Changelog

What changed, and when.

Each release is dated and lists what a scan can now see that it could not before. Detection changes that alter results are called out so you can explain a new finding.

  1. v0.1.0

    First public release of the open-source scanner core. MIT-licensed, on PyPI and as a GitHub Action. Full notes in the release on GitHub.

    Checks

    • 16 passive checks: AUTH-01..04, TRANS-01..05, META-01..05, ERR-01, DOS-01.
    • 8 active checks (INJ-01..05, SUPPLY-01/02, SANDBOX-01) registered as gated stubs: they report not_implemented and no payloads are sent.
    • 5 governance items (GOV-01..05) listed as attestation-only in every report. 29 catalogue entries in all.
    • META-02 baselines: canonical SHA-256 of tools, prompts, resources and instructions, diffed against a stored baseline.

    Scanner

    • MCP client for Streamable HTTP and stdio, written to send deliberately non-conformant requests.
    • Protocol fingerprinting: server/discover (2026-07-28), then initialize with 2025-11-25 and 2025-06-18, then the deprecated 2024-11-05 HTTP+SSE transport.
    • Evidence log of every request and response; Authorization values and known secret patterns redacted.
    • Authorisation gate for active mode: --authorised-by, --scope and --verify dns-txt or --verify local, with an authorisation record written next to the report.
    • Opt-out by DNS TXT mcpprobe-opt-out=all at _mcpprobe.<host> or /.well-known/mcpprobe-opt-out, both checked before any MCP request.
    • 5 requests per second by default, hard ceiling 10.
    • JSON, SARIF 2.1.0 and terminal reports; exit codes 0, 1 and 2. Optional LLM-judge hook for META-01; mcpprobe makes no LLM calls itself.

    Site