AI coding 工具
Reasonix 1.34 Adds Sandboxed MCP Apps and Patches DNS Rebinding and Git Filter Execution Boundaries
Reasonix 1.34.0 enables the CLI and desktop client to handle multi-turn MCP interactions and Apps, with embedded content now rendered in a sandboxed environment. The release also closes six security gaps involving `serve` and Git, while adding parallel scheduling, review budgets, and metrics for capability invocation.
Open-source coding agent Reasonix 1.34.0 expands MCP interactions from single tool calls to multi-turn workflows and desktop Apps, rendering interactive content returned by Apps inside a sandbox. This allows an MCP server to provide not only JSON tool results but also interactive interfaces in the desktop client. For engineering teams, the new rendering layer also creates a new trust boundary, requiring content isolation, source verification, and tool permissions to be handled separately.
Another core change concerns `use_capability` controls. Reasonix adds speed and quality modes, parallel scheduling, a review budget, and metrics for capability selection, with the goal of orchestrating tools or sub-capabilities without disrupting prefix caching. The project itself uses a fixed, stable context prefix to reduce caching costs for DeepSeek-like APIs. Consequently, frequently changing the positions of capability descriptions, review content, and tool results could offset those caching gains. The new release centralizes these controls at the capability layer, but the maintainers have not yet published comparative data on latency, token costs, or task success rates.
On the security front, the maintainers say they patched six issues involving `serve` and Git boundaries in a single release. Problems listed in the public summary include DNS rebinding, out-of-bounds reads through the preview feature, and execution of Git clean filters when an agent operates on a repository. The latter two are particularly noteworthy: treating a workspace solely as a data directory is insufficient, because Git attributes and filter configuration can also create code-execution paths. Model discovery and chat for custom model providers now share the same network policy, and streaming failures are surfaced instead of producing a silent split in which the model list loads but chat remains unresponsive.
For compatibility, the release fixes issues with MCP Streamable HTTP and stateless bridges, and pins the Go MCP SDK version. It also resolves a 500 error in which new sessions created after `/resume` lost write permissions. Operators should retest existing MCP servers, agents, and custom providers, paying particular attention to content security policies for Apps, stateless connection recovery, and Git filter behavior. The release notes provide no CVE identifiers, evidence of exploitation, or third-party security audit, so describing these issues as “closed” does not mean that all related attack surfaces have been fully validated.