This release includes 3 security fixes for security teams reviewing exposed deployments.
Topics
+10 more
Affected surfaces
Summary
AI summaryServer-side code mode executes whole tool sequences in a Rust sandbox, reducing round‑trips.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Binds human approvals to exact arguments, preventing reuse against swapped inputs. Binds human approvals to exact arguments, preventing reuse against swapped inputs. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Isolates MCP sessions per client and requires authentication for loopback HTTP reads. Isolates MCP sessions per client and requires authentication for loopback HTTP reads. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Security | High |
Guards embedding requests against SSRF and rejects stale writes in Teams server updates. Guards embedding requests against SSRF and rejects stale writes in Teams server updates. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Adds server-side code execution in a sandboxed pure‑Rust engine. Adds server-side code execution in a sandboxed pure‑Rust engine. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Adds folder- and project-scoped routing for tool profiles. Adds folder- and project-scoped routing for tool profiles. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Feature | Medium |
Adds tool‑granular profiles to control which tools each server exposes. Adds tool‑granular profiles to control which tools each server exposes. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Feature | Low |
Adds light/dark theme selector in Settings; fresh installs follow OS theme. Adds light/dark theme selector in Settings; fresh installs follow OS theme. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Adds structured-result projection to trim large tool outputs before model input. Adds structured-result projection to trim large tool outputs before model input. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Maps workspace folders to profiles for automatic tool routing per project. Maps workspace folders to profiles for automatic tool routing per project. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Allows tool-granular scoping within profiles to select individual tools per server. Allows tool-granular scoping within profiles to select individual tools per server. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Pre‑emptively refreshes OAuth tokens before expiry to avoid call failures. Pre‑emptively refreshes OAuth tokens before expiry to avoid call failures. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Debounces Share‑dialog config export to reduce unnecessary writes. Debounces Share‑dialog config export to reduce unnecessary writes. Source: llm_adapter@2026-07-16 Confidence: high |
— |
Full changelog
The orchestration-and-polish release: run whole tool sequences server-side, scope tools by folder and by profile, and a lighter, more finished UI.
Highlights
Code mode. An agent can send one script that runs server-side in a sandboxed pure-Rust engine, calling tools and shaping results inline, instead of round-tripping every call through the model. Fewer round-trips and less token overhead on multi-step work.
Folder- and project-scoped routing. Map a workspace folder to a profile so the active server set follows the project you're working in, with no manual switching.
Tool-granular profiles. A profile can now scope which individual tools each server exposes, not just which servers are visible, so you can present a tight, purpose-built tool set.
Light and dark theme. A System / Light / Dark control in Settings, with the light palette tuned for real use. Existing installs stay dark; fresh installs follow your OS.
Official client logos. Client pages now show the real brand logo for Cursor, Codex, Claude, Gemini CLI, Zed, Warp, and more.
Live Activity. The feed and Live Inspector update in place as calls come in, and the savings banner reads more honestly, with B/T token units and the dollar figure framed as a list-price upper bound before caching.
Structured-result projection. Large tool results can be projected down to the fields that matter before they reach the model, instead of returning the full payload.
Security
- Human approvals are bound to the exact arguments they were granted for, so a decision can't be reused against swapped inputs.
- MCP sessions are isolated per client, and loopback HTTP requires authentication with bounded reads.
- Embedding requests are guarded against SSRF, and Teams server updates reject stale writes.
Fixes
- Windows stdio process trees are cleaned up on shutdown.
- OAuth tokens refresh ahead of expiry instead of failing a call first.
- Share-dialog config export is debounced.
Thanks
Big thanks to @BharadwajKanneveti for contributing to this release: the server-dialog transport helper text (#334), the debounced Share-dialog config export (#338), the toaster theme fix (#333), and the structured-result projection groundwork (#313) that #331 built on.
Existing installs auto-update.
Security Fixes
- Human approvals are now argument‑specific preventing reuse against swapped inputs
- MCP sessions isolated per client; loopback HTTP requires authentication with bounded reads
- Embedding requests guarded against SSRF; Teams server rejects stale writes
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Toolport
All releases →Beta — feedback welcome: [email protected]