No new features. Every change in this release closes a finding from external security review of v0.2.0 (two independent AI-assisted reviews plus a manual pass).
Security fixes
Policy pipeline enforced on every execution path. The custom stdio-mesh handlers (the path Claude Desktop actually uses) previously dispatched directly, bypassing the six-layer pipeline. All tool execution now routes through a unified ToolPolicy.guard() across the HTTP server, pipeline, and stdio mesh. 13 adversarial tests prove the bypass is closed.
Credential denial is now fail-closed. Previously, a config requesting a secret it was not granted received a placeholder string and the HTTP request proceeded anyway -- against a permissive upstream, an unauthenticated call could succeed silently. CredentialDenied now propagates and aborts the call before any request is constructed. This corrects behavior the launch blog post described as a feature.
Audit redaction hardened. Redaction now recurses through nested dicts and lists, and URL query parameters are parsed and scrubbed by key rather than by token syntax. Regression tests cover nested secrets and punctuated tokens.
exec() codegen removed. HTTP-bridge handlers are built as real typed callables via inspect.Signature -- no config-influenced source strings ever reach exec().
Improvements
heddle secrets set --stdin-- pipe credential values instead of passing them as arguments, keeping secrets out of shell history and process lists- Registry discovery manifest reports the package version dynamically
Numbers
273 tests (was 237 at v0.2.0). 15 security controls mapped to OWASP Agentic Top 10 and NIST AI RMF.