v0.2.16

🌟 Release Highlights

This release closes a security gap in allowed-tools enforcement and updates the schema validation baseline to gh-aw v0.67.1.

🔒 Security Fix: Server-Side Allowed-Tools Enforcement

Previously, the tools allow-list in your server config was parsed but never enforced at runtime — a client with raw HTTP access could bypass it by sending tools/call requests directly for tools that should be restricted.

What changed:

• tools/call enforcement: Blocked tools are now rejected with a descriptive error (IsError: true) before any backend request is made. A 403 OTEL span status is set and a WARN log is emitted.
• tools/list defense-in-depth: Non-allowed tools are filtered out during backend registration — they never appear in tools/list responses and are never registered with the SDK server.
• O(1) lookup: Allowed-tool sets are pre-computed at startup (buildAllowedToolSets), adding no per-request overhead.

No config changes required. When tools is absent or empty, all tools remain accessible — existing configurations are unaffected.

Example allow-list config:

{
  "mcpServers": {
    "github": {
      "type": "stdio",
      "container": "ghcr.io/github/github-mcp-server:latest",
      "tools": ["search_code", "get_file_contents", "list_issues"]
    }
  }
}

See the Configuration Guide for full server config options.

🔧 Maintenance

• Updated MCP Gateway JSON schema validation URL to gh-aw v0.67.1 for reproducible, deterministic configuration validation.

🐳 Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.2.16
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

---

For complete details, see the full release notes.

Generated by Release · ● 150.6K

---

What's Changed

• Gateway: enforce allowed-tools filtering server-side on tools/list and tools/call by @Copilot in #3334
• Gateway: enforce allowed-tools filtering server-side on tools/list and tools/call by @Copilot in #3333
• 🔄 chore: update schema URL to gh-aw v0.67.1 by @github-actions[bot] in #3318

Full Changelog: v0.2.15...v0.2.16