KryptosAI/mcp-observatory

v1.33.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 9d MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agent-security ai-agent ai-security ai-supply-chain cli code-scanning

+14 more

developer-tools github-action github-code-scanning mcp mcp-ci mcp-security mcp-server mcp-testing model-context-protocol regression-testing sarif schema-drift security supply-chain-security

Affected surfaces

auth

ReleasePort's take

Light signal

editorial:auto 9d

v1.33.0 introduces Ed25519 receipt signing and OIDC device authorization, enhancing security without adding dependencies.

Why it matters: Security engineers gain stronger authentication (Ed25519) and streamlined SSO flows; developers benefit from zero‑dependency integrations in affected surfaces.

Summary

AI summary

Adds Ed25519 receipt signing, multi‑CI templates, OIDC device auth flow, and demo command with remediation hints.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds Ed25519 receipt signing with zero new dependencies Adds Ed25519 receipt signing with zero new dependencies Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	Adds Multi-CI templates supporting GitLab CI, CircleCI, Bitbucket Pipelines, Azure DevOps with auto-detection Adds Multi-CI templates supporting GitLab CI, CircleCI, Bitbucket Pipelines, Azure DevOps with auto-detection Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	Adds SSO/OIDC auth with device authorization flow, token storage, and cloud login/logout/whoami commands Adds SSO/OIDC auth with device authorization flow, token storage, and cloud login/logout/whoami commands Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	Adds `mcp-observatory demo` command to scan servers and display safety grade Adds `mcp-observatory demo` command to scan servers and display safety grade Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	Adds remediation hints for scan/test failures providing fix instructions Adds remediation hints for scan/test failures providing fix instructions Source: llm_adapter@2026-07-18 Confidence: high	—
Dependency	Low	Resolves TypeScript 7 peer dependency conflict by downgrading to 5.8.0 Resolves TypeScript 7 peer dependency conflict by downgrading to 5.8.0 Source: llm_adapter@2026-07-18 Confidence: high	—
Dependency	Low	Removes `--legacy-peer-deps` flag from all CI workflows Removes `--legacy-peer-deps` flag from all CI workflows Source: llm_adapter@2026-07-18 Confidence: high	—
Bugfix	Low	Fixes 3 pre-existing test failures Fixes 3 pre-existing test failures Source: llm_adapter@2026-07-18 Confidence: high	—
Bugfix	Low	Resolves lint errors blocking release pipeline Resolves lint errors blocking release pipeline Source: llm_adapter@2026-07-18 Confidence: high	—

Full changelog

New Features

Ed25519 receipt signing — Cryptographic signing and verification for MCP receipts with zero new dependencies (Node.js built-in)
Multi-CI templates — GitLab CI, CircleCI, Bitbucket Pipelines, Azure DevOps support with auto-detection
SSO/OIDC auth — Device authorization flow, token storage, cloud login/logout/whoami commands
Demo command — mcp-observatory demo scans your servers and shows a safety grade in seconds
Remediation hints — Scan/test failures now tell you how to fix them (thanks @albatrossflyon-coder!)

Website

Safety Index SEO — 175 server detail pages with health scores, dimension breakdowns, and check results
Sitemap — Expanded from 1 to 177 URLs
SOC 2 compliance docs — 8 documents covering system description, access control, change management, risk assessment, incident response, data retention, vendor management, encryption policy

Fixes

TypeScript 7 peer dep conflict resolved (downgraded to 5.8.0)
3 pre-existing test failures fixed
--legacy-peer-deps removed from all CI workflows
Lint errors blocking release pipeline resolved

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track KryptosAI/mcp-observatory

Get notified when new releases ship.

About KryptosAI/mcp-observatory

Regression testing for MCP servers. Auto-discovers servers from Claude configs, checks capabilities, invokes tools, detects schema drift between versions, and recommends new servers based on your environment. Works as both a CLI and an MCP server.

All releases →