- netx_api/mcp_remote: ops / topology / bizMonitor tools, Bearer auth,
per-tool RBAC filtering, ?groups= filter, readOnlyHint and group meta.
- Mount the official MCP Streamable HTTP app at /mcp (stateless);
AuthAuditMiddleware is pure ASGI and skips /mcp.
- Let uvicorn chunk MCP responses; some Windows LSPs rewrite
Content-Length replies on */mcp* paths into broken chunked framing.
- NETX_MCP_ALLOWED_HOSTS opts into DNS-rebinding checks (off by default
so LAN and reverse-proxy hosts work; Bearer is the gate).
- Remove the three stdio Python MCP packages; tests moved to /mcp,
including real-TCP framing regressions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ship installable releases via zip/Inno Setup with optional bundled Postgres, API-hosted SPA, manual update path, and CI workflow for future tag builds.
Co-authored-by: Cursor <cursoragent@cursor.com>
Checkpoint before workbench facade redesign: list defaults, API key quota, toast portal, topology canvas editor toolbar with More menu, and trusted-proxy client IP for sessions.
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep one 401 audit per IP+path window, and hide historical unauthorized noise from the default business view.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sample Windows CPU via Processor Utility so values match Task Manager, and expose host metrics on /v1/metrics/json for the workbench poll.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add capability RBAC, Alembic bootstrap, optional worker schedulers, and close public docs by default so lab installs stay usable without shared signing keys.
Co-authored-by: Cursor <cursoragent@cursor.com>
Gate netx Web/API/WebCRT with JWT and per-user API tokens, bootstrap an admin with forced password change, and expose users/audit/API-key management under a System section. MCP can reuse data/auth/mcp_token without extra env for local labs.
Co-authored-by: Cursor <cursoragent@cursor.com>
