Framework Watch: LiteLLM 1.106 Turns Off stdio MCP Servers by Default, FastMCP Caps Tool-Search Regexes After Security Fixes, Mastra 1.78 Makes Tenant Identity a Run Parameter, and Cline Moves Tasks Into Hosted Sandboxes

LiteLLM v1.106.0 (October 18): stdio MCP is now opt-in

The release notes list a breaking change, "disable stdio MCP servers by default". The pull request explains why: "stdio MCP servers run local commands on the proxy host", "Most deployments only need remote HTTP/SSE servers", and "There was no way to switch stdio off". A new environment variable, LITELLM_ENABLE_MCP_STDIO, is off by default. When off, "stdio servers stay listed but never start", creating or updating one is rejected, and "Only the process env counts; config.yaml and DB-stored values are ignored." The authors call it an intentional product change: "proxies that already run stdio MCP servers stop starting them after upgrade until the admin sets LITELLM_ENABLE_MCP_STDIO=true and restarts." The same release adds a one-command Docker quickstart for gateway, Postgres and admin UI, traces for Claude Agent SDK runs "with agent name, logo and chat content", and, in its cost map, "OpenAI TTS and GPT-5.x deprecation dates". Images are signed with cosign.

FastMCP 4.1.1 and 3.4.9 (October 16-18): bounded search, contained skills

Version 4.1.1, titled "Regex Marks the Spot", says "Regex tool search now rejects patterns over 1,000 characters and stops after about a second", closing a path to pathological regexes in tool discovery, and restores skill folders that are symlinks "including links to folders outside the skills root; a skill's own files must still resolve inside the folder it links to." The 3.x backport, 3.4.9, carries the security fixes to older users: "OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID."

Mastra core 1.78.0 (October 16): scopes

Agents gain scopes, "the addresses a run acts as, written as <type>:<value> (for example org:acme, resource:user-123, thread:conversation-123)". They can be passed per call, set on the agent, or injected "from trusted middleware" via a request-context key, and Mastra merges all three. Memory now reads its resource and thread from scopes, and "If they name different values, the call throws a 400 error instead of silently picking one." Nested tools and subagents see the org scope but not the parent's thread, "so nested agent calls can choose their own thread", and "Suspended runs keep their scopes when resumed: a resume may repeat some or all of them but cannot add new ones." The release also adds queueSignal for typed signals behind an active run, a trace aggregation API, and stored input and output previews so trace lists no longer read full payloads. Two breaking changes: Factory sessions lose their Plan and Explore modes, and "cross-scope credential fallback is removed".

Cline 4.1.25 (October 16): cloud sessions and a new default model

Cline Cloud sessions, "rolling out gradually", let you "run a task in a hosted sandbox on a GitHub repo and branch you pick" that will "keep running after you close your editor." With no model chosen, the Cline provider now defaults to Gemini 4 Argon, and the refreshed catalog changes defaults for more than twenty providers, including Nemotron 3.5 Super VL for Nvidia and Muse Spark Open for Fireworks: "If you use one of those providers without pinning a model, expect a different default." Mid-stream provider errors are now retried up to three times.

Smaller items

• Strands harness-python 0.3.1 (October 15) fixes a subagent that would "surface the child's stop reason instead of masking blocked runs as success", drops reasoning blocks a target model rejects "when history crosses model families", and sends adaptive thinking to Claude Haiku 5.5.
• DeepSeek Harness 0.2.1-rc.2 (October 17) adds support for V4.1-Flash-1017 and the new Search and Fetch APIs covered here on October 18.
• vLLM 0.32.0 (October 18), "814 commits from 363 contributors", adds a /v1/systemone endpoint for structured choice, null and score questions, an hf tool and reasoning parser that reads a checkpoint's own response template, and FP8 KV cache by default for GLM-5.x on Blackwell.
• Claude Code 2.1.303 (October 18) lists only "Bug fixes and reliability improvements"; the TypeScript Agent SDK 0.3.303 tracks it.

What remains uncertain. LiteLLM's pull request merged on October 2, so some users may have had the change earlier through dev builds; the stable notes attach it to 1.106.0. FastMCP's notes describe fixes without the vulnerability reports behind them. Mastra's scope guard depends on servers that register themselves, and the notes say older or custom servers "are not detected".

Analysis: Three of this week's changes are default-deny decisions: no local processes from an MCP config unless an operator opts in, no unbounded regex from a tool search, no skill file outside its folder. The fourth, Mastra's scopes, is the identity half of the same story, giving every run an org and user it acts as and refusing to guess when they conflict. Add Strands refusing to call a blocked subagent a success, and the week reads as harness authors closing the quiet failure modes before someone else finds them.