v1.0.4MCP ServerLatest
•1 min read

Vault Key Throttling & Honest Version Reporting

Wrong vault keys are now rate limited on every MCP tool that accepts one, and the server reports its real version to the API instead of a hardcoded string.

#What's Changed

  • [Security] Incorrect vault keys supplied to reveal_key, add_key or update_key are now rate limited (10 attempts per 15 minutes, budgeted per user and per source address). These tools verify the key against a stored hash, so without a limit they were an online guessing path that the equivalent web and CLI endpoints already closed.
  • [Improvement] A throttled tool call now tells the agent how long to wait and not to retry sooner, so a model cannot spin on the same rejected vault key.
  • [Fix] The User-Agent sent to the ApiVault API is derived from the package version instead of a hardcoded 1.0.3, which had already gone stale and would have misreported every future release.