This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+10 more
Summary
AI summaryFixes make code mode toggleable in Settings and correct Activity call totals.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds "Code mode" toggle in Settings to enable server-side toolport_run_script. Adds "Code mode" toggle in Settings to enable server-side toolport_run_script. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes Activity call total to reflect full retained log instead of capping at 2,000. Fixes Activity call total to reflect full retained log instead of capping at 2,000. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Reduces false positives: injection scanner no longer flags benign shell examples with pipelines. Reduces false positives: injection scanner no longer flags benign shell examples with pipelines. Source: llm_adapter@2026-07-16 Confidence: high |
— |
Full changelog
A fast follow-up to v1.9.0 that makes code mode reachable, corrects the Activity call total, and stops the injection scanner from flagging benign shell examples.
Fixes
Turn on code mode from Settings. Code mode (the server-side toolport_run_script meta-tool) was reachable only through an environment variable, so there was no way to enable it from the app. There's now a "Code mode" toggle in Settings under Discovery, off by default.
Activity shows your real call total. The summary was counting only the most recent 2,000 calls, so the total capped at 2000 and the error rate was measured over that slice. It now reflects the full retained log, so the total, error rate, and per-server breakdown are the real numbers.
The injection scanner stops flagging benign shell examples. A tool description that documents a hashing command (for example ... | base64 -d | shasum -a 256 | awk ...) no longer trips a false "suspicious content" notice. The scanner now matches a pipe into an actual shell or interpreter, so real decode-then-execute still flags while look-alikes stay clean.
Existing installs auto-update.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Toolport
All releases →Related context
Beta — feedback welcome: [email protected]