SMCP 3.1.0: The Tool Layer Ships

Sanctum Letta MCP — SMCP — is the protocol server that turns plugins into tools an agent can actually call. Today we merged dev → master and tagged v3.1.0 on sanctumos/smcp. This is an omnibus production release: months of hardening on the Sanctum fork, not a single hotfix.

If you run SMCP anywhere agents touch real infrastructure, read the security section first, then skim what changed for operators and plugin authors.

Why this release matters

SMCP sits between Letta agents (and other MCP clients) and everything else — Tasks, Gmail, GitHub, provisioning APIs, custom product backends. When the core is sloppy, the failure modes are subtle: wrong tools in context, malformed argv, silent plugin skips, or an HTTP listener that should never have been world-readable.

3.1.0 is the line where we treat SMCP as production infrastructure, not a clever demo:

• Session attach governor with config-driven profiles — product-specific tool allowlists live in JSON, not hardcoded in core.
• Versioned plugin --describe contract validated at discovery — bad metadata fails loudly with field paths, not mystery empty catalogs.
• Structured tool errors — clients can tell timeout from plugin_error from invalid_tool_name without parsing prose.
• Installable packaging — pip install . exposes smcp and smcp-stdio console entrypoints; import collisions fixed.
• CI + 90% coverage gate on Python 3.10–3.13 — 354 tests, ~99% line coverage on the release branch.
• ServerContext — governor state and plugin registries are per-context, not process-global singletons.

Deep-dive on the governor philosophy (attach/detach as protocol): SMCP Tool Governance: Attach, Detach, and Help as a Protocol.

Critical security patch (HTTP/SSE transport)

Operators: this section is mandatory if you expose SMCP over the network.

SMCP 3.1.0 carries the HTTP authentication hardening we introduced on the dev line (issue #39, first documented in 3.0.3):

• Shared-secret auth via MCP_API_KEY / MCP_API_KEYS — clients send Authorization: Bearer or X-API-Key: .
• --allow-external fails closed — binding beyond localhost refuses to start without a configured key, unless you explicitly set MCP_AUTH_DISABLED=1 (logged as unsafe).
• Loopback clients skip auth by default; use --require-auth when you want keys even on 127.0.0.1.
• Auth runs as raw ASGI middleware so SSE streaming is never buffered by a broken auth wrapper.
• STDIO transport is unchanged — no network surface, no keys required.

This is a critical security patch for any deployment that listens on a non-loopback interface. Upgrade, generate a long random key, set MCP_API_KEY, and restart before you bind externally. We are not publishing incident-specific details here; the fix is in the release, and the operator action is: upgrade + configure auth.

Quick reference:

export MCP_API_KEY="$(openssl rand -hex 32)"
smcp --allow-external --port 8000

export MCP_API_KEY="$(openssl rand -hex 32)" smcp --allow-external --port 8000

Full tables: SMCP deployment guide and API reference.

Governor profiles: tools the agent should see, not everything you could expose

The catalog plane (what plugins can do) and the attach plane (what this session may call) are different problems. 3.1.0 makes the attach plane data-driven:

• Load profiles from SMCP_PROFILES — a JSON file or directory of .json configs.
• Built-ins: full (entire catalog) and optional admin when SMCP_ADMIN_PREFIX is set.
• Stale profile names fall back to full instead of bricking the server.
• Example config ships at docs/examples/governor-profiles.json.

SMCP is AGPLv3 code, CC BY-SA docs. Maintained by the Sanctum team as a SanctumOS core module.*