smart-mcp-proxy/mcpproxy-go v0.66.0

on GitHub

⚡ code_execution is now on by default

The sandboxed JavaScript/TypeScript code_execution tool — one request that orchestrates several upstream tool calls, with loops, conditionals and data transformation in between — ships enabled starting with this release. Previously it had to be switched on by hand.

What changes for you

• New installs get "enable_code_execution": true in mcp_config.json and see the tool in tools/list on the default /mcp endpoint.
• Existing installs: an explicit value in the file wins. mcpproxy writes every setting when it saves the config, so a mcp_config.json created by an earlier release carries "enable_code_execution": false and stays off. To get the tool, flip it to true in the file or in Settings → Enable code execution tool — the change is hot-reloaded and connected clients receive notifications/tools/list_changed, no restart needed.
• A hand-written config that omits the key turns the tool on at the next start or hot reload. If you maintain the file yourself and want it off, add "enable_code_execution": false before upgrading.
• To keep it off, set "enable_code_execution": false. As of this release a disabled tool is no longer advertised at all (#1236): it disappears from tools/list instead of being listed as a stub that refuses every call.

The sandbox has no filesystem, network or require(). call_tool from inside a script goes through the same gates as a direct call_tool_* request — quarantine, agent-token scope, per-server restrictions and, as of this release, output_sanitisation redact/block — and each run is bounded by code_execution_timeout_ms (default 2 min; a script that overruns is now interrupted, not just abandoned) and code_execution_max_tool_calls. Details: docs/features/code-execution.

🔒 Agent-token scope hardening

Five fixes close the places where an agent token restricted to a subset of servers could still learn about, or act on, servers outside its grant: call_tool_* now requires the target tool's tier and fails closed on an unresolved one (#1223); upstream_servers tail_log (#1224), set_profile responses (#1225), read_cache entries (#1226) and aggregated prompts (#1227) are all scoped to the calling token. No configuration change is needed; if you hand out scoped agent tokens (mcpproxy token create --servers …), upgrade.

The registry SSRF guard now also unwraps IPv6 transition addresses (6to4, NAT64, Teredo, IPv4-compatible) and blocks the embedded IPv4 when it is private or link-local (#1235, thanks @aroh3006).

🪟 Windows: stdio servers no longer leak child processes

Restarting, reconnecting or disconnecting a stdio server on Windows used to leave its node.exe / python.exe grandchildren running forever (one report counted 413 orphans after an hour). Every spawned server is now wrapped in a Job Object that is closed on every disconnect and stop path, so the whole tree goes with it (#1234, thanks @LocoLoboZ; #1260). If you have orphans from earlier builds, end them once by hand — this release cannot reach processes it did not start.

🩺 "Token expired" on servers that no longer use OAuth

A server switched from OAuth to a static Authorization header stayed unhealthy / Token expired / action: login forever, because a stale record in the oauth_tokens bucket outranked the current config (#1172). Such servers now report from their live connection; the dead record is ignored (and mcpproxy auth logout <server> still removes it).

This release focuses on critical security hardening and process management improvements, particularly for Windows systems.

Security Fixes (Teams Edition)

• Authorization enforcement: Fixed multiple authorization bypass vulnerabilities:
  • Tool calls now properly enforce tier-based permissions, failing closed on unresolved tiers
  • Cache reads are now gated by the authorization that created the entry
  • Server log access is scoped to caller's authorized servers only
  • Profile operations are properly scoped to caller's token
  • Aggregated prompts now authorize by canonical owner and prevent profile enumeration on deleted pins
• SSRF protection: Blocked IPv6 transition addresses (Teredo, 6to4, etc.) in the SSRF guard to prevent network-based attacks

Bug Fixes

Windows (Personal & Teams)

• Fixed child process cleanup by implementing proper Job Object management
• Resolved Job Object release issues on disconnect and stop operations

OAuth & Authentication (Teams Edition)

• Health checks no longer incorrectly judge header-auth servers using stale OAuth token records
• Daemon mode now prints OAuth authorization URLs for easier authentication

Core Functionality

• Fixed issue where code_execution tool was advertised even when disabled in configuration
• Corrected database compaction lock token generation to be clock-independent
• Resolved UI state assertion errors from v0.65.0

New Features

• Code execution enabled by default: The code_execution tool is now enabled out of the box for faster onboarding
• Improved daemon authentication: OAuth URLs are printed in daemon mode for streamlined login flows

Other Changes

• macOS installer PKG now displays correct panes and certificate trust information
• Docker image builds re-enabled for stable releases (Teams Edition)

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key