midgard 1.0.0-alpha4

Fourth alpha. Bifrost now enforces PKCE S256 itself for its clients, and Midgard moves to MCP Server 2.0.0-beta6 and Config Guardian 1.1. Sites that use Bifrost over HTTP should upgrade.

Upgrading from alpha3

The install command in the README pins drupal/mcp_server in your project's own composer.json, so the new pin goes in the same command:

composer require 'drupal/midgard:^1.0@alpha' 'drupal/mcp_server:2.0.0-beta6@beta' -W
drush updatedb
drush cache:rebuild

If Composer refuses because the site's Drupal core is affected by a security advisory, update core first: composer update 'drupal/core-*' -W.

Security

• Bifrost now enforces PKCE with S256 itself for its clients: an authorization request from a Bifrost client with a plain code challenge, or none, is refused with 400 invalid_request before it reaches the OAuth server, and the consumers Bifrost registers have PKCE required (drush updatedb turns that on for clients registered before). Earlier releases stated that plain PKCE was disabled on the strength of the OAuth server's PKCE settings alone; Midgard no longer relies on them. OAuth discovery still lists plain (simple_oauth_21 issue #23 on GitHub), and Bifrost's check applies to Bifrost clients only.

Changed

• Bifrost runs on drupal/mcp_server 2.0.0-beta6, still pinned to that exact release, and Midgard declares mcp/sdk ^0.8.
• Requires Config Guardian 1.1, which rolls back through Drupal core's configuration importer: a field restored by a rollback comes back with its database table.
• Requires e0ipso/simple_oauth_21 1.13.1 or later; Midgard's own provide for its submodules is gone.
• Eir scores an import on the changes the importer applies, with Config Guardian 1.1's risk model, so scores and levels differ from alpha3. It leaves Midgard's own rollbacks and their previews alone, gates any other rollback like an import, and lists in the audit trail what Drupal also changed during a rollback.
• MCP Server 2.0.0-beta6 leaves tool arguments and results out of the mcp_server log; SECURITY.md says how to log them while debugging.

Fixed

• The two known issues of alpha3 are gone with MCP Server 2.0.0-beta6: a tool that loads entities answers over HTTP as plain JSON, and a client of protocol revision 2026-07-28 is served.
• A recovery rollback Heimdall could not apply left no trace: the failed operation's audit row now records why, and a refused rollback reports every reason.

Every change, with the details: CHANGELOG.md.