diff --git a/Cargo.lock b/Cargo.lock
index 85c49dc..48f642d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6111,7 +6111,7 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokenfuse"
-version = "1.20.0"
+version = "1.20.1"
 
 [[package]]
 name = "tokenfuse-cloud"
diff --git a/crates/tokenfuse/Cargo.toml b/crates/tokenfuse/Cargo.toml
index f2a8e27..b057471 100644
--- a/crates/tokenfuse/Cargo.toml
+++ b/crates/tokenfuse/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "tokenfuse"
-version = "1.20.0"
+version = "1.20.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
diff --git a/docs/releases/v1.20.1.md b/docs/releases/v1.20.1.md
new file mode 100644
index 0000000..54659e5
--- /dev/null
+++ b/docs/releases/v1.20.1.md
@@ -0,0 +1,38 @@
+# TokenFuse 1.20.1
+
+A patch release with a security fix in the MCP broker. Upgrading is recommended for every deployment that runs the broker.
+
+The broker judges a call by reading `method` from one JSON-RPC object. A JSON-RPC batch is an array, so it has no `method` of its own, and until this release the broker skipped every check keyed on `tools/call` and forwarded the array as it came: no policy decision, no identity requirement, no drift refusal, no taint gate, no scan of the arguments and no `tool_call` record, and a batched `tools/list` answer was not scanned for poisoned descriptions. This affected the HTTP and stdio transports alike, in 1.19.0 and 1.20.0. The broker now refuses such a message before anything is forwarded (invariant 142).
+
+It covers everything merged since v1.20.0: pull requests #478, #480 and #481. Pull request #476 moved the README badge, the README examples and the compose pins to v1.20.0 after that tag existed. This release moves them to v1.20.1 in a post-tag pull request, once the tag and its images exist.
+
+`compat/1.0.json` and `components.json` are unchanged since v1.20.0.
+
+## Upgrade
+
+Read this section before you change the image tag.
+
+1. No configuration changes. A deployment that sends one JSON-RPC message per request keeps working unchanged.
+2. A client that still sends JSON-RPC batches to the MCP broker now gets JSON-RPC `-32600` (Invalid Request) with a null id, and HTTP 400 on the HTTP transport. The way out is to send each message on its own. The Model Context Protocol removed batching in its 2025-06-18 revision, and its HTTP transport carries one message per POST.
+
+## Security
+
+- The MCP broker refuses, before an upstream is resolved or a secret read, a message that is not one JSON object (a batch, a bare string, a number, null), and an object whose `method` is present and is not a string. A JSON-RPC response from a client (an `id` and a `result`, no `method`) is still forwarded (#478, invariant 142).
+
+## Dependencies
+
+Five RustSec advisories are cleared, and `.cargo/audit.toml` gains no new ignore (#480):
+
+- RUSTSEC-2026-0382: rustls-webpki 0.103.15 to 0.103.16, in the workspace and `crates/cluster`.
+- RUSTSEC-2026-0381: webpki-roots 1.0.8 to 1.0.11, in the workspace and `crates/cluster`.
+- RUSTSEC-2026-0379 and RUSTSEC-2026-0378: wasmtime 49.0.3 to 49.0.4.
+- RUSTSEC-2026-0387: crypto-bigint 0.5.5 is gone, by moving p256 to 0.14 (elliptic-curve 0.14, ecdsa 0.17). The wire format of keys and signatures is unchanged, and tests now pin it to the published vectors of RFC 6979 appendix A.2.5.
+
+## Other changes
+
+- CI runs the teeth harness as eight shards instead of four, reads the shard count from the workflow alone, and cancels a pull request's older run when a newer push arrives (#481, invariant 113).
+
+## Not proven
+
+- The batch refusal is proven by the tests in `tests/it/mcp_broker.rs`, each of which failed on the broker before the fix, and by seven mutants of the refusal, each caught by one of those tests. It has not yet been run against a live deployment.
+- The APNs provider token has no fixed-vector test; it signs with the same calls the RFC 6979 vector tests pin.
diff --git a/sdk/js/package.json b/sdk/js/package.json
index 1ec8806..e6c490f 100644
--- a/sdk/js/package.json
+++ b/sdk/js/package.json
@@ -1,6 +1,6 @@
 {
   "name": "tokenfuse",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "description": "JavaScript/TypeScript client helpers for TokenFuse — runtime cost control for AI agents.",
   "keywords": ["llm", "agents", "finops", "budget", "tokenfuse"],
   "license": "Apache-2.0",
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
index 823fb2d..0682691 100644
--- a/sdk/python/pyproject.toml
+++ b/sdk/python/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tokenfuse-sdk"
-version = "1.20.0"
+version = "1.20.1"
 description = "Python SDK for TokenFuse — runtime cost control for AI agents (import as `tokenfuse`)."
 readme = "README.md"
 requires-python = ">=3.9"