agentveil-mcp-proxy 0.7.36

Release agentveil-mcp-proxy 0.7.36.\n\nHighlights:\n- Public paid activation bridge is available from PyPI.\n- Paid activation writes durable activation/install artifacts for private Runtime Gate consumption.\n- Approval Center paid projection path is included from the merged integration work.\n- Release verification completed against PyPI with exact install of agentveil-mcp-proxy==0.7.36.\n\nVerification:\n- PR #131 CI green.\n- Publish workflow 30035905985 green.\n- PyPI latest: 0.7.36.\n- Clean venv install with --no-cache-dir succeeded.\n- CLI help and paid help rendered.\n- Post-release paid activation bridge smoke passed.\n- Private Runtime Gate consumer smoke selected private_v1 and paid_active projection from public-created artifacts.

agentveil-mcp-proxy 0.7.25

Public beta hardening release for the agentveil-mcp-proxy proof and retry loop.

Added

• events show as the bounded human-readable local evidence view, with JSON and local hash-chain verification options for scripting and CI use.
• Explicit approval retry contract fields for approval-required MCP calls, including same-tool, same-target, and same-payload retry requirements.

Changed

• Clarified the public README and package README around the AgentVeil loop: attempt, decision, controlled path when available, and local proof.
• Improved approval and post-approval copy so users and agents are told to retry the same MCP tool call without changing tool, target, or payload.
• Refined decision messages for classifier and runtime sanity failures so they no longer look like ordinary policy stops.

Verification

• GitHub Actions publish workflow passed full compatibility before PyPI publish.
• agentveil-mcp-proxy==0.7.25 is available on PyPI.
• Clean-venv post-publish smoke passed for CLI version, Claude Code setup/status/remove, approval center lifecycle, and events show --help.

Scope

AgentVeil controls configured project connectors and routed MCP calls. It does not provide machine-wide control or control actions outside configured AgentVeil paths.

agentveil-mcp-proxy 0.7.23

agentveil-mcp-proxy 0.7.23\n\nPublic release for the MCP proxy package after adding project connector setup for Cursor and Claude Code.\n\nHighlights:\n- Project connector setup commands for Cursor and Claude Code.\n- Managed local Approval Center lifecycle for connector setup.\n- Routed MCP proxy approval / block / evidence path remains the core control layer.\n- Public docs updated to describe configured project scope and non-host-wide limitations.\n\nInstall:\n\nbash\npip install agentveil-mcp-proxy==0.7.23\n\n\nPyPI: https://pypi.org/project/agentveil-mcp-proxy/0.7.23/

MCP Proxy 0.7.22

Release agentveil-mcp-proxy 0.7.22.\n\nWhat changed:\n- Publishes the routed MCP Proxy product runtime cut.\n- Includes authority metadata, redirect playbook metadata, approval/block behavior, local evidence/timeline/export surfaces, and installed release acceptance gates for routed MCP tool calls.\n- Keeps scope explicit: MCP Proxy controls only MCP tool calls routed through agentveil-mcp-proxy; actions outside the proxy are not classified or logged.\n\nVerification before publish:\n- PR #69 CI passed on Ubuntu, Windows, and macOS.\n- Fresh clone/fresh venv build and install passed.\n- twine check passed for wheel and sdist.\n- Onboarding gate passed with privacy clean.\n- Product-route acceptance passed with 68 tools, target proof, redirect metadata, evidence summary/timeline/events, and privacy clean.\n\nPyPI: https://pypi.org/project/agentveil-mcp-proxy/0.7.22/

MCP Proxy 0.7.21

Summary

MCP Proxy 0.7.21 publishes the Approval Center foundation in the standalone agentveil-mcp-proxy package.

Included

• Local Approval Center foundation for approval-required MCP Proxy actions.
• Browser open-once behavior for repeated approval-required calls.
• Dashboard/API support for pending approvals.
• Stale/expired/already-decided approval pages.
• client-config print onboarding helper.
• Terminal/none UI modes for non-browser workflows.

Boundary

• This release is scoped to packages/agentveil-mcp-proxy.
• Workflow Guard is not included in this package release.
• This is Approval Center foundation/beta, not a final hosted enterprise Approval Center.

Verification

• PR #63 merged into main with 1 commit and 2 release metadata/doc files.
• GitHub Actions Tests run 27011916534: success.
• Wheel built from merged commit 351cc441b4dc06c2d702dc5220b1f7f995b2924a.
• Release acceptance gate passed with backend registration/check and evidence verification.
• PyPI agentveil-mcp-proxy==0.7.21 published and fresh install verified.

Install

pip install agentveil-mcp-proxy==0.7.21

v0.7.15

[0.7.15] - 2026-05-12

Post-launch polish release: discoverability fixes for the v0.1 MCP Proxy
adapter and Tier 1 differentiator framing per the AgentVeil design principles
roadmap. Zero production code changes; documentation, metadata, and design
narrative only.

Changed

• Bumped PyPI Development Status classifier from 4 - Beta to
  5 - Production/Stable to match the project's commercial-bar discipline.
• Surfaced the agentveil-mcp-proxy MCP transport proxy adapter in the
  top-level README.md integrations table alongside framework adapters,
  Bedrock, and Microsoft AgentMesh.
• Surfaced the MCP transport proxy in README_PYPI.md features list and
  added a dedicated section with quick-start commands and a link to the
  subproject README.
• Added mcp-proxy keyword to pyproject.toml for PyPI search discovery.
• Reframed customer-facing authorization narrative as capability tokens
  (signed, scoped, time-bounded, replay-resistant, attenuatable) per Mark
  Miller (2006) and Macaroons (NDSS 2014) discipline. AVP's existing
  similar_5m scope expansion already implements these properties; this
  release names them explicitly.
• Adjusted customer copy to acknowledge HRU 1976 undecidability of the general
  access-control safety problem. AVP claims constrained, auditable, reversible
  decisions within the practically decidable policy subset, not unconditional
  safety.
• Updated public repository URL references in README.md, README_PYPI.md,
  pyproject.toml, AGENTS.md, and agentveil_mcp/server.py, and refreshed
  customer-facing example paths in agentveil_mcp/README.md,
  examples/proof_pack/README.md, and mcp_server/README.md from avp-sdk
  to agentveil-sdk after the GitHub repository rename for brand consistency
  with the agentveil PyPI package name. Operator-local
  /Users/.../avp-sdk-public release-smoke paths remain unchanged.
• Added an MCP transport proxy "what's new" callout to the top-level
  README.md hero section surfacing the v0.7.15 ship and IDE client coverage
  without disrupting the AVP product-led hero tagline.

Added

• New design principles document at
  docs/MCP_PROXY_DESIGN_PRINCIPLES.md
  mapping AgentVeil MCP Proxy architecture to the eight Saltzer-Schroeder
  (1975) principles: economy of mechanism, fail-safe defaults, complete
  mediation, open design, separation of privilege, least privilege, least
  common mechanism, and psychological acceptability.

Audit References

• Discoverability fixes: PL-1, PL-2, PL-3, PL-4, caught reviewer-side after
  the P11.5 ceremony.
• Differentiator items: #1 Saltzer-Schroeder citation, #2 HRU honest framing,
  #3 capability discipline reframing - Tier 1 free items from
  avp_mcp_proxy_differentiators_roadmap.md.

Validation

• No production code changes. Pytest baseline unchanged: 642 passed, 1 skipped.
• Bandit static analysis unchanged: 6 LOW, 0 MEDIUM, 0 HIGH.
• All refined customer-facing wording scans (AI-attribution, prohibited
  product terminology, production-grade strict reading) return zero matches
  post-edit.

v0.7.14

[0.7.14] - 2026-05-11

AgentVeil MCP Proxy v0.1 first public release. Action Control Plane for IDE
MCP clients wrapping downstream MCP servers with runtime decision gating,
human approval routing, durable signed evidence, and replay defense.

Added

• Added the agentveil-mcp-proxy console script and
  python -m agentveil_mcp_proxy entry point for MCP transport proxy
  operation.
• Added encrypted local proxy identity storage with Argon2id and SecretBox,
  passphrase-file support, AVP_PROXY_PASSPHRASE, a 12-character minimum for
  new identities, and documented passphrase-source trade-offs.
• Added Runtime Gate integration with DecisionReceipt verification, schema
  enforcement, audit ID binding, payload hash binding, risk class binding,
  policy context hash binding, and circuit breaker handling.
• Added a local TTL-capped DecisionReceipt replay cache as a v0.1 compensating
  control before the backend nonce/freshness protocol update.
• Added the loopback browser approval server with CSRF checks, HMAC cookies,
  per-prompt tokens, Content-Length bounds, socket timeouts, and
  ThreadingHTTPServer.
• Added a durable SQLite evidence store with WAL mode, hash chaining, fsync
  durability, owner-only permissions, and auxiliary WAL/SHM permission
  hardening after commits.
• Added offline evidence bundle export and verification covering chain
  integrity, signed receipt validation, receipt binding checks, audit ID
  matching, and receipt-reference dedupe.
• Added headless approval mode and bounded headless policy support with
  owner-only policy-file validation.
• Added built-in policy packs for default, github, filesystem, and
  shell, including broadened destructive coverage for purge_*,
  truncate_*, wipe_*, format_*, rm, rmdir_*, unlink_*, and
  clean_* patterns where applicable.
• Expanded destructive classification prefixes with purge, truncate,
  wipe, format, rm, rmdir, unlink, and clean.
• Added cross-platform CI coverage across 3 operating systems and 4 Python
  versions, workflow dispatch support, pinned GitHub Actions SHAs, and
  permissions: contents: read.
• Added env_passthrough blocking for the reserved AVP_* prefix so proxy
  secrets cannot be forwarded to downstream MCP servers by configuration.
• Added the MCP Proxy subproject README and the operations guide at
  docs/MCP_PROXY_OPERATIONS.md.

Security

• Completed the P10.5 security audit remediation train: 12 MEDIUM and 8 LOW
  findings were identified across independent passes; 10 MEDIUM findings were
  closed in P10.6-P10.10, M-2 received the local replay-cache mitigation, and
  M-10 was deferred to v0.1.1.
• Completed the post-P10.9 mid-train audit: 2 MEDIUM and 3 LOW findings were
  identified; MT-1, MT-2, and MT-3 were closed in P10.10, while MT-4 and MT-5
  were accepted as v0.1 LOW risk.
• Annotated the 14-site Bandit B608 SQL false-positive cluster with narrow
  # nosec B608 rationale comments.
• Verified public documentation surfaces for attribution wording and prohibited
  product terminology.
• Added receipt audit_id cross-checking and duplicate receipt-reference
  rejection to the offline verifier.
• Added positive-value validation for RuntimeGateClient replay-cache settings.
• Hardened CLI identity, config, and grant writes with file fsync and parent
  directory fsync.
• Added a 1 MiB client-to-proxy JSON-RPC line cap matching the downstream
  message cap.
• Bounded downstream response bookkeeping with in-flight ID tracking,
  TTL-pruned timed-out IDs, unsolicited-response counting, and retained
  response caps.
• Required DecisionReceipt schema, audit ID, and receipt binding fields in
  offline evidence verification.

Known Limitations

• Backend protocol nonce/freshness: the local replay cache mitigates
  same-process replays within a five-minute window. The v0.1.1 protocol update
  adds backend-issued nonce plus issued_at and expires_at fields to a new
  decision_receipt/3 schema. Same-intent replays across proxy restarts and
  against a compromised backend response channel remain possible in v0.1.
• Windows Job Object race: Windows downstream process containment has a
  narrow start() window where a child process can spawn descendants before
  assignment to the Job Object. Use an external Windows service supervisor for
  production Windows deployments until the v0.1.1 fix lands.
• OS keychain identity storage: v0.1 uses passphrase-encrypted Argon2id
  identity files. v0.1.1+ adds opt-in macOS Keychain, Linux Secret Service, and
  Windows Credential Manager integration.
• P7a WAL/SHM creation-window race: the evidence store chmods auxiliary
  SQLite files after every commit; a small in-flight transaction window still
  depends on the user umask. Accepted as v0.1 LOW risk.
• P7b runtime-only chain validation: chain integrity is validated at store
  open and after write transactions; there is no periodic background chain
  validation during a long-running proxy. Periodic restarts are the v0.1
  mitigation.
• MT-4 receipt cache eviction under sustained burst: sustained high-volume
  legitimate receipts can evict captured receipts before the nominal TTL,
  weakening local replay defense in adversarial timing scenarios. The v0.1.1
  protocol nonce/freshness fix supersedes this mitigation.
• MT-5 granted_by_request_id reference validation: the verifier does not
  dereference cache-hit granted_by_request_id values to prove the referenced
  record exists in the same bundle. Manual auditors should cross-check those
  references when reviewing cache-hit evidence.

Audit References

• Closed P10.5-security findings: M-1, M-3, M-4, M-5, M-6, M-7, M-8, M-9.a,
  M-9.b, M-11, M-12, L-1, L-2, L-3, Codex MEDIUM-1, Codex LOW-2, and
  Codex LOW-3.
• Closed mid-train audit findings: MT-1, MT-2, and MT-3.
• Partial mitigation: M-2 local replay cache; full protocol fix deferred to
  v0.1.1.
• Deferred v0.1.1: M-2 and M-10.
• Accepted as v0.1 LOW risk: MT-4, MT-5, P7a residual, and L-4 through L-8.
• Commits: 0e6583c (P10.6), 5c14f37 (P10.7), 5a89148 (P10.8),
  de43147 (P10.9), 3577e4b (P10.10), and bddf600 (P10.11).

Validation

• P11 release gate passed: main CI matrix green on 12/12 cells, full local
  pytest passed with 642 passed, 1 skipped, Bandit reported 0 HIGH and
  0 MEDIUM findings, pip-audit reported 0 known vulnerabilities, public-surface
  wording scans passed, console scripts worked, build artifacts included the
  MCP Proxy README, and license/security metadata was verified.

Release 0.7.9

agentveil 0.7.9

SDK release for smoother first-run production journeys.

Changed

• Added AVPAgent.get_audit_trail(did=None, limit=50, offset=0) for public audit trail reads.
• search_agents() now preserves agent_did and also adds a did alias for easier client code.
• SDK HTTP helpers retry once on 429 using the server Retry-After header.
• Signed retry paths rebuild the Authorization header per attempt so retries use a fresh nonce.
• Updated package metadata to describe the SDK truthfully as identity, action gates, signed receipts, and proof packets.

Validation

• Full SDK suite: 236 passed, 19 skipped.
• Fresh PyPI install smoke passed for agentveil==0.7.9.
• Full production external agent journey passed against https://agentveil.dev with agentveil==0.7.9.

PyPI: https://pypi.org/project/agentveil/0.7.9/

Release 0.7.7

Changed

• Aligned public API docs, security notes, roadmap, skill instructions, and
  examples around AgentVeil action control: Runtime Gate, signed receipts,
  advisory reputation APIs, and MCP profile/audit surfaces.
• Updated MCP server instructions and Docker entrypoints to use the
  agentveil-mcp console command and clarify the SDK Runtime Gate path for
  risky action execution.
• Updated the quickstart and wheel verification examples to run against the
  current package metadata without requiring a live backend.
• Replaced the default DelegationReceipt purpose text with neutral
  controlled-action wording.
• Made the PyPI publish workflow idempotent when artifacts already exist.

Validation

• PYTHONPATH=. pytest tests/test_delegation_issuance.py tests/test_controlled_action.py -q
  passed.
• PYTHONPATH=. python3 examples/quickstart.py passed.

Release 0.7.6

Changed

• Reframed the public README around AgentVeil action control: local smoke test,
  production integration shape, Runtime Gate, approvals, signed receipts, and
  controlled-action proof packets.
• Moved advisory reputation APIs into a dedicated reference section while
  keeping existing can_trust(...), @avp_tracked(...), and framework tool
  documentation discoverable.
• Updated Features, Security, Proof Pack, and Integrations copy to reduce
  overclaims and match the current SDK/API surface.
• Added Gemini and PydanticAI examples to the integrations table.
• Updated PyPI metadata keywords for action-control, runtime-gate,
  controlled-actions, and signed-receipts positioning.
• Clarified the Microsoft Agent Governance Toolkit / AgentMesh integration and
  softened the Glama directory label while retaining the verified listing.

Validation

• README local/mock snippets pass from a clean editable install.
• Markdown/link sanity checks passed for README tables, fences, and local docs
  links.
• agentmesh-avp==0.1.1 verified to export AVPProvider; README avoids an
  unverified TrustEngine(...) constructor claim.