smart-mcp-proxy/mcpproxy-go v0.72.0

on GitHub

This release strengthens security with improved quarantine scanning defaults, adds flexible TLS certificate configuration, and delivers numerous stability fixes across authentication, logging, and URL handling.

New Features

• Quarantine scanning is now the default trust mode with automatic approval for clean-scanned contract changes (Spec 119)
• TLS certificate customization: serve certificates for custom domains via extra_sans, cert_file, and key_file configuration (Teams)
• File-based secrets: support ${file:/absolute/path} references in configuration (Spec 111)
• Rate limiting: per-token call rate limits for agent tokens (Teams)
• API key from file: read API keys from MCPPROXY_API_KEY_FILE environment variable
• Signed TPA bundles: cryptographically signed Threat Pattern Archive format with automatic refresh and downgrade protection (Spec 101)
• Access profile suggestions: mcpproxy access suggest converts blocked calls into profile configuration changes
• Query string API key blocking: mcp_reject_query_apikey option refuses ?apikey= credentials on MCP endpoints
• OAuth browser page branding after sign-in
• Automatic tool rescanning when definitions change (Spec 118)

Bug Fixes

• Security: prevent upstream tool schemas from loading local files
• Security: sanitize API keys, tokens, and credentials in logs (GitHub PATs, Anthropic keys, OpenAI keys, JWTs, Bearer tokens)
• Authentication: drop caller-sent _auth_* arguments before stamping activity identity (Teams)
• Authentication: case-insensitive Bearer scheme handling for user JWTs and HTTP API
• URL encoding: properly escape and decode server/tool names in URLs and API paths
• IPv6: correctly derive registry source IDs from full IPv6 addresses
• Windows: classify npx.cmd and uvx.exe as package runners in security scanner
• Observability: label HTTP metrics by route pattern instead of raw paths; mask API keys in spans
• Storage: fix transaction handling in activity streaming to prevent deadlocks
• OAuth: keep pending logins alive across quarantine scans; parse resource_metadata per RFC 7235
• Configuration: read <data-dir>/mcp_config.json and honor MCPPROXY_DATA_DIR
• MCP protocol: preserve compact tool routing guidance and structured errors
• UI: distinguish tool approval status from callable readiness
• NPM: don't cache failed package lookups

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy