Skip to content

ViperJuice/mcp-gateway

v1.20.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1d MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

auth

Summary

AI summary

Added a fail-closed scoped_advisor_audit.v1 profile that terminates startup on policy failures, filters gateway-owned tools, and introduces privacy‑safe typed audit correlations with JSONL sink.

Full changelog

Security

  • Add the fail-closed scoped_advisor_audit.v1 profile for isolated advisor
    research. Explicit policy failures now terminate startup, gateway-owned tools
    are filtered in discovery and dispatch, and the shipped profile exposes only
    health, catalog search, describe, and invoke controls over approved Firecrawl
    and Bright Data research patterns.
  • Add typed run/seat/evidence correlations and an explicit JSONL audit sink with
    privacy-safe source/result digests, contiguous sequence/count validation, and
    exactly one fsynced terminal marker. Raw URLs, queries, arguments,
    credentials, and result bodies are not written to the audit. (Consiliency/pmcp#103)

Added

  • pmcp capabilities --json, --audit-jsonl, and PMCP_AUDIT_JSONL expose the
    released feature contract required by Consiliency/agent-harness#310.

Security Fixes

  • Added fail-closed scoped_advisor_audit.v1 profile that terminates startup on explicit policy failures, filters gateway‑owned tools in discovery/dispatch, exposes only health, catalog search, describe, and invoke controls for approved Firecrawl/Bright Data research patterns; introduced typed run/seat/evidence correlations with privacy‑safe JSONL audit sink (no raw URLs, queries, arguments, credentials, or result bodies written).
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ViperJuice/mcp-gateway

Get notified when new releases ship.

Sign up free

About ViperJuice/mcp-gateway

A meta-server for minimal Claude Code tool bloat with progressive disclosure and dynamic server provisioning. Exposes 9 stable meta-tools, auto-starts Playwright and Context7, and can dynamically provision 25+ MCP servers on-demand from a curated manifest.

All releases →

Related context

Beta — feedback welcome: [email protected]