Changelog

Versions in production

SDK 0.3.0 · 2026-11-13

pip install drums-sdk now installs 0.3.0 (PyPI, release v0.3.0).

• The drums command. drums version, and drums mcp: the local MCP server on stdio with the same 34 tools as the hosted endpoint. drums mcp --print-config claude|claude-local|cursor|codex prints the client snippet; see Use Drums from Claude Code, Cursor and Codex.
• Keys travel over HTTPS only. A key paired with a plain http:// URL whose host is not loopback raises InsecureTransport before any request (drums mcp exits 2 with a one-line message naming the host, never the key). Opt in for a trusted network with connect(allow_insecure_http=True), DRUMS_ALLOW_INSECURE_HTTP=1 or drums mcp --allow-insecure-http. drums.check_transport() is the rule itself.
• Redirects are same-origin only. The client follows a redirect only to the same scheme, host and port, at most 5 hops (drums.MAX_REDIRECTS), and raises RedirectRefused otherwise, so the key is never re-sent to another origin.
• Destructive MCP tools need confirm: true from the caller. destroy_computer, delete_snapshot and revoke_api_key are refused before any request unless the tool call carries it; the MCP client owns the user's approval, Drums does not prompt.
• Client.runs, create_run, run, api_keys, create_api_key, revoke_api_key and audit for the /v1/runs, /v1/api-keys and /v1/audit routes; call() takes extra headers (Idempotency-Key).
• The SDK repository is a Claude Code plugin (.claude-plugin/plugin.json, .mcp.json, the drums-workflow skill).

MCP server · 2026-11-12

• Hosted MCP endpoint. Every workspace gateway serves one MCP server at its gateway URL plus /mcp (Streamable HTTP, API-key bearer auth) with 34 tools over the workspace and the desktop; see Use Drums from Claude Code, Cursor and Codex. Every call is written to the audit log as actor mcp; destructive tools need confirm: true.
• New routes. GET/POST /v1/runs, GET /v1/runs/{id}, GET/POST /v1/api-keys, DELETE /v1/api-keys/{id}, GET /v1/audit (HTTP API).
• The local drums mcp command and the drums CLI come with SDK 0.3.0 (published 2026-11-13, above).

RC1 · 2026-10-31

The first release candidate: one build of the runtime, the desktop image build, the checkpoint/restore fork and the prime-rl adapter.

• Hardened desktops by default. Each desktop runs in its own user namespace (root inside it is an unprivileged id on the host), with no_new_privs, a reduced capability set, a seccomp filter and a metadata firewall.
• No privilege escalation for the agent. The desktop user is in no administrator group; sudo, su and pkexec refuse. Task setup steps that need root run as trusted provisioning by the runtime, never by the agent. The 3 tasks that need the agent itself to act as root are marked supported: false and refused with TaskUnsupported.
• New gate no_app_crash. A process of a desktop that dies of a crash signal makes the episode invalid, with a named reason. A save or fork of a crashed desktop passes the crash on.
• Forked Chrome fixed. Fork children restored Chrome without its memory protection keys, so Chrome crashed on a form submit ("Can't open this page"). Restores now keep them.
• Lab verifiers. A task's evaluator can name an operator-installed Python verifier (drums_verifier) instead of an OSWorld checker.
• One template-server start at a time, so concurrent creates after a reinstall no longer fail.

SDK 0.2.5 · 2026-10-31

• TaskUnsupported (HTTP 422 task_unsupported) for tasks the host cannot run.

0.4.2 (SDK 0.2.4) · 2026-10-30

• A quarantined desktop's episode is invalid everywhere: the verdict is invalid with the gate not_quarantined, the checker does not run (score None, checker_skipped), and rewards carry invalid_reasons.
• Leases. Desktops and saved states nobody uses are reaped (30 minutes idle by default; idle_timeout= and ttl= on create, fork and save).
• SDK cleanup. A client closes the desktops it created at process exit, on SIGTERM/SIGHUP, and at the end of with drums.connect() as client:. connect(..., close_on_exit=False) turns it off.
• fork() returns a ForkResult (a list of children with .state, .checkpoint, .failed, .seconds); fork(keep_state=False) deletes the fork's saved state when its last child closes. Env.last_fork is deprecated.
• EnvGone (HTTP 410 env_gone) for any call on a closed desktop, with closed_reason.

Drums Cloud console · 2026-11-04

• Workspaces with owner, admin and member roles; invites; API keys with scopes, expiry, rotation and revocation; audit log.
• Computers, templates, snapshots and forks in the console; the screenshot viewer (observation only).
• Runs: scripted tests. Model evaluations are not offered yet; training is not offered in this version.
• Usage with measured compute cost (not billed); workspace limits and spend caps. Billing is not enabled.
• These docs.