releases

2 posts with the tag “releases”

Gasoline v5.5.0: Rock-Solid MCP Protocol Compliance

Feb 4, 2026

Brenn Hill

Gasoline v5.5.0 is a stability release focused on MCP protocol compliance. If you experienced “Unexpected end of JSON input” errors or connection issues with Claude Desktop or Cursor, this release fixes them all.

The Problem: Intermittent Connection Failures

Users reported sporadic errors when connecting to Gasoline via Claude Desktop:

[error] Unexpected end of JSON input

The MCP server appeared to be working — valid JSON responses were logged — but immediately after each response, a parse error occurred.

Root Cause: Three Protocol Violations

Our investigation uncovered three distinct MCP protocol violations:

1. Double Newlines in stdio Output

Go’s json.Encoder.Encode() adds a trailing newline to JSON output. Our stdio bridge then called fmt.Println(), adding a second newline. The empty line between messages was parsed as an empty JSON message, causing the parse error.

Fix: Changed fmt.Println(string(body)) to fmt.Print(string(body)) in the bridge — the HTTP response already includes the trailing newline.

2. Notification Responses

JSON-RPC 2.0 notifications (requests without an id field) must not receive responses. We were responding to notifications/initialized with an empty response, violating the spec.

Fix: Notifications now return nil from the handler and receive no response. HTTP transport returns 204 No Content.

3. Exit Race Condition

The stdio bridge could exit before the final response was written to stdout, truncating the last message.

Fix: Implemented an exit gate pattern — the process waits for any pending responses to flush before exiting.

Comprehensive Protocol Tests

v5.5.0 adds 10 new Go tests that verify MCP protocol compliance:

TestMCPProtocol_ResponseNewlines — exactly one trailing newline per response
TestMCPProtocol_NotificationNoResponse — notifications receive no response
TestMCPProtocol_JSONRPCStructure — valid JSON-RPC 2.0 structure
TestMCPProtocol_IDNeverNull — response ID is never null (Cursor requirement)
TestMCPProtocol_ErrorCodes — standard JSON-RPC error codes
TestMCPProtocol_InitializeResponse — MCP initialize handshake
TestMCPProtocol_ToolsListStructure — tools/list response format
TestMCPProtocol_HandlerUnit — handler method dispatch
TestMCPProtocol_HTTPHandler — HTTP transport compliance
TestMCPProtocol_BridgeCodeVerification — static analysis of bridge code

These tests are designed to be unalterable — they verify the MCP spec, not implementation details. Any future change that breaks MCP compliance will fail these tests.

Silenced Version Check Errors

The GitHub API version check now fails silently. Previously, rate limit errors (403) would log warnings even though version checking is non-critical.

Prior Versions Deprecated

All npm packages prior to v5.5.0 have been deprecated. Users installing old versions will see a warning directing them to upgrade.

Upgrade

npx gasoline-mcp@5.5.0

Or update your MCP configuration:

{
  "mcpServers": {
    "gasoline": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "gasoline-mcp@5.5.0", "--port", "7890", "--persist"]
    }
  }
}

Full Changelog

GitHub Release

Gasoline v5.1.0: Single-Tab Tracking Isolation

Jan 28, 2026

Brenn Hill

Gasoline v5.1.0 is a security-focused release that fixes a critical privacy vulnerability in how the extension captures browser telemetry. If you’re running any previous version, upgrade immediately.

The Problem: All Tabs Were Captured

Prior to v5.1.0, the extension captured console logs, network requests, and other telemetry from every open browser tab — regardless of whether tracking was enabled for that tab. If you had 40 tabs open and clicked “Track This Page” on one of them, data from all 40 tabs was forwarded to the MCP server.

This was a privacy vulnerability. Tabs containing banking sites, personal email, or other sensitive sessions would leak telemetry into the AI assistant’s context.

The Fix: Single-Tab Tracking Isolation

v5.1.0 introduces tab-scoped filtering in the content script. The extension now:

Only captures from the explicitly tracked tab. All other tabs are completely isolated.
Attaches a tabId to every forwarded message for data attribution.
Blocks Chrome internal pages (chrome://, about://, devtools://) from being tracked.
Clears tracking state on browser restart — no stale tab references.

The button has been renamed from “Track This Page” to “Track This Tab” to reflect the actual behavior.

”No Tracking” Mode

When no tab is tracked, the MCP server now prepends a warning to all observe() responses:

WARNING: No tab is being tracked. Data capture is disabled. Ask the user to click ‘Track This Tab’ in the Gasoline extension popup.

This prevents the AI assistant from silently operating on stale or missing data.

Network Schema Improvements

API responses from network_waterfall and network_bodies now include:

Unit suffixes: durationMs, transferSizeBytes instead of ambiguous duration, size
compressionRatio: Computed field showing transfer efficiency
capturedAt timestamps on all entries
limitations array explaining what the data can and can’t tell you

These changes help LLMs interpret network data without guessing units.

PyPI Distribution

Gasoline is now available on PyPI alongside NPM:

pip install gasoline-mcp
gasoline-mcp

Same binary, same behavior. Platform-specific wheels for macOS (arm64, x64), Linux (arm64, x64), and Windows (x64).

Known Issues

Five issues are deferred to v5.2. See KNOWN-ISSUES.md for details:

query_dom not yet implemented
Accessibility audit runtime error
network_bodies returns no data in some cases
Extension timeouts after several operations
observe() responses missing tabId metadata

Upgrade

npx gasoline-mcp@5.1.0

Or update your .mcp.json:

{
  "mcpServers": {
    "gasoline": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "gasoline-mcp@5.1.0", "--port", "7890", "--persist"]
    }
  }
}

Full Changelog

GitHub Release · CHANGELOG.md