blog · 17 posts
Engineering updates from the MCP Hangar team.
latest · 2026-08-16
The v2 line went from 2.0.0 to 2.9.0 in sixteen days: HA and storage backends, the front door, event sourcing, Python 3.14. Most of the work came from one recurring failure mode — a capability wired into a construction path nothing ran — and from the gates that now make it visible.
A symbol in the reference SDK with the right name, the right docstring, and the wrong shape. Why the tasks fossil in stable mcp-types is deliberate rather than forgotten, why hasattr is not feature detection, and the ninety-second habit that catches the whole class.
The async call path was the one governed call-shape left dormant. On the v2 preview, the SDK's first-class Tasks extension unblocks it: every relayed task is governed the instant it's relayed, and a task that pauses for input routes through the first interactive, mid-flight consent gate on the governed call path.
v1.6 puts Hangar's telemetry on the OpenTelemetry GenAI/MCP semantic conventions, traces the upstream call boundary end to end, and ships the L7 MCPEgressPolicy enforcement plane across core, operator, and Helm.
An upstream MCP Python SDK CVE (WebSocket Host/Origin validation) is fixed in mcp 1.28.1. MCP Hangar 1.5.1 raises the required floor so installs pull the patched SDK. Upgrade guidance inside.
v1.5 makes OIDC front-door auth work end-to-end over the HTTP server, adds a one-time admin bootstrap, a phase-aware interceptor invocation surface, and task-lifecycle audit events.
03:14:22 — a provider starts returning HTTP 200 responses with malformed payloads. Three seconds later, every agent call is succeeding through the backup. Nobody got paged. The interesting part is which layer did the work — and which layer was insurance the incident never needed.
Most teams read min_healthy as a quorum: drop below it, the group rejects. That's not what it does. The group keeps serving as long as one member is up. min_healthy is the threshold where the state label flips — and if you're not alerting on the label, the number is doing nothing.
Your MCP server passes every 30-second tools/list probe and fails 4 out of 5 real tool calls. The dashboard is green. The agent is producing garbage. Here's why the probe is the wrong instrument — and what the right one looks like.
Everything in mcp-hangar is now MIT, effective v1.2.2. This release removes the dual-license model and simplifies the codebase for all users.
v1.2 introduces SHA-256 digest pinning for MCP tool schemas, implementing a preemptive version of SEP-1766 to detect drift and block unauthorized mutations.
v1.2 implements SEP-1763 P1: hook-based event model, wildcard subscriptions, IMutator contract with priority-ordered pipeline, and interceptors/list endpoint.
v1.1 adds per-tool-call cost tracking, SIEM-ready compliance export (Splunk, Datadog, Sentinel), and end-to-end caller identity in every OTEL span.
Security hardening release: SSRF protection, default-deny command allow-list, granular RBAC, WebSocket origin validation, and trusted proxy resolution.
Your LLM just decided to delete a production alert rule. You didn't ask it to. The approval gate puts a human between the decision and the execution — not for every tool call, but for the ones where 'undo' is a support ticket.
Your agent just discovered it can call hangar_call in a loop. Twelve hundred requests in ninety seconds. Here's how MCP Hangar's two-system rate limiting — token bucket at the command bus, exponential backoff on auth — puts a ceiling on that.
MCP Hangar v1.0 ships identity propagation, compliance-grade audit, Kubernetes enforcement, and sub-millisecond proxy overhead.