v0.8.0 — MCP Hub Architecture

v0.8.0 — MCP Hub Architecture

FuzzForge AI v0.8.0 is a major architectural rewrite. The previous module system has been replaced by the MCP Hub architecture — FuzzForge now acts as a meta-MCP server that connects AI agents to collections of containerized security tools, discovered and orchestrated at runtime.

---

Highlights

MCP Hub System

FuzzForge no longer ships its own security modules. Instead, it connects to MCP tool hubs — registries of Dockerized MCP servers that AI agents can discover, chain, and execute autonomously.

• Runtime tool discovery — agents call list_hub_servers and discover_hub_tools to find available tools
• Agent context convention — hub tools provide built-in usage tips, workflow guidance, and domain knowledge so agents can use them without human intervention
• Category filtering — servers are organized by category (binary-analysis, web-security, reconnaissance, etc.) for efficient discovery
• Persistent sessions — stateful tools like Radare2 run in long-lived containers with start_hub_server / stop_hub_server
• Volume mounts — project assets are automatically mounted into tool containers for seamless file access
• Continuous mode — long-running tools (fuzzers) with real-time status via start_continuous_hub_tool

MCP Security Hub Integration

Ships with built-in support for the MCP Security Hub — 36 production-ready MCP servers covering:

Category	Servers	Examples
Reconnaissance	8	Nmap, Masscan, Shodan, WhatWeb
Web Security	6	Nuclei, SQLMap, ffuf, Nikto
Binary Analysis	6	Radare2, Binwalk, YARA, Capa, Ghidra
Blockchain	3	Medusa, Solazy, DAML Viewer
Cloud Security	3	Trivy, Prowler, RoadRecon
Code Security	1	Semgrep
Secrets Detection	1	Gitleaks
Exploitation	1	SearchSploit
Fuzzing	2	Boofuzz, Dharma
OSINT	2	Maigret, DNSTwist
Threat Intel	2	VirusTotal, AlienVault OTX
Active Directory	1	BloodHound

185+ individual security tools accessible through a single MCP connection.

Terminal UI

A new interactive terminal interface (uv run fuzzforge ui) for managing hubs and agents:

• Dashboard with hub status overview
• One-click MCP server installation for GitHub Copilot, Claude Code, and Claude Desktop
• In-UI Docker image building with live log viewer
• Hub linking and registry management

---

Breaking Changes

• The module system has been removed (list_modules, execute_module, start_continuous_module)
• Replaced by hub tools: list_hub_servers, discover_hub_tools, execute_hub_tool, start_hub_server, stop_hub_server, etc.
• make build-modules replaced by ./scripts/build-hub-images.sh

---

Other Changes

• CI: GitHub Actions workflows with ruff lint, mypy typecheck, and tests
• Storage: ~/.fuzzforge for user-global data, .fuzzforge/ in workspace for project storage
• Docs: README rewritten for hub-centric architecture

v0.7.2 - Secrets Worker Fix

🐛 Critical Fix

Secrets Worker Missing from Repository

• Fixed missing secrets worker - was being ignored by broad gitignore pattern
• Added gitignore exception for workers/secrets/ directory
• Secrets worker now properly tracked in repository:
  • workers/secrets/Dockerfile
  • workers/secrets/requirements.txt
  • workers/secrets/worker.py

This release adds the missing secrets detection worker that should have been included in v0.7.1.

Included from v0.7.1

All improvements from v0.7.1 are included:

Worker Naming Fixes

• Fixed worker container naming mismatch between CLI and docker-compose
• Backend now correctly uses service names (worker-python, worker-secrets, etc.)

Monitor Command Consolidation

• Unified monitor live command with --once and --style flags

Findings CLI Improvements (Closes #18)

• Moved show command to finding (singular) for better UX
• Kept export in findings (plural) for exporting all findings
• Removed broken analyze command

📊 Changes

• 10 files changed from v0.7.0: 672 insertions(+), 204 deletions(-)
• Secrets worker fix: 4 files, 389 insertions

Full Changelog: v0.7.0...v0.7.2

FuzzForge v0.7.0 - Temporal Orchestration & AI-Powered Security

Major Release: Complete migration from Prefect to Temporal with vertical workers architecture.

🚀 Key Features:

• Temporal workflow orchestration with persistent execution
• Vertical worker architecture (Python, Rust, Secrets, OSS-Fuzz, Android)
• MinIO-based target storage with automatic upload
• On-demand worker startup (saves 5-7GB RAM)
• Real-time workflow monitoring via Temporal UI

🤖 AI-Powered Analysis:

• LLM secret detection: 84.4% recall (gpt-5-mini)
• AI code analysis workflow (llm_analysis)
• Semantic secret discovery with context awareness

✅ Production Workflows:

• security_assessment: Regex-based security analysis
• gitleaks_detection: Pattern-based secret scanning
• trufflehog_detection: Secret detection with verification
• llm_secret_detection: AI-powered secret detection

🔧 Development Workflows:

• atheris_fuzzing: Python fuzzing (early development)
• cargo_fuzzing: Rust fuzzing (early development)
• ossfuzz_campaign: OSS-Fuzz integration (heavy development)

📦 Infrastructure:

• Docker Compose orchestration
• PostgreSQL for Temporal state
• MinIO S3-compatible storage
• Vertical workers with pre-installed toolchains
• SARIF-compliant result format

📚 Documentation:

• Complete documentation overhaul for Temporal architecture
• Worker startup instructions for new users
• Updated workflow references and examples
• Environment configuration guide