MCPHub
Back to changelog
v1.1.12Oct 27, 2026

v1.1.12

This release strengthens personal-credential and Bearer key storage. Existing client tokens remain valid.

View on GitHub

Summary

This release strengthens personal-credential and Bearer key storage. Existing client tokens remain valid.

[!WARNING] Before upgrading, back up your database/settings and preserve the original personal-credential encryption key. A database backup alone cannot recover bindings if that key is lost. See the upgrade and recovery guide.

[!CAUTION] Bearer key hashing is a one-way migration. After migration, do not run an older version against the migrated database/settings. Rollback requires restoring a pre-upgrade backup.

Fixes

  • Personal credentials (#1393): Database mode no longer generates a local encryption key automatically. Configure MCPHUB_CREDENTIAL_ENCRYPTION_KEY or retain an existing valid key file; keep the same key across upgrades and instances. A database backup alone cannot recover bindings if the key is lost. See the upgrade and recovery guide for working deployments and lost-key recovery.
  • Bearer keys (#1387): Store SHA-256 hashes instead of plaintext, with automatic migration at startup. Existing client tokens keep working; newly created tokens are returned only once. After migration, do not run an older version against the migrated database/settings—restore a pre-upgrade backup to roll back. When switching from file to database mode, run this version in file mode first or remove leftover plaintext keys from the source settings file.

References