Changelog

Unreleased - 2026-10-25

Added

• Persistent, operator-defined engagements with allowed targets, exclusions, authorization periods, and optional testing windows.
• Engagement IDs on active assessment tools, with target and time checks before execution. The checks apply to declared targets; they do not prove every secondary request made by an external tool remains in scope.
• Private on-disk evidence records with retrieval by engagement and record ID.
• Paged record and report lists; reports require explicit evidence IDs so older records cannot silently disappear from a client copy.
• Owner-specific metadata indexes so listing records and reports does not load every stored raw output across clients.
• Runtime diagnostics for tool availability and command limits, active Nmap scan listing, and an explicit succeeded/failed/cancelled outcome with run timing on evidence records.
• Analyst-authored findings and Markdown/JSON report retrieval with an evidence index, severity counts, assessment completeness section, optional affected assets/reproduction/retest details, and explicit wording when no findings have been verified.
• A Docker capture profile that opts in to host networking and the network capabilities required for packet capture on Linux.
• Versioned assessment and report prompts, assessment plans, context-quarantined Codex and Claude workers, provider profiles, worker-to-parent evidence import, and evidence-linked model report drafts with an analyst publication gate.
• Local CLI, pinned container, API-draft, and fixed SSH-draft profile types. Daybreak Blue and Red are optional access programs rather than product prerequisites; local-agent keeps engagement packets off hosted APIs.
• OpenAI-compatible chat-completions profiles for loopback servers such as llama.cpp or Ollama and dedicated OpenRouter profiles. Both support report drafting; guarded assessment mode exposes only the plan tool intersection, enforces bounded calls and stop conditions, verifies the served model, and imports model-turn, denial, and run-counter audit receipts.
• Guided wordlist elicitation for authorized names, organization terms, dates, location fragments, and format rules, with private inputs and count/digest evidence instead of clue values.
• Hashcat 8-aware local credential checks: PCFG attack mode 4 using the bundled grammar, hashRecipe for hash mode 4000, and backend device IDs for hosts with supported accelerators. Runtime diagnostics expose the detected Hashcat version, and v8-only requests require an installed v8 binary. Native hosts still supply their own binary; FPGA bridge and hardware remain host-specific.
• Opt-in hostileModelProtection for duplicate action rejection, strict unknown-finish handling, and distrustful token accounting; it defaults off so intentional retests and ordinary provider variants do not cause alarms.
• No-progress reflection, revisioned campaign state, ambiguous-interruption blocking, and reconcileAgentAssessment with explicit operator confirmation and prior-worker scope revocation.
• A real acceptance runner that requires explicit authorization and targets and can require separate tool-using assessment and report profiles.
• T3MP3ST design provenance and a complete Faxbot phased assessment dossier.
• A live OpenRouter draft, guarded-MCP run, and quarantined report-draft acceptance receipt using a hosted model that selected and invoked the real generateWordlist MCP tool and saved an analyst-review report artifact.

Changed

• Stdio and loopback binding are the local defaults. Non-loopback HTTP requires bearer validation, issuer, audience, an allowed-origin list, and an HTTPS public base URL; the Docker HTTP profile always enables authentication and publishes to loopback by default.
• Authenticated HTTP requires separate read, write, and execute token scopes per MCP operation. Stateless HTTP creates a fresh SDK transport for each request, including successive calls by the same client.
• Authenticated HTTP scanner execution requires the separate MCP_REMOTE_EXECUTION_ENABLED=true opt-in. Host privilege auditing is available only through local stdio; hash cracking and packet capture are local stdio tools too.
• External commands stop at the engagement deadline or when its owner closes the engagement, and honor MCP request cancellation. Failed and cancelled runs persist bounded audit evidence.
• Hashcat deviceTypes now selects OpenCL CPU/GPU classes with -D instead of device IDs with -d. backendDevices selects IDs reported by hashcat -I; Hashcat 8 accepts but ignores the retained workloadProfile setting.
• The Dockerfile now builds and installs the signed Hashcat 8.0.0 source release with its PCFG rulesets and a CPU OpenCL runtime, replacing the older Kali package. GPU and FPGA passthrough remain host-specific.
• Scanner evidence now retains Nmap XML and bounded ffuf/Nuclei result files.
• Nuclei requires an operator-selected directory of reviewed, signed HTTP templates and host-wide authorization for its input targets. Its default invocation excludes network/OAST templates, redirects, and update checks.
• URL path exclusions reject ambiguous encoded paths, and enumeration tools reject path-restricted scopes they cannot honor.
• Docker runs as a non-root user and persists engagement data in a private bind mount. The image gives Nuclei templates to the runtime user and no longer grants passwordless sudo or privileged mode by default.
• Docker packaging now copies source before npm ci so its prepare script can compile, and removes Go build caches from the runtime image.
• Report scope text is taken from the registered engagement. Optional SoW notes in a report do not expand executable scope.
• Updated the MCP SDK, Inspector, Express, XML parser, Zod, and transitive dependencies to versions with zero findings in the current npm audit.
• npm packages now include only compiled code and documentation, so workspace scan journals, backups, and tests are excluded from published tarballs.
• Project licensing is now AGPL-3.0-or-later. Logging is always active and the credential-tool guides describe the enforced secret and evidence boundaries.
• Current Context7 provider documentation now drives OpenAI-compatible request behavior: tool_choice is omitted for Ollama compatibility, llama.cpp model paths are accepted, OpenRouter keys are pinned to openrouter.ai, and OpenRouter requests require ZDR, data-collection denial, supported parameters, and no provider fallback.

Removed

• Legacy SSE transport, its Compose profile, and the start:sse package script.
• The unused node-nmap dependency and tracked vendor files under node_modules (the directory remains locally installed and Git-ignored).
• Student/professional response modes, setMode, conditional logging, the public synthetic agent profile, fake acceptance receipts, and the legacy tracked mode-change scan journal.

[0.9.0] - 2026-02-18

Added

• New first-class tools:
  • trafficCapture
  • hydraBruteforce
  • privEscAudit
  • extractionSweep
• New report-admin tools:
  • listEngagementRecords
  • getEngagementRecord
• SoW-aware reporting flow in createClientReport:
  • scopeMode=ask uses MCP elicitation/user invocation
  • falls back to safe default template if declined/unavailable
• Invocation metadata output for the new tools (invocation.clientId, session, scopes, request id when available).
• Bundled MCP Inspector integration:
  • dependency on @modelcontextprotocol/inspector@^0.20.0
  • new CLI entry path: pentest-mcp inspector
• Command execution controls:
  • MCP_COMMAND_TIMEOUT_MS
  • MCP_COMMAND_OUTPUT_LIMIT_BYTES
• Docker image support for modern recon dependencies (httpx, ffuf, nuclei, subfinder) and hashcat.
• Docker image support for hydra, sqlmap, and tcpdump.

Changed

• Upgraded @modelcontextprotocol/sdk to ^1.26.0.
• Streamable HTTP is now the canonical network transport (MCP_TRANSPORT=http).
• Node.js engine requirement updated to >=22.7.5 (Inspector compatibility).
• Auth model modernized to bearer + OIDC/JWKS/introspection via:
  • MCP_AUTH_*
  • MCP_OIDC_*
• Health endpoints now return transport/auth/deprecation metadata.

Deprecated

• MCP_TRANSPORT=sse is now compatibility-only and emits deprecation warnings.
• Legacy MCP_OAUTH_* env aliases remain accepted temporarily but are deprecated.

Fixed

• Removed brittle dynamic transport/auth import fallbacks tied to outdated SDK structures.
• Corrected version reporting drift in runtime metadata.
• Hardened httpx command resolution:
  • prefers httpx-toolkit
  • validates fallback httpx binary
  • rejects accidental Python HTTPX CLI matches
• Restored concrete Nmap XML parsing to populate ScanData host/port/service details.

[0.5.0] - 2025-06-08

• Initial multi-transport release (stdio, http, sse) with OAuth-oriented networking setup.