@@ -4,6 +4,32 @@ All twenty-six published Dex agents packages share this changelog and one versio
 release is tagged `agents/v<version>`. See [README.md](README.md#versions-and-compatibility)
 for the Dex SDK and framework versions each release supports.
 
+## 0.6.4 (2026-11-13)
+
+### Added
+
+- `dex-agents-cli-core` and `@superdurable/dex-agents-cli-core`: the
+  configuration file's optional `mcp_servers` map names remote MCP servers,
+  each with a `url`, `headers`, and `trust_tool_annotations`. The effective
+  configuration carries it as `mcp_servers` (`RemoteMcpServerConfig` values),
+  with header values as written. `resolve_mcp_servers` (`resolveMcpServers`)
+  expands each `${NAME}` header reference from the environment, treats
+  `DEX_API_KEY`, `DEX_CREDENTIAL`, and `DEX_CREDENTIAL_FILE` as not set, and
+  raises `McpServerSettingsError` with the setting and an exact message that
+  names the variable, never its value. `McpServersToolSource`, source name
+  `mcp_servers` (`MCP_SERVERS_TOOL_SOURCE_NAME`, `mcpServersToolSourceName`),
+  wraps `McpToolSource`, applies each turn's `approval.always`, and checks it
+  again in the tool Step. There it also refuses, unsent, a call that lacks the
+  approval or single attempt that the Worker's own `trust_tool_annotations:
+  false` requires, and it replaces every header and variable value of at least
+  8 characters with `[redacted]` in its log lines, errors, and tool output.
+  `mcp_server_secret_texts` (`mcpServerHeaderVariableValues`) returns the
+  secret texts to pass it. The new configuration error code is
+  `insecure_mcp_server_url`. The rules and cases are in
+  `agents/conformance/cli_config.json`.
+- `@superdurable/dex-agents-pi-cli` and `dex-agents-deepagents-cli`: writes of
+  `mcp_servers` tools wait for approval, as connector writes do.
+
 ## 0.6.3 (2026-11-13)
 
 ### Added
 
@@ -16,7 +16,7 @@ and upgrade steps.
 
 ## 0.6 {#v0-6}
 
-Released 2026-11-12 as [agents/v0.6.0](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.0); 0.6.1 released 2026-11-12 as [agents/v0.6.1](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.1); 0.6.2 released 2026-11-12 as [agents/v0.6.2](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.2); 0.6.3 released 2026-11-13 as [agents/v0.6.3](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.3).
+Released 2026-11-12 as [agents/v0.6.0](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.0); 0.6.1 released 2026-11-12 as [agents/v0.6.1](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.1); 0.6.2 released 2026-11-12 as [agents/v0.6.2](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.2); 0.6.3 released 2026-11-13 as [agents/v0.6.3](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.3); 0.6.4 released 2026-11-13 as [agents/v0.6.4](https://github.com/superdurable/dex/releases/tag/agents%2Fv0.6.4).
 
 ### Breaking
 
@@ -47,6 +47,7 @@ Released 2026-11-12 as [agents/v0.6.0](https://github.com/superdurable/dex/relea
   **acquire_session_terminal_lease** and **release_session_terminal_lease**
   RPCs and the **SessionTerminalLease** Attribute, which mark the terminal that
   has the session open. Since 0.6.3.
+- Python and TypeScript CLI commands: the new **mcp_servers** section of the configuration file adds the tools of remote MCP servers over Streamable HTTP, stateless servers included. The agent sees each tool as **SERVER__TOOL**, and every call waits for approval unless **trust_tool_annotations** lets the server's hints mark the tool a read or an idempotent write. A header value can take its secret from an environment variable reference, which the Worker expands at startup and never prints, logs, or stores; error text that a server sends back, such as an HTTP 401 body or a tool error, has the header values replaced with **[redacted]** on a best-effort basis; an http URL on a host that is not loopback, or an unset variable, stops the command. [Reference](/reference/agents/cli#mcp-servers). Since 0.6.4.
 
 ### Changed