Minor on 0.13.0. objective.signals[].entities values are stage-scoped, response.responders is a configuration enum, pip install opentide now ships the MCP server, and documentation and export generation no longer rescan the catalogue for every object — a corpus that exceeded a one-hour CI job timeout now completes.
pip install opentide==0.14.0
What changes
objective.signals[].entities entries take their stage prefix: Hostname becomes Host::Hostname. Seven of the 28 keys are defined under two stages — Account, User, Authentication, Token, Permissions, Email and API Call — so a bare name could not tell a host account from a cloud account, and seven values were unreachable. Stage ids are capitalised (Host, Network, Cloud) to match threat.surface. Vocabulary entry keys are unchanged.
opentide migrate vocab-scope --apply does the re-prefixing, for threat.surface as well. It applies only what the vocabulary implies and reports anything ambiguous instead of guessing, exiting 2 while a value still needs a human.
response.responders is a configuration enum: declare your teams in a [[responders]] block in deployment.toml and they appear in the editor, validated. Declaring none leaves the field unconstrained. [deployment] default_responders supplies the team for a rule that names none. If you emptied the field to get past validation on 0.13.0, you can put the team back.
validate and generate now resolve a vocabulary value the same way, so a green validate no longer hides degraded documentation.
A deployment status resolves by the strategy it maps to rather than by its configured name, so renaming a status no longer changes behaviour.
Minor on 0.12.1. threat.surface values are now stage-scoped, platform configuration blocks require status, opentide --json validate emits one document shape, and the local [vocabulary] extension block is removed. Re-run opentide setup ci: generated pipelines deployed to the staging tenant and pushed to your default branch from any pull request.
Read the changes
What changes
threat.surface entries take their stage prefix: Windows::Desktop becomes OS::Windows::Desktop. The same key name is defined under two stages — VPN, VPN::OpenVPN, VPN::WireGuard, Wireless and Industrial are each both Infrastructure and Protocol — so a bare name was ambiguous and those five values were unreachable. Vocabulary entry keys are unchanged.
configurations.<platform>.status is required. A rule omitting it used to pass validate and then crash deploy.
opentide --json validate --check <x> returns the same document as a bare validate: the report is always at report. Replace issues.issues with report.issues, and replace the removed errors map with report.issues.
A [vocabulary] block in schema.toml no longer injects entries. Vocabularies are canonical in specifications.
Generated CI now requires a pull request to target the default branch before it deploys or pushes. Re-run opentide setup ci.
A MISP cluster UUID that was reported as unknown now validates: threat.actors.name is pinned to actors::1.1, exposing 220 clusters that were bundled but invisible.
Patch on 0.12.0. A missing credential is logged once. Re-run opentide setup ci so a live query job guards only the $VAR names in the enabled platform file and exits 2 when one is unset.
Read the changes
What changes
Each unset configuration variable is reported once, not once per object. The live check still ends on the FATAL panel.
Generated CI ignores comments and literal values in the platform file. A skip exits 2. Exit 0 means the tenant check ran.
Minor on 0.11.0. opentide-mcp is gone. The command is opentide mcp start. Regenerate MCP config with opentide setup mcp. Re-run opentide setup ci so live query jobs run only when every required credential is set. Regenerate schemas with opentide generate so threat.chaining items are not stamped with a string enum.
Read the changes
What changes
The opentide-mcp console script is removed. Start the server with opentide mcp start. opentide setup mcp writes command: opentide and args: ["mcp", "start"] (#460).
Splunk [[modifiers]] loads as an array of tables. A config error during engine load is reported as that error, not only as a missing declare (#466).
Generated schemas no longer put a string vocabulary enum on threat.chaining items or on the array node. list[str] vocabulary fields still get items.enum (#468).
Stage-prefix suggestions strip using the field name (#467).
A retired [tenants.setup] proxy key fails the live query check and names opentide --proxy (#469).
--live fails when a credential is still $VARIABLE. Generated CI runs that job only when every required credential variable is set (#471).
Vocabulary and cross-object validation findings record yaml_line (#470).
Minor on 0.10.0. Bare validate query no longer scans.--live is the tenant check. Regenerate CI with opentide setup ci so generated pipelines pass --live and pin this release. Regenerate schemas with opentide generate so optional vocabulary lists include items.enum.
Read the changes
What changes
Bare opentide validate query exits 1 and tells you to re-run with --live. It does not scan query text (#456).
--live checks the tenant. A missing SDK or plan is a failed live check. CrowdStrike and HarfangLab stay unsupported.
Generated CI passes --live and skips a platform when its credential variables are empty. Re-run opentide setup ci.
MCP validate_query refuses unless live is true.
Optional vocabulary lists in generated schemas include items.enum (#450).
opentide generate schemas templates vocabs snippets runs those phases in one invocation (#455).
Minor on 0.9.0. Upgrade and regenerate schemas with opentide generate. Technique lists are mitre_attack. Signal log sources come from visibility.toml. Signal severity uses alert labels. Regenerate CI with opentide setup ci so the install pin is exact. A root composition block is still accepted and is no longer required.
Read the changes
What changes
Threat and objective technique lists are mitre_attack, pinned to att&ck::1.1. Actor values stay scoped (att&ck::G0007).
objective.composition is the required composition block. Templates emit it once.
signals[].data.logsources are names from visibility.toml.
Signal severity is Informational, Low, Medium, High, or Critical.
detection_model may be an objective UUID or a signal UUID.
HTTP proxy configuration is opentide --proxy http://[user:pass@]host:port.
opentide info --strict exits non-zero when an object file failed to load.
Minor on 0.8.2. Upgrade and regenerate schemas with opentide generate so rule::1.1 can record metadata.reviewed and technique and logsource checks use att&ck::1.1 and datasources::1.1. opentide rules unreviewed lists rules with no review, or a review older than the window. It does not require regenerating CI.
Read the changes
What changes
rule::1.1 accepts optional metadata.reviewed (ISO 8601 date or datetime). rule::1.0, threats, and objectives still reject the field. Nothing in validate, deploy, share, or template generation writes the date (#437, #438).
opentide rules unreviewed --older-than 90d lists rule::1.0 as schema, a missing review as absent, and a review older than the window as stale. Exit code is 0 when the window parses (#437).
Techniques validate against att&ck::1.1. Objective logsources validate against datasources::1.1. The bundled catalogues match ATT&CK 19.2 (#392, #445).
CrowdStrike and Defender auth logs no longer include the bearer token or a client-secret prefix (#441).
share push publishes a retracted object again (#385).
Deploy on a deep git history records the immediate parent instead of raising RecursionError (#369).
Patch on 0.8.1. Upgrade for a memoised object index and vocabulary files that keep dotted keys quoted. It does not change accepted input, CLI output, or exit codes, and it does not require regenerating CI.
Read the changes
What changes
OpenTide.Models.FlatIndex is built once per registry snapshot. Dropping the registry cache drops that map too, so a rebuilt index cannot serve the previous objects (#436).
Extraction runners can take keyword arguments. The CLI still calls them with none (#436).
A vocabulary writer quotes a dotted list key such as "tide.vocab.stages". A file that already nests those stages under tide.vocab is still read (#436).
Patch on 0.8.0. Upgrade and regenerate GitLab CI with opentide setup ci gitlab --yes so query validation gates generate and deploy. GitHub and Azure already waited for those checks. This patch restores that gate on GitLab. It does not change accepted input, CLI output, or exit codes.
Read the changes
What changes
A generated GitLab generate job needs validate and every validate_query_* job. A failed opentide validate query no longer starts deploy (#429).
The inflight shell quotes $CI_DEFAULT_BRANCH and exits if cd into the worktree fails. A document job with no commands is omitted, along with the document stage (#430).
Minor on 0.7.0. Upgrade and regenerate CI with opentide setup ci <github|gitlab|azure> --yes. Validation and lint are now strict, deploy skips a plan whose platforms have no tenants, and an Azure pipeline declares ubuntu-latest. An object file with no uuid fails validation. get_chaining returns threat, objective, and rule lineage.
Read the changes
What changes
opentide validate fails an object YAML file that has no uuid. The schema check reports missing_uuid. An empty catalogue still exits 0 (#397).
deploy --plan STAGING on a detached pull-request checkout fetches origin. It no longer dies with list index out of range (#402, #415).
The inflight prune job creates .opentide/inflight before git add (#403).
Generated gates are opentide validate --strict and opentide lint --strict. Deploy runs --dry-run, then opentide deploy --plan <PLAN> --skip-unconfigured. --skip-unconfigured exits 0 only when every platform in the plan has no [[tenants]] block (#408, #409).
Azure pipelines set pool.vmImage to ubuntu-latest. Azure Repos Git ignores pr:. Add a build validation policy on the default branch so a pull request sets Build.Reason to PullRequest. Staging stays gated on that reason (#398).
setup skills installs the full GitHub tree, renders package AGENTS.md, and ships four authoring skills for rule::1.0, objective::1.0, and threat::1.0 (#399, #405).
setup repo keeps empty scaffold directories in git, does not hardcode Sentinel, and warns when --name, --org, or --description are ignored because README.md already exists (#400, #404).
generate docs writes the three section indexes even when a folder is empty (#401).
MCP get_chaining returns lineage for a threat linked from an objective and a rule. A non-empty threat.chaining map stays in graph (#407).
lint prints ISSUES when findings exist. Exit code stays 0 unless --strict.
Installation pages name 0.8.0 as the latest release (#406).
Minor on 0.6.4. Upgrade to publish Tide objects to MISP, or regenerate CI so a GitHub production job compares github.ref to a literal branch ref. The share stage is off until you pass --sharing.
Read the changes
If you already generated a workflow, run opentide setup ci <github|gitlab|azure> --yes again. Add --sharing only when that pipeline should run opentide share push --changed on the default branch.
What changes
opentide share creates one MISP Event per threat, objective, or rule. preview and status do not contact MISP. The API key is never printed (#184, #371, #372).
Destinations live in .opentide/configurations/sharing.toml. Blocks with the same name merge. Successes are recorded in .opentide/states/sharing.jsonl (#370, #373).
Share exit 2 means every failure was authentication or connectivity. Exit 3 means the run both succeeded and failed.
--sharing adds the default-branch share job. Deploy does not wait for it (#375).
Patch on 0.6.3. Upgrade if generate printed an empty error for a missing detection model, a GitHub production deploy never ran, setup rewrote a README or platform comments, or MCP deploy_rule crashed. Regenerate a workflow with opentide setup ci github (or gitlab or azure) so production deploy and the checkout depth match this release.
Read the changes
What changes
generate exits 1 with a JSON message that names the missing detection_model UUID, instead of empty stdout (#352).
MCP deploy_rule returns a structured failure for an unknown platform or a platform with no tenants. deployment_status is deployed: false when the config has no external_id and no tenants (#345).
--json setup quotes the path it would write (#346).
Explorer pages are offered only for GitHub. GitLab and Azure warn and write no Explorer job (#347).
GitHub production deploy needs generate, so a push to the default branch still deploys. Deploy jobs fetch full history (#348).
setup --yes --ci none scaffolds the repository and writes no pipeline (#349).
Re-running setup keeps an edited README, .gitignore, and platform comments (#350).
lint --fix reports metadata on the renamed path (#353).
Patch on 0.6.2. Upgrade if a CI diff plan still crashed after 0.6.2 with encode, KeyError, Invalid object name, or list index out of range. Each of those cases still exits 1, with a sentence instead of the exception. FULL is unchanged.
Read the changes
What changes
A missing tip SHA names CI_COMMIT_SHA, GITHUB_SHA, or BUILD_SOURCEVERSION (#339).
Azure STAGING without pull-request variables names SYSTEM_PULLREQUEST_SOURCEBRANCH and SYSTEM_PULLREQUEST_TARGETBRANCHNAME, before any fetch (#339).
A pull-request ref that is not on origin names origin/<name> (#339).
DEBUG, MANUAL, and ALWAYS say they are not a CI diff plan. ALWAYS is no longer an alias of FULL (#339).
A GitLab merged-result commit with one parent keeps CI_COMMIT_SHA and exits 0 when both SHAs are in the checkout (#339).
Patch on 0.6.1. Upgrade if a GitLab STAGING or PRODUCTION plan crashed with 'Repo' object has no attribute 'lookup_ref', or a GitHub STAGING plan asked for Azure pull-request variables and then KeyError. Both still exit 1. GitLab reports No Source Commit Found. GitHub names GITHUB_HEAD_REF and GITHUB_BASE_REF.
Read the changes
What changes
A GitLab diff plan whose base SHA is missing exits 1 with No Source Commit Found instead of an AttributeError (#333).
A GitHub STAGING plan without GITHUB_HEAD_REF and GITHUB_BASE_REF exits 1 with that sentence, instead of Azure variable names and KeyError while compiling the deployment plan (#334).
Patch on 0.6.0. Upgrade if a CI STAGING or PRODUCTION plan skipped a changed rule file that sits directly in objects/rules/. 0.6.0 left that file out of the plan, and 0.6.1 deploys it. A file in a subdirectory of objects/rules/ is still not deployed. The missing-checkout failure is still exit 1, with a different message.
Read the changes
What changes
CI STAGING and PRODUCTION plans include a changed objects/rules/*.yaml (or .yml). 0.6.0 matched the diff against an absolute path, so a repo-relative change was skipped (#318).
Fixes
deploy --plan STAGING or PRODUCTION outside a git checkout names the directory it searched and points at --plan FULL, instead of No git repository was found at None (#310).
opentide setup --path . from a git subdirectory scaffolds that directory. An explicit --repo still replaces . (#324).
setup --no-promotion and --promotion-target write [promotion] without --ci (#325).
Minor on 0.5.0. Upgrade if a command checked the wrong directory, hid what --json already showed, or crashed on a repository that was not finished yet. A few JSON fields and exit results change, so read the first list before upgrading a pipeline.
Read the changes
If you generated CI with opentide setup ci, regenerate it so --default-branch matches the branch you deploy from: opentide setup ci <github|gitlab|azure> --yes.
What changes
opentide --json validate names the directory it read under workspace. A full run that finds no objects still exits 0, and its message names that directory (#294).
setup mcp --generic returns its copy-the-file instruction as advice instead of note (#292).
SDK: the registry index has a file_paths map. ValidationScope.path_basenames is removed; a path target matches only the object's own file (#297).
An unset Splunk frequency_scheduling keeps the mode it deployed with before: current for a legacy [setup] table, random for a [[tenants]] entry (#295).
Fixes
Commands find a detection workspace from .opentide/ or objects/, including one nested in a larger git checkout (#294). validate --file matches that path only, and issues name the object's own file (#297).
Human output keeps bracketed text, prints advice and lint findings, and info rules, info threats, info objectives, and info coverage print the section you asked for (#292, #293).
rule.metadata.schema returns the schema id (#298). generate docs writes an actor stage as att&ck, not a Python tuple (#296). info no longer warns about Splunk in a repository that does not use it (#295).
deploy without objects/rules/ reports skipped instead of Errno 2. Rules in subfolders are named in a warning and are still not deployed (#300, #312). An enabled platform with no [[tenants]] entry fails deploy and validate query --live with the file to edit (#314).
setup --ci accepts --default-branch and prints step warnings (#288, #308). --no-promotion and --promotion-target write [promotion] in deployment.toml (#307).
Minor on 0.4.0. Upgrade if your threats follow threat::1.0 and list their impact / leverage names — 0.4.0 rejected every such threat with Input should be a valid string. A threat written the way 0.4.0 required (impact: Data Breach) now fails until it becomes a one-item list, so update threats before upgrading a pipeline.
Read the changes
Then run opentide generate so new threats start from the list template.
What changes
threat.impact and threat.leverage are non-empty YAML lists of vocabulary names. A single string fails with must be a YAML list of … vocabulary names; a value or list item that joins several names with ; fails too. Give every name its own item and keep all of them (#189). See Troubleshooting.
SDK: ThreatBody.impact / .leverage are list[str]. Threat templates, editor schemas, and the explorer bundle carry lists.
Fixes
Threats written to the threat::1.0 spec validate, and validate no longer suggests a single name for a ;-joined value, which would drop the others (#189).
The spec's threat conformance fixtures run in CI, so the engine cannot drift from threat::1.0 again.
Minor on 0.3.0. Upgrade if a first-run command crashed, printed a traceback, or quietly did nothing. Fixes the first-user bugs filed against 0.3.0 and the test-harness gaps that let them ship. A few fixes change output scripts can depend on, so read the first list before upgrading a pipeline.
Read the changes
Then regenerate CI and hooks: opentide setup ci <github|gitlab|azure> --yes and opentide setup hooks --yes.
Security: regenerate GitHub CI
The inflight job from opentide setup ci github in 0.3.0 pushed the pull request head to the default branch, so an up-to-date pull request landed there unreviewed. Inflight jobs now commit only .opentide/inflight/ shards from a worktree of the default branch (#244).
What changes
validate query is an offline syntax check by default and needs no SDK. Use --live for the tenant round-trip (#239).
query is required and non-blank on Splunk and Carbon Black; splunk::2.xsearch / cron_schedule map onto query / scheduling in both validate and deploy (#233). See Upgrading to 0.4.0.
opentide --json setup without --yes exits with a JSON error instead of starting the wizard (#255).
MCP: search always returns a list, coverage for a parent technique includes sub-techniques, opentide://vocabularies is an index, and run_query is an explicit stub (#252, #253, #254, #258).
mcp is pinned <2; fastmcp is no longer a dependency (#256).
Positional PATH on setup subcommands is deprecated; use --path / -C (#248).
Fixes
CLI: nested deploy metadata / generate inflight prune ran the parent command (#243); info coverage --technique failed to parse (#257); generate docs --changed crashed without a git HEAD and missed changes off non-main trunks, on pushed feature branches, and in non-ASCII file names (#241, #251); generate extract failed at import (#242); generate explorer was not registered (#202); Sentinel-only runs loaded every engine, and a broken engine ended deploy with a traceback (#246).
Validation: validate --file ignored the directory (#240); unparseable YAML raised a traceback (#250).
Setup: GitLab and Azure inflight jobs never pushed, GitHub and Azure jobs assumed a main trunk, and concurrent inflight jobs failed or dropped each other's shards (#244); the pre-commit hook validated OPENTIDE_REPO_ROOT instead of the commit, missed nested or additional workspaces, and was installed into a user-wide core.hooksPath (#249); setup --path DIR --yes <subcommand> ignored both flags, and refusing other group options hid the subcommand's --help (#248).
Output: --no-color, FORCE_COLOR=0, and PY_COLORS=0 still let ANSI escapes through on CI runners (#282).
MCP: coverage and actor search ignored rule.techniques / threat.actors (#252); schemas resolved to {} (#254); validate_query accepted garbage (#245); opentide-mcp tracebacked without the extra (#256).
Docs: tutorial and CLI samples now match live output, and every documented command is checked against the CLI in CI (#247, #270).
Minor maintenance on 0.2.1. Upgrade for current runtime and toolchain floors (cryptography 50.x, typer 0.27) and a clean GitHub Code Quality pass.
Read the changes
Changes
Recreated stale Dependabot uv upgrades on current trunk (#235): cryptography 50.0.1 (CVE-2026-69247), dulwich 1.2.15, typer 0.27.2 (extra all removed; rich/shellingham/colorama are default deps), syrupy 5.5.3, ruff 0.16.8, ty 0.0.82 (dev extra only).
Cleared GitHub Code Quality findings from the CodeQL python-code-quality suite (#236).
Patch on 0.2.0. Upgrade if you validate threat.cve identifiers or generate threat documentation that should link to CIRCL Vulnerability-Lookup.
Read the changes
Adds
CVE validation and generated threat CVE tables use CIRCL Vulnerability-Lookup instead of scraping NVD through mitrecve (#109).
opentide validate --check cve looks up CVE, GHSA, and GCVE identifiers. GNA 0 GCVE ids map to CVE. Generated docs link to https://vulnerability.circl.lu/vuln/{id} and can enrich published date, severity, and aliases.
threat.cve is a first-class optional list on the threat body.
Changes
Bundled [cve] defaults point at Vulnerability-Lookup. Legacy NVD link prefixes are remapped. The CVE check stays opt-in so default opentide validate stays offline.
Minor on 0.1.8. Upgrade if you generate templates or VS Code snippets — optional YAML now hugs # to each key, spacers stay blank, and rule configurations are commented platform stubs rather than {}.
Read the changes
Changes
opentide generate templates walks Pydantic FieldInfo instead of the JSON Schema gen_template walker (#223).
Optional sections are commented YAML with # hugging each key; nested optionals are not commented again; spacer blanks stay blank.
Rule configurations are commented platform stubs (#sentinel:) rather than {}.
VS Code snippet conversion treats commented nested keys as mapping children, so configurations: is not turned into a tabstop.
Patch on 0.1.7. Upgrade if first-time setup / generate logged missing object folders as errors, dumped YAML null, attached live children under #key: parents, skipped platform TOML from setup repo --platform, emitted Title-Case UUID documentation paths, or looked up objective.priority in criticality::1.0.
Read the changes
Adds
VS Code snippets with tide-* prefixes, YAML scope, descriptions, and tabstops (#194).
Patch on 0.1.6. Upgrade if VS Code YAML reported "Matches multiple schemas", generated templates hid required nested fields, setup vscode skipped snippets or crashed on a missing path, JSON validate stamped every check failed, or invalid_ref pointed at parent objects.
Read the changes
Fixes
invalid_ref reports the leaf UUID field; JSON validate uses per-check status; vocabulary names skip list indices.
VS Code yaml.schemas uses recursive per-folder globs (objects/threats/**/*.yaml) instead of the router wildcard.
MCP templates use servers (VS Code/Cursor), host-specific repo-root env, extensions.json, and AGENTS.md.
Python 3.10–3.14. One wheel: CLI, MCP (opentide-mcp), SDK, seven platform adapters. Enable platforms with opentide setup platforms — not with pip extras.
In this release
A version you can pin, instead of a CoreTide submodule SHA.
opentide setup for repo, CI, MCP, and skills.
Honest capability: seven platforms deploy; five validate query syntax (Sentinel, Defender, Splunk, SentinelOne, Carbon Black). CrowdStrike and HarfangLab are deploy-only.
Not in this release
A hard cut for existing instances. Pinned CoreTide checkouts keep resolving. Migrate when you next touch CI — migration guide.
A freeze forever. For four weeks after 0.1.0 the maintainers treat this as a support window: deployer bugs, docs, agent setup, migration questions. File issues on OpenTideHQ/opentide.
