portainer/portainer-mcp

2.43.2 — Targets Portainer 2.43.x

Fixed

• Guidance gate no longer keys on Mcp-Session-Id — clients behind
  session-churning bridges are never locked out (#75). The gate is now a
  toll booth: the first tool call from a caller whose idle window has
  lapsed is answered with the operating guide itself (plus a retry
  instruction) instead of a "call get_guidance and retry" bounce, and the
  caller is marked guided immediately — delivery is the proof, so nothing
  needs to be correlated across requests and there is no lockout state.
  Callers are identified by the authenticated principal (the per-user
  API-key digest over HTTP, the process over stdio), the scoping SEP-2567
  recommends now that major clients mint a fresh session id per tool call.
  The window slides with activity (PORTAINER_MCP_GUIDANCE_TTL, default
  1800s), so re-delivery happens on the next conversation, not mid-task —
  including over stdio, where the old gate fired only once per process
  lifetime. PORTAINER_MCP_DISABLE_GUIDANCE_GATE=1 disables enforcement
  entirely (install the hygiene skill manually on clients in that case);
  get_guidance remains available on demand.

Added

• Trust-proxy auth posture (PORTAINER_MCP_TRUST_PROXY_AUTH=1) for
  deployments behind an identity-aware proxy that owns the Authorization
  header (e.g. Pomerium in MCP server mode) — #76. The gate-token
  compare is replaced by per-request proxy attestation: inherited from the
  PORTAINER_MCP_TRUST_PROXY_TLS + PORTAINER_MCP_FORWARDED_ALLOW_IPS
  declaration behind a TLS-terminating proxy, or an explicit
  PORTAINER_MCP_TRUSTED_PROXY_AUTH_IPS socket-peer allowlist when the
  server terminates TLS itself. Exactly one auth posture must be declared
  (gate token XOR trust-proxy); every degenerate combination — both, neither,
  trust + plaintext opt-out, wildcard allowlists (* or zero-prefix CIDRs),
  a server-held cert alongside the inherited shape, a peer allowlist without
  the trust flag — refuses to boot, and the
  per-user X-Portainer-API-Key validation floor is unchanged. New audit
  outcomes untrusted_scheme / untrusted_peer; audit records under this
  posture carry auth_posture: "trust_proxy".

Full changelog: https://github.com/portainer/portainer-mcp/blob/2.43.2/CHANGELOG.md