Changelog

This page answers two questions: what version am I on, and what happens to audit archives written under an older version if I upgrade. The second one matters more here than it would for an ordinary library. An audit format change means chains written under the old format stop verifying under the new one, so an upgrade is a records-retention decision, not just a dependency bump.

The canonical file is CHANGELOG.md in the repository.

Published on npm

These are the versions npm install gives you today.

Unreleased

• @mcpose/audit 3.0.0 — audit format v2. Breaking. Canonical preimages, a signature covering the whole manifest rather than only the Merkle root, domain-separated Merkle leaves and nodes, keyId no longer derived as SHA256(secret), and ciphertext keys bound to session, position, and event with AES-GCM AAD. Adds the keyed verifiers verifyAuditChain and verifyManifestSignature. See ADR-0004.
• @mcpose/testing 3.0.0 — strengthened assertions. Breaking. assertAuditChainIntegrity throws on an empty chain; assertReplayManifestValid recomputes the Merkle root and checks proof indices; assertPiiRedacted structurally checks high-tier events; assertDelegationHonored takes an AuditEvent rather than an Identity[].
• mcpose 2.2.0 — audit-visible rejections, pass-through observers.

Upgrading across the v1 to v2 boundary

Chains, manifests, key ids, and ciphertexts written under v1 do not verify under v2, and the reverse is also true. There is deliberately no dual-format mode. v1 chains are forgeable by any manifest-holder with a guessable secret, so continuing to attest them would lend the new verifier's credibility to artifacts that do not deserve it.

If you hold v1 archives, keep a pinned @mcpose/audit 2.x alongside the new one and verify old archives with it.

2.1.1 — 2026-07-16

Re-release of 2.1.0, which was published and then unpublished. npm does not allow republishing a version number, so the corrected build shipped as 2.1.1. No functional change from 2.1.0.

2.1.0 — 2026-07-16

• BackendConfig gains headers, sent on every request to an HTTP/SSE backend.
• BackendConfig gains authProvider, driving the MCP OAuth flow with transparent token refresh. HTTP/SSE only; ignored on stdio.
• ProxyOptions gains name and version, controlling the server identity advertised in initialize.
• Fixed: the proxy no longer advertises a hardcoded 1.1.1 as its version.

2.0.2 — 2026-06-02 · security

Audit subkeys now derive from the signing secret through the sign() oracle rather than from the public keyId.

The per-entry HMAC chain key and the high-tier AES encryption root were previously keyId, which is SHA256(secret) and is published in ReplayManifest.signedBy. Anyone holding a manifest could therefore forge chainHash values and decrypt high-tier payloads. Keys now derive through domain-separated labels (mcpose/v1/chain, mcpose/v1/enc) and never leave the process; keyId is a public identifier only.

Format change. chainHash and the encrypted payloads differ from 2.0.0, so chains written under the old scheme do not verify under 2.0.2. Core (2.0.1) and @mcpose/testing (2.0.0) were unaffected. See ADR-0003.

2.0.0 — 2026-06-02

• @mcpose/audit — new package: HMAC-chained AuditEvent records, per-event SHA-256 input/output hashes, sensitivity tiers with AES-256-GCM encryption for the high tier, and a signed ReplayManifest with a Merkle proof per event.
• @mcpose/testing — new package: runner-agnostic compliance assertions.
• Identity resolution — resolveIdentity on HttpProxyOptions, resolved once per session and stamped on every ProxyContext.
• Agent delegation — delegatedFrom on ProxyContext for recording A2A handoff sequences.

1.0.0 — 2026-02-27

Initial release: the transparent proxy, onion middleware, and the stdio and HTTP transports.