smart-mcp-proxy/mcpproxy-go v0.73.0

on GitHub

This release focuses on security hardening, performance improvements, and enhanced OAuth reliability following third-party security assessment findings.

New Features

• Teams: Filter retrieve_tools by upstream server for better tool management (#1836)
• Teams: SkillSpector-informed checks added to built-in tool scanner for improved security analysis (#1818)
• Teams: Opt-in recovery mechanism for lost OAuth refresh token responses (#1828)
• Teams: Opt-in per-upstream argument-error redaction to protect sensitive data (#1798)
• Teams: Stateless list surfaces implementation (MCP Spec 058 US3) (#1691)

Security Fixes

• Fixed multiple round-2 security findings from third-party assessment: scanned baseline enforcement, diacritics handling, name squatting prevention (R2-1 through R2-5) (#1714)
• Identical tool definitions across servers no longer incorrectly flagged as shadowing clones (#1838)
• Approval-locked tools now properly withheld from REST index search (#1826)
• Registry-supplied text properly escaped in catalog search and show commands (#1767)
• Bearer credentials and unsigned JWTs now fully masked in logs (#1792)
• Config-to-secret conversion blocked for values containing references (#1782)

Bug Fixes

• Personal: Desktop app now launches correctly over dead core socket without 60-second wait (#1815)
• Teams: Server admission remains human-controlled under default trust tier (#1802)
• Docker isolation: Fixed environment variable passing, --cidfile placement, and Windows path recognition (#1811, #1773, #1777)
• Tool search now correctly resolves qualified tool IDs (#1825)
• init_timeout values above 30 seconds now properly honored on supervisor and reload connects (#1819)
• API key authentication switched from query parameters to X-API-Key headers for Codex and generic clients (#1820)
• Profile pin properly intersected into shared enumeration predicate (MCP Spec 118) (#1821)
• Secret name percent-decoding fixed on DELETE /secrets/{name} endpoint (#1775)
• OAuth metadata discovery URL no longer includes query string (#1757)
• Windows launcher runtime detection improved for .exe/.cmd suffixes (#1778)

Performance Improvements

• Teams: Concurrent tool discovery from multiple servers for faster enumeration (#1814)
• Teams: Per-server capture locks reduce contention (#1813)

Download Installers

Homebrew (macOS/Linux):

brew install smart-mcp-proxy/mcpproxy/mcpproxy