| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: bugwarden | Distribution: openSUSE Tumbleweed |
| Version: 0.3.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Mon Aug 3 07:49:01 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 10063707 | Source RPM: bugwarden-0.3.0-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/plusky/bugwarden | |
| Summary: MCP server for Bugzilla with operator-controlled security guards | |
bugwarden exposes Bugzilla to MCP (Model Context Protocol) clients through a guard policy that the client can neither read nor change. The policy is a TOML file read once at startup and decides, per bug, which of thirteen capabilities a client is granted, so an operator can expose a Bugzilla instance to an LLM client while keeping undisclosed security bugs, private comments and write access out of reach. Denials are uniform: a bug hidden by policy is indistinguishable from one that does not exist, and search results filtered by policy are dropped silently. What the client may not see, the operator can: an optional append-only audit stream records every tool call together with the guard's verdict.
(Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND (MIT OR Unlicense) AND Apache-2.0 AND BSD-3-Clause AND CDLA-Permissive-2.0 AND ISC AND MIT AND Unicode-3.0
* Mon Aug 03 2026 Martin Pluskal <mpluskal@suse.com>
- Update to 0.3.0:
* The server can hold the Bugzilla API key itself via
- -api-key-file (container secret, systemd LoadCredential), so
over HTTP clients no longer have to present the real key
* New policy matcher created_by_me matches the bug-caller
relationship, letting a policy treat the requesting account's
own reports differently from everyone else's
* Policy rules are scoped by operation, fixing a rule granting
only create silently deciding - and denying - read access to
existing bugs in its products
* update_bug_fields gained named parameters for summary, url,
whiteboard, version, target_milestone and add/remove lists for
keywords and see_also, all under the existing fields capability
* Audit records adopt the W3C trace context from a client-supplied
traceparent, and bugs_quicksearch records how many rows the
search-window scan examined and how many it withheld
* The example policy installed as /etc/bugwarden/policy.toml was
reworked to demonstrate the new matchers; installs that edited
theirs keep it (the file is config noreplace)
- Add ca-certificates-mozilla to BuildRequires: the HTTP transport
tests new in this release refuse to construct their client while
the system CA store is empty
* Tue Jul 28 2026 Martin Pluskal <mpluskal@suse.com>
- Update to 0.2.0:
* Added the create_bug and add_attachment tools, growing the guard
capability vocabulary from eleven to thirteen
* An existing policy file is not rewritten on upgrade, so wherever it
grants allow it starts permitting bug filing and attachment upload;
keep the previous behaviour with disabled_tools = ["create_bug",
"add_attachment"] under [global], or replace allow grants with
restrict rules naming the capabilities meant
* Added an optional append-only JSONL audit stream recording every
tool call together with the guard's verdict, written only when named
with --audit-config or BUGWARDEN_AUDIT_CONFIG
* bugs_quicksearch now paginates over the bugs a client may see, so a
policy-filtered page no longer returns short
* Denied bug ids are scrubbed from bug bodies, history and comments
* bug_info bodies are served on their own verdict
* The example policy denies security groups by name
- Install the worked audit-stream example as %config(noreplace)
/etc/bugwarden/audit.toml, on the same terms as the policy example
* Mon Jul 27 2026 Martin Pluskal <mpluskal@suse.com>
- Initial package (version 0.1.0):
* MCP server exposing Bugzilla to Model Context Protocol clients,
gated by an operator-controlled guard policy the client can
neither read nor change
* worked example policy installed as %config(noreplace)
/etc/bugwarden/policy.toml; the server only reads a policy named
explicitly with --policy or BUGWARDEN_POLICY
/etc/bugwarden /etc/bugwarden/audit.toml /etc/bugwarden/policy.toml /usr/bin/bugwarden /usr/share/doc/packages/bugwarden /usr/share/doc/packages/bugwarden/DESIGN.md /usr/share/doc/packages/bugwarden/README.md /usr/share/licenses/bugwarden /usr/share/licenses/bugwarden/LICENSE
Generated by rpm2html 1.8.1
Fabrice Bellet, Wed Aug 5 22:28:34 2026