Minor internal improvements and maintenance updates.

This patch release includes build pipeline enhancements to improve reliability of macOS application notarization and distribution.

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key

mcpproxy v0.71.0-rc.1 (Prerelease)

⚠️ This is a prerelease version - Use at your own risk!

Smart MCP Proxy - Intelligent tool discovery and proxying for Model Context Protocol servers.

Download Links

This Prerelease (v0.71.0-rc.1):

• Linux AMD64
• Linux ARM64
• Windows AMD64
• Windows ARM64
• macOS AMD64
• macOS ARM64

macOS Installer:

• Signed DMG (Apple Silicon)
• Signed DMG (Intel)

Installation

macOS:

1. Download the signed installer DMG for your Mac (Apple Silicon or Intel)
2. Double-click the DMG to mount it
3. Double-click the PKG installer inside
4. Follow the installation wizard
5. CLI tool mcpproxy will be available in Terminal
6. Launch mcpproxy.app from Applications folder
7. The app will appear in your system tray

Manual Installation (All Platforms):

1. Download the appropriate archive for your platform using the links above
2. Extract the archive: tar -xzf mcpproxy-*.tar.gz (Linux/macOS) or unzip (Windows)
3. Make it executable: chmod +x mcpproxy (Linux/macOS)
4. Run ./mcpproxy to start

Platform Support

• macOS: Full system tray support with menu and icons
• Windows: Full system tray support with menu and icons
• Linux: Headless mode only (no system tray due to compatibility)

Usage

GUI (Recommended):

• Launch mcpproxy.app from Applications (auto-starts core server)
• Manages server via system tray menu

CLI:

• Start core server: mcpproxy serve
• Custom port: mcpproxy serve --listen 127.0.0.1:8081
• Set API key: export MCPPROXY_API_KEY=your-secret-key
• Start tray separately: mcpproxy-tray (if core already running)

⚠️ Prerelease Notes

• This is a development version and may contain bugs
• Not recommended for production use
• Auto-updater will NOT automatically update to this version unless MCPPROXY_ALLOW_PRERELEASE_UPDATES=true is set

Highlights

Profiles now enforce policy (Spec 108). A profile can cap the tool tier (max_tier: read / write / destructive), allow or deny individual tools with server:tool globs, decide how unannotated tools are treated, and switch off code_execution or the management tools. This is enforced on every execution surface (call_tool_*, /mcp/all, nested code_execution calls, REST) and in discovery: retrieve_tools filters by policy before it cuts to the limit, and it reports hidden_by_profile. The same access explainer is available in the Web UI, the macOS app, mcpproxy access explain and the new profiles MCP tool. → Profiles

A credential per client. Connect no longer writes the admin API key into client configs. Each client gets an mcp_cli_ credential bound to a profile, valid on MCP endpoints only. Rotate or forget it per client from the new Clients hub. Configs that still hold the admin key are reported, never rewritten automatically: use Upgrade clients holding the admin key, then rotate the key. → Connect Clients

Agents find their tools (#1486).

• /mcp, /mcp/call and /mcp/code now actually send initialize instructions.
• Each caller's instructions end with a YOUR ACCESS block: its profile, the connected servers it can reach, and its allowed operations, all filtered by profile and agent-token scope.
• The retrieve_tools description names those servers, so Claude Code's tool search finds it.
• Opt out with advertise_upstream_servers: false.
• mcpproxy agent-instructions prints a CLAUDE.md / AGENTS.md snippet. → Agent Instructions

Navigation rebuilt around one list (Spec 109).

• One needs-attention list across Home, tray, status and doctor.
• A Review queue that starts fail-closed.
• Catalog-first Add Server with a real popularity signal (Spec 110).
• Clients hub, grouped sidebar and command palette (Cmd/Ctrl+K).
• Deep-linkable Activity filters.
• One status vocabulary on every surface.

Security and reliability fixes

• Upgrade keeps quarantined servers quarantined (#1485, #1488). v0.69 restarts could overwrite a held server's recorded quarantine, and the upgrade then auto-approved all of its tools. A server is now admitted on upgrade only with an approval baseline. Implicit quarantine also survives restarts and config writes (#1463), and an explicit quarantined value given on add or import is persisted.
• Dead stdio servers come back (#1489). A stdio upstream whose process died used to keep reporting healthy while every call failed. Now it is marked unhealthy at once and respawned.
• A malformed import no longer bricks startup (#1490). An entry the boot path would refuse is rejected at import time.
• Open-object schemas survive (#1434, #1438). call_tool_* arguments and /mcp/all tools keep additionalProperties and $defs. Grammar-constrained local models read {"properties":{}} as "no arguments".
• Client header forwarding to upstreams (Spec 112), and a versioned search index with automatic migration (#1386).

Upgrade notes

• Downgrading: set require_mcp_auth: true before going back to v0.69 or earlier. Older binaries don't know mcp_cli_ credentials, and with MCP auth off they grant them unconfined access.
• Vetted servers with no approved tools (prompt/resource-only servers, servers not connected since v0.21) are held for review once. Approve them, or set "quarantined": false before upgrading.
• CLI tables changed for upstream list, status and doctor. -o json is unchanged; scripts should use it.
• describe_tool reports not_found instead of invisible for tools outside your scope.
• Profile refusals now name the caller's own profile. Match on block_reason (profile_tier, profile_rule, profile_unannotated) rather than the text.

Full write-up: MCPProxy v0.70.0 on the blog. Changes since v0.69.0: v0.69.0...v0.70.0.

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy v0.70.0-rc.5 (Prerelease)

⚠️ This is a prerelease version - Use at your own risk!

Smart MCP Proxy - Intelligent tool discovery and proxying for Model Context Protocol servers.

Download Links

This Prerelease (v0.70.0-rc.5):

• Linux AMD64
• Linux ARM64
• Windows AMD64
• Windows ARM64
• macOS AMD64
• macOS ARM64

macOS Installer:

• Signed DMG (Apple Silicon)
• Signed DMG (Intel)

Installation

macOS:

1. Download the signed installer DMG for your Mac (Apple Silicon or Intel)
2. Double-click the DMG to mount it
3. Double-click the PKG installer inside
4. Follow the installation wizard
5. CLI tool mcpproxy will be available in Terminal
6. Launch mcpproxy.app from Applications folder
7. The app will appear in your system tray

Manual Installation (All Platforms):

1. Download the appropriate archive for your platform using the links above
2. Extract the archive: tar -xzf mcpproxy-*.tar.gz (Linux/macOS) or unzip (Windows)
3. Make it executable: chmod +x mcpproxy (Linux/macOS)
4. Run ./mcpproxy to start

Platform Support

• macOS: Full system tray support with menu and icons
• Windows: Full system tray support with menu and icons
• Linux: Headless mode only (no system tray due to compatibility)

Usage

GUI (Recommended):

• Launch mcpproxy.app from Applications (auto-starts core server)
• Manages server via system tray menu

CLI:

• Start core server: mcpproxy serve
• Custom port: mcpproxy serve --listen 127.0.0.1:8081
• Set API key: export MCPPROXY_API_KEY=your-secret-key
• Start tray separately: mcpproxy-tray (if core already running)

⚠️ Prerelease Notes

• This is a development version and may contain bugs
• Not recommended for production use
• Auto-updater will NOT automatically update to this version unless MCPPROXY_ALLOW_PRERELEASE_UPDATES=true is set

mcpproxy v0.70.0-rc.4 (Prerelease)

⚠️ This is a prerelease version - Use at your own risk!

Smart MCP Proxy - Intelligent tool discovery and proxying for Model Context Protocol servers.

Download Links

This Prerelease (v0.70.0-rc.4):

• Linux AMD64
• Linux ARM64
• Windows AMD64
• Windows ARM64
• macOS AMD64
• macOS ARM64

macOS Installer:

• Signed DMG (Apple Silicon)
• Signed DMG (Intel)

Installation

macOS:

1. Download the signed installer DMG for your Mac (Apple Silicon or Intel)
2. Double-click the DMG to mount it
3. Double-click the PKG installer inside
4. Follow the installation wizard
5. CLI tool mcpproxy will be available in Terminal
6. Launch mcpproxy.app from Applications folder
7. The app will appear in your system tray

Manual Installation (All Platforms):

1. Download the appropriate archive for your platform using the links above
2. Extract the archive: tar -xzf mcpproxy-*.tar.gz (Linux/macOS) or unzip (Windows)
3. Make it executable: chmod +x mcpproxy (Linux/macOS)
4. Run ./mcpproxy to start

Platform Support

• macOS: Full system tray support with menu and icons
• Windows: Full system tray support with menu and icons
• Linux: Headless mode only (no system tray due to compatibility)

Usage

GUI (Recommended):

• Launch mcpproxy.app from Applications (auto-starts core server)
• Manages server via system tray menu

CLI:

• Start core server: mcpproxy serve
• Custom port: mcpproxy serve --listen 127.0.0.1:8081
• Set API key: export MCPPROXY_API_KEY=your-secret-key
• Start tray separately: mcpproxy-tray (if core already running)

⚠️ Prerelease Notes

• This is a development version and may contain bugs
• Not recommended for production use
• Auto-updater will NOT automatically update to this version unless MCPPROXY_ALLOW_PRERELEASE_UPDATES=true is set

mcpproxy v0.70.0-rc.2 (Prerelease)

⚠️ This is a prerelease version - Use at your own risk!

Smart MCP Proxy - Intelligent tool discovery and proxying for Model Context Protocol servers.

Download Links

This Prerelease (v0.70.0-rc.2):

• Linux AMD64
• Linux ARM64
• Windows AMD64
• Windows ARM64
• macOS AMD64
• macOS ARM64

macOS Installer:

• Signed DMG (Apple Silicon)
• Signed DMG (Intel)

Installation

macOS:

1. Download the signed installer DMG for your Mac (Apple Silicon or Intel)
2. Double-click the DMG to mount it
3. Double-click the PKG installer inside
4. Follow the installation wizard
5. CLI tool mcpproxy will be available in Terminal
6. Launch mcpproxy.app from Applications folder
7. The app will appear in your system tray

Manual Installation (All Platforms):

1. Download the appropriate archive for your platform using the links above
2. Extract the archive: tar -xzf mcpproxy-*.tar.gz (Linux/macOS) or unzip (Windows)
3. Make it executable: chmod +x mcpproxy (Linux/macOS)
4. Run ./mcpproxy to start

Platform Support

• macOS: Full system tray support with menu and icons
• Windows: Full system tray support with menu and icons
• Linux: Headless mode only (no system tray due to compatibility)

Usage

GUI (Recommended):

• Launch mcpproxy.app from Applications (auto-starts core server)
• Manages server via system tray menu

CLI:

• Start core server: mcpproxy serve
• Custom port: mcpproxy serve --listen 127.0.0.1:8081
• Set API key: export MCPPROXY_API_KEY=your-secret-key
• Start tray separately: mcpproxy-tray (if core already running)

⚠️ Prerelease Notes

• This is a development version and may contain bugs
• Not recommended for production use
• Auto-updater will NOT automatically update to this version unless MCPPROXY_ALLOW_PRERELEASE_UPDATES=true is set

🔒 Rotate your API key if anyone else can read your mcpproxy logs

Earlier releases wrote the admin API key to the log files in plain text. It appeared in the access log whenever the key arrived as ?apikey=, which is how the Web UI and the tray open the /events stream and the /ui/ page, and in main.log when the key was auto-generated. This release redacts it on the access, authentication and startup log lines that carried it (SEC-01).

What to do: if your logs have been shared, collected by a log shipper, attached to an issue, or can be read by other users, treat the key as exposed.

1. Set a new value for api_key in ~/.mcpproxy/mcp_config.json, or remove the field and one will be generated.
2. Restart mcpproxy.
3. Update every client, script and scraper that sends the old key. For clients set up with the Web UI's Connect dialog, click Disconnect and then Connect for each one, so its config gets the new key.
4. Delete the old log files: ~/Library/Logs/mcpproxy/ on macOS, ~/.local/state/mcpproxy/logs/ on Linux (or $XDG_STATE_HOME/mcpproxy/logs/, and /var/log/mcpproxy/ when run as root), %LOCALAPPDATA%\mcpproxy\logs\ on Windows.

The Web UI also stopped printing the key to the browser console.

/metrics now requires the API key

If you enabled the Prometheus exporter (observability.metrics.enabled, off by default), /metrics now returns 401 without credentials. Agent tokens get 403, because the endpoint exposes fleet-wide data. Send the admin key as Authorization: Bearer <key> (Prometheus authorization.credentials) or as X-API-Key. The health probes (/healthz, /livez, /health, /readyz, /ready) stay unauthenticated. See Observability.

The REST API no longer allows any origin (CORS)

/api/v1/* and /events used to send Access-Control-Allow-Origin: *. They now allow loopback origins and the hosts listed in trusted_hosts only. The bundled Web UI and non-browser clients are unaffected. If a separate web app calls the REST API from another domain, add that domain to trusted_hosts. MCPPROXY_TRUSTED_HOSTS replaces the list rather than adding to it, and the same list also governs Host validation on the MCP endpoint.

Tray self-update on Windows and on macOS tarball installs

The tray's built-in updater now checks every download against the release's checksums.txt and refuses to install on any mismatch. It also installs the tray binary. Earlier versions put the core binary in its place, so after a "successful" update the tray app turned into a headless core. If your tray stopped showing its menu after an earlier self-update, reinstall it from this release. DMG app bundles (Sparkle) and Homebrew installs were never affected.

Also in this release

• config.db, which holds OAuth tokens, is now created owner-only (0600). Existing databases are tightened automatically on startup.
• The admin API key is compared in constant time.

This release focuses on critical security hardening and bug fixes across authentication, data protection, and system stability.

Security Fixes

• API Key Protection: Admin API keys are now redacted from all log files and compared in constant time to prevent timing attacks
• Metrics Endpoint: /metrics now requires admin authentication (previously unauthenticated)
• CORS Policy: Removed permissive Access-Control-Allow-Origin: * headers from REST API and /events endpoints
• Request Path Redaction: MCP and OAuth callback URLs are now redacted in logs to prevent sensitive data exposure
• Database Security: config.db is now created with owner-only permissions and database backups are properly secured
• Artifact Verification: Tray self-updates now verify artifacts against release checksums (Personal edition)

Bug Fixes

• TOCTOU Vulnerabilities: Closed time-of-check-to-time-of-use race conditions in connect/disconnect operations for JSONC comment guards and precondition tokens
• Signal Handling: Improved graceful shutdown by continuing to honor signals after force-quit window and adding hard shutdown deadline
• Self-Update: Fixed tray edition to install the correct tray binary instead of core during self-update (Personal edition)
• HTTP API: Restored build after typed controller refactor and added fail-closed behavior when config is missing
• Frontend Fixes:
  • Improved Dashboard contrast and empty-fleet checks in web UI
  • Fixed Connect modal state refresh after connection
  • Added rendering for exfiltration and unknown threat types in scan reports
  • Fixed Auth Type and Agent filters by exposing caller identity in activity logs
• Config Validation: Now refuses writes when a client's servers section is not a valid object

New Features

• Added ZCode as a supported Connect client

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

🔒 Colon-named tools are approved by their exact name — one-time review after upgrade

A tool's approval record, search-index entry and callability are now keyed by the exact name its server reports, colons included. Earlier releases filed a namespaced tool such as ns:erase under the text after its first colon, so it shared — and silently inherited — the approval of a sibling erase on the same server. Every dispatch path (call_tool_*, direct-name dispatch on /mcp/all, call_tool() inside code execution), preflight and describe_tool now resolve exactly the server:tool pair they dispatch.

What changes for you

• On manual (default) and scan trust, colon-named tools on a server that already has an approved baseline become pending once, under their own names, on the first discovery after upgrade. They stay uncallable and out of retrieve_tools until you approve them: mcpproxy upstream inspect <server> to review, mcpproxy upstream approve <server> <tool>, the quarantine_security MCP tool, or the Web UI. trust_mode: auto servers and installs with quarantine_enabled: false auto-approve them; no other tool is affected.
• Blocks carry over. A tool you had disabled under the old collapsed name stays disabled under its own name until you enable it there; the log records the carry-over at WARN with both names. A tool that was locked pending review is pending under its own name and is unlocked by approving it by that name — nothing else is needed, and nothing is deleted. A namespaced tool you had toggled in the UI keeps its old review lock (with the before/after evidence) under its own name until you approve it; if its old record approved a different definition than the server reports now, it is held as changed for review, and if it had no old record it is pending under an active gate — a toggle never approves a definition nobody reviewed.
• Unresolved names are refused for everyone. A call to a tool that a connected server's discovered tool set does not contain is refused before any upstream call, for administrators too — while the server's discovery has not completed, retry shortly; afterwards, refresh with retrieve_tools and retry with a listed name. Quarantined, disabled and disconnected servers keep their existing answers: a call to a disconnected server still gets the not-connected / reconnect_on_use answer, and once the server reconnects and completes discovery, a name that result does not list is refused as unresolved — it is never dispatched.

Details: Security Quarantine → Namespaced tool names and Agent Tokens → Target tool tier.

Server edition: configuration keys and modes that never did anything are gone

This release removes the server-edition knobs and auth_broker modes that were accepted by the validator but had no reader in production. An old mcp_config.json still loads; what changes is how the removed keys are treated. Personal-edition users are not affected unless the file carries a server_edition or auth_broker block.

Removed keys and modes (spec 107, FR-032):

• server_edition.max_user_servers and server_edition.workspace_idle_timeout — never enforced.
• Per-server auth_broker.header and auth_broker.header_format — no request was ever rewritten with them.
• auth_broker.mode: token_exchange and auth_broker.mode: entra_obo — never implemented. oauth_connect is now the only accepted mode.

What the server edition (mcpproxy-server) does with an old file

• Loading succeeds. Each removed key is dropped with one warning naming it — server_edition.max_user_servers is no longer supported and was ignored, auth_broker.header is no longer supported and was ignored, and so on. A server whose auth_broker.mode is token_exchange or entra_obo loses its whole auth_broker block: auth_broker.mode "token_exchange" was never implemented; the auth_broker block for server "<name>" was ignored. The next write-back of the file omits the dropped keys.
• Writing them is refused. PATCH /api/v1/config and /api/v1/config/apply reject a document that carries any removed key or mode with the same message, so a script that still sends max_user_servers now gets a validation error instead of a silent accept.
• Remove the keys from your file, and change any token_exchange/entra_obo server to oauth_connect if you want its connect flow to keep working — otherwise its auth_broker block is dropped on the next load.

What the personal edition (mcpproxy) does with the same file

• Nothing. The server_edition block and every server's auth_broker block now pass through the personal binary as opaque JSON — every key and value preserved, removed keys included, no warning and no validation. Earlier releases wrote both blocks back as {}, so an API-key bootstrap or a PATCH /api/v1/config from the personal binary could erase a team's SSO or broker configuration; that is fixed here (FR-040).

store_idp_tokens is now a no-op

server_edition.store_idp_tokens no longer stores anything. The identity-provider access and refresh tokens it used to persist at login existed only to feed the never-implemented token_exchange/entra_obo modes, which left a long-lived IdP refresh token at rest with nothing reading it. The writer, the reader and the offline-access scope and authorization parameters that asked the IdP for a refresh token (offline_access, access_type=offline) are removed (FR-033), so a fresh login no longer requests a refresh token from the IdP.

• The key is still accepted so an old file loads. "store_idp_tokens": true logs one warning at boot — server_edition.store_idp_tokens is deprecated and no longer stores IdP tokens; remove it — and does nothing else.
• Remove it from your configuration. Nothing in this release reads the IdP tokens an earlier release stored, and the first start of mcpproxy-server with server_edition.enabled: true after upgrading deletes them from config.db (the rows are removed by key before anything else in the server-edition setup runs, so this happens whether MCPPROXY_CRED_KEY is still set, unset or even invalid; the log line purged legacy IdP subject-token rows reports the count). Credentials connected through the oauth_connect flow are not touched.
• The former IdP Token Storage page is now a tombstone.

Auth broker: a stored credential is stored, not injected

The oauth_connect connect flow, its REST routes, the mcpproxy credential commands, the encrypted credential store and MCPPROXY_CRED_KEY / credential_encryption_key all stay. What changes is the promise attached to them: a credential a user connects through the broker is kept for a future broker and is not injected into upstream tool calls. It never was — the injection, resolution and per-user connection-keying code paths that the documentation described had no production caller and are deleted in this release (FR-031, FR-034).

• mcpproxy credential list and mcpproxy credential status now open with the line Stored credentials are kept for a future broker and are NOT injected into upstream calls in this release.
• The auth broker and credential commands pages are rewritten accordingly; the "Credential resolution", "Header injection" and "Per-(user, server) connection keying" sections are gone.
• Upstream calls keep using whatever the server's own configuration provides (static headers, the server's own OAuth). If you deployed the broker expecting per-user credentials on upstream calls, that expectation was never met, and this release says so rather than fixing it.
• Historical credential_broker activity rows remain readable and labelled.

Agent tokens: a per-user quota inside the deployment cap

The server edition now enforces a 25-token quota per signed-in user on top of the existing 100-record deployment cap (#1177). Revoked tokens keep their slot until they are permanently deleted.

• Server edition: a user at 25 tokens gets a 409 Conflict from POST /user/tokens that names their quota — permanently deleting one of their unused tokens frees a slot — so one user can no longer take the whole pool. The 100-record deployment cap remains and every stored token still counts toward it, so a deployment whose stored records add up to 100 refuses the next token for everyone until an administrator frees records; a caller who is still under their own quota then gets the 409 that says the limit is shared and points at an administrator (the quota is checked first, so a user already at 25 sees their own-quota message instead). A user who already holds more than 25 tokens keeps them; they cannot create another until they are back under the quota.
• Personal edition: every token is ownerless, so the quota does not apply and the 100-token limit is unchanged.
• No configuration change is needed. Details: agent tokens.

Server edition: /mcp always requires a credential

When server_edition.enabled is true, /mcp now behaves as if require_mcp_auth were true whatever the file says (spec 107, FR-029). Before this release a server-edition deployment with require_mcp_auth off (the default) handed every unauthenticated /mcp caller an anonymous administrator context.

• No credential → 401. A session cookie or a user JWT on /mcp → 401 (they were never valid there; they are no longer silently promoted). Agent tokens (mcp_agt_…), the global API key and the Unix socket work exactly as before.
• An explicit "require_mcp_auth": false is ...

🔒 Colon-named tools are approved by their exact name — one-time review after upgrade

A tool's approval record, search-index entry and callability are now keyed by the exact name its server reports, colons included. Earlier releases filed a namespaced tool such as ns:erase under the text after its first colon, so it shared — and silently inherited — the approval of a sibling erase on the same server. Every dispatch path (call_tool_*, direct-name dispatch on /mcp/all, call_tool() inside code execution), preflight and describe_tool now resolve exactly the server:tool pair they dispatch.

What changes for you

• On manual (default) and scan trust, colon-named tools on a server that already has an approved baseline become pending once, under their own names, on the first discovery after upgrade. They stay uncallable and out of retrieve_tools until you approve them: mcpproxy upstream inspect <server> to review, mcpproxy upstream approve <server> <tool>, the quarantine_security MCP tool, or the Web UI. trust_mode: auto servers and installs with quarantine_enabled: false auto-approve them; no other tool is affected.
• Blocks carry over. A tool you had disabled under the old collapsed name stays disabled under its own name until you enable it there; the log records the carry-over at WARN with both names. A tool that was locked pending review is pending under its own name and is unlocked by approving it by that name — nothing else is needed, and nothing is deleted. A namespaced tool you had toggled in the UI keeps its old review lock (with the before/after evidence) under its own name until you approve it; if its old record approved a different definition than the server reports now, it is held as changed for review, and if it had no old record it is pending under an active gate — a toggle never approves a definition nobody reviewed.
• Unresolved names are refused for everyone. A call to a tool that a connected server's discovered tool set does not contain is refused before any upstream call, for administrators too — while the server's discovery has not completed, retry shortly; afterwards, refresh with retrieve_tools and retry with a listed name. Quarantined, disabled and disconnected servers keep their existing answers: a call to a disconnected server still gets the not-connected / reconnect_on_use answer, and once the server reconnects and completes discovery, a name that result does not list is refused as unresolved — it is never dispatched.

Details: Security Quarantine → Namespaced tool names and Agent Tokens → Target tool tier.

This release focuses on bug fixes and improved tool identity enforcement, enhancing reliability and security across both editions.

New Features

• Exact tool identity enforcement - MCPProxy now enforces exact raw-name tool identity on every dispatch path, ensuring tools are precisely identified and invoked according to Spec 105 (FR-009). This enhances security and prevents ambiguous tool resolution. (Both editions)

Bug Fixes

• Improved search matching - Fixed search functionality to correctly match non-contiguous underscore segments in tool names, making it easier to find tools with complex naming patterns. (Both editions)

• Token quota enforcement - Fixed per-owner agent token quotas to properly enforce limits, preventing agents from exceeding their allocated token budgets. (Teams edition)

• Windows stability - Resolved a critical heap crash issue on Windows caused by recovered panics, and fixed a race condition in Pass-2 temporary directory handling that could cause build instability. (Both editions)

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key

This release focuses on important security and stability fixes, along with OAuth authorization improvements.

Bug Fixes

• Fixed OAuth authorization handling - The proxy now correctly honors OAuth configuration blocks for upstreams that authorize per method, ensuring proper authentication flow for method-specific permissions
• Closed residual security scope gaps - Addressed additional security scope issues to improve overall system security posture
• Fixed log sink memory leak - Server log sinks are now properly released on every disconnect, preventing potential memory accumulation over time

Improvements

• Enhanced telemetry reliability - Telemetry counter delivery is now idempotent, preventing duplicate counter submissions and improving metrics accuracy

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key