This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+13 more
Summary
AI summaryAdded a non‑blocking startup self‑check for skill‑pin drift and an SPDX license identifier header.
Full changelog
Highlights
Patch release with two landed items:
- #388 — startup self-check for skill-pin drift (closes design 4 of #379). Non-blocking fetch + sha256 of canonical `SKILL.md` from `vaultpilot-security-skill` master at server boot; on drift, emits a `VAULTPILOT NOTICE — Skill pin drift detected` block on the first tool response per session (deduped). Pure diagnostic — fails soft on network errors. Catches the failure class that prompted the v0.9.5 → v0.10.0 → drift saga (silent skill-master drift while the skill repo released v5 + Step 0 + the project rename without a coordinated MCP-side bump).
- #389 — `SPDX-License-Identifier: BUSL-1.1` header added to `LICENSE`. Lets GitHub / Snyk / FOSSA / npm classify the project from the LICENSE file directly instead of falling back to filename heuristics.
No public API changes; semver patch is the right shape.
Auto-generated PR list since v0.10.0
What's Changed
- feat(security): startup self-check for skill-pin drift (#379 design 4) by @szhygulin in https://github.com/szhygulin/vaultpilot-mcp/pull/388
- chore(release): bump to 0.10.1 by @szhygulin in https://github.com/szhygulin/vaultpilot-mcp/pull/390
- chore(license): add SPDX-License-Identifier header to LICENSE by @szhygulin in https://github.com/szhygulin/vaultpilot-mcp/pull/389
Full Changelog: https://github.com/szhygulin/vaultpilot-mcp/compare/v0.10.0...v0.10.1
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About szhygulin/recon-crypto-mcp
Self-custodial crypto portfolio for AI agents. Reads EVM wallet balances, ENS, token prices, and DeFi positions across Ethereum/Arbitrum/Polygon/Base (Aave V3, Compound V3, Morpho Blue, Uniswap V3 LP, Lido, EigenLayer), surfaces health-factor alerts and protocol risk scores, then prepares unsigned transactions (supply, borrow, repay, withdraw, stake, send, LiFi swap/bridge) signed on Ledger via WalletConnect — private keys never leave the hardware wallet.
Related context
Beta — feedback welcome: [email protected]