smart-mcp-proxy/mcpproxy-go v0.67.0

on GitHub

🔒 Colon-named tools are approved by their exact name — one-time review after upgrade

A tool's approval record, search-index entry and callability are now keyed by the exact name its server reports, colons included. Earlier releases filed a namespaced tool such as ns:erase under the text after its first colon, so it shared — and silently inherited — the approval of a sibling erase on the same server. Every dispatch path (call_tool_*, direct-name dispatch on /mcp/all, call_tool() inside code execution), preflight and describe_tool now resolve exactly the server:tool pair they dispatch.

What changes for you

• On manual (default) and scan trust, colon-named tools on a server that already has an approved baseline become pending once, under their own names, on the first discovery after upgrade. They stay uncallable and out of retrieve_tools until you approve them: mcpproxy upstream inspect <server> to review, mcpproxy upstream approve <server> <tool>, the quarantine_security MCP tool, or the Web UI. trust_mode: auto servers and installs with quarantine_enabled: false auto-approve them; no other tool is affected.
• Blocks carry over. A tool you had disabled under the old collapsed name stays disabled under its own name until you enable it there; the log records the carry-over at WARN with both names. A tool that was locked pending review is pending under its own name and is unlocked by approving it by that name — nothing else is needed, and nothing is deleted. A namespaced tool you had toggled in the UI keeps its old review lock (with the before/after evidence) under its own name until you approve it; if its old record approved a different definition than the server reports now, it is held as changed for review, and if it had no old record it is pending under an active gate — a toggle never approves a definition nobody reviewed.
• Unresolved names are refused for everyone. A call to a tool that a connected server's discovered tool set does not contain is refused before any upstream call, for administrators too — while the server's discovery has not completed, retry shortly; afterwards, refresh with retrieve_tools and retry with a listed name. Quarantined, disabled and disconnected servers keep their existing answers: a call to a disconnected server still gets the not-connected / reconnect_on_use answer, and once the server reconnects and completes discovery, a name that result does not list is refused as unresolved — it is never dispatched.

Details: Security Quarantine → Namespaced tool names and Agent Tokens → Target tool tier.

This release focuses on bug fixes and improved tool identity enforcement, enhancing reliability and security across both editions.

New Features

• Exact tool identity enforcement - MCPProxy now enforces exact raw-name tool identity on every dispatch path, ensuring tools are precisely identified and invoked according to Spec 105 (FR-009). This enhances security and prevents ambiguous tool resolution. (Both editions)

Bug Fixes

• Improved search matching - Fixed search functionality to correctly match non-contiguous underscore segments in tool names, making it easier to find tools with complex naming patterns. (Both editions)

• Token quota enforcement - Fixed per-owner agent token quotas to properly enforce limits, preventing agents from exceeding their allocated token budgets. (Teams edition)

• Windows stability - Resolved a critical heap crash issue on Windows caused by recovered panics, and fixed a race condition in Pass-2 temporary directory handling that could cause build instability. (Both editions)

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy

mcpproxy serve                           # Start server
mcpproxy serve --listen 127.0.0.1:8081  # Custom port
export MCPPROXY_API_KEY=your-secret-key  # Set API key