

Security Fixes

  • Full IPv6 private-range SSRF blocking now covers fc00::/7 (unique-local), fe80::/10 (link-local) and deprecated fec0::/10 via leading-hextet masks
  • All GitHub Actions pinned to commit SHAs to prevent compromised third‑party actions
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cameronrye/activitypub-mcp

Get notified when new releases ship.

Sign up free

About cameronrye/activitypub-mcp

A comprehensive MCP server that enables LLMs to explore and interact with the Fediverse through ActivityPub protocol. Features WebFinger discovery, timeline fetching, instance exploration, and cross-platform support for Mastodon, Pleroma, Misskey, and other ActivityPub servers.

All releases →

Related context

Earlier breaking changes

  • v2.1.0 `activitypub://instance-info/{domain}` `software` field now an object instead of a string.
  • v2.1.0 Removed `activitypub://post-thread/{postUrl}` URI form; use `{domain}/{statusId}` instead.
  • v2.0.0 'get-relationship' no longer accepts legacy `accountIds` array; requires single `acct` string.
  • v2.0.0 `MCP_HTTP_CORS_ORIGINS` no longer defaults to '*'; must be set explicitly.
  • v2.0.0 `scheduledId` renamed to `scheduledPostId` in scheduling tools.

Beta — feedback welcome: [email protected]