ViperJuice/mcp-gateway

v1.19.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 15d MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 12d

Release v1.19.3 of ViperJuice/mcp-gateway prevents downstream servers from inheriting each other's PMCP-managed credentials by stripping those secrets from the inherited environment.

Why it matters: With a severity score of 95, this change blocks cross‑server credential bleed for any deployment using the PMCP gateway subprocess spawning surface. Operators should upgrade immediately to eliminate unauthorized access risk.

Summary

AI summary

Prevents downstream servers from receiving each other's PMCP-managed credentials.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevents cross-server credential bleed by stripping PMCP-managed secrets from inherited environment. Prevents cross-server credential bleed by stripping PMCP-managed secrets from inherited environment. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Security

No cross-server credential bleed. The gateway loads every PMCP-stored
credential into its own os.environ, and the subprocess-spawn paths copied
that whole environment — so each downstream MCP server received every other
server's credentials (e.g. @brightdata/mcp got the OpenAI key). Downstream
subprocesses now inherit the gateway environment minus PMCP-managed secret
keys (the keys in the user pmcp.env + project .env.pmcp stores), then get
only their own resolved credential re-applied. This covers both the server
spawn (_connect_stdio) and the paths that execute a server's package code
(start_install/install_server, and the update_server / verify_installation
--help probes). Non-secret ambient vars (PATH/HOME/NODE_*/proxy/locale)
are preserved. (#96)

Scope: only PMCP-managed secrets are stripped — not secrets the operator
exported into the shell or a plain .env. Behavior change: a server that
relied on ambient inheritance of a secret it does not declare (no config
env block, no manifest credential) no longer receives it. Follow-ups tracked
in #96: sanitizing the trusted-CLI probes as defense-in-depth, and the durable
fix of not loading secrets into the global os.environ at all.

Security Fixes

Removed PMCP-managed secret keys from inherited os.environ in downstream server subprocesses, preventing cross-server credential bleed.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ViperJuice/mcp-gateway

Get notified when new releases ship.

About ViperJuice/mcp-gateway

A meta-server for minimal Claude Code tool bloat with progressive disclosure and dynamic server provisioning. Exposes 9 stable meta-tools, auto-starts Playwright and Context7, and can dynamically provision 25+ MCP servers on-demand from a curated manifest.

All releases →