Changelog

This document records the major version evolution, new features, and bug fixes of the TestNet platform.

NOTE

Features from v2.x, including AI Applications, AI Models, AI Knowledge Base, AI Agent Orchestration, Ollama/DeepSeek integration, gRPC, and Elasticsearch, have been removed in the v3.0 architectural refactoring. Please refer to v3.0 and later versions for current features.

---

[3.0.4] 2026-09-17

MCP Agent Ecosystem & Security Assessment Matrix

• Tool Matrix Expanded, then Consolidated: Within this release cycle the MCP toolchain kept growing with atomic capabilities — blocking task await and proactive cancellation (testnet_await_tasks / testnet_cancel_task), cluster capacity awareness (testnet_get_system_status), natural-language tool discovery (testnet_search_tools), frontend JS static analysis (testnet_js_analyzer), plus workflow-run and vulnerability lifecycle tools — and was consolidated on Sep 17 into 14 core facade tools with full backward compatibility.
• MCP Long-Running Task Notification Bus: Standard notifications/progress progress updates, notifications/message streaming logs, and notifications/tools/list_changed hot reloads.

Target Credential Management Platform

• Multi-Credential Storage: Ingest and store COOKIE, TOKEN, BEARER, API_KEY, BASIC_AUTH, and HEADER_MAP credentials with automatic redaction and masking.
• Dynamic Header Stripping & Credential Injection: Automatically strip obsolete authorization headers and overwrite target requests with clean test credentials.
• Dedicated Management UI: Added a credential management page under "AI Agent" with complete CRUD, activation toggles, and multilingual support.

Distributed Probe Internal HTTP Relay

• Task-Based Internal Relay: Introduced RelayTaskBridge in HttpRelayService to route HTTP penetration probes through remote client probe nodes, enabling assessments in isolated network zones.
• Traffic Audit & HAR Export: Capture single-step redirect chains and full request/response traffic records with HAR 1.2 export.

Task Engine & Logging Enhancements

• Streaming Incremental Console Logs: Task log retrieval with offset/limit slicing and structured JSON format support.
• Active Task Abort & Cancellation: Cancel active or queued tasks on demand to conserve computing resources.

Unified MCP Facade Tool Architecture (14 Core Facade Tools)

• Consolidated Tool Surface: tools/list converged from 57 atomic tools into 14 core facade tools (testnet_asset, testnet_project, testnet_blackboard, testnet_memory, testnet_search_tools, testnet_workflow, testnet_task, testnet_get_system_status, testnet_http, testnet_web_recon, testnet_access_control, testnet_vuln, testnet_cyberspace, testnet_query_asset_graph). Each facade tool covers a complete business domain via an action parameter, drastically reducing tool-selection noise and context overhead for Agents.
• Fully Backward Compatible: All 57 legacy atomic tool names remain callable via tools/call (each resolves to the same underlying executor as its equivalent facade action, so behavior is identical); existing Agent integrations keep working unchanged.

Help Documentation Sync

• MCP Tools Reference Restructured: mcp/tools.md now leads with detailed specs of the 14 facade tools followed by an appendix mapping all 57 legacy atomic tool names, strictly aligned with actual server behavior.
• Site-Wide Consistency: Tool counts and invocation examples in the product introduction, MCP overview, client integration guides, and changelog all updated to the facade-tool perspective.
• Bilingual Sync: English (en/) documentation updated in lockstep.

[3.0.3] 2026-08-25

New Features & User Experience

• Continuous Sequential Table Row Indexing: Improved row numbers across all asset and task lists to accumulate continuously across pagination, providing a cleaner navigation experience for large datasets.
• Strict UI Language & Terminology Consistency: Cleaned up mixed-language text across interfaces to provide a consistent, localized user experience.
• One-Click Quick Copy for Key Asset Fields: Added hover-to-copy capability for domains, IPs, URLs, cookies, headers, and credentials to boost investigation and triage speed.
• Web Asset Card Grid Layout Optimization: Redesigned Web asset card layout with adaptive grid alignment for clean, organized viewing across screen resolutions.
• Terminal Execution Log Viewer Upgrade: Enhanced task log viewer with real-time ANSI color highlighting, adaptive auto-height, and smooth auto-scrolling.
• Improved Mobile Browsing Experience: Optimized mobile table view with smooth native horizontal scrolling for consistent data access on phones and tablets.
• Streamlined Node Pool Management: Simplified scan node cards and configuration dialogs to focus on vital node health and connectivity status.

Task Engine & Reliability Improvements

• Long Log & Large Task Collection Hardening: Optimized the task execution engine to handle long single-line scanner outputs without truncation, raising collection limits for output logs and generated artifact files.
• Comprehensive Task Status Filtering: Added full status filters for "Waiting", "Assigned", "Parsing", and "Skipped" to precisely track task execution lifecycle.
• Cross-Project Batch Action Guard: Enforced strict project ownership validation on batch workflow/tool triggers to prevent accidental execution across project contexts.
• Deterministic Pagination Sorting: Stabilized sorting behavior across all asset and task tables, eliminating row hopping between pages when records share identical sort weights.
• Advanced Query Precision: Improved advanced search field mapping and filtering logic for accurate multi-condition queries.

MCP AI Agent Ecosystem Expansion

• 29 Standardized MCP Tools: Added new tools for project container creation (testnet_create_project), real-time console log streaming (testnet_get_task_logs), DOM extraction (testnet_browser_fetch), hidden parameter discovery (testnet_param_miner), HTTP differential comparison (testnet_diff_response), and chunked body inspection (testnet_http_view_body).
• Asset Ingestion Robustness & Lifecycle Status Protection: Overhauled parameter alias resolution across all asset tools; strictly decoupled lifecycle status status (ACTIVE/INACTIVE) from vulnerability remediation status fixStatus to prevent validation deadlocks.
• SSE Streaming & Reverse Proxy Optimization: Configured X-Accel-Buffering: no header in MCP SSE handshake to prevent buffering delays behind Nginx/CDN reverse proxies.

Engine Architecture & Deadlock Elimination

• Workflow Distributed Lock Decoupling: Decoupled Redisson distributed locks from underlying database transactions, eliminating connection pool starvation deadlocks under high task concurrency.
• Large HTTP Body Streaming & Defense: Hardened penetration testing HTTP relay against oversized payloads with regex line filtering, truncation limits, and chunked fetching.

---

[3.0.2] 2026-08-04

Bug Fixes

• Probe Public Network Connectivity Fix: Resolved a network isolation issue in Docker deployment mode where client probes were unable to reach external cyberspace APIs, ensuring proper operation of native scanning tools.
• Upgrade Config Sync Fix: Fixed an issue where running ./testnet.sh update occasionally missed syncing updated configuration templates.

---

[3.0.1] 2026-08-04

New Features

• Version Management & Update Alerts: Added product version check in System Settings and License Management, actively notifying users when new releases are available.
• Proactive License Expiry Warning: Introduced license status countdown with 30-day advance expiry warnings to ensure uninterrupted service.

Improvements

• License Management Page Refactor: Unified license status, machine fingerprint, and version info in a clean layout, streamlining activation directly on login.

Bug Fixes

• Batch Action Display Fix: Fixed intermittent display issues when batch-triggering workflows and tools.

---

[3.0.0] 2025-07-01

Critical Upgrade Notice

This version contains breaking changes. Please make a full backup of your data before upgrading. The database has been migrated from MySQL to PostgreSQL 16. Direct upgrade from v2.x is not supported. Please perform a fresh installation and migrate asset data using Excel export/import.

New Features

• MCP Integration: Fully supports Model Context Protocol. AI Agents like Claude Code and Cursor can directly execute asset queries and trigger workflows (e.g., testnet_query_assets, testnet_run_workflow).
• vNext DSL Engine: Upgraded tool and workflow DSL specifications (kind: Tool/Workflow). The DAG control and data flows are defined via dependsOn and inputs.*.from, featuring real-time JSON Schema validation.
• Asset Graph Chart: Added a cross-type asset topology mapping page (powered by ECharts force-directed layout). View asset relationships in a clean, visual graph. Endpoint: GET /api/v1/asset/graph.
• Tool Store (Registry): One-click installation and updates of scanning tools and workflows from a remote DSL repository. Includes 23 built-in tools and 8 pre-configured workflows.
• Resilience & Circuit Breaking: Workflows and tasks now feature automatic circuit breaking and exponential backoff retry policies. System alerts are pushed in real time.
• Remote Config Synchronization: Scan nodes automatically synchronize configuration files from the server.

Architecture Upgrades

• Database Upgrade: Fully migrated the primary database to PostgreSQL 16, significantly boosting data processing performance and concurrent execution stability.
• API Port Adjustment: The backend API port has been changed from :8080 to :8081 (clients must update their configurations accordingly).
• Communication Architecture Refactor: The scan client now uses a highly reliable HTTP long-polling architecture, solving task loss and reconnection issues under unstable networks.
• Frontend Refactor: Enjoy faster page loading speeds, a brand new user interface, and real-time syntax checking/code highlighting for DSL rules using CodeMirror 6.

Bug Fixes

• Fixed the issue where workflow DAGs entered an infinite wait state in circular dependency scenarios.
• Fixed race conditions in task state updates during concurrent multi-node execution.
• Fixed URL deduplication logic errors during Web asset bulk imports.
• Fixed timezone offset issues that caused incorrect Cron-based automatic workflow triggers.

Migration Guide

• The database is now PostgreSQL 16. In docker-compose.yml, the database service is named testnet-db (instead of testnet-mysql), and the volume name is testnet-db-data.
• The backend API port is now 8081. Update TESTNET_SERVER_URL on scan clients to use port 8081.
• The client environment variable TESTNET_SERVER has been renamed to TESTNET_SERVER_URL.
• The backup command is now pg_dump (instead of mysqldump), and the restore command is pg_restore (instead of mysql).

---

[2.2] 2025-04-21

New Features

• AI Application Management: Added configuration for standard applications and advanced workflow applications
• AI Model Management: Unified management of integrated large model API endpoints
• AI Knowledge Base: Support uploading local asset background and knowledge entries to build a local knowledge graph
• AI Workflow Orchestration: Support graphical drag-and-drop AI Agent task orchestration
• AI Vector Database: Provides vector database local storage and retrieval interfaces for intelligent Agent semantic asset search

Bug Fixes

• Fixed a memory leak bug that occasionally occurred during large file bulk asset import
• Fixed the issue where Web assets were not automatically imported to API, and API asset entry threw errors
• Fixed the bug where Web assets were not properly deduplicated during import
• Fixed the issue where Httpx scanned Web assets had misaligned parsing under concurrency
• Fixed the issue where Httpx scans did not return status codes and response sizes
• Fixed the issue where certain specific Linux kernel incompatibilities caused scanning node crashes

---

[2.1] 2025-04-11

Redeployment Notice

This update refactored the distributed communication mechanism. Deployed distributed scanning nodes (Client) need to pull the latest code and recompile for redeployment.

New Features

• Multi-Port Input: Port list supports entering/importing multiple ports at once (separated by commas)
• Multi-Project Context: Added a project switcher in the top navigation bar, supporting quick filtering and switching of project context
• Optimized Page Navigation: Optimized asset click-to-navigate logic to prevent accidental navigation away from the current editing page
• Enhanced Log Search: Task log real-time monitoring viewer added global keyword filtering and highlighting
• Web Asset Path Support: Web asset URLs support non-root path recognition
• Data Ownership: Assets now support assigning ownership to users and departments, enabling data permission control

Bug Fixes

• Fixed the bug where subdomain import incorrectly extracted top-level domain rules
• Fixed the bug where node custom tools failed to reload after a loading failure
• Fixed the bug where "batch delete" on the asset list page did not work under certain conditions
• Fixed the bug where scanning task result reporting threw errors when importing to the asset hub

Performance Optimizations

• Optimized million-level asset Excel import/export speed, reducing memory consumption by 40%

---

[2.0] 2025-02-07

Fresh Install Notice

This version removes the external Elasticsearch dependency and refactors the database model. Before upgrading, please export and back up your asset data, and perform a fresh database initialization.

New Features

• AI Assistant Upgrade: Officially integrated DeepSeek API and Ollama local private deployment (such as DeepSeek-R1 distilled model)
• Cyberspace Engine Enhancement: Supports 0.zone (Lingling Xin'an) cyberspace search engine data fetching and import
• System Security: Admin initial password is now randomly generated at container startup (can be viewed via docker logs testnet-server | grep 'Random password:')
• Asset Hub Optimization: Port services support manual marking as OPEN or CLOSED status

Performance Optimizations

• Removed Elasticsearch: Optimized native SQL queries, removed ES component, overall system memory usage reduced by over 30%
• Underlying Communication Upgrade: Improved synchronization performance between server and distributed clients
• Asset Search Performance: Advanced query and list search response speed improved by 50%
• Result Reporting Retry: When scanning nodes cannot report results due to network fluctuations, supports local queue temporary storage and automatic exponential backoff retry
• High Availability Improvement: Resolved the issue where Go client hangs or goes offline due to Docker container execution exceptions
• API Asset Deduplication: Added API URL and Methods composite unique index to automatically filter duplicate data

Bug Fixes

• Fixed the bug where the project selection dialog was misaligned during cyberspace mapping engine result import
• Fixed the issue where individual technology stack JSON displayed abnormally during Web asset export
• Fixed the timestamp parsing logic error in advanced query for asset time filtering
• Fixed the issue where pagination count jump did not work in the task list

---

[1.9] 2024-12-05

New Features

• Added built-in URLFinder path scanning tool, supporting extracting APIs from Web frontend JS
• Added built-in wih sensitive information scanning tool, scanning sensitive credentials and emails in Web responses and source code

Performance Optimizations

• Image Pre-bundled Tools: To solve the issue of slow Go binary tool pulling and compilation on node machines, scanning node images now default to integrating Naabu, Subfinder, Nuclei and over 10 security tools, eliminating first-run installation wait time (image increased by 1GB, but experience significantly improved)
• Support custom timeout parameter in tool global configuration and node configuration (unit: minutes), default script timeout is 2 hours
• Optimized the issue where temporarily installed external tools were lost after node container restart
• Display specific stderr prompts in task details when task execution fails, reducing troubleshooting difficulty

---

[1.8] 2024-10-11

New Features

• Asset Blacklist: Supports configuring regex-based blacklist filtering rules to automatically block unwanted internal network or specific assets
• Port Scan Optimization: Naabu and Nmap scanning nodes added firewall (WAF/IDS) recognition anti-blocking filters
• Multi-channel Notification: System notifications added WeCom, DingTalk, and Feishu group robot Webhook push support

Bug Fixes

• Fixed the issue where concurrent task execution caused some client node long connections to be disconnected by the server
• Fixed the bug where automatic tool installation failed to work in offline/no-public-network environments