# Changelog of MCP Server Validator & Security Audit 2026 (`craigtechservicesllc/mcp-server-validator-security-audit`) Actor

- **URL**: https://apify.com/craigtechservicesllc/mcp-server-validator-security-audit/changelog.md
- **Full Actor documentation**: https://apify.com/craigtechservicesllc/mcp-server-validator-security-audit.md

### 0.2.5 — 2026-08-09

- Final reporting-hardening patch after authenticated Apify MCP cloud validation.
- A successful run with a supplied bearer credential no longer reports `authorization.required=false`; it records `credentialSupplied=true` and leaves `required=null` unless an actual 401/403 challenge proves protection.
- Adds a non-scoring informational finding explaining that a credentialed-only run cannot prove whether the same operation is public without credentials.
- Narrows generic credential redaction to concrete `Authorization: Bearer ...` header values plus exact supplied secrets/JWTs/credential assignments, so safe protocol prose such as `Bearer WWW-Authenticate challenge` is no longer cosmetically mangled.
- Downgrades absence of the RFC 9207 authorization-response issuer advertisement from medium to low warning because MCP 2026-07-28 describes the authorization-server `iss` response behavior as SHOULD-level hardening, not a mandatory server-conformance failure.
- Keeps the two live findings observed on `mcp.apify.com` as high failures: missing `MCP-Protocol-Version` accepted and unrelated `Origin` accepted. Both are backed by current MCP Streamable HTTP MUST requirements.
- Authenticated Apify MCP validation returned 11 tools and 5 resource templates, with zero MCP tool calls and no bearer credential present in the supplied run log, dataset JSON, or OUTPUT summary.
- Automated suite remains **37/37**, including 500 complete audits with zero `tools/call` invocations.

### 0.2.4 — 2026-08-09

- Corrects authorization-aware list handling discovered during the first live Apify MCP cloud audit.
- HTTP 401/403 responses from `tools/list`, `resources/list`, `resources/templates/list`, and `prompts/list` are now classified as authorization-blocked/inconclusive rather than malformed JSON-RPC responses.
- Detects operation-specific authorization when `server/discover` is public but capability-list methods are protected.
- Runs the invalid-bearer-token safety probe against the method that actually returned the authorization challenge, preventing false positives on intentionally public `server/discover`.
- Adds a regression fixture for public discovery + protected capability lists.
- Automated suite now passes **37/37**, including 500 complete audits with zero `tools/call` invocations.

## Changelog

### 0.2.3 — 2026-08-09

Publication-schema correction against Apify's current `input.schema.json`.

- Keeps the required `description` on `servers.items.properties.url`.
- Removes the forbidden `description` from the intermediate `servers.items` object; Apify permits descriptions on child sub-properties, not on the array item wrapper.
- Removes `maxLength` from the `isSecret: true` bearer-token input because Apify's secret-string schema does not permit string-length validators there; the same 8,192-character limit remains enforced in runtime code before any network activity.
- Adds package-check regression gates for both Apify-specific schema rules.
- No MCP probing, security, transport, or monetization behavior changed from 0.2.0.

### 0.2.0 — 2026-08-08

Security-hardening publication candidate.

- Adds output-wide exact-secret, Bearer, JWT, common credential-assignment, and control-character redaction.
- Adds bounded untrusted-output structures and null-prototype output objects to neutralize prototype-pollution keys.
- Validates Bearer-token syntax and rejects unsafe whitespace/control characters.
- Forbids authorization/cookie credentials over plaintext HTTP in production.
- Blocks HTTPS downgrade redirects and cross-origin redirects by default; credential headers are stripped if cross-origin redirects are explicitly enabled by an internal caller.
- Expands SSRF/abuse defenses with credential-like query rejection, URL/hostname caps, sensitive infrastructure-port blocking, header limits, and socket-time DNS revalidation.
- Adds absolute wall-clock request deadlines to stop slow-drip responses.
- Adds pagination cursor size/loop defenses.
- Corrects MCP-required OAuth/OIDC discovery for path-bearing issuers by trying RFC 8414 path insertion, OIDC path insertion, then OIDC path appending.
- Redacts credentials, sensitive query values, and fragments from resource/resource-template URIs before persistence.
- Deepens OAuth checks: RFC 9728 resource matching, RFC 8414/OIDC discovery, exact issuer consistency, endpoint URL safety, PKCE S256, authorization-code/implicit-flow indicators, RFC 9207 signal, and scope hygiene.
- Corrects authorization metadata status so discovered metadata with security-critical defects is not marked valid.
- Adds TLS/certificate observations, legacy `Mcp-Session-Id` detection, cookie/server disclosure observations, and Content-Type validation.
- Adds MCP tool risk-hint summaries using conservative defaults plus contradictory-annotation detection.
- Expands automated suite to **36 tests**, including 500 full endpoint audits with zero tool calls.
- Adds one high-entropy per-audit invalid-token `server/discover` probe plus passive 403 `insufficient_scope` challenge validation, without OAuth login or tool execution.
- Adds MCP 2026 Client ID Metadata Document (CIMD) readiness reporting, DCR-deprecation guidance, and deprecated IPv6 site-local (`fec0::/10`) blocking.
- Adds deployment security gate: required SHA-256 verification, pre-dependency source checks, lockfile generation from the official npm registry and verifies every locked package resolves there with an integrity hash, HIGH/CRITICAL `npm audit` before install, `npm ci --ignore-scripts`, npm registry signature/available provenance verification, full rebuild/tests/package checks, Apify CLI 1.6+ all-schema validation, and then `apify push --open`.
- Docker cloud builds require `package-lock.json`, use `npm ci --ignore-scripts`, compile from source, and prune dev dependencies with lifecycle scripts disabled.
- Adds `.actorignore` to exclude local tests, research, and deployment-only material from production Actor uploads.

### 0.1.0 — 2026-08-08

- Initial publication candidate targeting final MCP `2026-07-28`.
- Validates final `HeaderMismatch` `-32020`, `resultType`, modern response metadata, cache hints, routing headers, OAuth protected-resource discovery, Origin behavior, capability schemas, and legacy 2025 migration state.
- Never invokes MCP tools.

### 0.2.3 - 2026-08-09

- Corrected Apify schemaBased array metadata for current CLI validation.
- Removed the Docker build dependency on a locally generated package-lock.json.
- Docker builder/runtime now install the exact direct versions pinned in package.json with dependency lifecycle scripts disabled.
- Deployment ZIP is self-contained: no pre-push npm generation or manual source patch is required.