This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
Affected surfaces
Summary
AI summaryUpdates Bug Fixes, New Features, and Other Changes across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Add CI version-drift guard and clean-venv offline smoke test. Add CI version-drift guard and clean-venv offline smoke test. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Medium |
Emit structured output and ToolResult(is_error=True) on MATLAB errors. Emit structured output and ToolResult(is_error=True) on MATLAB errors. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Medium |
Add ExecuteResult/CheckResult schema‑additive models. Add ExecuteResult/CheckResult schema‑additive models. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Medium |
Register TimingMiddleware in create_server behind monitoring flag. Register TimingMiddleware in create_server behind monitoring flag. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Medium |
Add TimingMiddleware for per‑tool‑call metrics. Add TimingMiddleware for per‑tool‑call metrics. Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Medium |
Rewrite docker-compose to network‑license mathworks/matlab story. Rewrite docker-compose to network‑license mathworks/matlab story. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Feature | Medium |
Rewrite Dockerfile to honest mathworks/matlab + network license. Rewrite Dockerfile to honest mathworks/matlab + network license. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Feature | Medium |
Generate and commit pixi.lock manifest. Generate and commit pixi.lock manifest. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Feature | Medium |
Add pixi.toml workspace manifest with matlabengine deliberately absent. Add pixi.toml workspace manifest with matlabengine deliberately absent. Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Dependency | Low |
Add plotly as a runtime dependency. Add plotly as a runtime dependency. Source: llm_adapter@2026-07-13 Confidence: high |
— |
Full changelog
v2.1.0
81 changes since the previous release.
New Features
- re-add plotly package as a runtime dependency (maintainer request)
- add pixi engine-free job, gate docker build behind license flag, re-home publish smoke onto pip
- add CI version-drift guard and clean-venv offline smoke test
- rebuild vendor/ wheelhouse to the fastmcp 3.4.4 closure
- fix update_vendor.bat and regenerate requirements-lock.txt to fastmcp 3.4.4 closure
- rewrite docker-compose to network-license mathworks/matlab story
- rewrite Dockerfile to honest mathworks/matlab + network license
- emit structured output + ToolResult(is_error=True) on MATLAB errors
- add ExecuteResult/CheckResult schema-additive models
- generate and commit pixi.lock
- add pixi.toml workspace manifest with matlabengine deliberately absent
- delegate MATLAB engine install to shared script
- register TimingMiddleware in create_server behind monitoring flag
- add TimingMiddleware for per-tool-call metrics
- bump fastmcp to 3.4.4 and drop unused plotly runtime dep
- implement scripts/install_matlab_engine.py — GREEN
- add scale-down tests, replace sleep races, strengthen assertions
- convert asyncio.run tests to async def, consolidate mock_pool fixture
- fix server.py deprecations, session errors, CORS wiring, double-timeout docs
- fix config model — dead attrs, YAML errors, CORS origins, inspect_mode
- background task tracking, executor workspace API, shutdown
- add job state transition guards and TOCTOU-safe session creation
- add workspace API and _needs_replacement flag to MatlabEngineWrapper
- wire security validator into JobExecutor in server.py
- add security parameter to JobExecutor and centralize check_code
Bug Fixes
- lean sdist + changelog that never hard-fails
- clear pre-existing ruff F401/F841 in test files
- add pip to pixi env so
pixi run install-engineworks - stop generic CI building the licensed image for the trivial client (#2)
- map MATLAB_RELEASE to matching matlabengine pin in Dockerfile (#3)
- export detected MATLAB_RELEASE to the engine script (#4)
- let offline install bypass whitelist; catch pip failures in main (#5, #6)
- match 6-char MATLAB release dirs in install glob (#1)
- drop blanket --trusted-host, echo resolved dirs, reconcile banner
- close verification gaps — replace last asyncio.sleep, mark plans complete
- update _make_mock_pool references to conftest make_mock_pool after merge
- fix engine release leak, start timeout, acquire race, and status count
- session ID sanitization against path traversal
- expand blocklist, fix empty-token auth, add security-disable warning
- deduplicate route handlers, fix error count, prime cpu_percent
- add SQL LIMIT, clamp query params, fix path traversal
Documentation
- rework all wiki pages from the current codebase
- record phase executed, verification deferred to user's Win10/MATLAB env
- phase context, research, validation, verification (human_needed) + plan progress
- add plan summary for CI drift guard + offline smoke + pixi + license-gated docker
- add plan summary for conda deprecation + wiki reconciliation
- reconcile wiki Installation.md to R2022b+ and pixi-first
- deprecate conda env files toward pixi
- complete vendor rebuild + update_vendor.bat fix plan summary
- complete Docker rewrite to honest mathworks/matlab plan
- complete structured output for execute_code/check_code plan
- complete pixi manifest/lock/README plan summary
- add pixi quickstart and streamablehttp/sse transport guidance
- complete install.bat delegation plan summary
- complete TimingMiddleware for per-tool-call metrics plan
- complete FastMCP 3.4.4 bump + plotly cleanup plan
- reconcile FastMCP version string in CLAUDE.md to 3.4.4
- complete MATLAB engine install script plan
- create phase plan — 10 plans in 3 waves (pixi/docker/fastmcp 3.4.4)
- mark phase complete — 7/7 plans, 39 issues resolved
- complete test quality improvements plan summary and state update
- add self-check result to SUMMARY
- complete server and config cleanup plan summary and state update
- complete job/session state machine fixes plan
- complete pool resource safety plan summary and state update
- complete centralize-security-in-executor plan
- complete security hardening plan summary and state update
- complete monitoring subsystem security and accuracy fixes plan
- create phase plan — 7 plans across 4 waves for 39 codebase review issues
- add validation strategy and update roadmap for phase 7
- research phase 7 fix all HIGH and MEDIUM codebase review issues
- auto-generated context (infrastructure phase)
CI/CD
- remove AI wiki-gen workflow (docs.yml)
- exercise the real MATLAB release-detection path (no license needed)
Other Changes
- add failing tests for MATLAB engine install script
- Merge pull request #7 from HanSur94/claude/fix-release-pipeline
- Merge pull request #6 from HanSur94/claude/release-2.1.0
- bump version to 2.1.0
- Merge pull request #5 from HanSur94/claude/rework-wiki
- Merge pull request #4 from HanSur94/claude/win10-install-lean-3d6b8f
- Create SECURITY.md
Security Fixes
- Session ID sanitization against path traversal
- Expands blocklist, fixes empty‑token auth, adds security‑disable warning
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About HanSur94/matlab-mcp-server-python
Connect AI agents to MATLAB — execute code, run async jobs with progress reporting, get interactive Plotly plots, expose custom .m functions as tools, and monitor via live dashboard.
Related context
Beta — feedback welcome: [email protected]