Skip to content

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 14d MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agent ai matlab mcp model-context-protocol python

Affected surfaces

auth rbac

Summary

AI summary

Updates Bug Fixes, New Features, and Other Changes across a mixed release.

Changes in this release

Feature Medium

Add CI version-drift guard and clean-venv offline smoke test.

Add CI version-drift guard and clean-venv offline smoke test.

Source: llm_adapter@2026-07-13

Confidence: high

Feature Medium

Emit structured output and ToolResult(is_error=True) on MATLAB errors.

Emit structured output and ToolResult(is_error=True) on MATLAB errors.

Source: llm_adapter@2026-07-13

Confidence: high

Feature Medium

Add ExecuteResult/CheckResult schema‑additive models.

Add ExecuteResult/CheckResult schema‑additive models.

Source: llm_adapter@2026-07-13

Confidence: high

Feature Medium

Register TimingMiddleware in create_server behind monitoring flag.

Register TimingMiddleware in create_server behind monitoring flag.

Source: llm_adapter@2026-07-13

Confidence: high

Feature Medium

Add TimingMiddleware for per‑tool‑call metrics.

Add TimingMiddleware for per‑tool‑call metrics.

Source: llm_adapter@2026-07-13

Confidence: high

Feature Medium

Rewrite docker-compose to network‑license mathworks/matlab story.

Rewrite docker-compose to network‑license mathworks/matlab story.

Source: llm_adapter@2026-07-13

Confidence: low

Feature Medium

Rewrite Dockerfile to honest mathworks/matlab + network license.

Rewrite Dockerfile to honest mathworks/matlab + network license.

Source: llm_adapter@2026-07-13

Confidence: low

Feature Medium

Generate and commit pixi.lock manifest.

Generate and commit pixi.lock manifest.

Source: llm_adapter@2026-07-13

Confidence: low

Feature Medium

Add pixi.toml workspace manifest with matlabengine deliberately absent.

Add pixi.toml workspace manifest with matlabengine deliberately absent.

Source: llm_adapter@2026-07-13

Confidence: low

Dependency Low

Add plotly as a runtime dependency.

Add plotly as a runtime dependency.

Source: llm_adapter@2026-07-13

Confidence: high

Full changelog

v2.1.0

81 changes since the previous release.

New Features

  • re-add plotly package as a runtime dependency (maintainer request)
  • add pixi engine-free job, gate docker build behind license flag, re-home publish smoke onto pip
  • add CI version-drift guard and clean-venv offline smoke test
  • rebuild vendor/ wheelhouse to the fastmcp 3.4.4 closure
  • fix update_vendor.bat and regenerate requirements-lock.txt to fastmcp 3.4.4 closure
  • rewrite docker-compose to network-license mathworks/matlab story
  • rewrite Dockerfile to honest mathworks/matlab + network license
  • emit structured output + ToolResult(is_error=True) on MATLAB errors
  • add ExecuteResult/CheckResult schema-additive models
  • generate and commit pixi.lock
  • add pixi.toml workspace manifest with matlabengine deliberately absent
  • delegate MATLAB engine install to shared script
  • register TimingMiddleware in create_server behind monitoring flag
  • add TimingMiddleware for per-tool-call metrics
  • bump fastmcp to 3.4.4 and drop unused plotly runtime dep
  • implement scripts/install_matlab_engine.py — GREEN
  • add scale-down tests, replace sleep races, strengthen assertions
  • convert asyncio.run tests to async def, consolidate mock_pool fixture
  • fix server.py deprecations, session errors, CORS wiring, double-timeout docs
  • fix config model — dead attrs, YAML errors, CORS origins, inspect_mode
  • background task tracking, executor workspace API, shutdown
  • add job state transition guards and TOCTOU-safe session creation
  • add workspace API and _needs_replacement flag to MatlabEngineWrapper
  • wire security validator into JobExecutor in server.py
  • add security parameter to JobExecutor and centralize check_code

Bug Fixes

  • lean sdist + changelog that never hard-fails
  • clear pre-existing ruff F401/F841 in test files
  • add pip to pixi env so pixi run install-engine works
  • stop generic CI building the licensed image for the trivial client (#2)
  • map MATLAB_RELEASE to matching matlabengine pin in Dockerfile (#3)
  • export detected MATLAB_RELEASE to the engine script (#4)
  • let offline install bypass whitelist; catch pip failures in main (#5, #6)
  • match 6-char MATLAB release dirs in install glob (#1)
  • drop blanket --trusted-host, echo resolved dirs, reconcile banner
  • close verification gaps — replace last asyncio.sleep, mark plans complete
  • update _make_mock_pool references to conftest make_mock_pool after merge
  • fix engine release leak, start timeout, acquire race, and status count
  • session ID sanitization against path traversal
  • expand blocklist, fix empty-token auth, add security-disable warning
  • deduplicate route handlers, fix error count, prime cpu_percent
  • add SQL LIMIT, clamp query params, fix path traversal

Documentation

  • rework all wiki pages from the current codebase
  • record phase executed, verification deferred to user's Win10/MATLAB env
  • phase context, research, validation, verification (human_needed) + plan progress
  • add plan summary for CI drift guard + offline smoke + pixi + license-gated docker
  • add plan summary for conda deprecation + wiki reconciliation
  • reconcile wiki Installation.md to R2022b+ and pixi-first
  • deprecate conda env files toward pixi
  • complete vendor rebuild + update_vendor.bat fix plan summary
  • complete Docker rewrite to honest mathworks/matlab plan
  • complete structured output for execute_code/check_code plan
  • complete pixi manifest/lock/README plan summary
  • add pixi quickstart and streamablehttp/sse transport guidance
  • complete install.bat delegation plan summary
  • complete TimingMiddleware for per-tool-call metrics plan
  • complete FastMCP 3.4.4 bump + plotly cleanup plan
  • reconcile FastMCP version string in CLAUDE.md to 3.4.4
  • complete MATLAB engine install script plan
  • create phase plan — 10 plans in 3 waves (pixi/docker/fastmcp 3.4.4)
  • mark phase complete — 7/7 plans, 39 issues resolved
  • complete test quality improvements plan summary and state update
  • add self-check result to SUMMARY
  • complete server and config cleanup plan summary and state update
  • complete job/session state machine fixes plan
  • complete pool resource safety plan summary and state update
  • complete centralize-security-in-executor plan
  • complete security hardening plan summary and state update
  • complete monitoring subsystem security and accuracy fixes plan
  • create phase plan — 7 plans across 4 waves for 39 codebase review issues
  • add validation strategy and update roadmap for phase 7
  • research phase 7 fix all HIGH and MEDIUM codebase review issues
  • auto-generated context (infrastructure phase)

CI/CD

  • remove AI wiki-gen workflow (docs.yml)
  • exercise the real MATLAB release-detection path (no license needed)

Other Changes

  • add failing tests for MATLAB engine install script
  • Merge pull request #7 from HanSur94/claude/fix-release-pipeline
  • Merge pull request #6 from HanSur94/claude/release-2.1.0
  • bump version to 2.1.0
  • Merge pull request #5 from HanSur94/claude/rework-wiki
  • Merge pull request #4 from HanSur94/claude/win10-install-lean-3d6b8f
  • Create SECURITY.md

Security Fixes

  • Session ID sanitization against path traversal
  • Expands blocklist, fixes empty‑token auth, adds security‑disable warning

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track HanSur94/matlab-mcp-server-python

Get notified when new releases ship.

Sign up free

About HanSur94/matlab-mcp-server-python

Connect AI agents to MATLAB — execute code, run async jobs with progress reporting, get interactive Plotly plots, expose custom .m functions as tools, and monitor via live dashboard.

All releases →

Beta — feedback welcome: [email protected]