Skip to content

v2.1.0 — Built-in MCP, Security Hardening, 12 Bug Fixes

Choose a tag to compare

View all tags
@1bcMax 1bcMax released this 04 Apr 12:29
· 13 commits to main since this release
v2.1.0
2193a26
This commit was signed with the committer’s verified signature.
1bcMax 1bcMax
SSH Key Fingerprint: +7oAFkEZAQrklMNSYE1PWeyCZGPBjhky1GktJCmoFmU
Verified
Learn about vigilant mode.

Built-in @blockrun/mcp

RunCode now ships with BlockRun MCP server pre-configured — zero setup needed:

  • blockrun_search — web search
  • blockrun_exa — neural research
  • blockrun_dex — DEX prices
  • blockrun_markets — prediction markets
  • blockrun_chat — second opinion from other models

Just run runcode start — tools are automatically available.

Security Hardening

  • Project MCP trust: .mcp.json files in project directories now require explicit trust before loading. Prevents malicious repos from executing arbitrary commands.
  • Write symlink check: Target file symlinks are now resolved before writing. Prevents writing to /etc/passwd through a symlink.

12 Bug Fixes

  • MCP: 5s connect timeout, 30s tool call timeout, transport leak cleanup
  • Session: JSONL corruption recovery, prune protects active session
  • Tokens: anchor sanity check on history mutation
  • LLM: malformed tool JSON logged instead of silent {}
  • Tools: truncation at line boundaries, imagegen download 30s timeout
  • Compact: threshold capped at 8-20 messages (was unbounded %)
Assets 2
Loading