Skip to content

vinkius-labs/mcp-fusion

v4.3.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

chatgpt claude mcp mcp-framework mcp-server mcp-tools
+1 more
model-context-protocol

Summary

AI summary

Updates Type Safety, Edge Runtime Compatibility, and Observability across a mixed release.

Full changelog

What's Changed

31-file deep-dive audit — zero new features, pure stability hardening for type safety, runtime security, and Edge compatibility.

Type Safety

  • Eliminated all no-explicit-any casts across BuildPipeline, FluentToolBuilder, ServerAttachment, CursorCodec, MCPFusionClient, HandoffStateStore
  • Removed unnecessary no-unnecessary-condition suppressions in 5+ modules

Security

  • Prototype pollution guard in FluentToolBuilder middleware context enrichment (__proto__, constructor, prototype filtered via Object.hasOwn())
  • AsyncGeneratorFunction constructor guard in MiddlewareCompiler
  • Crypto availability guards in CursorCodec, CryptoAttestation, canonicalize

Edge Runtime Compatibility

  • Deterministic Promise.resolve() returns in startServer capability stubs
  • Explicit Promise wrapping in HandoffStateStore InMemoryStore
  • Bundle sanitizer string interpolation fix in deploy.ts

Observability

  • ExecuteWithRecoveryEvent telemetry type in TelemetryEvent union
  • Cached regex with lastIndex reset in ObservabilityHooks XML extraction

Test Suite

  • 333 test files, 6841 tests passing, 0 failed

Packages

All 16 @mcpfusion/* packages published to npm at 4.3.0.

Full Changelog: https://github.com/vinkius-labs/mcpfusion/blob/main/CHANGELOG.md

Security Fixes

  • Prototype pollution guard added to `FluentToolBuilder` middleware context enrichment using `Object.hasOwn()`
  • `AsyncGeneratorFunction` constructor usage guarded in `MiddlewareCompiler`
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track vinkius-labs/mcp-fusion

Get notified when new releases ship.

Sign up free

About vinkius-labs/mcp-fusion

A TypeScript framework for building production-ready MCP servers with automatic tool discovery, multi-transport support (stdio/SSE/HTTP), built-in validation, and zero-config setup.

All releases →

Related context

Earlier breaking changes

  • v4.0.0 All packages now published under the `@mcpfusion` npm scope.
  • v4.0.0 GitHub repository renamed to vinkius-labs/mcpfusion; npm packages under @mcpfusion scope.
  • v4.0.0 All source code, documentation, CLI output, workflows, and npm packages now use the @mcpfusion scope.

Beta — feedback welcome: [email protected]