Bumping version to 0.4.0 (#573)

* Bumping version to 0.4.0

Signed-off-by: Mihai Criveti <[email protected]>

* Bumping version to 0.4.0

Signed-off-by: Mihai Criveti <[email protected]>

---------

Signed-off-by: Mihai Criveti <[email protected]>

Author: crivetimihai

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.3.1
+current_version = 0.4.0
 commit = False
 tag = False
 sign-tags = True

.github/tools/cleanup-ghcr-versions.sh

@@ -92,7 +92,7 @@ fi
 ##############################################################################
 ORG="ibm"
 PKG="mcp-context-forge"
-KEEP_TAGS=( "0.1.0" "v0.1.0" "0.1.1" "v0.1.1" "0.2.0" "v0.2.0" "0.3.0" "v0.3.0" "latest" )
+KEEP_TAGS=( "0.1.0" "v0.1.0" "0.1.1" "v0.1.1" "0.2.0" "v0.2.0" "0.3.0" "v0.3.0" "0.4.0" "v0.4.0" "latest" )
 PER_PAGE=100
 
 DRY_RUN=${DRY_RUN:-true}          # default safe

.github/workflows/docker-release.yml

@@ -4,12 +4,12 @@
 #
 # This workflow re-tags a Docker image (built by a previous workflow)
 # when a GitHub Release is published, giving it a semantic version tag
-# like `v0.3.0`. It assumes the CI build has already pushed an image
+# like `v0.4.0`. It assumes the CI build has already pushed an image
 # tagged with the commit SHA, and that all checks on that commit passed.
 #
 # ➤ Trigger: Release published (e.g. from GitHub UI or `gh release` CLI)
 # ➤ Assumes: Existing image tagged with the commit SHA is available
-# ➤ Result: Image re-tagged as `ghcr.io/OWNER/REPO:v0.3.0`
+# ➤ Result: Image re-tagged as `ghcr.io/OWNER/REPO:v0.4.0`
 #
 # ======================================================================
 
@@ -25,7 +25,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag (e.g., v0.3.0)'
+        description: 'Release tag (e.g., v0.4.0)'
         required: true
         type: string
 

.github/workflows/release-chart.yml.inactive

@@ -2,7 +2,7 @@
 name: Release Helm Chart
 on:
   release:
-    types: [published]            # tag repo, ex: v0.3.0 to trigger
+    types: [published]            # tag repo, ex: v0.4.0 to trigger
 permissions:
   contents: read
   packages: write

Containerfile

@@ -1,7 +1,7 @@
 FROM registry.access.redhat.com/ubi9-minimal:9.6-1752587672
 LABEL maintainer="Mihai Criveti" \
       name="mcp/mcpgateway" \
-      version="0.3.1" \
+      version="0.4.0" \
       description="MCP Gateway: An enterprise-ready Model Context Protocol Gateway"
 
 ARG PYTHON_VERSION=3.11

Containerfile.lite

@@ -108,7 +108,7 @@ LABEL maintainer="Mihai Criveti" \
       org.opencontainers.image.title="mcp/mcpgateway" \
       org.opencontainers.image.description="MCP Gateway: An enterprise-ready Model Context Protocol Gateway" \
       org.opencontainers.image.licenses="Apache-2.0" \
-      org.opencontainers.image.version="0.3.1"
+      org.opencontainers.image.version="0.4.0"
 
 # ----------------------------------------------------------------------------
 # Copy the entire prepared root filesystem from the builder stage

Makefile

@@ -1956,7 +1956,7 @@ MINIKUBE_ADDONS  ?= ingress ingress-dns metrics-server dashboard registry regist
 # OCI image tag to preload into the cluster.
 # - By default we point to the *local* image built via `make docker-prod`, e.g.
 #   mcpgateway/mcpgateway:latest.  Override with IMAGE=<repo:tag> to use a
-#   remote registry (e.g. ghcr.io/ibm/mcp-context-forge:v0.3.0).
+#   remote registry (e.g. ghcr.io/ibm/mcp-context-forge:v0.4.0).
 TAG              ?= latest         # override with TAG=<ver>
 IMAGE            ?= $(IMG):$(TAG)  # or IMAGE=ghcr.io/ibm/mcp-context-forge:$(TAG)
 
@@ -2593,7 +2593,7 @@ devpi-unconfigure-pip:
 
 # ─────────────────────────────────────────────────────────────────────────────
 # 📦  Version helper (defaults to the version in pyproject.toml)
-#      override on the CLI:  make VER=0.2.1 devpi-delete
+#      override on the CLI:  make VER=0.4.0 devpi-delete
 # ─────────────────────────────────────────────────────────────────────────────
 VER ?= $(shell python3 -c "import tomllib, pathlib; \
 print(tomllib.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])" \

README.md

@@ -120,7 +120,7 @@ ContextForge MCP Gateway is a feature-rich gateway, proxy and MCP Registry that
 
 **ContextForge MCP Gateway** is a gateway, registry, and proxy that sits in front of any [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server or REST API-exposing a unified endpoint for all your AI clients.
 
-**⚠️ Caution**: The current release (0.3.1) is considered alpha / early beta. It is not production-ready and should only be used for local development, testing, or experimentation. Features, APIs, and behaviors are subject to change without notice. **Do not** deploy in production environments without thorough security review, validation and additional security mechanisms.  Many of the features required for secure, large-scale, or multi-tenant production deployments are still on the [project roadmap](https://ibm.github.io/mcp-context-forge/architecture/roadmap/) - which is itself evolving.
+**⚠️ Caution**: The current release (0.4.0) is considered alpha / early beta. It is not production-ready and should only be used for local development, testing, or experimentation. Features, APIs, and behaviors are subject to change without notice. **Do not** deploy in production environments without thorough security review, validation and additional security mechanisms.  Many of the features required for secure, large-scale, or multi-tenant production deployments are still on the [project roadmap](https://ibm.github.io/mcp-context-forge/architecture/roadmap/) - which is itself evolving.
 
 It currently supports:
 
@@ -386,13 +386,13 @@ docker run -d --name mcpgateway \
   -e BASIC_AUTH_PASSWORD=changeme \
   -e AUTH_REQUIRED=true \
   -e DATABASE_URL=sqlite:///./mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.3.1
+  ghcr.io/ibm/mcp-context-forge:0.4.0
 
 # Tail logs (Ctrl+C to quit)
 docker logs -f mcpgateway
 
 # Generating an API key
-docker run --rm -it ghcr.io/ibm/mcp-context-forge:0.3.1 \
+docker run --rm -it ghcr.io/ibm/mcp-context-forge:0.4.0 \
   python3 -m mcpgateway.utils.create_jwt_token --username admin --exp 0 --secret my-test-key
 ```
 
@@ -420,7 +420,7 @@ docker run -d --name mcpgateway \
   -e JWT_SECRET_KEY=my-test-key \
   -e BASIC_AUTH_USER=admin \
   -e BASIC_AUTH_PASSWORD=changeme \
-  ghcr.io/ibm/mcp-context-forge:0.3.1
+  ghcr.io/ibm/mcp-context-forge:0.4.0
 ```
 
 SQLite now lives on the host at `./data/mcp.db`.
@@ -444,7 +444,7 @@ docker run -d --name mcpgateway \
   -e PORT=4444 \
   -e DATABASE_URL=sqlite:////data/mcp.db \
   -v $(pwd)/data:/data \
-  ghcr.io/ibm/mcp-context-forge:0.3.1
+  ghcr.io/ibm/mcp-context-forge:0.4.0
 ```
 
 Using `--network=host` allows Docker to access the local network, allowing you to add MCP servers running on your host. See [Docker Host network driver documentation](https://docs.docker.com/engine/network/drivers/host/) for more details.
@@ -460,7 +460,7 @@ podman run -d --name mcpgateway \
   -p 4444:4444 \
   -e HOST=0.0.0.0 \
   -e DATABASE_URL=sqlite:///./mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.3.1
+  ghcr.io/ibm/mcp-context-forge:0.4.0
 ```
 
 #### 2 - Persist SQLite
@@ -479,7 +479,7 @@ podman run -d --name mcpgateway \
   -p 4444:4444 \
   -v $(pwd)/data:/data \
   -e DATABASE_URL=sqlite:////data/mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.3.1
+  ghcr.io/ibm/mcp-context-forge:0.4.0
 ```
 
 #### 3 - Host networking (rootless)
@@ -497,7 +497,7 @@ podman run -d --name mcpgateway \
   --network=host \
   -v $(pwd)/data:/data \
   -e DATABASE_URL=sqlite:////data/mcp.db \
-  ghcr.io/ibm/mcp-context-forge:0.3.1
+  ghcr.io/ibm/mcp-context-forge:0.4.0
 ```
 
 ---
@@ -506,7 +506,7 @@ podman run -d --name mcpgateway \
 <summary><strong>✏️ Docker/Podman tips</strong></summary>
 
 * **.env files** - Put all the `-e FOO=` lines into a file and replace them with `--env-file .env`. See the provided [.env.example](.env.example) for reference.
-* **Pinned tags** - Use an explicit version (e.g. `v0.3.1`) instead of `latest` for reproducible builds.
+* **Pinned tags** - Use an explicit version (e.g. `v0.4.0`) instead of `latest` for reproducible builds.
 * **JWT tokens** - Generate one in the running container:
 
   ```bash
@@ -552,7 +552,7 @@ docker run --rm -i \
   -e MCP_SERVER_CATALOG_URLS=http://host.docker.internal:4444/servers/UUID_OF_SERVER_1 \
   -e MCP_TOOL_CALL_TIMEOUT=120 \
   -e MCP_WRAPPER_LOG_LEVEL=DEBUG \
-  ghcr.io/ibm/mcp-context-forge:0.3.1 \
+  ghcr.io/ibm/mcp-context-forge:0.4.0 \
   python3 -m mcpgateway.wrapper
 ```
 
@@ -600,7 +600,7 @@ python3 -m mcpgateway.wrapper
 <summary><strong>Expected responses from mcpgateway.wrapper</strong></summary>
 
 ```json
-{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"experimental":{},"prompts":{"listChanged":false},"resources":{"subscribe":false,"listChanged":false},"tools":{"listChanged":false}},"serverInfo":{"name":"mcpgateway-wrapper","version":"0.3.0"}}}
+{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-03-26","capabilities":{"experimental":{},"prompts":{"listChanged":false},"resources":{"subscribe":false,"listChanged":false},"tools":{"listChanged":false}},"serverInfo":{"name":"mcpgateway-wrapper","version":"0.4.0"}}}
 
 # When there's no tools
 {"jsonrpc":"2.0","id":2,"result":{"tools":[]}}
@@ -632,7 +632,7 @@ docker run -i --rm \
   -e MCP_SERVER_CATALOG_URLS=http://localhost:4444/servers/UUID_OF_SERVER_1 \
   -e MCP_AUTH_TOKEN=${MCPGATEWAY_BEARER_TOKEN} \
   -e MCP_TOOL_CALL_TIMEOUT=120 \
-  ghcr.io/ibm/mcp-context-forge:0.3.1 \
+  ghcr.io/ibm/mcp-context-forge:0.4.0 \
   python3 -m mcpgateway.wrapper
 ```
 

SECURITY.md

@@ -6,7 +6,7 @@
 
 ## ⚠️ Early Beta Software Notice
 
-**Current Version: 0.3.1 (Beta)**
+**Current Version: 0.4.0 (Beta)**
 
 MCP Gateway is currently in early beta and should be treated as such until the 1.0 release. While we implement comprehensive security measures and follow best practices, important limitations exist:
 
@@ -189,17 +189,20 @@ These validation rules help prevent XSS injection when data from untrusted MCP s
 Starting with v0.3.1, MCP Gateway follows the principle of "secure by default":
 
 - **Admin UI and API are disabled by default** - must be explicitly enabled via environment variables
-- **Authentication is required** for all endpoints when enabled
-- **Admin UI binds to localhost only** preventing external access
-- **Minimal container images** with non-root execution
-- **Read-only filesystems** in container deployments
+
 
 To enable admin features for development:
 ```bash
 MCPGATEWAY_UI_ENABLED=true        # Default: false
 MCPGATEWAY_ADMIN_API_ENABLED=true # Default: false
 ```
 
+Starting with 0.1.0:
+- **Authentication is required** for all endpoints when enabled
+- **Admin UI binds to localhost only** preventing external access
+- **Minimal container images** with non-root execution
+- **Read-only filesystems** in container deployments
+
 **Important**: The Admin UI is provided for developer convenience only and should **never be enabled in production deployments**.
 
 ---

charts/README.md

@@ -247,7 +247,7 @@ Below is a minimal example. Copy the default file and adjust for your environmen
 mcpContextForge:
   image:
     repository: ghcr.io/ibm/mcp-context-forge
-    tag: 0.3.0
+    tag: 0.4.0
   ingress:
     enabled: true
     host: gateway.local   # replace with real DNS
@@ -434,7 +434,7 @@ For every setting see the [full annotated `values.yaml`](https://github.com/IBM/
 * 💾 Stateful storage - PV + PVC for Postgres (`/var/lib/postgresql/data`), storage class selectable.
 * 🌐 Networking & access - ClusterIP services, optional NGINX Ingress, and `NOTES.txt` with port-forward plus safe secret-fetch commands (password, bearer token, `JWT_SECRET_KEY`).
 * 📈 Replicas & availability - Gateway (3) and Fast-Time-Server (2) provide basic HA; stateful components run single-instance.
-* 📦 Helm best-practice layout - Clear separation of Deployments, Services, ConfigMaps, Secrets, PVC/PV and Ingress; chart version 0.3.0.
+* 📦 Helm best-practice layout - Clear separation of Deployments, Services, ConfigMaps, Secrets, PVC/PV and Ingress; chart version 0.4.0.
 * ⚙️ Horizontal Pod Autoscaler (HPA) support for mcpgateway
 
 ---