github samanhappy/mcphub v1.0.33
on GitHub

5 hours ago

Summary

This release rounds out OpenAPI integration and tightens security boundaries. OpenAPI imports now support urlencoded and multipart request bodies, serialize array query parameters per the spec, encode path parameters before URL substitution, and can prefill security from the spec's securitySchemes or a dedicated openapi.specSecurity credential. Security-wise, shared-server use is separated from config disclosure, template import enforces the privileged config check, and hidden-server tool calls return a unified "not available" error. Server names are now validated against the MCP tool-name charset, OAuth gains RFC 9207 issuer identification and CIMD client support, and the share-candidates picker scales better for large user sets.

Features

  • feat(oauth): add RFC 9207 issuer identification and CIMD client support by @samanhappy in #1075
  • feat: surface OpenAPI import tool-list size with context-window warning by @samanhappy in #1092
  • feat: prefill OpenAPI security from the spec's securitySchemes when importing by @samanhappy in #1093
  • feat(openapi): separate spec download credential via openapi.specSecurity by @samanhappy in #1097
  • feat: validate server names against the MCP tool-name charset (#1076) by @samanhappy in #1100
  • feat: improve share-candidates picker for large user sets by @samanhappy in #1107

Fixes

  • docs: update README for clarity on website and production support by @samanhappy in #1071
  • fix: handle missing ps when killing stdio process trees (#1072) by @samanhappy in #1073
  • fix(security): separate shared server use from config disclosure by @samanhappy in #1085
  • fix(frontend): show specific password rule errors instead of generic message by @samanhappy in #1086
  • fix: send declared request bodies on DELETE OpenAPI tool calls by @samanhappy in #1088
  • fix: encode OpenAPI path parameters before URL substitution by @samanhappy in #1089
  • fix: support urlencoded and multipart OpenAPI request bodies by @samanhappy in #1090
  • fix: serialize OpenAPI array query params per spec default (#1080) by @samanhappy in #1091
  • fix(security): enforce privileged config check on template import by @samanhappy in #1096
  • fix: move OpenAPI prefill and footprint analysis inline by @samanhappy in #1099
  • fix: re-read mcp_settings.json on external edits to match server definitions by @samanhappy in #1101
  • fix: return unified "not available" MCP error for hidden-server tool calls (#1103) by @samanhappy in #1106
  • fix: launch node directly in Docker to avoid runtime Corepack download by @samanhappy in #1109

摘要

本版本完善了 OpenAPI 集成并进一步加固了安全边界。OpenAPI 导入现在支持 urlencoded 与 multipart 请求体、按规范序列化数组查询参数、在 URL 替换前对路径参数进行编码，并可从规范的 securitySchemes 或专用的 openapi.specSecurity 凭据预填安全配置。安全方面，共享服务器使用与配置披露相分离，模板导入强制执行特权配置检查，隐藏服务器的工具调用统一返回"不可用"错误。服务器名称现在会对照 MCP 工具名称字符集进行校验，OAuth 新增 RFC 9207 签发者识别与 CIMD 客户端支持，分享候选选择器在大用户集下也更具扩展性。

功能

  • 新增 OAuth RFC 9207 签发者识别与 CIMD 客户端支持 by @samanhappy in #1075
  • 导入时显示 OpenAPI 工具列表大小并给出上下文窗口警告 by @samanhappy in #1092
  • 导入时从规范的 securitySchemes 预填 OpenAPI 安全配置 by @samanhappy in #1093
  • 通过 openapi.specSecurity 单独提供规范下载凭据 by @samanhappy in #1097
  • 校验服务器名称是否符合 MCP 工具名称字符集 by @samanhappy in #1100
  • 针对大型用户集优化分享候选选择器 by @samanhappy in #1107

修复

  • 更新 README 以更清晰地说明网站与生产支持 by @samanhappy in #1071
  • 处理终止 stdio 进程树时缺少 ps 命令的情况 by @samanhappy in #1073
  • 将共享服务器使用与配置披露相分离 by @samanhappy in #1085
  • 在前端显示具体的密码规则错误而非通用提示 by @samanhappy in #1086
  • 在 DELETE OpenAPI 工具调用时发送声明的请求体 by @samanhappy in #1088
  • 在 URL 替换前对 OpenAPI 路径参数进行编码 by @samanhappy in #1089
  • 支持 OpenAPI 的 urlencoded 与 multipart 请求体 by @samanhappy in #1090
  • 按规范默认值序列化 OpenAPI 数组查询参数 by @samanhappy in #1091
  • 在模板导入时强制执行特权配置检查 by @samanhappy in #1096
  • 将 OpenAPI 预填与足迹分析内联处理 by @samanhappy in #1099
  • 在外部编辑时重新读取 mcp_settings.json 以匹配服务器定义 by @samanhappy in #1101
  • 隐藏服务器工具调用统一返回"不可用"MCP 错误 by @samanhappy in #1106
  • 直接在 Docker 中启动 node 以避免运行时下载 Corepack by @samanhappy in #1109

References

  • docs: update README for clarity on website and production support by @samanhappy in #1071
  • fix: handle missing ps when killing stdio process trees (#1072) by @samanhappy in #1073
  • feat(oauth): add RFC 9207 issuer identification and CIMD client support by @samanhappy in #1075
  • fix(security): separate shared server use from config disclosure by @samanhappy in #1085
  • fix(frontend): show specific password rule errors instead of generic message by @samanhappy in #1086
  • fix: send declared request bodies on DELETE OpenAPI tool calls by @samanhappy in #1088
  • fix: encode OpenAPI path parameters before URL substitution by @samanhappy in #1089
  • fix: support urlencoded and multipart OpenAPI request bodies by @samanhappy in #1090
  • fix: serialize OpenAPI array query params per spec default (#1080) by @samanhappy in #1091
  • feat: surface OpenAPI import tool-list size with context-window warning by @samanhappy in #1092
  • feat: prefill OpenAPI security from the spec's securitySchemes when importing by @samanhappy in #1093
  • fix(security): enforce privileged config check on template import by @samanhappy in #1096
  • feat(openapi): separate spec download credential via openapi.specSecurity by @samanhappy in #1097
  • fix: move OpenAPI prefill and footprint analysis inline by @samanhappy in #1099
  • feat: validate server names against the MCP tool-name charset (#1076) by @samanhappy in #1100
  • fix: re-read mcp_settings.json on external edits to match server definitions by @samanhappy in #1101
  • fix: return unified "not available" MCP error for hidden-server tool calls (#1103) by @samanhappy in #1106
  • feat: improve share-candidates picker for large user sets by @samanhappy in #1107
  • fix: launch node directly in Docker to avoid runtime Corepack download by @samanhappy in #1109
  • Full changelog: v1.0.32...v1.0.33
Check out latest releases or
releases around samanhappy/mcphub v1.0.33

Don't miss a new mcphub release

NewReleases is sending notifications on new releases.

Get notifications