Release notes

User-visible changes per release. The full list is in the server CHANGELOG.

0.10.0

GitHub release v0.10.0

Breaking: Docker settings

MCP processes no longer run as the server's user. Update your docker-compose.yml (see Docker):

• user: "0:0" — the entrypoint drops to uid 1000; no root process remains
• cap_drop: [ALL] and cap_add: [SETUID, SETGID, KILL, CHOWN, SETPCAP]
• security_opt: [no-new-privileges:true] and read_only: true
• deploy.resources.limits.pids: 4096

Without SETUID, SETGID or KILL, MCP children refuse to start and the server logs a clear message (fail closed). Without SETPCAP, the container refuses to start.

Breaking: user API port

The browser and user API (login, session, CSRF token, user endpoints) is served on the admin port 9443 only, no longer on 8443. 8443 serves only the MCP client protocol and the agent endpoint.

server.trust_proxy / MCP_AMBASSADOR_TRUST_PROXY no longer accept hop counts: use true, false or an IP/CIDR list.

Security

• Each MCP instance runs as its own unprivileged uid (default range 20000-20999) with zero capabilities, a private 0700 home and cache, and no access to /data. See Security Model.
• With isolation on (the default), children always start with --no-new-privs, and setuid/setgid bits are stripped from the image. The server logs a warning once, when it first checks to start an MCP, if it runs without no-new-privileges, and a startup warning if child isolation is disabled.
• Per-instance process cap (MCP_AMBASSADOR_CHILD_NPROC, default 256, counts threads) and a container-wide pids limit; tini is PID 1.
• Known residuals: instances share the network namespace and the process list (TD-063).

Changed

• Creating or updating an MCP through the admin API, or installing one from the registry, with a command that is not on the allowlist (MCP_ALLOWED_COMMANDS) now returns 400.
• Community registry entries are reduced to the fields the server reads when cached; sync provenance fields are no longer stored or returned by the admin registry API.

Added

• Per-tool group policy, tool kill switch, progressive tool disclosure and approval gates. See the Groups & RBAC, Kill Switches, Progressive Disclosure and Approval Gates guides.
• Tool Review: Approve all and Approve selected for pending tool definitions (FB-033), via POST /v1/admin/mcps/:mcpId/tool-pins/approve (1-200 pins per request). See Tool Pinning.
• uv/uvx (pinned) and system python3 in the server image, for registry MCPs that run PyPI packages. See MCP Catalog.
• Community registry: weekly dry-run sync and curated intake. See Registry.

New environment variables

Upgrading from 0.9.x

1. Back up ./data, ./config, ./cache and your compose file.
2. Empty the ./cache directory before the first 0.10.0 boot. MCP packages are downloaded once again.
3. Check that ./data is owned by uid 1000 and that ambassador-server.yaml is readable by uid 1000 (keep it 0600).
4. Apply the compose changes above and remove any MCP_AMBASSADOR_CHILD_UID setting (the image now sets a default uid range, and setting both makes the entrypoint exit).
5. docker compose up --build -d and check /health.

To roll back, restore your old compose file and image, and empty ./cache again before upgrading a second time.

0.9.1

Hardening release: CSRF protection, audit log rotation, stronger password policy, structured logging and UX polish. See the roadmap.