Skip to content
Proposals/Audit security updates in SDK v0.0.67
proposalteamP5High impactCline

Audit security updates in SDK v0.0.67

Reasoning controls (effort, budget, on/off) are now driven by the models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; · Anthropic's mandatory and impossible thinking modes are handled explicitly, and out-of-ra

Why this loop

Release: SDK v0.0.67 Detail: Reasoning controls (effort, budget, on/off) are now driven by the models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; · Anthropic's mandatory and impossible thinking modes are handled explicitly, and out-of-range budgets are clamped · OpenRouter now defaults to `anthropic/claude-sonnet-5` · +14 more changes Themes: mcp, model, security Config surfaces changed: MCP server config Developer angle: Try in a throwaway repo before changing daily workflow. Team angle: Pilot / sandbox / policy review before org rollout. Source: https://github.com/cline/cline/releases/tag/sdk/sdk/v0.0.67

Proposed actions

  1. Check your MCP server config for Cline — the release states: “The per-server `timeout` in `cline_mcp_settings.json` is now honored by the SDK's MCP clients for `initialize`, `tools/list`, and `tools/call` instead of hardcoded 1.5s and 5s limits — it defaults to 60 seconds and is clamped to 1–3600 seco”
  2. Confirm the rest of your Cline config still behaves as you expect, then decide adopt / pilot / wait.
  3. Run a 30-minute bake-off of Cline's new/default model on one real task you already know well.
  4. Re-check agent/tool permissions for Cline on a throwaway repo before using it on production code.
  5. List permission, sandbox, API, or config breaks for Cline and decide adopt / pilot / wait.
  6. Decide this week: adopt now, pilot on one project, or defer — then capture the decision in DevAgentRadar.

Action pack

Paste into your agent or query via MCP (`get_action_pack`) — free, no extra AI cost

Paste into Claude Code / CLAUDE.md task

# DevAgentRadar → Claude Code

You are helping me adopt a real coding-assistant change. Work only from the facts below. Do not invent features.

## Context
Assistant: Cline
Proposal: Audit security updates in SDK v0.0.67
Summary: Reasoning controls (effort, budget, on/off) are now driven by the models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; · Anthropic's mandatory and impossible thinking modes are handled explicitly, and out-of-ra
Primary source: https://github.com/cline/cline/releases/tag/sdk/sdk/v0.0.67

## Why it matters
Release: SDK v0.0.67
Detail: Reasoning controls (effort, budget, on/off) are now driven by the models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; · Anthropic's mandatory and impossible thinking modes are handled explicitly, and out-of-range budgets are clamped · OpenRouter now defaults to `anthropic/claude-sonnet-5` · +14 more changes
Themes: mcp, model, security
Config surfaces changed: MCP server config
Developer angle: Try in a throwaway repo before changing daily workflow.
Team angle: Pilot / sandbox / policy review before org rollout.
Source: https://github.com/cline/cline/releases/tag/sdk/sdk/v0.0.67

## Suggested actions
1. Check your MCP server config for Cline — the release states: “The per-server `timeout` in `cline_mcp_settings.json` is now honored by the SDK's MCP clients for `initialize`, `tools/list`, and `tools/call` instead of hardcoded 1.5s and 5s limits — it defaults to 60 seconds and is clamped to 1–3600 seco”
2. Confirm the rest of your Cline config still behaves as you expect, then decide adopt / pilot / wait.
3. Run a 30-minute bake-off of Cline's new/default model on one real task you already know well.
4. Re-check agent/tool permissions for Cline on a throwaway repo before using it on production code.
5. List permission, sandbox, API, or config breaks for Cline and decide adopt / pilot / wait.
6. Decide this week: adopt now, pilot on one project, or defer — then capture the decision in DevAgentRadar.

## Config surfaces this release may change
- MCP servers **(high confidence)** — check your repo before applying
- skills — check your repo before applying
- sandbox settings — check your repo before applying


## Your job
1. Restate the change in one sentence.
2. Propose a minimal plan for my repo (or a throwaway pilot).
3. Implement only what I approve; prefer small diffs and tests.
4. Call out risks (permissions, breaking APIs, cost).

Start by confirming you understood the proposal.
mcpmodelsecurityRelease source ↗

Your loop

This browser · no sign-in · not shared as “you”

Community signal · 0 approved · 0 deferred · 0 ignored

Anonymous public tally (one vote per visitor; changing choice updates your vote). Not moderated product truth.

Originating release signal

Clinesdk/sdk/v0.0.67Jul 31, 2026

SDK v0.0.67

Reasoning controls (effort, budget, on/off) are now driven by the models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; · Anthropic's mandatory and impossible thinking modes are handled explicitly, and out-of-range budgets are clamped · OpenRouter now defaults to `anthropic/claude-sonnet-5` · +14 more changes

Verified excerpt — the source's own words
- Reasoning controls (effort, budget, on/off) are now driven by the models.dev catalog and normalized once before provider encoding, so requests match what each provider actually advertises; Anthropic's mandatory and impossible thinking modes are handled explicitly, and out-of-range budgets are clamped
- OpenRouter now defaults to `anthropic/claude-sonnet-5`
- The per-server `timeout` in `cline_mcp_settings.json` is now honored by the SDK's MCP clients for `initialize`, `tools/list`, and `tools/call` instead of hardcoded 1.5s and 5s limits — it defaults to 60 seconds and is clamped to 1–3600 seconds
- Fixed the China and international endpoint toggles being ignored for Qwen, Moonshot, and Z AI
- Legacy API keys are now migrated for every secret-backed provider instead of a subset
- Legacy OpenAI Compatible model-info overrides are now carried into the seeded `models.json` instead of being dropped
- Removed the "Enable R1 messages format" option from the OpenAI Compatible provider
- Fixed checkpoint restores across session resumes

Excerpt ends here — this release continues at the source ↗.

Primary source ↗