Skip to content
  1. Home
  2. Changelog
Back to home
Release history

Changelog

32 releases shipped — every feature, fix, and security improvement on the record. Latest: v0.17.6 on 2026-09-16.

Showing 32 releases matching any change

  1. v0.17.6

    2026-09-16

    Latest3 changes
    • fixedCanary values can no longer read as placeholders — CSPRNG noise occasionally spelled a placeholder marker (`xxx` turns up in a 74-char body roughly once every few hundred draws), and `scan` would then report the planted canary as a placeholder instead of a secret. Every canary format now regenerates until the value passes the same heuristic `scan` uses
    • fixedTest suite: the canary alert registry's 0600 mode assertion is skipped on Windows, where chmod is a no-op — the Windows compat job had been failing on it since 0.17.5
    • securityDependency floors: hono ≥ 4.13.5 (three moderate advisories in the transitive MCP transport dependency); in-range bumps for zod, @types/node, eslint, typescript-eslint

  2. v0.17.5

    2026-09-11

    5 changes
    • addedWrap policy — `.q-ring.json` gains a `policy.wrap` block for the airlock: allowTools / denyTools with `*` globs (deny wins), approveTools that run only while a `qring mcp approve <tool>` grant is live, a global rateLimit plus per-tool toolRateLimits (sliding windows), and a redactResults switch; denied tools are hidden from tools/list and refused with a policy_deny audit event, and an unparseable policy fails closed like the rest of the engine
    • addedAirlock v2 — `qring mcp wrap` now proxies resources (list, templates, read, subscribe) and prompts (list, get), relays list_changed / updated notifications, advertises exactly the capabilities the wrapped server has, wraps remote Streamable HTTP servers with `--url` (`--header`, `--auth-secret KEY` for a Bearer token read from q-ring), and scrubs known secret values from every tool result, resource, and prompt before they reach the transcript (`--no-redact` or `wrap.redactResults: false` opts out)
    • addedCanary v2 — honeytokens imitate thirteen real issuer shapes (aws, aws-secret, github, github-pat, openai, openai-project, anthropic, stripe, gitlab, slack, google, npm, generic); trips can page you via `qring canary alert add --discord | --slack | --ntfy | --url` webhook channels, SSRF-guarded, throttled with the desktop alert and never carrying the fake value; `qring canary plant KEY --push github` (or vercel / cloudflare) plants a tripwire and seeds it into a deployment platform's secrets without reading it back
    • addedAgent session timeline — audit events folded into one timeline per MCP client process (pid + clientInfo label) and per airlock session (correlation id, wrapped command as the label), with window, event and denial counts, and key names touched — never values; surfaced as an expandable Agent Sessions (24h) dashboard card, `qring audit:sessions [--agent] [--since 24h|7d] [-v]`, and two MCP resources, `qring://sessions` and `qring://sessions/{id}`, which strip canary trips and go dark when policy denies the audit_log tool
    • changed`qring mcp wrap` no longer requires a tools capability on the wrapped server — at least one of tools, resources, or prompts is enough

  3. v0.17.0

    2026-09-11

    4 changes
    • addedMCP tool annotations — all 44 tools advertise readOnlyHint, destructiveHint, idempotentHint, and openWorldHint from a single table, so hosts can auto-approve the 27 read-only tools and confirm destructive or open-world ones (delete_secret, rotate_secret, exec_with_secrets, …); a test lists tools over a real MCP session and checks every tool carries every hint
    • fixedClaude Code plugin always-on rules — a plugin install never loaded the plugin-root CLAUDE.md, so `/plugin install qring@q-ring` shipped commands, agents, and skills but none of the secret-hygiene rules; they now ship as a generated `secret-hygiene-rules` skill built from the Cursor rules, and the validator passes clean
    • fixedREADME MCP config paths (Kiro reads `.kiro/settings/mcp.json`; Claude Code reads a project `.mcp.json`, not Claude Desktop's config) and keychain-first descriptions on npm, the MCP Registry, and the Cursor and Claude plugin manifests
    • fixedSmithery listing now shows all 44 tools — bundles publish through the registry API with the server's live tools/list attached instead of the CLI, which could not carry tool schemas

  4. v0.16.2

    2026-09-03

    3 changes
    • securityCanaries no longer self-identify (no default description readable via inspect_secret), bulk export trips them like a read, and trip records are operator-only — MCP audit_log and export_audit never expose `canary` events; audit rendering strips control characters
    • fixedAirlock protocol fidelity — long-running wrapped tools are governed by the host's own timeout with a generous airlock ceiling (QRING_WRAP_TIMEOUT_MS), and the per-agent `agent` label is visible in `qring audit` output and filterable with `--agent`
    • added`qring canary disarm <key>` — clears the canary flag so reads stop alarming; the stored value stays fake until overwritten

  5. v0.16.1

    2026-08-17

    1 change
    • changedRicher MCP Registry listing — server.json now carries the optional metadata registries render: title, websiteUrl (qring.i4c.studio), brand icons, an npx runtime hint, and declarations for the three install-relevant environment variables (QRING_BACKEND, QRING_FILE_PASSPHRASE, QRING_FILE_BACKEND_PATH), so MCP clients and directories can render a proper config form instead of a bare package name; no runtime changes