← Back to home

Changelog

Release notes for all MeowPass projects.

APIv2.2.02026-07-29

Identity moved to WorkOS AuthKit

  • >Sign-in is now powered by WorkOS AuthKit: a polished hosted login with SSO, MFA, passkeys, and social providers. Existing accounts link automatically by email
  • >The CLI signs in through a browser loopback auth-code flow (mp login) and refreshes tokens automatically
  • >Retired the previous hosted OIDC integration and the CLI device flow
APIv2.1.02026-07-27

Server-side encryption and SSO

  • >Secrets are now encrypted at rest server-side with AES-256-GCM envelope encryption (a per-secret data key wrapped by a server-managed key encryption key)
  • >Identity moved to hosted SSO with MFA and passkeys. Sign in with your browser, no separate password to manage
  • >Access is authorized per request with scoped grants and a full audit trail
  • >The earlier client-side key model (per-member key wrapping and encrypted local backups) is superseded by the server-side model above
APIv2.0.02026-07-26

AI Credential & Integration Gateway (now live in production)

  • +Agents: non-human identities with scoped, least-privilege policies (POST/GET /agents, PATCH /agents/{id}/status, GET/PUT /agents/{id}/policy)
  • +Credential broker: short-lived, revocable sessions that inject the real key server-side (POST/GET /broker/sessions, DELETE to revoke)
  • +Proxy mode: agent calls /broker/sessions/{id}/proxy/{path...}, MeowPass injects the credential and forwards upstream. The raw key never reaches the agent
  • +Native-temp mode: mint provider-native short-lived credentials, e.g. GitHub App installation tokens (POST /broker/sessions/{id}/credential)
  • +Tool registry: register providers, attach encrypted broker credentials, and configure native tokens (POST/GET /tools, PUT /tools/{id}/credential, PUT /tools/{id}/native-config, health + update routes)
  • +Human-in-the-loop approvals: sensitive tools queue for review. Agents request, only humans approve (GET /approvals, POST /approvals/{id}/approve|reject)
  • +Workflow runner: pipelines chaining brokered tool calls with approval gates and resume (POST /workflows, /workflows/{id}/run, /workflow-runs/{id}, /resume)
  • +Prompt history: inspect and replay agent interactions (POST/GET /prompts, POST /prompts/{id}/replay)
  • +Generalized OAuth integrations: provider discovery plus token refresh/rotation (GET /integrations/providers, POST /integrations/{id}/refresh)
  • +resource:action scope system with wildcards (broker:*, *:read) enforced on every gateway route via RequireScope middleware
GitHub Actionv2.0.02026-07-26

Web dashboard + OIDC SSO identity

  • +Web dashboard at app.meowpass.dev: browse agents, live broker sessions, the pending approval queue, prompt history, and the audit trail
  • +One-click session approvals from the approval queue
  • +OIDC SSO sign-in: auth-code + PKCE for the web app, device flow for the CLI (non-breaking)
  • >Landing page repositioned around the AI credential gateway
CLIv0.4.02026-07-26

Account recovery, encrypted backups, Vercel sync

  • +mp recovery setup: generate account recovery codes (the server stores only salt and wrapped material, never the code itself)
  • +mp recovery restore: recover access from a code and re-key your account atomically
  • +mp export / mp import: encrypted local backup bundles under a separate backup password
  • +mp vercel: connect a Vercel project via OAuth and sync secrets to its environment variables
  • +Account recovery API: POST/GET /account/recovery-codes, POST /account/recovery/rotate
MCP Serverv0.3.02026-05-07

Multi-environment support

  • +env parameter on all 14 tools (list_secrets, get_secret, set_secret, delete_secret, pull, etc.)
  • +AI agents can target specific environments (local, staging, production)
  • >Default env is 'default' when not specified (backwards-compatible)
CLIv0.2.52026-05-14

Per-member vault sharing, web app decrypt fix, salt drift fix

  • +Per-member vault sharing: each team member gets their own wrapped copy of the vault key
  • +mp share now wraps the vault key separately for each member
  • +mp pull auto-detects shared vaults and unwraps the vault key for the current member
  • +GET /teams/{id}/members/keys API endpoint for team member public keys
  • +Team members list now shows email and name, with remove button (owner-only)
  • +DELETE /teams/{id}/members/{userId} endpoint for removing members
  • ~Web app reveal/copy: proper ArrayBuffer slicing for Web Crypto API
  • ~Web app unlock: validate only against owned vaults to avoid false errors
  • ~Salt drift: mp login now reuses existing ~/.meowpass/salt instead of regenerating
  • ~Audit logs: cast inet column to text for pgx compatibility
  • ~Vault GET: returns member-specific encrypted key from vault_access for shared vaults
CLIv0.2.42026-05-07

CLI promo code redemption

  • +mp promo redeem CODE: redeem promo codes directly from the CLI
CLIv0.2.32026-05-07

Free tier limits, promo codes, pricing launch

  • +Promo code system: POST /promo/redeem endpoint for 3-month Pro upgrades
  • +Auto-downgrade middleware: reverts to free tier when promo expires
  • +Redeem Promo Code UI in web dashboard settings tab
  • >Free tier now has actual limits: 3 vaults, 50 secrets (was unlimited)
  • >Pro and Team pricing buttons redirect to Discord for free 3-month access
CLIv0.2.22026-05-07

Multi-env secrets, mp shorthand, web dashboard fixes

  • +Multi-environment secrets: mp set KEY val --env production
  • +mp init auto-tags environments from .env file names (.env.local becomes local)
  • +mp shorthand alias: all commands work with mp instead of meowpass
  • ~Web dashboard reveal/copy buttons now pass env to API (was returning empty)
  • +Env column in web dashboard secret list
  • >All docs and UI updated to use mp shorthand by default
CLIv0.2.12026-05-06

Bug fixes for rotation and rollback

  • ~Vault key rotation now updates server-side encrypted key via PUT /vaults/{id}
  • ~Rollback no longer fails with 500 when nonce is nil
  • +PUT /vaults/{id} endpoint for vault key updates
  • +UpdateVaultKey database method
CLIv0.2.02026-05-05

Major feature release

  • +mp init: scan .env files, create a vault, encrypt and push in one command
  • +mp run: inject decrypted secrets into a subprocess (in-memory only)
  • +mp diff: compare local .env with the vault, colored output, --exit-on-drift
  • +mp doctor: diagnose config, API, auth, salt, and vault health
  • +mp history: per-secret version timeline
  • +mp rollback: restore a previous secret version
  • +mp rotate: full vault key rotation and re-encrypt all secrets
  • +mp git-hook install: pre-commit drift detection
  • +mp set --ttl: secret auto-expiry (24h, 30m, etc.)
  • +Offline cache: auto-save vault snapshots, fall back on API failure
  • +Audit log middleware wired to all vault/secret routes
  • +GET /audit-logs endpoint with vault_id filter
  • +GET /vaults/{id}/secrets/{key}/history endpoint
  • +Secret TTL enforcement: auto-delete expired secrets on read
MCP Server0.2.02026-05-05

14 tools, redacted mode

  • +meowpass_diff: compare local .env with vault secrets
  • +meowpass_init: scan a directory for .env files
  • +meowpass_run: run a command with injected secrets
  • +meowpass_run_redacted: safe mode, scrubs secret values from output
  • >Now 14 tools total (was 10)
Node.js SDK0.1.12026-05-06

Initial release with README

  • +Node.js SDK with encrypt and decrypt helpers, byte-compatible with the Go CLI
  • +get, set, delete, list, pull, createVault, whoami methods
  • +Byte-compatible ciphertext with the Go CLI
  • +README with API reference and examples
GitHub Actionv12026-05-05

Initial release

  • +Composite GitHub Action for CI/CD secret injection
  • +Export mode (GITHUB_ENV) and env file mode
  • +API key authentication
CLIv0.1.42026-05-05

DDoS protection and early access

  • +Rate limiting: 60 req/min general, 10 req/min auth endpoints
  • +Request body size limit (1MB)
  • +Security headers (X-Content-Type-Options, X-Frame-Options)
  • >All plan limits set to unlimited for early access