diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 76d5538..7d9b009 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.9.0"
+  ".": "0.10.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..b005d0c
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,37 @@
+# Changelog
+
+## [0.10.0](https://github.com/KeyValueSoftwareSystems/agent-opfor/compare/v0.9.0...v0.10.0) (2026-07-06)
+
+
+### ⚠ BREAKING CHANGES
+
+* **sdk:** switch to apikey values; update sdk e2e tests and examples ([#168](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/168))
+
+### Features
+
+* expand env references in agent target headers ([#169](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/169)) ([605a9b5](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/605a9b5e032d52ffa11da3ce0b372c3c74f037fc))
+* stream run lifecycle events as ndjson via a run-listener ([#159](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/159)) ([ccc99dc](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/ccc99dc161121f40ecdaf56182c5bd4c91b99dc1))
+* support listing mcp suites from the sdk ([#144](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/144)) ([6b68b42](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/6b68b4292d5f8f9b1a86df1b40dba8c6f02a0769))
+* support server-owned session IDs with body/header config ([#167](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/167)) ([121edfd](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/121edfdc1a29d553acad160487feacd794faffb1))
+
+
+### Bug Fixes
+
+* broken gitleaks ci for fork ([#158](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/158)) ([e0be561](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/e0be561283febd7a237db7677059bb4124f638bb))
+* bump zod to ^4.0.0 to satisfy claude-agent-sdk peer dependency ([#148](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/148)) ([bcd970e](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/bcd970e4e53a805386e3a84c439d8d6f96b12264))
+* conditional reasoning instruction and stricter section() parsing ([15b598f](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/15b598f64739cae5cf3df529ba3ceb11832ebd9c))
+* declare mcp dep, add createRequire banner, fix atlas-data resolution for bundled runners ([#134](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/134)) ([b8ff91f](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/b8ff91fa2032d7cd09b6a9af9f1cf0b65ec61143))
+* harden mcp baseline scanner against false negatives and crashes ([#155](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/155)) ([cd36f85](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/cd36f8567fa655217ffe245f9f4c574e6adefc89))
+* make agent judge reason before stating its verdict ([3b551c6](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/3b551c68144e0426d86e52b5dc4678eb8ecda259))
+* make agent judge reason before stating its verdict ([60dacc8](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/60dacc89a9ee12a3459fd0a7a8dd506007499647))
+* make hunt work from a published install ([#157](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/157)) ([ac468ea](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/ac468ea824c4bd6ec63a8e5a9daeff7e54825393))
+* rename 'Risk Score' to 'Safety Score' in extension popup ([#133](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/133)) ([4c955a0](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/4c955a0cf202e553a20d57a9f4906d0930cef7b0))
+* revert gitleaks trigger from pull_request_target to pull_request ([#161](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/161)) ([ea7315e](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/ea7315e8609b212e98b01b04bd3d00d9342edbd0))
+* run gitleaks binary in ci to unblock fork pull requests ([#162](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/162)) ([be307b2](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/be307b27b7fd4880211ab08f20e47b81ecf3f01e))
+* use simple tag format for release-please ([9e7a8e6](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/9e7a8e6ede254af8c3ef59e56cdd9942bd20362c))
+* validate mcp tool inputs with zod and return actionable errors ([#143](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/143)) ([ad749bc](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/ad749bc917303db92ae1076a6bf97036427c8fa5))
+
+
+### Refactors
+
+* **sdk:** switch to apikey values; update sdk e2e tests and examples ([#168](https://github.com/KeyValueSoftwareSystems/agent-opfor/issues/168)) ([ed40cea](https://github.com/KeyValueSoftwareSystems/agent-opfor/commit/ed40cea15fcce5837bd172f6d4c2ad89e46c7432))
diff --git a/core/package.json b/core/package.json
index 2e97ef2..6e89e56 100644
--- a/core/package.json
+++ b/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-core",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Opfor core engine — attacker prompt generation, judge, and execution shared by all runners",
   "license": "Apache-2.0",
   "private": true,
diff --git a/package-lock.json b/package-lock.json
index b66d6bb..254cf9c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "agent-opfor",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agent-opfor",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "license": "Apache-2.0",
       "workspaces": [
         "core",
@@ -37,7 +37,7 @@
     },
     "core": {
       "name": "@keyvaluesystems/agent-opfor-core",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@ai-sdk/anthropic": "^2.0.77",
@@ -5754,7 +5754,7 @@
     },
     "runners/cli": {
       "name": "@keyvaluesystems/agent-opfor-cli",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.165",
@@ -5772,7 +5772,7 @@
         "@ai-sdk/openai-compatible": "^1.0.0",
         "@anthropic-ai/sdk": "^0.100.1",
         "@inquirer/prompts": "^8.4.2",
-        "@keyvaluesystems/agent-opfor-core": "^0.9.0",
+        "@keyvaluesystems/agent-opfor-core": "^0.10.0",
         "@types/express": "^5.0.3",
         "@types/node": "^24.0.0",
         "ai": "^6.0.0",
@@ -6276,7 +6276,7 @@
     },
     "runners/extension": {
       "name": "@keyvaluesystems/agent-opfor-extension",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "license": "Apache-2.0",
       "dependencies": {
         "yaml": "^2.8.3"
@@ -6771,7 +6771,7 @@
     },
     "runners/mcp": {
       "name": "@keyvaluesystems/agent-opfor-mcp",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0"
@@ -6780,7 +6780,7 @@
         "opfor-agent-mcp": "dist/index.js"
       },
       "devDependencies": {
-        "@keyvaluesystems/agent-opfor-core": "^0.9.0",
+        "@keyvaluesystems/agent-opfor-core": "^0.10.0",
         "@types/node": "^24.0.0",
         "dotenv": "^17.4.2",
         "esbuild": "^0.25.0",
@@ -7278,13 +7278,13 @@
     },
     "runners/sdk": {
       "name": "@keyvaluesystems/agent-opfor-sdk",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0"
       },
       "devDependencies": {
-        "@keyvaluesystems/agent-opfor-core": "^0.9.0",
+        "@keyvaluesystems/agent-opfor-core": "^0.10.0",
         "@types/node": "^24.0.0",
         "tsup": "^8.0.0",
         "tsx": "^4.20.0",
@@ -7307,7 +7307,7 @@
       "version": "0.9.0",
       "license": "Apache-2.0",
       "devDependencies": {
-        "@keyvaluesystems/agent-opfor-sdk": "^0.9.0",
+        "@keyvaluesystems/agent-opfor-sdk": "^0.10.0",
         "@types/node": "^24.0.0",
         "tsx": "^4.20.0",
         "typescript": "^5.8.3",
diff --git a/package.json b/package.json
index c4eecaf..5b692b8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-opfor",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Opfor — security testing for AI agents and MCP servers (workspace root)",
   "license": "Apache-2.0",
   "private": true,
diff --git a/runners/cli/package.json b/runners/cli/package.json
index 6ee877b..135f14c 100644
--- a/runners/cli/package.json
+++ b/runners/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Opfor CLI — security testing for AI agents and MCP servers (opfor setup|run|hunt)",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,7 +62,7 @@
     "@ai-sdk/openai-compatible": "^1.0.0",
     "@anthropic-ai/sdk": "^0.100.1",
     "@inquirer/prompts": "^8.4.2",
-    "@keyvaluesystems/agent-opfor-core": "^0.9.0",
+    "@keyvaluesystems/agent-opfor-core": "^0.10.0",
     "@types/express": "^5.0.3",
     "@types/node": "^24.0.0",
     "ai": "^6.0.0",
diff --git a/runners/cli/ui/package-lock.json b/runners/cli/ui/package-lock.json
index 3a92933..6b32af2 100644
--- a/runners/cli/ui/package-lock.json
+++ b/runners/cli/ui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@keyvaluesystems/agent-opfor-autonomous-ui",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@keyvaluesystems/agent-opfor-autonomous-ui",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "dependencies": {
         "react": "^19.1.0",
         "react-dom": "^19.1.0"
diff --git a/runners/cli/ui/package.json b/runners/cli/ui/package.json
index 68c5598..47150d4 100644
--- a/runners/cli/ui/package.json
+++ b/runners/cli/ui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@keyvaluesystems/agent-opfor-autonomous-ui",
   "private": true,
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/runners/extension/manifest.json b/runners/extension/manifest.json
index bb47da2..b86f5fd 100644
--- a/runners/extension/manifest.json
+++ b/runners/extension/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Agent OPFOR",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Red-team any chat interface. Auto-detects chat widgets, runs adaptive attacks, and generates security reports.",
   "icons": {
     "16": "icons/icon16.png",
@@ -21,8 +21,15 @@
   "side_panel": {
     "default_path": "sidepanel.html"
   },
-  "permissions": ["activeTab", "scripting", "storage", "sidePanel"],
-  "host_permissions": ["<all_urls>"],
+  "permissions": [
+    "activeTab",
+    "scripting",
+    "storage",
+    "sidePanel"
+  ],
+  "host_permissions": [
+    "<all_urls>"
+  ],
   "background": {
     "service_worker": "service_worker.js",
     "type": "module"
diff --git a/runners/extension/package.json b/runners/extension/package.json
index 0ade64d..f4e2d98 100644
--- a/runners/extension/package.json
+++ b/runners/extension/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-extension",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Opfor browser extension (MV3) — chat UI injector for live testing",
   "license": "Apache-2.0",
   "private": true,
diff --git a/runners/mcp/package.json b/runners/mcp/package.json
index 5e0ab89..d69cc56 100644
--- a/runners/mcp/package.json
+++ b/runners/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-mcp",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Opfor MCP server — expose red team tools to any MCP-compatible AI agent",
   "license": "Apache-2.0",
   "type": "module",
@@ -51,7 +51,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "devDependencies": {
-    "@keyvaluesystems/agent-opfor-core": "^0.9.0",
+    "@keyvaluesystems/agent-opfor-core": "^0.10.0",
     "@types/node": "^24.0.0",
     "dotenv": "^17.4.2",
     "esbuild": "^0.25.0",
diff --git a/runners/sdk/package.json b/runners/sdk/package.json
index 4f5fa7e..4ec4dee 100644
--- a/runners/sdk/package.json
+++ b/runners/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-sdk",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Opfor SDK — programmatic adversarial testing for AI systems",
   "license": "Apache-2.0",
   "type": "module",
@@ -56,7 +56,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "devDependencies": {
-    "@keyvaluesystems/agent-opfor-core": "^0.9.0",
+    "@keyvaluesystems/agent-opfor-core": "^0.10.0",
     "@types/node": "^24.0.0",
     "tsup": "^8.0.0",
     "tsx": "^4.20.0",
diff --git a/tests/e2e/agents/customer-support/package.json b/tests/e2e/agents/customer-support/package.json
index f4a2c7f..0d5d3f9 100644
--- a/tests/e2e/agents/customer-support/package.json
+++ b/tests/e2e/agents/customer-support/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-test-agent-customer-support",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Customer support test agent with PostgreSQL — tests BOLA, BFLA, RBAC, PII, and SQL injection evaluators",
   "private": true,
   "type": "module",
diff --git a/tests/e2e/agents/vanilla-chat/package.json b/tests/e2e/agents/vanilla-chat/package.json
index 10bf5de..9390fd6 100644
--- a/tests/e2e/agents/vanilla-chat/package.json
+++ b/tests/e2e/agents/vanilla-chat/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-test-agent-vanilla-chat",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Vanilla chat test agent — used for local developer testing of Opfor evaluators",
   "private": true,
   "type": "module",
diff --git a/tests/e2e/agents/vulnerable-memory/package.json b/tests/e2e/agents/vulnerable-memory/package.json
index f8f6843..686e3f3 100644
--- a/tests/e2e/agents/vulnerable-memory/package.json
+++ b/tests/e2e/agents/vulnerable-memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-test-agent-vulnerable-memory",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Intentionally vulnerable agent — accepts and persists user-injected 'policies' into a global knowledge base across sessions",
   "private": true,
   "type": "module",
diff --git a/tests/e2e/mcp/vulnerable-server/package.json b/tests/e2e/mcp/vulnerable-server/package.json
index 8ac8f0c..72e6765 100644
--- a/tests/e2e/mcp/vulnerable-server/package.json
+++ b/tests/e2e/mcp/vulnerable-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@keyvaluesystems/agent-opfor-test-mcp-vulnerable",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Intentionally vulnerable MCP server for opfor testing — DO NOT deploy",
   "private": true,
   "type": "module",
diff --git a/tests/e2e/sdk/package.json b/tests/e2e/sdk/package.json
index e805f72..57c79fc 100644
--- a/tests/e2e/sdk/package.json
+++ b/tests/e2e/sdk/package.json
@@ -10,7 +10,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "devDependencies": {
-    "@keyvaluesystems/agent-opfor-sdk": "^0.9.0",
+    "@keyvaluesystems/agent-opfor-sdk": "^0.10.0",
     "@types/node": "^24.0.0",
     "tsx": "^4.20.0",
     "typescript": "^5.8.3",