Labs64/NetLicensing-MCP

v0.1.7 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

laas labs64 licensing-as-a-service llm mcp mcp-server

+1 more

netlicensing

Affected surfaces

auth deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

The redaction layer now masks sensitive fields in all tool responses and debug logs. The server also fails fast or returns a 503 when no API key is configured unless demo mode is explicitly enabled.

Why it matters: Redaction (severity 90) protects data leakage in any response or log output; fail‑fast on missing keys (severity 85) prevents accidental exposure of production endpoints. Address both to safeguard confidentiality and availability.

Summary

AI summary

Updates New Features, Bug Fixes, and pip pip install netlicensing-mcp==0.1.7 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Redaction layer now masks sensitive fields in all tool responses and debug logs. Redaction layer now masks sensitive fields in all tool responses and debug logs. Source: llm_adapter@2026-06-09 Confidence: high	—
Security	High	Server fails fast or returns 503 when no API key is configured and demo mode not explicitly opted in. Server fails fast or returns 503 when no API key is configured and demo mode not explicitly opted in. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Adds netlicensing_get_customer_health tool aggregating licensee validation data into a structured health report. Adds netlicensing_get_customer_health tool aggregating licensee validation data into a structured health report. Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Medium	Adds netlicensing_explain_validation tool translating raw validation responses into human‑readable per‑model explanations (dry‑run only). Adds netlicensing_explain_validation tool translating raw validation responses into human‑readable per‑model explanations (dry‑run only). Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Fixed incorrect filter method applied to product modules, licenses, licensees, and license templates list queries. Fixed incorrect filter method applied to product modules, licenses, licensees, and license templates list queries. Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Uniform delete safety invariant: all delete operations now require a confirmation token; no‑token path returns preview and issues a token. Uniform delete safety invariant: all delete operations now require a confirmation token; no‑token path returns preview and issues a token. Source: llm_adapter@2026-06-09 Confidence: high	—
Refactor	Low	Normalizes response envelope: single‑item responses promote properties to top level, list responses include count and per‑item console_url; adds include_raw parameter. Normalizes response envelope: single‑item responses promote properties to top level, list responses include count and per‑item console_url; adds include_raw parameter. Source: llm_adapter@2026-06-09 Confidence: high	—

Full changelog

What's New

New Features

Vendor/Operator Workflow Tools — Two new high-level synthesis tools:
- netlicensing_get_customer_health — aggregates licensee validation data into a structured
  health report with per-model status rows, expiry heuristics, warning-level taxonomy, and
  suggested actions
- netlicensing_explain_validation — translates raw validation responses into human-readable
  per-model explanations with deduped suggested actions and signature/TTL passthrough (dry-run
  only, never triggers a real validate call)

Security

Redaction layer — Sensitive fields (apiKey, licenseeSecret, nodeSecret, password, secret)
are now masked in all tool responses and debug logs; extendable via MCP_REDACT_FIELDS
Eliminated silent demo-credential fallback — Server now fails fast (stdio) or returns 503
(HTTP) when no API key is configured and demo mode is not explicitly opted in via
NETLICENSING_ALLOW_DEMO=true
CodeQL config — Static analysis workflow introduced; fixed a clear-text logging
vulnerability for sensitive information (PYSEC-2026-196 / CodeQL alert #12)
Dependency audit — Addressed PYSEC-2026-196 finding in httpx 26.1.2

Improvements

Normalized response envelope — All tool responses now follow a consistent shape: single-item
responses promote properties to top level with active as a JSON bool and a console_url deep
link; list responses include count and per-item console_url; include_raw: bool parameter
available on every tool to attach the original NetLicensing payload
Uniform delete safety invariant — All delete operations now consistently require a
confirmation token regardless of dependent-entity count; no-token path always returns a
preview + issues a token; invalid/expired tokens return a structured error

Bug Fixes

Fixed incorrect filter method applied to product modules, licenses, licensees, and license
templates list queries

Artifacts

| Registry | Package |
|----------|---------|
| PyPI | netlicensing-mcp==0.1.7 |
| GHCR | ghcr.io/labs64/netlicensing-mcp:0.1.7 |
| Docker Hub | labs64/netlicensing-mcp:0.1.7 |
| MCP Registry | io.github.Labs64/netlicensing-mcp |

Install

# pip
pip install netlicensing-mcp==0.1.7

# uvx (no install needed)
uvx netlicensing-mcp

# Docker
docker run -i --rm \
  -e NETLICENSING_API_KEY=your_key \
  ghcr.io/labs64/netlicensing-mcp:0.1.7

Full Changelog: https://github.com/Labs64/NetLicensing-MCP/compare/0.1.6...0.1.7

Breaking Changes

Eliminated silent demo-credential fallback – server now fails fast (stdio) or returns HTTP 503 when no API key is configured and NETLICENSING_ALLOW_DEMO is not true
Uniform delete safety invariant – all delete operations now require a confirmation token; invalid/expired tokens return structured errors

Security Fixes

Sensitive fields (apiKey, licenseeSecret, nodeSecret, password, secret) are now masked in all tool responses and debug logs; extendable via MCP_REDACT_FIELDS
CodeQL config introduced – fixed clear‑text logging vulnerability for sensitive information (PYSEC-2026-196 / CodeQL alert #12)
dep: Addressed PYSEC-2026-196 finding in httpx 26.1.2

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Labs64/NetLicensing-MCP

Get notified when new releases ship.

About Labs64/NetLicensing-MCP

The official NetLicensing MCP Server is a natural language interface that enables agentic applications to manage the full software licensing lifecycle in Labs64 NetLicensing without writing a single API call.

All releases →