Skip to content

Changelog

Last update: October 20, 2026

All notable changes to this project are documented in this file.

[v202612-beta3] - 2026-10-20

Added

  • Upgrade tool (tolk-setup.sh): loads the image, creates .env on first install; on upgrade, reconciles .env with the release (new settings added in place with their default value, PROJECT_* refreshed, .env backup, --dry-run preview).
  • CUCM — RoomOS codecs support (SERVER_CUCM_ROOMOS_ENABLED): RoomOS devices driven through their xAPI over HTTPS.
  • cucm_phone_web_info: reads the web information pages of a Cisco 88xx/98xx IP phone, returned parsed: device, network setup, Ethernet, network/access ports (CDP/LLDP neighbour), RTP streams 1-5, status messages, debug display, console log / core dump file names, several pages (pages list) or all pages at once, with optional compact (no empty fields / zero counters) and summary (one digest per page) output. Time stamps are given in phone local time and in UTC (time_utc, from the phone IANA time zone); truncated flags a full 10-line phone buffer. Security audit: trust_list object (security mode, ITL/CTL file, signature, hash, TFTP/CAPF/TVS servers, last update, last DeviceTLInfo report) and compare_cucm option comparing the phone ITL hash with the CUCM database (tftptlinfo / devicetlinfo, AXL executeSQLQuery). Several phones at once with ip_phones (list, exclusive with ip_phone): phones read in parallel, one result per phone with an overall ok / partial / error status and counters, compact on by default, page="all" only with summary, global time budget, a single batched CUCM comparison and a fleet trust_summary (distinct ITL hashes, match / mismatch / unknown phones). Same prerequisites as the screenshot (cucm-phone credentials, Web Access enabled). New RBAC phone operation web_info (granted to the admin, operator and auditor profiles; one rate-limit slot per phone) and new settings SERVER_CUCM_PHONE_WEB_TIMEOUT, SERVER_CUCM_PHONE_WEB_MAX_TARGETS, SERVER_CUCM_PHONE_WEB_CONCURRENCY and SERVER_CUCM_PHONE_WEB_BATCH_TIMEOUT.
  • cucm_restart_feature_service: restarts a CUCM feature service (e.g. Cisco Tftp) on one node through the Serviceability SOAP API (ControlCenterServices).
  • Admin Web UI — Tools > Connectivity test: checks access to a product / device (network, TLS, credentials, APIs, SSH; ITL / CTL hash read on IP phones and RoomOS codecs, no comparison) and can add him to a client.
  • Admin Web UI — Custom prompts: common end-of-workflow summary: new Append the common end-of-workflow summary option ("summary": true in the definition file); the AI agent then ends the workflow with a short customer summary (operation, overall result, key figures, changes, attention points, remaining actions, rollback), completed by the prompt's own ## Summary specifics section.

Changed

  • Admin Web UI — UID / GID: the container user is now shown and editable in Global settings → Server → Docker container (0 = root refused). Both keys are now active in .env (default 1000, same as before); on upgrade, the commented-out #UID / #GID lines are activated in place with 1000.
  • Admin Web UI — AUTH_MODE consistency: a mode more restrictive than a client's own authentication mode is now refused (the server used to fail at the next restart); switching to jwt+oauth2 assigns the previous mode to every existing client; undoing AUTH_MODE or the clients alone is refused when the pair would no longer match. AUTH_MODE is now staged like the clients: the running server keeps its mode until Apply & restart.
  • Admin Web UI — self-signed TLS certificate past mid-life: as it is only regenerated at startup, the header tile now reads RESTART REQUIRED (link to Apply & restart), the restart banner is shown on every page and the certificate is listed as a pending change (author System).
  • Admin Web UI — Backup / Restore: the SFTP export now button is disabled when no local full-system backup exists.
  • Admin Web UI — sessions: Keep me signed in no longer expires on inactivity (the session remains valid for ADMIN_UI_SESSION_REMEMBER_DAYS days).
  • Admin Web UI — new settings highlighted: settings added by an upgrade are highlighted in blue (header tile, menu / tab dots, rows) until "marked as seen", edited, or after 7 days.
  • cucm_phone_send_message: multi-device support — one message pushed in parallel to up to 50 IP phones. The terminal_type argument is removed: the tool targets Cisco IP Phones 88xx / 98xx only, RoomOS codecs use cucm_roomos_send_message.
  • cucm_risport_query: multi-device support — up to 1000 device names (or * wildcard patterns) resolved in ONE RisPort request.
  • CUCM — upgrade campaign journals purge: the nightly garbage collector (03:15) deletes the journals of closed (completed / aborted) or never-started campaigns older than SERVER_CUCM_PHONE_CAMPAIGN_RETENTION_DAYS (IP phones) / SERVER_CUCM_ROOMOS_CAMPAIGN_RETENTION_DAYS (RoomOS), 30 days by default (0 = never purge).

Fixed

  • CUCM — AXL busyLampField (BLF): a BLF to an internal DN could not be written — blfDest is mandatory in the AXL schema (Missing element blfDest when omitted / null) while CUCM rejects it, even empty, next to blfDirn. The server now omits blfDest for entries carrying blfDirn and drops the empty blfDirn / routePartition of external number entries in add* / update* operations; an entry with both or none of blfDest / blfDirn is refused before reaching CUCM.
  • CUCM — AXL returnedTags: xsd:choice members requested with an empty value (e.g. blfDirn / routePartition of a BLF) were silently dropped from get* / list* requests, so CUCM returned them as null (a BLF to an internal DN looked orphan).

Custom prompts

  • CUCM — Phones upgrade workflow: server-driven upgrade campaigns, with ITL, automatic monitoring, persistent journal and final report.
  • CUCM — RoomOS upgrade workflow: server-driven upgrade campaigns, with ITL/CTL and Room Navigator checks, automatic monitoring, persistent journal and final report.
  • CUCM — RoomOS phonebook edit workflow: server-driven upgrade campaigns, with ITL/CTL and Room Navigator checks, automatic monitoring, persistent journal and final report.
  • CUCM — COP File installation workflow : Deploy across the cluster or node-by-node in a sequential order.
  • CUCM — Phone BLF edit workflow: two explicit entry formats — internal DN and external number.
  • CUCM — all workflows: end-of-workflow customer summary enabled, with the specifics of each workflow (Phones / RoomOS upgrade, COP file installation, BLF and RoomOS phonebook edit).

Dependencies

- bcrypt==5.0.0
- colorlog==6.12.0
- cryptography==50.0.2
- fastmcp==3.4.9
- lxml==6.1.3
- Markdown==3.11.2
- matplotlib==3.11.2
- mcp==1.30.0
- numpy==2.5.4
- paramiko==5.1.0
- pillow==13.0.0
- prometheus_client==0.26.0
- pydantic==2.14.1
- pydantic-settings==2.16.1
- PyJWT==2.15.1
- python-dotenv==1.2.4
- python-multipart==0.0.32
- requests==2.34.2
- starlette==1.9.0
- tzdata==2026.5
- urllib3==2.8.0
- weasyprint==70.0
- zeep==4.3.3

- bandit==1.9.4
- httpx2==2.16.0
- mypy==2.4.0
- pip==26.2.1
- pip-audit==2.10.1
- pip-check==3.2.1
- pre-commit==4.7.0
- pymupdf==2.0
- pytest==9.1.1
- pytest-asyncio==1.4.0
- pytest-cov==7.1.0
- pytest-timeout==2.4.0
- pytest-xdist==3.8.0
- PyYAML==6.0.3
- ruff==0.17.1

- OS: Debian GNU/Linux 13.7 (trixie)
- Python: 3.13.13 (base image python:3.13-slim)

[v202609] - 2026-09-30

Added

CUCM

  • New tool cucm_phone_send_message: push a text message to a Cisco IP Phone (88xx/98xx) or RoomOS endpoint display.

Security

  • Global rate limiting : cumulative limit protecting each Cisco destination server.
  • Manual IP blacklist (System page): accepts a single IP or a CIDR subnet (IPv4/IPv6), a scope (Web UI, MCP or both) and an auto-unlock duration in minutes / hours / days, or never (permanent until manually unlocked). A Web UI-scoped block denies the whole admin UI to that address; blocking your own address is refused.
  • Reverse proxy support: new TRUSTED_PROXY_IPS (trusted proxies, real client IP from X-Forwarded-For) and MCP_SERVER_PUBLIC_URL (public URL advertised behind a VIP) settings.

Diagnostics

  • Show tech: client details, partially masked IPv4 addresses, pending changes included.
  • /metrics, /status and /health: new metrics and information (statistics, admin UI certificate).

Maintenance mode

  • New maintenance mode to drain MCP traffic before an upgrade or restart: new sessions are refused, sessions in progress continue.
  • Connected clients are refused once idle for MAINTENANCE_IDLE_TIMEOUT_SECONDS (or after MAINTENANCE_MAX_DRAIN_SECONDS); /health turns to maintenance once all are drained.

Admin Web UI

  • New Admin Web UI: browser-based administration console for the Tolk server.
  • Documentation help link (?) can be edited — e.g. an internal documentation mirror.
  • Certificates: CSR generation with editable SANs.

Changed

  • TLS certificate status (dashboard Security zone, System & reload, Apply & restart check, header tile): same rule for every certificate and type — green, orange once 50% of the lifetime has elapsed (renewal recommended), red when expired. CA-signed certificates no longer use the fixed 30-day threshold.

Fixed

  • A self-signed admin UI certificate was treated as CA-signed after a restart (never renewed at mid-life, wrong status colour).
  • Dashboard / header TLS status was computed once at startup; it is now evaluated live, and the header tile links to the TLS card of the System & reload page.
  • Statistics › Pipeline: infrastructure probes (/health, /status, /metrics — Docker HEALTHCHECK, monitoring, show tech) are no longer counted in the Transport, HTTP and Authentication stages, so the Pipeline stays empty after a statistics reset like the other charts.
  • Statistics: after a restart, the 5 min / 1 h / 24 h ranges (in-memory) lost every request recorded before it, while 7 d / 30 d / 1 y (persisted history) kept them — a longer range could show more requests than a shorter one covering the same activity. The live windows are now rebuilt from the hourly history at startup (events spread over their hour), so all ranges agree.
  • Statistics: an in-place restart (Apply & restart, license reconciliation) dropped up to one minute of not-yet-saved statistics; they are now saved before the restart.
  • Statistics › Pipeline: /health, /status, /metrics, /authorize (POST) and /token requests were counted twice at the HTTP stage.

Dependencies

- bcrypt==5.0.0
- colorlog==6.12.0
- cryptography==50.0.2
- fastmcp==3.4.7
- lxml==6.1.3
- Markdown==3.11
- matplotlib==3.11.2
- mcp==1.29.0
- numpy==2.5.3
- paramiko==5.0.0
- pillow==12.3.0
- prometheus_client==0.26.0
- pydantic==2.13.5
- pydantic-settings==2.15.0
- PyJWT==2.15.1
- python-dotenv==1.2.4
- python-multipart==0.0.32
- requests==2.34.2
- starlette==1.7.0
- urllib3==2.8.0
- weasyprint==70.0
- zeep==4.3.3

- bandit==1.9.4
- freezegun==1.5.5
- httpx==0.28.1
- httpx2==2.13.1
- msgpack==1.2.3
- mypy==2.3.1
- pip==26.2.1
- pip-audit==2.10.1
- pre-commit==4.6.2
- pymupdf4llm==1.28.2
- pytest==9.1.1
- pytest-asyncio==1.4.0
- pytest-cov==7.1.0
- pytest-timeout==2.4.0
- pytest-xdist==3.8.0
- PyYAML==6.0.3
- ruff==0.16.9

[v202606] - 2026-06-25

Added

CUC (Cisco Unity Connection) — new product module

  • New cuc product module, gated by the signed license claim "cuc".
  • Supported versions: CUC v14 & v15.
  • 13 MCP tools across CUPI REST (get_version, cupi_list, cupi_call, …), SSH OS Admin (os_run_command), connectivity diagnostics and credential management.
  • Prompts: cuc/procedure, cuc/security_audit.
  • Resources: 8 VOS CLI Guide chapters, 3 optional Security Guide chapters, plus a CUPI endpoint catalogue (~80 endpoints) packaged as docs://cuc/cupi/reference and referenced by the CUC prompts.
  • Notable: CUPI client (REST /vmrest/) with mandatory TLS verification; same RBAC and credential model as CUCM / IMP.

Other additions

  • SSH session pooling extended
  • SSH pool Prometheus metrics: live pool occupancy, command-reuse histogram, success counter.
  • RBAC self-discovery for MCP clients: new tool infra_get_my_permissions(product?) and matrix embedded in infra_init_session.
  • Documentation discovery for tools-only clients: new tools infra_list_docs() / infra_get_doc(name|uri).

Changed

  • Misleading "read-only" wording removed from *_axl_call, *_os_run_command, cuc_cupi_call and related listings — permissions now depend on the caller's RBAC profile.
  • procedure prompts (CUCM / IMP / CUC) now instruct the LLM to call infra_get_my_permissions(<product>) before any write/admin operation.

Dependencies

- bcrypt==5.0.0
- colorlog==6.10.1
- cryptography==49.0.0
- fastmcp==3.2.4
- lxml==6.1.1
- Markdown==3.10.2
- matplotlib==3.11.0
- mcp==1.28.0
- numpy==2.5.0
- paramiko==5.0.0
- Pillow==12.2.0
- prometheus_client==0.25.0
- pydantic==2.13.4
- pydantic-settings>=2.14.2
- PyJWT==2.13.0
- python-dotenv==1.2.2
- python-multipart==0.0.32
- requests==2.34.2
- starlette==1.3.1
- urllib3==2.7.0
- weasyprint==69.0
- zeep==4.3.3

- bandit>=1.7
- freezegun==1.5.5
- httpx==0.28.1
- msgpack>=1.2.1
- mypy>=1.11
- pip>=26.1.2
- pip-audit>=2.7
- pre-commit==4.6.0
- pymupdf4llm>=0.0.17
- pytest==9.1.1
- pytest-asyncio==1.4.0
- pytest-cov==7.1.0
- pytest-timeout>=2.3
- pytest-xdist>=3.6
- PyYAML>=6.0.2
- ruff==0.15.19

[v202605] - 2026-05-31

Added

Core

  • FastMCP Streamable HTTP server, configured via .env.
  • Auto-bootstrap at startup: RSA-4096 key pair, server salt, client directories, JWT tokens, license verification.
  • Client lifecycle sync with AUTH_CLIENTS at every start (create / renew / purge).
  • HTTP endpoints: /health, /metrics (Prometheus), /status.
  • Structured logging (app.log JSON + dedicated audit.log).

Security

  • Air-gapped or hybrid deployment, no cloud dependency.
  • Mandatory TLS (self-signed or CA-signed).
  • Client auth: RS256 bearer tokens, JWT or OAuth2 Client Credentials (with PKCE).
  • RBAC with admin / operator / auditor profiles, customizable per client.
  • Per-client data isolation; credentials encrypted with a per-client Fernet key (PBKDF2-SHA512).
  • Full structured audit trail with control-character sanitization.
  • Transport hardening: HTTPS, DNS-rebinding protection, Host/Origin/Content-Type checks.
  • SSH fingerprint + HTTPS certificate verification before any Cisco UC connection.
  • Pydantic input validation on every MCP tool.
  • Per-client sliding-window rate limiting and Fail2ban per-IP brute-force detection.
  • .env-only configuration policy.

Performance & Stability

  • Bounded LRU caches on Zeep/WSDL clients.
  • Reduced lock contention on credential storage.

Observability

  • In-memory 24 h sliding windows, Prometheus counters for HTTP and MCP tool calls.
  • Per-tool / resource / prompt failure audit lines with error type and metric increment.
  • Show-tech bundle redaction extended to all sensitive key patterns.

Licensing

  • RS256-signed offline JWT licenses (VALID / GRACE / EXPIRED / INVALID), optional hostname binding, background watchdog, standalone CLI inspector.

Backup & Restore

  • Periodic encrypted backups (RSA-4096 + AES-256-GCM + SHA-512 sidecar), local retention, optional SFTP export.
  • Restore script with integrity verification and safe in-place replacement.

Upgrade

  • Signed upgrade bundles with RSA-PSS verification, dry-run preview, automatic pre-upgrade backup, .env key-merge without overwriting customer values.

Reporting

  • MCP tools write_report / read_report / export_report_pdf with Markdown output, 9 chart types, and WeasyPrint PDF export.

CUCM

  • Supported versions: CUCM v14 & v15.
  • 20 MCP tools across AXL, RisPort70, SSH OS Admin and Phone Web Access.
  • Prompts: cucm/procedure, cucm/security_audit.
  • Resources: 8 VOS CLI Guide chapters and 5 Security Guide (R15) chapters.
  • Notable: IP Phone screenshot capture (phone_screenshot); security audit prompt based on the Cisco Security Guide R15.

IMP

  • Supported versions: IMP v14 & v15.
  • 14 MCP tools across AXL and SSH OS Admin.
  • Prompts: imp/procedure, imp/security_audit.
  • Resources: 8 VOS CLI Guide chapters and 3 Security Guide (R15) chapters.
  • Notable: same RBAC and credential model as CUCM.

Deployment & Supply chain

  • Production-ready Dockerfile (multi-stage) and docker-compose.yml, hardened non-root runtime.
  • Base image and GitHub Actions pinned by digest; Dependabot refreshes them weekly.
  • Dependency management migrated to uv with hashed uv.lock.

Documentation

  • SECURITY.md regenerated and aligned with the documentation site.
  • Setup guides updated to highlight the .env-only policy.

Testing & CI

  • 839+ unit tests, 93%+ coverage (90% threshold enforced), live CUCM integration tests, Python 3.12 + 3.13 matrix.
  • Bandit SAST, Gitleaks secret scan, Trivy image scan — all blocking.
  • Mypy report (warn-only) and pip-audit on runtime + dev dependency trees.
  • Signed CycloneDX SBOM produced and signed offline at release time.

Dependencies

- bcrypt==5.0.0
- colorlog==6.10.1
- cryptography==48.0.0
- fastmcp==3.2.4
- lxml==6.1.1
- Markdown==3.10.2
- matplotlib==3.10.9
- mcp==1.27.1
- numpy==2.4.6
- paramiko==5.0.0
- Pillow==12.2.0
- prometheus_client==0.25.0
- pydantic==2.13.4
- PyJWT==2.13.0
- python-dotenv==1.2.2
- requests==2.34.2
- starlette==1.2.0
- urllib3==2.7.0
- weasyprint==68.1
- zeep==4.3.2

- freezegun==1.5.5
- httpx==0.28.1
- pre-commit==4.6.0
- pymupdf4llm>=0.0.17
- pytest==9.0.3
- pytest-asyncio==1.4.0
- pytest-cov==7.1.0
- PyYAML>=6.0.2
- ruff==0.15.15