Summary
This release brings per-user credentials to shared MCP servers: a single shared server definition can now require each caller's own API keys or tokens, managed through the new My Credentials page with bindings encrypted at rest (AES-256-GCM) — so multiple users share one server instead of maintaining duplicate private copies. Reliability is hardened across the board: on-demand servers stay alive while their tools are running, overlapping initialization no longer strands servers in a "connecting" state, transport creation failures are isolated to the affected server, the log-stream reconnect backoff resets correctly, and public auth routes no longer consume the shared /api rate limiter. Interoperability and polish: OpenAPI query arrays serialize correctly, copied MCP configuration uses group names, single-route tool calls survive session rebuilds, and the js-yaml, hono, and multer dependencies are updated.
Features
- add per-user credentials for shared MCP servers by @samanhappy in #1129
Fixes
- fix: serialize OpenAPI query arrays correctly by @emecii in #1138
- fix: update btn-primary border to transparent for improved styling by @samanhappy in #1141
- fix: use group names in copied MCP configuration by @samanhappy in #1142
- chore(deps): bump multer from 2.2.0 to 2.3.0 by @app/dependabot in #1146
- chore(deps): bump hono from 4.12.34 to 4.13.5 by @app/dependabot in #1147
- chore(deps): bump js-yaml from 4.3.1 to 4.3.2 by @app/dependabot in #1148
- fix: preserve single-route tool calls after session rebuild by @samanhappy in #1149
- fix(routes): stop the shared /api rate limiter from counting public auth routes by @11113127 in #1152
- fix(logs): reset the log-stream reconnect backoff on open, not on every attempt by @11113127 in #1153
- fix(mcp): isolate transport creation failures to the affected server by @11113127 in #1156
- fix(mcp): stop overlapping inits from stranding servers on 'connecting' by @11113127 in #1157
- fix: keep on-demand servers alive while tools are running by @yunfeizhu in #1164
摘要
本版本为共享 MCP 服务器引入了按用户的凭据支持：同一个共享服务器定义现在可以要求每位调用者提供各自的 API 密钥或令牌，通过新增的「我的凭据」（My Credentials）页面管理绑定，并以 AES-256-GCM 加密存储在静态数据中——这样多位用户共享一个服务器，而无需各自维护重复的私有副本。可靠性全面增强：按需启动的服务器在工具运行期间保持存活，重叠初始化不再让服务器卡在「connecting」状态，传输创建失败被隔离到受影响的服务器，日志流重连退避逻辑正确重置，公共认证路由也不再占用共享的 /api 限流器。互操作性与细节打磨：OpenAPI 查询数组正确序列化，复制的 MCP 配置使用分组名称，会话重建后单路由工具调用得以保留，并更新了 js-yaml、hono、multer 依赖。
功能
- 为共享 MCP 服务器添加按用户凭据支持 by @samanhappy in #1129
修复
- 正确序列化 OpenAPI 查询数组 by @emecii in #1138
- 将 btn-primary 边框更新为透明以改进样式 by @samanhappy in #1141
- 在复制的 MCP 配置中使用分组名称 by @samanhappy in #1142
- 将 multer 从 2.2.0 升级到 2.3.0 by @app/dependabot in #1146
- 将 hono 从 4.12.34 升级到 4.13.5 by @app/dependabot in #1147
- 将 js-yaml 从 4.3.1 升级到 4.3.2 by @app/dependabot in #1148
- 会话重建后保留单路由工具调用 by @samanhappy in #1149
- 阻止共享的 /api 限流器统计公共认证路由 by @11113127 in #1152
- 在打开而非每次尝试时重置日志流重连退避 by @11113127 in #1153
- 将传输创建失败隔离到受影响的服务器 by @11113127 in #1156
- 阻止重叠初始化使服务器卡在 connecting 状态 by @11113127 in #1157
- 在工具运行时保持按需服务器存活 by @yunfeizhu in #1164
New Contributors
- @yunfeizhu made their first contribution in #1164
References
- fix: keep on-demand servers alive while tools are running by @yunfeizhu in #1164
- refactor: update descriptions to emphasize open-source nature and control plane functionality by @samanhappy in #1160
- fix(mcp): stop overlapping inits from stranding servers on 'connecting' by @11113127 in #1157
- fix(mcp): isolate transport creation failures to the affected server by @11113127 in #1156
- fix(logs): reset the log-stream reconnect backoff on open, not on every attempt by @11113127 in #1153
- fix(routes): stop the shared /api rate limiter from counting public auth routes by @11113127 in #1152
- fix: preserve single-route tool calls after session rebuild by @samanhappy in #1149
- chore(deps): bump js-yaml from 4.3.1 to 4.3.2 by @app/dependabot in #1148
- chore(deps): bump hono from 4.12.34 to 4.13.5 by @app/dependabot in #1147
- chore(deps): bump multer from 2.2.0 to 2.3.0 by @app/dependabot in #1146
- chore: remove deprecated baseUrl from frontend tsconfig by @samanhappy in #1143
- fix: use group names in copied MCP configuration by @samanhappy in #1142
- fix: update btn-primary border to transparent for improved styling by @samanhappy in #1141
- refactor: polish release-notes skill into polish-release by @samanhappy in #1140
- fix: serialize OpenAPI query arrays correctly by @emecii in #1138
- feat: add per-user credentials for shared MCP servers by @samanhappy in #1129
- Full changelog: v1.0.35...v1.0.36