costajohnt/oss-autopilot

vmcp-v5.5.0 scope: mcp Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai-agent anthropic claude-code claude-code-plugin cli contribution-tracker

+6 more

developer-tools github github-automation issue-discovery pr-management typescript

Affected surfaces

rce_ssrf

ReleasePort's take

Light signal

editorial:auto 1mo

The MCP CLI now includes a guidelines list subcommand for easier reference. The agent has integrated an untrusted‑content fence to harden output handling.

Why it matters: Security severity 90 triggers mandatory review of agent output processing; developers gain direct access to guidelines via the new CLI command.

Summary

AI summary

Updates 5.5.0, Bug Fixes, and 2026-06-11 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Wire untrusted-content fence into agent‑facing output for security hardening Wire untrusted-content fence into agent‑facing output for security hardening Source: llm_adapter@2026-06-11 Confidence: high	—
Feature	Medium	Adds guidelines list subcommand to MCP tool Adds guidelines list subcommand to MCP tool Source: llm_adapter@2026-06-11 Confidence: high	—
Bugfix	Medium	Retries Gist initialization after transient failure instead of latching done Retries Gist initialization after transient failure instead of latching done Source: llm_adapter@2026-06-11 Confidence: high	—

Full changelog

5.5.0 (2026-06-11)

Features

guidelines: add guidelines list subcommand and MCP tool (#1400) (085e127), closes #1393
security: wire the untrusted-content fence into agent-facing output (#1396) (e1599a0), closes #1372

Bug Fixes

mcp: retry Gist init after transient failure instead of latching done (#1383) (924aff0), closes #1368

Security Fixes

Untrusted-content fence integrated to prevent exposure of untrusted data in agent‑facing output

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track costajohnt/oss-autopilot

Get notified when new releases ship.

About costajohnt/oss-autopilot

Open source contribution manager with PR tracking across repos, issue discovery, CI failure diagnosis, and maintainer response drafting. Available as CLI, MCP server, and Claude Code plugin.

All releases →