@@ -0,0 +1,26 @@
+## ⚡ `code_execution` is now on by default
+
+The sandboxed JavaScript/TypeScript `code_execution` tool — one request that orchestrates several upstream tool calls, with loops, conditionals and data transformation in between — ships **enabled** starting with this release. Previously it had to be switched on by hand.
+
+**What changes for you**
+
+- **New installs** get `"enable_code_execution": true` in `mcp_config.json` and see the tool in `tools/list` on the default `/mcp` endpoint.
+- **Existing installs: an explicit value in the file wins.** mcpproxy writes every setting when it saves the config, so a `mcp_config.json` created by an earlier release carries `"enable_code_execution": false` and stays off. To get the tool, flip it to `true` in the file or in **Settings → Enable code execution tool** — the change is hot-reloaded and connected clients receive `notifications/tools/list_changed`, no restart needed.
+- **A hand-written config that omits the key turns the tool on** at the next start or hot reload. If you maintain the file yourself and want it off, add `"enable_code_execution": false` before upgrading.
+- **To keep it off**, set `"enable_code_execution": false`. As of this release a disabled tool is no longer advertised at all ([#1236](https://github.com/smart-mcp-proxy/mcpproxy-go/issues/1236)): it disappears from `tools/list` instead of being listed as a stub that refuses every call.
+
+The sandbox has no filesystem, network or `require()`. `call_tool` from inside a script goes through the same gates as a direct `call_tool_*` request — quarantine, agent-token scope, per-server restrictions and, as of this release, `output_sanitisation` redact/block — and each run is bounded by `code_execution_timeout_ms` (default 2 min; a script that overruns is now interrupted, not just abandoned) and `code_execution_max_tool_calls`. Details: [docs/features/code-execution](https://docs.mcpproxy.app/features/code-execution/).
+
+## 🔒 Agent-token scope hardening
+
+Five fixes close the places where an agent token restricted to a subset of servers could still learn about, or act on, servers outside its grant: `call_tool_*` now requires the target tool's tier and fails closed on an unresolved one ([#1223](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1223)); `upstream_servers` `tail_log` ([#1224](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1224)), `set_profile` responses ([#1225](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1225)), `read_cache` entries ([#1226](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1226)) and aggregated prompts ([#1227](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1227)) are all scoped to the calling token. No configuration change is needed; if you hand out scoped agent tokens (`mcpproxy token create --servers …`), upgrade.
+
+The registry SSRF guard now also unwraps IPv6 transition addresses (6to4, NAT64, Teredo, IPv4-compatible) and blocks the embedded IPv4 when it is private or link-local ([#1235](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1235), thanks @aroh3006).
+
+## 🪟 Windows: stdio servers no longer leak child processes
+
+Restarting, reconnecting or disconnecting a stdio server on Windows used to leave its `node.exe` / `python.exe` grandchildren running forever (one report counted 413 orphans after an hour). Every spawned server is now wrapped in a Job Object that is closed on every disconnect and stop path, so the whole tree goes with it ([#1234](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1234), thanks @LocoLoboZ; [#1260](https://github.com/smart-mcp-proxy/mcpproxy-go/pull/1260)). If you have orphans from earlier builds, end them once by hand — this release cannot reach processes it did not start.
+
+## 🩺 "Token expired" on servers that no longer use OAuth
+
+A server switched from OAuth to a static `Authorization` header stayed `unhealthy / Token expired / action: login` forever, because a stale record in the `oauth_tokens` bucket outranked the current config ([#1172](https://github.com/smart-mcp-proxy/mcpproxy-go/issues/1172)). Such servers now report from their live connection; the dead record is ignored (and `mcpproxy auth logout <server>` still removes it).
@@ -112,7 +112,7 @@ Env vars: `MCPPROXY_LISTEN`, `MCPPROXY_API_KEY`, `MCPPROXY_DEBUG`, `MCPPROXY_TEL
 
 ## MCP Protocol
 
-**Built-in tools**: `retrieve_tools` (BM25 search across upstream tools; Spec 049 opt-in `include_disabled`; Spec 085 `detail` override + compact signatures under `tool_response_mode: compact`) · `describe_tool` (Spec 085: batch ≤5 ids → full schemas; Spec 102: also on the direct surface, `server:tool` or `server__tool` ids) · `call_tool_read|write|destructive` (Spec 018 intent variants; operation type inferred from the variant; Spec 085 pre-dispatch arg validation with self-healing `invalid_params` errors) · `code_execution` (sandboxed JS, off by default) · `upstream_servers` (CRUD, Spec 049) · `quarantine_security` (Spec 032). **Tool format**: `<serverName>:<toolName>` (e.g. `github:create_issue`); the direct surface lists as `<serverName>__<toolName>` and accepts both.
+**Built-in tools**: `retrieve_tools` (BM25 search across upstream tools; Spec 049 opt-in `include_disabled`; Spec 085 `detail` override + compact signatures under `tool_response_mode: compact`) · `describe_tool` (Spec 085: batch ≤5 ids → full schemas; Spec 102: also on the direct surface, `server:tool` or `server__tool` ids) · `call_tool_read|write|destructive` (Spec 018 intent variants; operation type inferred from the variant; Spec 085 pre-dispatch arg validation with self-healing `invalid_params` errors) · `code_execution` (sandboxed JS, on by default since v0.66.0) · `upstream_servers` (CRUD, Spec 049) · `quarantine_security` (Spec 032). **Tool format**: `<serverName>:<toolName>` (e.g. `github:create_issue`); the direct surface lists as `<serverName>__<toolName>` and accepts both.
 
 **REST API** base `/api/v1`, auth via `X-API-Key` header or `?apikey=`. MCP endpoints (`/mcp`) stay unprotected for client compatibility; the REST API always requires a key (auto-generated if absent). All responses carry `X-Request-Id` (correlate with `mcpproxy activity list --request-id <id>`). Live updates via SSE at `/events`. Full endpoint list: `oas/swagger.yaml` + [docs/api/rest-api.md](docs/api/rest-api.md).
 
 
@@ -695,7 +695,7 @@ Edit `~/.mcpproxy/mcp_config.json`:
 
 ```json
 {
-  "enable_code_execution": false,
+  "enable_code_execution": true,
   "code_execution_timeout_ms": 120000,
   "code_execution_max_tool_calls": 0,
   "code_execution_pool_size": 10,
@@ -707,7 +707,7 @@ Edit `~/.mcpproxy/mcp_config.json`:
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enable_code_execution` | boolean | `false` | Enable/disable code execution feature (must be `true` to use) |
+| `enable_code_execution` | boolean | `true` | Enable/disable code execution feature (on by default since v0.66.0) |
 | `code_execution_timeout_ms` | number | `120000` | Default timeout in milliseconds (range: 1-600000) |
 | `code_execution_max_tool_calls` | number | `0` | Default max tool calls (0 = unlimited) |
 | `code_execution_pool_size` | number | `10` | Number of JavaScript VM instances in pool (range: 1-100) |
 
@@ -174,7 +174,7 @@ The JavaScript execution environment is **heavily sandboxed** to prevent securit
 
 ```json
 {
-  "enable_code_execution": false,           // Must be explicitly enabled (default: false)
+  "enable_code_execution": true,            // On by default since v0.66.0; set false to switch off
   "code_execution_timeout_ms": 120000,      // Default: 2 minutes, max: 10 minutes
   "code_execution_max_tool_calls": 0,       // Default: unlimited
   "code_execution_pool_size": 10,           // Default: 10 concurrent VMs
 
@@ -31,7 +31,7 @@ Common issues, error messages, and solutions for the `code_execution` tool.
 Error: code_execution is disabled in configuration. Set 'enable_code_execution: true' in config file.
 ```
 
-**Cause**: The `code_execution` feature is disabled by default for security. While it is disabled the tool is not listed in `tools/list`, so an MCP client will normally not see it at all; this error appears when a call reaches the handler by name anyway (the REST API or the CLI). An MCP client that calls the name from a stale tool list gets an unknown-tool error instead.
+**Cause**: The `code_execution` feature is switched off in this configuration (`"enable_code_execution": false` — it ships on by default since v0.66.0, but a config file written by an earlier release carries an explicit `false`). While it is disabled the tool is not listed in `tools/list`, so an MCP client will normally not see it at all; this error appears when a call reaches the handler by name anyway (the REST API or the CLI). An MCP client that calls the name from a stale tool list gets an unknown-tool error instead.
 
 **Solution**:
 1. Edit your configuration file (`~/.mcpproxy/mcp_config.json`)
 
@@ -1254,7 +1254,7 @@ See [Tool Quarantine](features/tool-quarantine.md) for complete details.
 
 ```json
 {
-  "enable_code_execution": false,
+  "enable_code_execution": true,
   "code_execution_timeout_ms": 120000,
   "code_execution_max_tool_calls": 0,
   "code_execution_pool_size": 10,
@@ -1264,7 +1264,7 @@ See [Tool Quarantine](features/tool-quarantine.md) for complete details.
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enable_code_execution` | boolean | `false` | Enable JavaScript/TypeScript code execution tool (disabled by default for security). While `false` the `code_execution` tool is not advertised in `tools/list`. Hot-reloaded: a flip adds/removes the tool and sends `notifications/tools/list_changed` |
+| `enable_code_execution` | boolean | `true` | Enable JavaScript/TypeScript code execution tool (on by default since v0.66.0; set `false` to switch it off). While `false` the `code_execution` tool is not advertised in `tools/list`. Hot-reloaded: a flip adds/removes the tool and sends `notifications/tools/list_changed` |
 | `code_execution_timeout_ms` | integer | `120000` | Default timeout in milliseconds (1-600000, max 10 minutes) |
 | `code_execution_max_tool_calls` | integer | `0` | Maximum tool calls per execution (0 = unlimited) |
 | `code_execution_pool_size` | integer | `10` | Number of JavaScript VM instances in pool (1-100) |
@@ -1562,7 +1562,7 @@ Here's a complete configuration example with all major sections:
     "enhance_path": false
   },
 
-  "enable_code_execution": false,
+  "enable_code_execution": true,
   "code_execution_timeout_ms": 120000,
   "code_execution_max_tool_calls": 0,
   "code_execution_pool_size": 10,
 
@@ -34,7 +34,7 @@ MCPProxy uses a JSON configuration file located at `~/.mcpproxy/mcp_config.json`
   "http_idle_timeout": "180s",
   "tools_limit": 15,
   "tool_response_limit": 20000,
-  "enable_code_execution": false,
+  "enable_code_execution": true,
   "code_execution_timeout_ms": 120000,
   "code_execution_max_tool_calls": 0,
   "code_execution_pool_size": 10,
@@ -136,7 +136,7 @@ Both cadences are configurable globally, and can be overridden per server (see [
 
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
-| `enable_code_execution` | boolean | `false` | Enable JavaScript code execution tool |
+| `enable_code_execution` | boolean | `true` | Enable JavaScript code execution tool (on by default since v0.66.0) |
 | `code_execution_timeout_ms` | integer | `120000` | Execution timeout in milliseconds |
 | `code_execution_max_tool_calls` | integer | `0` | Maximum tool calls (0 = unlimited) |
 | `code_execution_pool_size` | integer | `10` | VM pool size for code execution |
 
@@ -37,7 +37,7 @@ Enable code execution in your config:
 
 | Option | Type | Default | Description |
 |--------|------|---------|-------------|
-| `enable_code_execution` | boolean | `false` | Enable the code execution tool. While `false` the tool is not listed in `tools/list`; a flip is hot-reloaded and announced with `notifications/tools/list_changed` |
+| `enable_code_execution` | boolean | `true` | Enable the code execution tool (on by default since v0.66.0). While `false` the tool is not listed in `tools/list`; a flip is hot-reloaded and announced with `notifications/tools/list_changed` |
 | `code_execution_timeout_ms` | integer | `120000` | Execution timeout (2 minutes) |
 | `code_execution_max_tool_calls` | integer | `0` | Max tool calls (0 = unlimited) |
 | `code_execution_pool_size` | integer | `10` | Number of VM instances to pool |
 
@@ -165,7 +165,7 @@ Code execution mode is designed for multi-step orchestration workflows. Instead
 - Complex conditional logic that would require many round-trips in other modes
 - Data transformation pipelines (fetch from one tool, transform, send to another)
 
-**Note:** Code execution must be enabled in config (`"enable_code_execution": true`). While it is disabled, the `code_execution` tool is not listed in `tools/list` on any endpoint, so clients that pick tools from the list never attempt it. An MCP `tools/call` for the name is refused as an unknown tool; a call that reaches the handler through the REST API or the CLI is refused with an error directing the user to enable it. The flag is hot-reloadable: flipping it adds or removes the tool on the live surfaces and sends `notifications/tools/list_changed` to connected sessions, no restart required.
+**Note:** Code execution is on by default since v0.66.0 (`"enable_code_execution": true`); set it to `false` to switch it off. While it is disabled, the `code_execution` tool is not listed in `tools/list` on any endpoint, so clients that pick tools from the list never attempt it. An MCP `tools/call` for the name is refused as an unknown tool; a call that reaches the handler through the REST API or the CLI is refused with an error directing the user to enable it. The flag is hot-reloadable: flipping it adds or removes the tool on the live surfaces and sends `notifications/tools/list_changed` to connected sessions, no restart required.
 
 ## Choosing the Right Mode
 
 
@@ -292,7 +292,9 @@ const posture = computed(() => {
     { label: 'MCP auth', on: !!w.require_mcp_auth, good: !!w.require_mcp_auth },
     { label: 'Docker isolation', on: !!(w.docker_isolation && w.docker_isolation.enabled), good: !!(w.docker_isolation && w.docker_isolation.enabled) },
     { label: 'Secret scan', on: sdd, good: sdd },
-    { label: 'Code exec', on: !!w.enable_code_execution, good: !w.enable_code_execution },
+    // on by default since v0.66.0: the sandbox honours quarantine and server
+    // restrictions, so an enabled tool is not by itself something to review.
+    { label: 'Code exec', on: !!w.enable_code_execution, good: true },
     { label: 'Read-only', on: !!w.read_only_mode, good: true },
     { label: 'Reveal headers', on: !!w.reveal_secret_headers, good: !w.reveal_secret_headers },
   ]
Original file line number	Diff line number	Diff line change
`@@ -174,7 +174,7 @@ The JavaScript execution environment is heavily sandboxed to prevent securit`
`174`	`174`
`175`	`175`	```json
`176`	`176`	`{`
`177`		`- "enable_code_execution": false, // Must be explicitly enabled (default: false)`
	`177`	`+ "enable_code_execution": true, // On by default since v0.66.0; set false to switch off`
`178`	`178`	`"code_execution_timeout_ms": 120000, // Default: 2 minutes, max: 10 minutes`
`179`	`179`	`"code_execution_max_tool_calls": 0, // Default: unlimited`
`180`	`180`	`"code_execution_pool_size": 10, // Default: 10 concurrent VMs`