Skip to content

Toolport

v0.3.2 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

ai ai-agents anthropic claude cursor developer-tools
+10 more
gateway llm local-first mcp mcp-server model-context-protocol react rust tauri vscode

Affected surfaces

auth

Summary

AI summary

Updates New, Reliability & fixes, and Platforms across a mixed release.

Full changelog

Conduit is a local-first gateway for your MCP servers: set up and authenticate each server once, and every AI coding tool (Claude, Cursor, VS Code, and more) shares them through one local gateway. Keys stay in your OS keychain. No Docker, no cloud.

This is a big one, the first release with macOS and Linux builds (signed/notarized Mac), plus a lot of reliability and polish work since v0.3.0.

Platforms

  • macOS support, both Apple Silicon and Intel, signed and notarized (no Gatekeeper warning).
  • Linux support: .deb and AppImage. Beta.
  • The Windows app no longer flashes a console window while servers run.

New

  • Share a setup. Export your server set and import a teammate's. Secrets are never included, so a curated setup can be shared without leaking keys.
  • Add API keys when adding a server. The "Add server" form now has an environment-variables field, so key-based servers work in one step.
  • Bulk enable / disable every server at once.
  • Version + "update available" indicator in the sidebar.
  • Open data folder (config, logs, audit) for quick backup or inspection.
  • Statuses auto-refresh when you return to the window.

Auth & secrets

  • OAuth requests only the scopes a server advertises (fixes providers that rejected offline_access, e.g. Stripe).
  • Hardened the OAuth loopback callback: reads reliably across platforms, a fresh port per attempt so rapid retries can't collide, and clearer guidance when a provider's sign-in page is blank.
  • Clearer API-key entry; secret-read failures now report the real cause instead of failing silently.

Reliability & fixes

  • The gateway recovers from a poisoned lock instead of wedging the whole process.
  • Installed-but-unconfigured clients no longer show "not found", and you can't connect Conduit to a client that isn't installed.
  • "Import all" reports accurately (no more false success on a partial import).
  • Enabling a server re-probes immediately instead of sticking on "Checking...".
  • A server that exits on startup surfaces its real error (e.g. a missing key).
  • Added SECURITY.md and a cargo-audit CI job, plus more tests around config import/export and the dashboard stats.

Install

  • Windows: unsigned. SmartScreen may warn, click More info → Run anyway.
  • macOS: signed + notarized. Use aarch64 for Apple Silicon, x64 for Intel.
  • Linux: .deb or AppImage (beta).

Upgrading from v0.3.0 on Windows: the app is now named Conduit (it was lowercase before), so a fresh install may appear alongside the old one. Uninstall the old "conduit" from Add or Remove Programs.

macOS keychain prompt (first run): the first time the gateway reads a saved key (when a client like VS Code or Claude Code uses it), macOS shows a keychain prompt. Click Always Allow once and it won't ask again. (A future release will remove this prompt entirely.)

Breaking Changes

  • Windows app renamed from "conduit" to "Conduit"; existing installations may appear side‑by‑side requiring manual uninstall of the old name.

Security Fixes

  • OAuth now requests only advertised scopes (fixes providers rejecting `offline_access` such as Stripe)
  • Hardened OAuth loopback callback: fresh port per attempt, reliable cross‑platform reads, clearer guidance on blank sign‑in pages
  • Added SECURITY.md and cargo-audit CI job

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Toolport

Get notified when new releases ship.

Sign up free

About Toolport

All releases →

Beta — feedback welcome: [email protected]