| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: bugwarden | Distribution: openSUSE Tumbleweed |
| Version: 0.4.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Wed Aug 12 21:19:16 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 13267582 | Source RPM: bugwarden-0.4.0-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/plusky/bugwarden | |
| Summary: MCP server for Bugzilla with operator-controlled security guards | |
bugwarden exposes Bugzilla to MCP (Model Context Protocol) clients through a guard policy that the client can neither read nor change. The policy is a TOML file read once at startup and decides, per bug, which of thirteen capabilities a client is granted, so an operator can expose a Bugzilla instance to an LLM client while keeping undisclosed security bugs, private comments and write access out of reach. Denials are uniform: a bug hidden by policy is indistinguishable from one that does not exist, and search results filtered by policy are dropped silently. What the client may not see, the operator can: an optional append-only audit stream records every tool call together with the guard's verdict.
(Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR LGPL-2.1-or-later OR MIT) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT) AND (MIT OR Unlicense) AND Apache-2.0 AND BSD-3-Clause AND CDLA-Permissive-2.0 AND ISC AND MIT AND Unicode-3.0
* Wed Aug 12 2026 Martin Pluskal <mpluskal@suse.com>
- Move the shell completions into bash-completion, zsh-completion and
fish-completion subpackages, so a shell's completions are only
pulled in where that shell is installed
* Wed Aug 12 2026 Martin Pluskal <mpluskal@suse.com>
- Update to 0.4.0:
* Add product and field discovery tools, and accept custom fields
when filing a bug
* Add --allowed-hosts to restrict the inbound host header
* Fail startup when the identity cannot be resolved, and resolve it
from a declared, verified login so it no longer depends on the
local account
* Identify this build to Bugzilla with a User-Agent, and introduce
it by name in the MCP handshake
* Stop imposing one instance's status workflow on every instance
* Stop reading a capped search page as the end of results
* Stop shipping the example policy rule that depended on whoami
* Reserve the rule names the guard decides under
* Stop under-reporting suppressed_count as a maximum
* Derive the HTTP body cap from the attachment ceiling
* Move the server to rmcp 3.1 and pin what the transport may serve
* Move the Bugzilla client to reqwest 0.13
- Install the man page and the bash, zsh and fish completions, which
upstream now generates from the CLI definition and ships prebuilt
* Mon Aug 03 2026 Martin Pluskal <mpluskal@suse.com>
- Update to 0.3.0:
* The server can hold the Bugzilla API key itself via
- -api-key-file (container secret, systemd LoadCredential), so
over HTTP clients no longer have to present the real key
* New policy matcher created_by_me matches the bug-caller
relationship, letting a policy treat the requesting account's
own reports differently from everyone else's
* Policy rules are scoped by operation, fixing a rule granting
only create silently deciding - and denying - read access to
existing bugs in its products
* update_bug_fields gained named parameters for summary, url,
whiteboard, version, target_milestone and add/remove lists for
keywords and see_also, all under the existing fields capability
* Audit records adopt the W3C trace context from a client-supplied
traceparent, and bugs_quicksearch records how many rows the
search-window scan examined and how many it withheld
* The example policy installed as /etc/bugwarden/policy.toml was
reworked to demonstrate the new matchers; installs that edited
theirs keep it (the file is config noreplace)
- Add ca-certificates-mozilla to BuildRequires: the HTTP transport
tests new in this release refuse to construct their client while
the system CA store is empty
* Tue Jul 28 2026 Martin Pluskal <mpluskal@suse.com>
- Update to 0.2.0:
* Added the create_bug and add_attachment tools, growing the guard
capability vocabulary from eleven to thirteen
* An existing policy file is not rewritten on upgrade, so wherever it
grants allow it starts permitting bug filing and attachment upload;
keep the previous behaviour with disabled_tools = ["create_bug",
"add_attachment"] under [global], or replace allow grants with
restrict rules naming the capabilities meant
* Added an optional append-only JSONL audit stream recording every
tool call together with the guard's verdict, written only when named
with --audit-config or BUGWARDEN_AUDIT_CONFIG
* bugs_quicksearch now paginates over the bugs a client may see, so a
policy-filtered page no longer returns short
* Denied bug ids are scrubbed from bug bodies, history and comments
* bug_info bodies are served on their own verdict
* The example policy denies security groups by name
- Install the worked audit-stream example as %config(noreplace)
/etc/bugwarden/audit.toml, on the same terms as the policy example
* Mon Jul 27 2026 Martin Pluskal <mpluskal@suse.com>
- Initial package (version 0.1.0):
* MCP server exposing Bugzilla to Model Context Protocol clients,
gated by an operator-controlled guard policy the client can
neither read nor change
* worked example policy installed as %config(noreplace)
/etc/bugwarden/policy.toml; the server only reads a policy named
explicitly with --policy or BUGWARDEN_POLICY
/etc/bugwarden /etc/bugwarden/audit.toml /etc/bugwarden/policy.toml /usr/bin/bugwarden /usr/share/doc/packages/bugwarden /usr/share/doc/packages/bugwarden/DESIGN.md /usr/share/doc/packages/bugwarden/README.md /usr/share/licenses/bugwarden /usr/share/licenses/bugwarden/LICENSE /usr/share/man/man1/bugwarden.1.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Sat Aug 15 00:13:46 2026