🌟 Release Highlights
This release focuses on observability improvements and internal code quality, introducing a new opt-in URL domain audit pipeline and enhanced OpenTelemetry GenAI tracing semantics.
✨ What's New
🔍 Opt-In URL Domain Audit Pipeline
A new opt-in pipeline for auditing observed URL domains in tool responses and write sinks (#7987). This gives operators runtime visibility into what external domains MCP tools are actually accessing — useful for security audits, compliance checks, and diagnosing unexpected network behavior.
📊 Improved OpenTelemetry GenAI Span Semantics
mcp.tool_call spans now include [GenAI semantic convention]((opentelemetry.io/redacted) attributes (GenAIOperationName, GenAIAgentName) as specified by the OpenTelemetry GenAI working group (#7981, #7989). DIFC enforcement decisions and rate-limit milestones are now also surfaced as span events, making distributed traces significantly richer for GenAI workload observability.
See docs/otel-sentry.md for tracing configuration.
🔧 Internal Improvements
- Schema pinned to v0.80.9 — JSON schema validation updated from v0.79.8 → v0.80.9 (#7966)
- Rust guard reliability — Deduplicated repo fallback resolution and
private-flag field checks in the Rust guard, reducing drift risk (#7988)
- Code quality — WASM guards env var constant centralized; duplicated
[]string→[]interface{} conversions extracted to strutil.StringsToAny; DIFC helper placement and content-rewrite helpers refactored for clarity (#7990, #7991, #7992, #8000)
- Debug logging — Debug loggers added to MCP pagination and URL domain utilities (#7950, #8005)
- Test coverage — Expanded tests for
oidc.fetchToken and cmd tracing helpers (#7986, #7951)
📚 Documentation
CONTRIBUTING.md updated with internal/urlutil/ package in the project structure reference (#8004)
🐳 Docker Image
The Docker image for this release is available at:
docker pull ghcr.io/github/gh-aw-mcpg:v0.3.29
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest
Supported platforms: linux/amd64, linux/arm64
For complete details, see the full release notes.
Generated by Release · 52.3 AIC · ⊞ 33.8K · ◷
🌟 Release Highlights
This release focuses on observability improvements and internal code quality, introducing a new opt-in URL domain audit pipeline and enhanced OpenTelemetry GenAI tracing semantics.
✨ What's New
🔍 Opt-In URL Domain Audit Pipeline
A new opt-in pipeline for auditing observed URL domains in tool responses and write sinks (#7987). This gives operators runtime visibility into what external domains MCP tools are actually accessing — useful for security audits, compliance checks, and diagnosing unexpected network behavior.
📊 Improved OpenTelemetry GenAI Span Semantics
mcp.tool_callspans now include [GenAIsemantic convention]((opentelemetry.io/redacted) attributes (GenAIOperationName,GenAIAgentName) as specified by the OpenTelemetry GenAI working group (#7981, #7989). DIFC enforcement decisions and rate-limit milestones are now also surfaced as span events, making distributed traces significantly richer for GenAI workload observability.See docs/otel-sentry.md for tracing configuration.
🔧 Internal Improvements
private-flag field checks in the Rust guard, reducing drift risk (#7988)[]string→[]interface{}conversions extracted tostrutil.StringsToAny; DIFC helper placement and content-rewrite helpers refactored for clarity (#7990, #7991, #7992, #8000)oidc.fetchTokenand cmd tracing helpers (#7986, #7951)📚 Documentation
CONTRIBUTING.mdupdated withinternal/urlutil/package in the project structure reference (#8004)🐳 Docker Image
The Docker image for this release is available at:
docker pull ghcr.io/github/gh-aw-mcpg:v0.3.29 # or docker pull ghcr.io/github/gh-aw-mcpg:latestSupported platforms:
linux/amd64,linux/arm64For complete details, see the full release notes.