smart-mcp-proxy/mcpproxy-go v0.64.0

on GitHub

⚠️ Security release — please read before upgrading

This release fixes credential-exposure and access-control defects that affect all previously released versions of MCPProxy. Two of them mean shipped versions were weaker than the documentation described. If you have used agent tokens, or connected an OAuth upstream, please read the remediation steps below.

What was wrong

Any agent token could obtain the admin API key (#1180)
GET /api/v1/info returned the global admin API key in its web_ui_url field to any authenticated caller, including a read-only token scoped to a single server. The holder could then act as an administrator.

The practical consequence: allowed_servers was not a security boundary. A scoped token never had to defeat the scope checks — it could read the admin key and stop being scoped. Treat any agent token you have issued as having had administrator-equivalent access.

Upstream credentials were served to unprivileged callers (#1167)
With the opt-in reveal_secret_headers setting enabled, the MCP door correctly required an authenticated administrator, but the REST, SSE and diagnostics doors checked the flag alone. A read-only scoped token received upstream Authorization headers, URL query tokens, command-line arguments and environment values in plaintext from GET /api/v1/servers, GET /api/v1/config and the /events stream.

Token scope was ignored on REST enumeration (#1166)
The MCP surface filtered by allowed_servers; the REST surface did not. Beyond server names, this exposed GET /api/v1/servers/{id}/logs — which serves an upstream server's own stdout/stderr, and therefore anything that server prints — and the activity and tool-call endpoints, which carry tool-call arguments and responses for every configured server.

Credentials were written to the log (#1158)
By severity of exposure, and by the log level required:

No non-default configuration was required for the info row. Anyone who has connected an OAuth upstream has authorization codes in main.log and in terminal scrollback. Authorization codes are single-use and short-lived, so the durable risk is the authorization-URL line: if an upstream URL carries a static token, that token is in the log of every OAuth-enabled install.

What you should do

1. Rotate your MCPProxy API key. Remove api_key from ~/.mcpproxy/mcp_config.json and restart to have a new one generated, or set a new value directly.
2. Revoke and re-mint every agent token (mcpproxy token list, then mcpproxy token revoke <name>). Any token issued before this release should be assumed to have had administrator-equivalent reach.
3. Rotate upstream credentials that appeared in logs. In order of likelihood: any credential embedded in an upstream server URL; any credential passed as a command-line argument; and, if you ran with Docker isolation at debug, upstream environment secrets.
4. Treat existing log files as secret-bearing. ~/.mcpproxy/logs/*.log on Linux, ~/Library/Logs/mcpproxy/*.log on macOS, %LOCALAPPDATA%\mcpproxy\logs\*.log on Windows. Delete them or restrict access; note they may also exist in backups.

Redaction preserves diagnostics — flag names, hosts, paths and parameter names still appear in logs, so debugging a connection is unaffected. Only the credential values are masked.

Reporting

Security issues can be reported privately through GitHub Security Advisories.

This release focuses on comprehensive security hardening to prevent credential exposure and unauthorized access, plus new token usage benchmarking capabilities.

Security Fixes

Critical security improvements - affects both Personal and Teams editions:

• Fixed credential exposure vulnerabilities - Credentials no longer leak through logs, stdout, structured errors, or connection failure messages
• Enhanced authentication and authorization - JWT admin roles and scoped agent tokens now properly derived per owner; REST and SSE endpoints now gate access on caller identity and token scope
• Improved secret masking - MCP server payloads now mask secrets consistently; fixed multiple gaps where raw URLs, argv parameters, and server configurations could expose credentials
• Closed shared-server leaks (Teams edition) - Per-user endpoints no longer leak data across users; shared servers properly masked
• Span verification - Span checksums now determine their input; unverified spans are never trusted

See security advisory for complete details on the credential exposure fixes.

New Features

• Token usage benchmarking - New benchmarking system measures token savings from code execution responses and provides detailed payload decomposition showing where tokens are consumed
• Enhanced threat detection - Third-party application (TPA) findings now point directly at offending words inline in the tool list
• Benchmark replay - Can replay and recompute costs over real recorded workloads using live fleet sources

Bug Fixes

• Stopped retrying deterministic connection failures indefinitely - Connections that will never succeed no longer retry forever
• Fixed isolation state reporting - Now reports effective isolation state instead of treating "inherit" as disabled
• Improved activity logging (Teams edition) - Now records redacted mutation payloads and target server information
• Dependency updates - Bumped transitive dompurify to 3.4.14
• Container toolchain improvements - Docker isolation now uses git-capable images; container toolchain failures properly classified

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key