Release notes

1.4.2 — OAuth/MCP and CLI fixes

• OAuth discovery and /oauth/ are served on the MCP listener; the separate admin listener returns 404 for these routes.
• MCPBOX_PUBLIC_MCP_URL configures the public HTTPS origin for discovery, resource metadata and the preferred project connection URL.
• Protected MCP responses advertise a public, project-specific metadata URL in WWW-Authenticate. The UI displays and copies the backend-provided MCP URL even when the admin panel uses another domain or port.
• Optional project CLI directory, private temporary working directories per invocation, and SSH access to the service account's configuration and agent.
• Project CLI folder settings: allow listed folders and subfolders, or all folders accessible to the MCPBox account. cli_execute accepts working_directory; cli_describe exposes the project directory policy. Global CLI definitions remain reusable across projects.
• Added CLI persistence/execution and OAuth/public-URL regression tests.

See configuration, connection setup and CLI operations.

1.4.0 — Skills and refreshed workspace

• Searchable Skills catalog, GitHub/ZIP import and version-specific project bindings.
• MCP tools for instruction reading, jobs, file transfer and approved scripts in prepared Docker environments.
• Skills tools appear only on projects with connected Skills; strict action discovery after OAuth is fixed.
• Disconnecting a Skill is blocked while the project retains its jobs.
• Light/Dark/System themes, Knowledge Base help/search dialogs, grouped Settings and project reordering.
• PolicyBox integration removed; legacy projects require explicit migration.
• Local MCP default: 127.0.0.1:38182. Six-platform builds with SHA256SUMS and architecture checks.

Published v1.4.0 notes.

Current source change after v1.4.0

After a page reload, the project first in saved order opens instead of the first ID. Availability depends on the binary built; this fix is not retroactively claimed for the published v1.4.0 release.

1.3.0 — Unified application

MCPBox and MCPBoxPro are now one open-source application under Apache-2.0. Former Pro features are included without commercial licensing or activation.

Included capabilities

• Local email/password accounts and first-administrator setup.
• User and role management, sessions and administrative agent tokens.
• Optional OIDC single sign-on.
• Named project OAuth connections for compatible clients such as ChatGPT.
• PolicyBox runtime identity and access integration.
• RagBox external ingestion and retrieval integration.
• Storage configuration with optional PostgreSQL connectivity and runtime status.
• CLI registry, locally available binary discovery and reviewed catalog updates.
• Unified interface, access/PolicyBox audit views and existing local model launchers.

The release also fixes invalid saved-session notifications on the login screen and delays protected data loading until session validation.

Upgrade changes

Administrator sign-in is required. Default ports are 38181 for administration and 38182 for MCP. Existing /api/pro/* routes, pro:* scopes and MCPBOX_PRO_* variables remain compatible. A separate MCPBoxPro source directory is no longer needed.

Back up data before upgrading; separate databases are not merged automatically. Follow the upgrade guide.

Earlier releases

Earlier releases introduced project aggregation, the Market, local Bleve knowledge collections, package runtime improvements and optional project Bearer protection. For historical tags and downloadable binaries, use GitHub Releases.

The guides describe v1.4.0 and explicitly marked current-source changes. Earlier binaries may have different ports, authentication requirements and available settings.