ninadphalak/LLM-Shield-Proxy: v1.3.0: Stateless Cryptography, MCP Governance, Air-Gapped Egress, and System Hardening
Abstract
LLM-Shield-Proxy v1.3.6 delivers a comprehensive plain-language documentation rewrite, dead-guard removal, security policy unification, and Vault encryption key fixes. Highlights: Plain-Language Documentation: Comprehensive rewrite of public documentation, website guides, landing page copy, and benchmark reports for clarity, removing complicated phrasing and em dashes. Added an automated regression test (tests/test_public_docs_style.py) to prevent future plain-language regressions. Vault Encryption Key Fix: Declares VAULT_ENCRYPTION_KEY in Settings so operator-supplied encryption keys take effect directly instead of defaulting to ephemeral per-process keys. Unified SSRF Protection: Centralized IP safety validation by having main._is_safe_ip delegate directly to egress_guard.is_public_ip, eliminating CIDR policy discrepancies. Unified RBAC Policy Resolvers: The /v1/mcp tool-governance route now uses the shared policy resolver, honoring Vault and Redis backends alongside InMemory. Upstream Resilience: Resets retry budgets on provider failover in both streaming and non-streaming flows, ensuring fallbacks receive full retry budgets. Codebase Cleanliness: Removed dead defensive guards, redundant exception catching, and obsolete observability assets. Supply Chain: Configured GitHub Actions release workflows to generate and attach Software Bill of Materials (SBOM) attestations. Install with: pip install llm-shield-proxy==1.3.6
