v3.6.10

v3.6.10 masks RPC provider URLs in the config_show MCP tool. It applies to anyone who connects a client model to the MCP server. The tool now returns only the scheme and host of each provider URL. The full value stays in the config file.

Breaking changes

1. Masked provider URLs in config_show

Before: the config_show MCP tool returned the stored RPC provider URL verbatim. Provider URLs carry the API key in the path, the query string or the userinfo. The tool disclosed that key to any client model and its transcript.

Now: the tool returns the scheme and host only. An unparsable value shows as ***. The stored configuration is unchanged.

Applies to: agents that read the provider URL from the output of config_show. The stored value stays in ~/.config/ipor-fusion/config.json.

---

Upgrade with pip install -U ipor-fusion. The MCP server ships in the same package. Full changelog: v3.6.10 on GitHub.

These notes describe changes to the IPOR Fusion SDK. They are not operational or financial advice. Operators are responsible for testing changes against their own vaults and configuration before use.