This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
Summary
AI summaryOptional networked transport added for MCP server with control‑panel management.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Requires bearer token for networked MCP transport requests; unauthenticated requests return 401. Requires bearer token for networked MCP transport requests; unauthenticated requests return 401. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Medium |
Adds optional networked transport (--transport stdio|sse|streamable-http). Adds optional networked transport (--transport stdio|sse|streamable-http). Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Medium |
Adds control-panel management for MCP transport (Setup → MCP card). Adds control-panel management for MCP transport (Setup → MCP card). Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Serializes concurrent page switches across local and networked MCP instances via page-switch lock. Serializes concurrent page switches across local and networked MCP instances via page-switch lock. Source: llm_adapter@2026-06-06 Confidence: high |
— |
Full changelog
Optional networked transport — run the MCP server over the network, safely, with control-panel management. Local stdio remains the default and is unchanged.
- Added
--transport stdio|sse|streamable-http(defaultstdio). Networked modes bind to loopback (127.0.0.1) by default and require a bearer token on every request ($DAVINCI_MCP_TOKEN, or generated + logged). A non-loopback bind logs a loud security warning. You can run a local stdio instance and a networked instance against the same Resolve at once. - Added control-panel management (Setup → MCP): a Transport card showing live mode / URL / token / loopback status with loopback-only Start/Stop, backed by
/api/mcp/transport/{start,stop}. - The page-switch lock (v2.34.1) serializes concurrent page switches across the local + networked instances.
Auth + loopback live-validated: 401 without token, auth-passes with token, bound to 127.0.0.1 only.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]