Changelog

Every release gets closer to finishing the work

Feature updates for the client; pure fixes are not listed separately. The installer version may be newer than the last entry.

Download the latest version
v5.0.0.6 2026-10-21

Local credentials: retry on bad password, delete saved credentials

  • No more retry loops on a bad password
    • HTTP 401/403, SSH/Git/MySQL authentication failures, and pages that report a bad username or password now return BAD_CREDENTIAL and mark the credential as needing re-entry
    • The next request does not reuse the old password; a secure local prompt appears, and the new password replaces the old one
    • Unattended tasks do not show a prompt; they return INPUT_REQUIRED
  • Delete saved credentials
    • Settings → Local credentials → Unattended authorization, select a credential, then choose Delete this credential
    • Deleting also revokes that credential's unattended authorization; other credentials are unaffected
v5.0.0.1 2026-10-20

Local credentials: generated Node scripts + password broker

  • secret_run: generate a Node script per scenario
    • When built-in adapters cannot cover a web page, desktop app, or CLI, Clerk generates a Node script and runs it locally
    • Scripts request secrets through the clerk.secret.type/http/exec/info plugin and do not receive plaintext by default
    • CDP, Chrome/Edge, UI Automation, PowerShell, HTTP, and CLI can all be composed by the script
  • On-demand input and unattended mode
    • If a credential has not been saved, a secure local prompt appears when the step needs it; save and continue
    • Unattended tasks must carry a taskId and an existing Grant; without one they return INPUT_REQUIRED and never prompt
  • reveal high-risk switch
    • When plaintext must be handed to a third-party library or CDP, a script can request reveal; it requires explicit confirmation and is off by default
    • Scripts are audited by SHA256 and outputs are redacted; free-form scripts are trusted automation code, not a hard sandbox
v4.0.0.1 2026-10-20

External MCP: authorize by workspace

  • New MCP tab in Settings
    • Choose an existing workspace and select the external MCP servers it may use (for example ChatBI); new sessions in that folder and its subfolders can then call them
    • External MCP is off by default; calls from unauthorized folders are blocked with a prompt to authorize in Settings
    • Restart the local service to apply immediately (in-progress replies are interrupted and can be resumed)
v3.1.0.64 2026-10-20

Data query MCP (ChatBI)

  • Ask data questions in a session
    • After an admin registers and authorizes the service, the client connects to Data query (ChatBI) and can list data sources, inspect schemas, and run read-only queries
    • Access is role-based: only accounts assigned to the matching role see these tools
    • Queries allow a single SELECT / WITH statement, return 200 rows by default (max 500), and time out at 30 seconds
  • External MCP managed centrally
    • Admins register upstream addresses and role scopes under MCP management → External MCP services; clients sync automatically after sign-in
    • Calls go through the Clerk gateway: forwarded as the user, revoked immediately, and audited