# MCP Boundary v0.2.3 Release Notes

This is a scoped local patch release for MCP Boundary. It builds on v0.2.2 and
keeps the same local-only release claim.

## Artifacts

```text
mcpboundary-v0.2.3-windows-amd64.zip
mcpboundary-v0.2.3-linux-amd64.tar.gz
SHA256SUMS.txt
```

## What Changed In v0.2.3

v0.2.3 focuses on the Policy Builder, manual policy authoring, and release
surface cleanup:

- The Policy Builder now supports the intended Manual Policy mode for policies
  without loaded tool metadata. A manually entered policy can be previewed,
  saved, reopened, and shown honestly as name-based and unverified until matching
  tool metadata is loaded.
- Manual policies now distinguish native downstream tool names from
  client-visible wrapper names. Matching and remap guidance use the wrapped
  server's native tool name, and the UI calls out that both tool names and field
  names must match exactly.
- The Builder keeps unsupported or complex rule shapes preserve-only instead of
  pretending they are editable. User-facing copy now says where JSON-only policy
  shapes remain outside the no-code editor.
- Full Policy JSON now lives in the Builder surface. The former standalone
  Tools and Rules hashes are legacy aliases to Builder, so policy authoring has
  one active dashboard home.
- Policy validation now rejects non-string `state_fact_rules` values through the
  server-side policy config path. This closes the fail-open case where numeric or
  boolean deny values could be saved but never match runtime string facts.
- Invalid selected policy files now project fail-closed consistently across the
  Rules, Tools, and Overview surfaces instead of showing contradictory "no
  rules" versus "all allowed" states.
- Dashboard V4 remains the default dashboard at `/`. The old V3 source package
  has been removed from this repository. The `/v3` frontend redirects to `/`,
  while the existing `/v3/api/*` compatibility namespace remains available for
  dashboard API callers.
- Hidden historical frontend routes `/v2.2`, `/v2.3`, and `/v2.4` are no longer
  mounted in the runtime. `/legacy` remains the explicit classic dashboard
  route.
- Publish docs were updated for the consolidated Builder flow, Manual Policy
  mode, runtime-versus-workspace dashboards, filesystem path guidance, and the
  implemented local approve/reject scope.

## Upgrade Notes

- If you already run v0.2.2, treat this as a dashboard and policy-authoring
  patch. Existing policy files remain normal policy JSON.
- After changing or saving policy in the dashboard, reload or restart the MCP
  client or agent that is using the protected config so it observes the current
  local boundary state.
- Manual policies match by exact native downstream tool name and exact field
  name. A typo in either name makes that rule ineffective, or can block calls
  when the field is marked required.
- Filesystem directory boundaries are still set by the wrapped filesystem
  server arguments. MCP Boundary path allow/deny values are exact-value policy
  checks, not subtree or glob policy.

## Still Not Claimed

This release does not claim hosted multi-tenant security, a Trust Broker, DLP,
remote approval execution, dashboard run-anyway execution, provider OAuth, real
email delivery, production persistence, or a generic policy engine. The local
approve/reject dashboard flow records configured human approval status; it does
not execute, resume, retry, or reconstruct the tool call.

## Verification Scope

The release build ran the Go test suite and `go vet` before packaging. Both
packaged archives were unpacked and smoke-tested:

- Windows ZIP: `WINDOWS_ARTIFACT_SMOKE_PASS`
- Linux tarball: `LINUX_ARTIFACT_SMOKE_PASS`

The artifacts were built from the local Core facade checkout
`../core - 0.2` at commit `785cd2e` (`fix: narrow raw error sk marker`).
That records the source-build input for this scoped local release and does not
change the source-free packaging limitations.