mcp-toolbox

v1.4.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

agent agents ai bigquery clickhouse cockroachdb

+14 more

database elasticsearch firestore genai llm mcp mongodb mysql oracle postgresql redis server spanner tidb

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 1mo

Version v1.4.0 of mcp‑toolbox adds Windows/ARM64 binaries and several new integrations, while introducing critical security hardening for query tools.

Why it matters: Security fixes (severity 80) block bypasses and injection attacks in BigQuery, ClickHouse, and Looker query handling; adopt the release to eliminate these vulnerabilities.

Summary

AI summary

Updates Bug Fixes, 1.4.0, and 2026-06-04 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	High	Prevents `allowedDatasets` bypass in BigQuery forecast query tool Prevents `allowedDatasets` bypass in BigQuery forecast query tool Source: llm_adapter@2026-06-04 Confidence: high	—
Security	High	Validates identifier parameters in Clickhouse and BigQuery tools to prevent injection Validates identifier parameters in Clickhouse and BigQuery tools to prevent injection Source: llm_adapter@2026-06-04 Confidence: high	—
Security	High	Escapes filter values for unquoted parameters in Looker tool to prevent injection Escapes filter values for unquoted parameters in Looker tool to prevent injection Source: llm_adapter@2026-06-04 Confidence: high	—
Feature
Feature	Medium	Adds windows/arm64 binary distribution support Adds windows/arm64 binary distribution support Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Adds Data Lineage integration Adds Data Lineage integration Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Adds `--ignore-unknown-tools` flag to server startup Adds `--ignore-unknown-tools` flag to server startup Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Adds remaining vector assist tools for Cloud SQL Postgres Adds remaining vector assist tools for Cloud SQL Postgres Source: llm_adapter@2026-06-04 Confidence: high	—
Feature	Medium	Adds `search_catalog` tool for Spanner Search Catalog integration Adds `search_catalog` tool for Spanner Search Catalog integration Source: llm_adapter@2026-06-04 Confidence: high	—
Bugfix
Bugfix	Medium	Enforces issuer presence in opaque token validation for generic auth Enforces issuer presence in opaque token validation for generic auth Source: llm_adapter@2026-06-04 Confidence: low	—
Bugfix	Medium	Separates Google and Generic MCP OAuth verification logic Separates Google and Generic MCP OAuth verification logic Source: llm_adapter@2026-06-04 Confidence: low	—
Bugfix	Low	Supports annotations and metadata within Tools for earlier MCP schemas Supports annotations and metadata within Tools for earlier MCP schemas Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Removes trailing semicolons from prebuilt Oracle tools Removes trailing semicolons from prebuilt Oracle tools Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Centralizes tool scopes validation in server/auth Centralizes tool scopes validation in server/auth Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Returns null id for batch request rejection in server Returns null id for batch request rejection in server Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Limits search results to pageSize in source/dataplex Limits search results to pageSize in source/dataplex Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Allows GCP project override in telemetry Allows GCP project override in telemetry Source: granite4.1:30b@2026-06-05-audit Confidence: low	—
Bugfix	Low	Handles ignored ProcessParameters error in Clickhouse tool Handles ignored ProcessParameters error in Clickhouse tool Source: granite4.1:30b@2026-06-05-audit Confidence: low	—

Full changelog

1.4.0 (2026-06-04)

Features

ci: Add support for windows/arm64 binary distribution (#3231) (10abf3b)
datalineage: Add Data Lineage integration (#3285) (19353c3)
server: Ignore unknown tools at startup with --ignore-unknown-tools flag (#3353) (5f0304f)
tools/cloudsqlpg: Add remaining vector assist tools for Cloud SQL Postgres (#3203) (b514cbd)
tools/spanner-search-catalog: Implement search_catalog tool (#3140) (defc086)

Bug Fixes

auth/generic: Enforce issuer presence in opaque token validation (#3360) (1d8df0d)
auth: Separate Google and Generic MCP OAuth verification (#3341) (dfd66ee)
mcp: Support annotations and metadata within Tools to earlier MCP schemas (#3300) (9a88c72)
oracle: Remove trailing semicolons from prebuilt tools (#3215) (fcad02d)
server/auth: Centralize tool scopes validation (#3335) (adce4ab)
server: Return null id for batch request rejection (#3333) (0b18d58)
source/dataplex: Limit search results to pageSize (#3323) (905c1f6), closes #3308
telemetry: Allow GCP project override (#2960) (3c83ba5)
tool/bigquery: Prevent allowedDatasets bypass in forecast query (#3324) (45df461)
tool/clickhouse: Handle ignored ProcessParameters error (#3340) (ddfd887)
tools/clickhouse,tools/bigquery: Validate identifier parameters to prevent injection (#3219) (2f45f75)
tools/looker: Escape filter values for unquoted parameters (#3289) (1711156)

| OS/Architecture | Description | SHA256 Hash |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------- |
| linux/amd64 | For Linux systems running on Intel/AMD 64-bit processors. | 85bfe54db164ed835a6c9d7e4036dd6ad1a417542367385a4c3809ff29b62304 |
| darwin/arm64 | For macOS systems running on Apple Silicon (M1, M2, M3, etc.) processors. | a3dc09bfe029851950cd4a3174f67bf4e25dc711e489f2c7144013ba2c59f7d7 |
| darwin/amd64 | For macOS systems running on Intel processors. | 19d09077202b0a9d9bf87edac2f97c4923a4f2d90ac6f22d099967e5aa416789 |
| windows/amd64 | For Windows systems running on Intel/AMD 64-bit processors. | 4be0bd4bca26af0163a1de38738be4c358dae2a2696bddd9344c900d9cd62cf6 |
| windows/arm64 | For Windows systems running on ARM 64-bit processors. | 5ce6a6b8335650c3dfdca86eee52867ebce7045fafef55142c60689131ca37ae |

Security Fixes

tool/bigquery: Prevent `allowedDatasets` bypass in forecast query
tools/clickhouse,tools/bigquery: Validate identifier parameters to prevent injection
tools/looker: Escape filter values for unquoted parameters

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track mcp-toolbox

Get notified when new releases ship.

About mcp-toolbox

MCP Toolbox for Databases is an open source MCP server for databases.

All releases →