Commit history

1. Commits on Oct 25, 2026

   • feat(secret): ${file:/absolute/path} references (Spec 111 FR-030) (#1717)

     Show description for 831f79f
     james-crowley

     authored
     831f79fView commit details

     Copy full SHA for 831f79f

     View code at this pointBrowse repository at this point

   • feat(security): per-token call rate limit for agent tokens (#1746)

     Show description for f13cb22
     james-crowley

     authored
     f13cb22View commit details

     Copy full SHA for f13cb22

     View code at this pointBrowse repository at this point

   • feat(quarantine): scan is the default trust mode; clean-scanned contract changes auto-approve (Spec 119) (#1740)

     Show description for 4eb1b78
     Dumbris

     authored
     4eb1b78View commit details

     Copy full SHA for 4eb1b78

     View code at this pointBrowse repository at this point
2. Commits on Oct 22, 2026

   • fix(oauth): keep a pending login alive across scans and the quarantine exemption (#1739)

     Show description for a983081
     Dumbris

     authored
     a983081View commit details

     Copy full SHA for a983081

     View code at this pointBrowse repository at this point

   • fix(sandbox): document stdio data-dir/socket exposure, doctor warning, writable /dev/null (#1704) (#1738)

     Show description for 27eb24a
     Dumbris

     authored
     27eb24aView commit details

     Copy full SHA for 27eb24a

     View code at this pointBrowse repository at this point

   • feat(profiles): mcpproxy access suggest turns blocked calls into profile changes (#1718)

     Show description for fa75d60
     

     james-crowley

     and

     Dumbris

     authored
     fa75d60View commit details

     Copy full SHA for fa75d60

     View code at this pointBrowse repository at this point

   • feat(security): mcp_reject_query_apikey refuses ?apikey= credentials on MCP endpoints (#1696)

     Show description for 5e9c9cd
     

     james-crowley

     and

     Dumbris

     authored
     5e9c9cdView commit details

     Copy full SHA for 5e9c9cd

     View code at this pointBrowse repository at this point

   • fix(audit): name the profile rule that refused a call in the authz reason (#1715)

     Show description for 81c9206
     james-crowley

     authored
     81c9206View commit details

     Copy full SHA for 81c9206

     View code at this pointBrowse repository at this point

   • feat(security): Spec 101 US3 TPA bundle refresh lifecycle and publication channel (#1720)

     Show description for 92dc64e
     Dumbris

     authored
     92dc64eView commit details

     Copy full SHA for 92dc64e

     View code at this pointBrowse repository at this point
3. Commits on Oct 20, 2026

   • feat(security): Spec 101 US1 signed TPA bundle format and downgrade-proof loader (#1701)

     Show description for 14cb288
     Dumbris

     authored
     14cb288View commit details

     Copy full SHA for 14cb288

     View code at this pointBrowse repository at this point

   • fix: preserve compact MCP tool routing guidance (#1668)

     Show description for 9b8271f
     copystring

     authored
     9b8271fView commit details

     Copy full SHA for 9b8271f

     View code at this pointBrowse repository at this point

   • feat(quarantine): rescan automatically after a tool definition change (Spec 118) (#1689)

     Show description for e22ed67
     

     Dumbris

     and

     claude

     authored
     e22ed67View commit details

     Copy full SHA for e22ed67

     View code at this pointBrowse repository at this point

   • feat(server): apply output_sanitisation to direct routing mode (#1685)

     Show description for 4e02c36
     

     james-crowley

     and

     Dumbris

     authored
     4e02c36View commit details

     Copy full SHA for 4e02c36

     View code at this pointBrowse repository at this point
4. Commits on Oct 17, 2026

   • fix(runtime): refuse tool calls after an incomplete tool capture and reconcile removals from stored records (#1635)

     Show description for b37447e
     Dumbris

     authored
     b37447eView commit details

     Copy full SHA for b37447e

     View code at this pointBrowse repository at this point
5. Commits on Oct 16, 2026

   • fix(quarantine): length-prefixed tool approval hash so contracts cannot collide (#1634)

     Show description for d1c3354
     Dumbris

     authored
     d1c3354View commit details

     Copy full SHA for d1c3354

     View code at this pointBrowse repository at this point
6. Commits on Oct 14, 2026

   • fix: bind OAuth state to the server incarnation so stale writes cannot re-create credentials (Spec 116 PR2b; #1607)

     Show description for d89d0d2
     Dumbris

     authored
     d89d0d2View commit details

     Copy full SHA for d89d0d2

     View code at this pointBrowse repository at this point
7. Commits on Oct 13, 2026

   • fix(oauth): support OAuth sign-in from a remote Web UI (#1597)

     Show description for 0aff450
     tomgrin10

     authored
     0aff450View commit details

     Copy full SHA for 0aff450

     View code at this pointBrowse repository at this point

   • fix(webui): keep manual OAuth sign-in available for recovery and account switching (#1599)

     Show description for 4031e33
     tomgrin10

     authored
     4031e33View commit details

     Copy full SHA for 4031e33

     View code at this pointBrowse repository at this point

   • feat(review): show what changed in held tools and approve a server's update in one click

     Show description for 27b1631
     Dumbris

     authored
     27b1631View commit details

     Copy full SHA for 27b1631

     View code at this pointBrowse repository at this point

   • fix: apply tool inventories in capture order so stale captures cannot overwrite newer state (Spec 117 PR-3; #1565)

     Show description for 896d935
     Dumbris

     authored
     896d935View commit details

     Copy full SHA for 896d935

     View code at this pointBrowse repository at this point
8. Commits on Oct 12, 2026

   • fix: bind approvals to the reviewed tool definitions (Spec 117 PR-2; #1566)

     Show description for 942afe6
     Dumbris

     authored
     942afe6View commit details

     Copy full SHA for 942afe6

     View code at this pointBrowse repository at this point

   • fix: atomic server removal with full purge and per-server incarnation (Spec 116 PR2; #1559, #1562)

     Show description for fb1ad33
     Dumbris

     authored
     fb1ad33View commit details

     Copy full SHA for fb1ad33

     View code at this pointBrowse repository at this point

   • fix: durable server tool baseline so replaced inventories never auto-approve (Spec 117 PR-1; #1567)

     Show description for 3473771
     Dumbris

     authored
     3473771View commit details

     Copy full SHA for 3473771

     View code at this pointBrowse repository at this point

   • fix(security): close TPA red-team holes in the rug-pull gate and detect engine (RT-01..RT-07)

     Show description for a857dba
     Dumbris

     authored
     a857dbaView commit details

     Copy full SHA for a857dba

     View code at this pointBrowse repository at this point

   • docs: align README and docs claims with default behavior; correct telemetry privacy, churn and funnel wording (CLAIM-01..05, TEL-01/06/08 docs)

     Show description for f85ff0b
     Dumbris

     authored
     f85ff0bView commit details

     Copy full SHA for f85ff0b

     View code at this pointBrowse repository at this point
9. Commits on Oct 11, 2026

   • fix(telemetry): count activation and upstream attempts on every dispatch path with one success definition (TEL-03, TEL-04)

     Show description for 506e7b4
     Dumbris

     authored
     506e7b4View commit details

     Copy full SHA for 506e7b4

     View code at this pointBrowse repository at this point

   • fix(cli): show review and approval next steps after upstream add; version-check the client guide (ACT-01..03)

     Show description for 43edb5d
     Dumbris

     authored
     43edb5dView commit details

     Copy full SHA for 43edb5d

     View code at this pointBrowse repository at this point

   • fix: Gemini-compatible profiles tier enum (#1576)

     Show description for fffc0c0
     Dumbris

     authored
     fffc0c0View commit details

     Copy full SHA for fffc0c0

     View code at this pointBrowse repository at this point

   • fix: preflight honours agent-token permission tiers (#1548 follow-up)

     Show description for ee7834e
     Dumbris

     authored
     ee7834eView commit details

     Copy full SHA for ee7834e

     View code at this pointBrowse repository at this point

   • feat: review-queue triage, profile availability labels and accessible Add form (UX-04, UX-07, UX-09)

     Show description for d63a94f
     Dumbris

     authored
     d63a94fView commit details

     Copy full SHA for d63a94f

     View code at this pointBrowse repository at this point
10. Commits on Oct 10, 2026

    • fix: flag MCP policy blocks as errors, accept legacy nested intent, correct protocol docs (UX-05, UX-06, UX-11)

      Show description for 704795c
      Dumbris

      authored
      704795cView commit details

      Copy full SHA for 704795c

      View code at this pointBrowse repository at this point

    • feat: admin MCP lifecycle for client credentials and agent tokens (Spec 115, #1552)

      Show description for a8d266c
      Dumbris

      authored
      a8d266cView commit details

      Copy full SHA for a8d266c

      View code at this pointBrowse repository at this point

    • feat(cli): add `mcpproxy review fetch` to capture tool definitions headlessly (UX-12)

      Show description for 1f5acb6
      Dumbris

      authored
      1f5acb6View commit details

      Copy full SHA for 1f5acb6

      View code at this pointBrowse repository at this point

    • fix: preflight evaluates the effective profile tool policy (#1548)

      Show description for 2c2fe29
      Dumbris

      authored
      2c2fe29View commit details

      Copy full SHA for 2c2fe29

      View code at this pointBrowse repository at this point
11. Commits on Oct 9, 2026

    • fix(oauth): recover a stale saved DCR client_id at login; readable tools list descriptions (#1538)

      Show description for bf2d9f1
      Dumbris

      authored
      bf2d9f1View commit details

      Copy full SHA for bf2d9f1

      View code at this pointBrowse repository at this point