What shipped — Jul 5–Aug 1, 2026

Four weeks, one post. We let the digest slip and we are catching it up in one go rather than pretending three separate ones happened. Across that span: a toolchain-wide rename, dario’s biggest architecture change yet, seventeen classifier bypasses found and closed in redstamp, and a new thirteenth tool.

The toolchain got renamed

warden became redstamp and keeper became strongroom, package renames, not new tools. If you have either pinned under the old name, the rename PRs are in the repo history, and every repo across the fleet got a README sweep to match.

dario: v5.0 to v5.1, and staying honest with upstream

dario is the OAuth proxy that lets your existing Claude subscription serve any OpenAI- or Anthropic-compatible tool. It shipped its biggest architecture change in this span: v5.0 moved to a pool-as-primitive model and removed shim mode entirely, followed by v5.1 adding --fast-model (keep forced-model sub-agents cheap) and --no-claude-auth (stop OpenAI-only proxies from rotating the Claude token). It also picked up attested release artifacts, tokenless OIDC npm publishing, and a rewritten README.

By week two it was reconciling against Claude Code v2.1.215 upstream and decoupling proxy liveness from OAuth state, so a stale token no longer looks like a dead proxy. By week four it added a drift watch that checks header set, header values, and body key order automatically, so the next upstream wire-format change gets caught instead of silently breaking someone’s proxy, plus a tripwire that fires when a capture matches a previously-seen anomaly pattern. Straightforward upgrades throughout; no config changes needed if you are already running it. dario also holds a 9.2/10 OpenSSF Scorecard score.

redstamp: seventeen bypasses closed, in one day

redstamp’s arc across the month: it launched under its new name with v0.5.0, the config-file rename, fully back-compatible, an existing warden.config.json is still read transparently. Then v0.5.1 made audit-log tail truncation detectable and closed a timing side-channel in the daemon’s capability-token comparison. Mid-month the arena benchmark grew competitor adapters, AEGIS, Pipelock, and mcp-firewall joined the existing LlamaFirewall one, so the numbers are comparable against other tools rather than self-reported.

The big week was the last one, and all of it shipped on a single day. A verdict-only white-box sweep, nothing executed, found nine command-class bypasses and four parser/tokenizer differentials (v0.7.0, which also added guardMcpCallAsync so the MCP surface can reach the LLM judge). Two more turned up while making the daemon boot-persistent on a headless box (v0.7.1). Red-teaming the judge tier itself, after upgrading it to a stronger model reset the adversarial baseline, found six more (v0.7.2).

Seventeen bypasses closed, with the benign sibling of each pinned so no fix over-widened. Precision stayed at 100%, zero false positives, across every bench run. v0.7.3 then dropped 14 live false positives with zero recall cost: the .claude config directory is no longer flagged as a credential path, dotted credential filenames no longer break path matching, and the browser-cookie rule now requires an actual browser profile. If you gate tool calls with redstamp, the 0.7.x line is the one to be on.

strongroom and agent: credentials got stricter

strongroom, the secrets vault, went from its first MCP control-plane server release (v0.1.2) to v0.4.0 over the month: CLI --json output, operator-set TTL and uses ceilings on grants, a bounded-timeout broker, a vendored audit chain, and zero-dependency install. agent moved to lease-only credential access, no more raw vault reads, just short-lived leases redeemed through strongroom, and tightened its default command blocklist to match actual commands instead of loose mentions, closing a bypass class.

truecopy: evidence you can actually check

truecopy vets and signs skills and MCP servers. This month it went from consuming its own watch manifest for file-level update checks, to findings that carry the actual matched text and byte offset, accurate through JSON-escaping and repeated substrings, plus a hardened Docker image (root dropped, base image pinned by hash, built and run in CI), a standalone MCP server mode, and stricter signer verification: the whole public key instead of a 64-bit fingerprint, closing a theoretical collision path. It has now scanned 68,560 skills.

fieldpass and cordon: fuzzing the trust boundary

Both fieldpass, the indirect-prompt-injection firewall for agentic browsers, and cordon, detect and redact, added ClusterFuzzLite continuous fuzzing on their core trust-boundary code this month, alongside fieldpass’s live-capture path and incident-detector improvements.

A thirteenth tool: plumbline

New this final week: plumbline joins the public stack, bringing the tool count to thirteen. Docs and site plumbing are live on the tools page.

Smaller stuff worth knowing

deepdive shipped three releases (v0.29–v0.32.1): MCP server mode, search relevance and host-cap fixes, an XDG Base Directory layout for fresh installs, and a fix for source-disclaimer sentences being miscounted as citations. hybrid hit v1.13.0 (prefill warmup, per-request token accounting) and corrected a README claim that PyPI publishing worked when it never had. hands picked up subscription-based learn/record mode and cross-platform UI targeting fixes. amnesia closed a tar dependency advisory (GHSA-r292-9mhp-454m), and alf-dock stopped putting a DB password on the process command line where any process listing could read it.

Across the fleet: a coordinated push to OpenSSF Scorecard badges, unified CodeQL, CONTRIBUTING and Code of Conduct docs, and OIDC trusted publishing.

If you run any of this

Full PR history is on GitHub, every repo above is public and open for issues. If you are running dario, redstamp, strongroom, or truecopy in production, the redstamp 0.7.x line and the strongroom lease-only credential model are the two upgrades worth prioritizing if you have not pulled them yet.

← All writing