Skip to content
ReleasesGitHub

Changelog

Subscribe with RSS

All areas
All changes

Agent Proxy now injects credentials for MCP Server Workloads

Agent Proxy 1.34.6014 injects credentials for Server Workloads whose Application Protocol is MCP. Agent Proxy handles this traffic as HTTP and injects the credential the same way it does for HTTP Server Workloads. Earlier versions passed MCP traffic through without injecting a credential.

Agent Proxy doesn’t read the MCP messages in this traffic, so these features of the MCP Identity Gateway don’t apply to it:

Tags:

Improved MCP Identity Gateway token validation and error reporting

MCP Identity Gateway version 1.34.6034 validates more access tokens and reports conflicting tool and prompt names. It also changes which timeout names take effect and what its request duration metric measures.

For the latest available versions of these components, see the Edge Components Supported Versions page.

  • ES256-signed access tokens: MCP Identity Gateway validates access tokens signed with ES256 as well as RS256. See Set up the MCP Identity Gateway.
  • Access token audience: MCP Identity Gateway accepts an access token whose audience is its /mcp endpoint URL, or its own URL with or without a trailing slash.
  • Tool and prompt name conflicts: Two Server Workloads assigned to the same MCP client can produce the same name prefix. MCP Identity Gateway then leaves both Server Workloads’ tools and prompts out of the client’s lists and logs the conflict. Rename one of the Server Workloads to fix it. See Tool and prompt names.
  • Timeout names with no effect: The initialize, notifications_initialized, proactive_tools_list, reinit_initialize, reinit_notifications_initialized, and reinit_tools_list timeout names no longer have an effect. MCP Identity Gateway still accepts them, so the service starts. If you set one of them, set upstream_call_timeout or the matching list timeout instead. See AEMBIT_MCP_GATEWAY_TIMEOUT.
  • Request duration excludes MCP server time: aembit_mcp_gateway_mcp_request_duration_seconds measures only the time MCP Identity Gateway spends processing a request, and excludes time spent waiting on MCP servers. Expect lower values, and review alerts and dashboards built on this metric. See Prometheus metrics.

This build also adds support for the 2026-07-28 MCP specification.

Tags:

MCP Identity Gateway 1.34.6034 release

Aembit has released MCP Identity Gateway version 1.34.6034, which serves the 2026-07-28 revision of the MCP specification.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • 2026-07-28 MCP specification support: MCP Identity Gateway serves MCP clients using the 2026-07-28 revision and earlier revisions. A client’s revision and a server’s revision don’t have to match, because MCP Identity Gateway negotiates each connection. The 2026-07-28 revision removes sessions, so MCP Identity Gateway doesn’t create a session for clients using that revision. See Proxied MCP methods.
  • Prompts, resources, and tasks across all assigned MCP servers: MCP Identity Gateway lists prompts and resources from every assigned MCP server. It sends each prompt or resource read to the MCP server that owns it. It routes task requests to the MCP server that created the task. It advertises the capabilities its assigned MCP servers support. It prefixes prompt and resource names with the Server Workload they came from, and returns each resource URI exactly as the MCP server reported it.
  • More timeout names: AEMBIT_MCP_GATEWAY_TIMEOUT accepts seven more timeout names, which tune the prompts/list fanout, the fan-out cap, upstream calls, upstream session caching, and Multi Round-Trip Request backoff.

Access token validation and error reporting improvements and a security update also shipped in this build.

Tags:

Edge components release with Ubuntu 26.04 support

Aembit has released new versions of the following components and packages:

  • Agent Proxy 1.34.6014
  • Aembit CLI 1.34.6014
  • AWS Lambda Extension 1.34.185
  • Helm Chart 1.34.571
  • AWS ECS Terraform 1.34.4

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Agent Proxy installs on Ubuntu 26.04 LTS: The Linux installer now completes on Ubuntu 26.04 LTS hosts. See Supported versions.
  • Private Network Access credential retrieval: Agent Proxy retrieves and injects credentials for Access Policies whose Credential Provider uses Private Network Access. Agent Proxy 1.34.5755 could fail credential retrieval for these Access Policies.

A dependency security fix also shipped in this build. See Edge components dependency security updates.

Tags:

Dynamic claims now support SAML assertions

Dynamic claims can now read values from a SAML 2.0 response, so a Credential Provider can issue a credential bound to each SAML user’s own identity.

Aembit receives SAML responses when users sign in through the MCP Authorization Server or the MCP Identity Gateway. A SAMLv2 Response Trust Provider validates each response, and three expressions read values from its assertion:

  • ${saml.response.subject.nameId} returns the Subject NameID that identifies the user.
  • ${saml.response.issuer} returns the identity provider that issued the assertion.
  • ${saml.response.attributes['<name>']} returns a named attribute, such as a user’s groups.

If a SAML expression can’t resolve to a value, Aembit denies the request and issues no credential. The Credential Provider form in the Aembit Tenant UI shows the SAML syntax with examples. See SAML assertion claims.

Tags:

Kubernetes Service Account Trust Provider now supports multiple OIDC endpoints

A Kubernetes Service Account Trust Provider now accepts more than one OpenID Connect (OIDC) endpoint. One Trust Provider can then attest a Client Workload that runs active-active across two or more clusters.

Each cluster signs its Service Account tokens with its own key. Add one OIDC Endpoint for each cluster’s issuer URL with Add an Endpoint, and the Trust Provider validates a token signed by any of them. See Attest one workload across multiple clusters.

Tags:

MCP Enterprise Managed Access Token Credential Provider now available

The MCP Enterprise Managed Access Token Credential Provider is now available in the Aembit Tenant UI. It obtains each user’s MCP server access token through your corporate identity provider, so users reach MCP servers behind the MCP Identity Gateway without a per-user consent prompt.

Aembit Cloud makes two token requests on the user’s behalf. The first asks your identity provider for an identity assertion that vouches for the user to one MCP server. The second presents that assertion to the MCP server’s authorization server in exchange for an access token, which the MCP Identity Gateway injects into the request.

To get started, prepare your identity provider for enterprise-managed access, then configure the Credential Provider. For how the exchange works, see About the MCP Enterprise Managed Access Token Credential Provider.

Tags:

Aembit Secrets Operator dependency security updates

Aembit Secrets Operator 1.34.358 updates its Go toolchain and bundled Go libraries to fix published vulnerabilities that container image scanning reported in the earlier versions. The update requires no configuration change. Upgrade to 1.34.358 or later to pick up the fixes.

These updates shipped in the same build as Aembit Secrets Operator now delivers X.509-SVID certificates. For the latest available versions, see the Edge Components Supported Versions page.

Tags:

Agent Controller dependency security updates

Agent Controller 1.34.3725 container images bundle the latest patched .NET runtime libraries, which fixes published high-severity .NET vulnerabilities that earlier container builds carried. The same build refreshes the .NET SDK base image and NuGet package dependencies. The update requires no configuration change. Upgrade to 1.34.3725 or later to pick up the fixes.

These updates shipped in the same build as the Agent Controller 1.34.3725 release. For the latest available versions, see the Edge Components Supported Versions page.

Tags:

Aembit Secrets Operator now delivers X.509-SVID certificates

Aembit Secrets Operator 1.34.358 and Aembit Secrets Operator Helm chart 1.34.358 are now available.

Secrets Operator now delivers X.509-SVID certificates to your Kubernetes workloads. When an AembitSecretRefreshSchedule sets credentialType: X509Svid, Secrets Operator generates a private key inside the cluster and obtains a signed certificate from Aembit. It writes both to a kubernetes.io/tls Secret that your workload uses for mutual TLS. See Deliver X.509-SVID certificates with Secrets Operator.

  • New X509Svid credential type: The Secret holds tls.crt with the signed certificate chain and tls.key with the private key. Secrets Operator sends Aembit only a certificate signing request, so the private key never leaves the cluster.
  • Automatic renewal: Secrets Operator refreshes the certificate before it expires.
  • TLS Secret type: X509Svid writes a kubernetes.io/tls Secret, while every other credential type writes a generic Secret, so switching a schedule to or from X509Svid deletes and recreates the target Secret. See Credential types and Secret data keys.
Tags:

Agent Controller 1.34.3725 release

Aembit has released Agent Controller version 1.34.3725 for Linux and Windows. For the latest available versions, see the Edge Components Supported Versions page.

  • Kerberos attestation on AWS EC2: An Agent Controller running on an AWS EC2 instance now completes Kerberos Trust Provider attestation requests from Agent Proxy. Agent Controller 1.32.3541 on EC2 answered those requests with an HTTP 500 error. Upgrade any Agent Controller that runs on EC2 and serves Kerberos attestation to 1.34.3725 or later.
  • Windows certificate chain validation: On Windows, Agent Controller now installs the intermediate CA certificates from its TLS certificate chain into the LocalMachine certificate store, so Windows TLS clients can validate the full chain.
  • Windows service logon account on reinstall: When you uninstall Agent Controller on Windows and reinstall it with a different SERVICE_LOGON_ACCOUNT, the installer now grants the new account access to the existing log file before the service starts, so logging continues. Changing the logon account of an installed service is still unsupported.
  • TLS certificate status reporting: Agent Controller reports its TLS certificate status to Aembit Cloud consistently during certificate renewal.
  • Container base image: The container image uses updated base image digests so it starts on newer container runtimes.
Tags:

GitHub Actions now selects among multiple AWS STS Credential Providers

The Aembit GitHub Action can now choose which AWS Security Token Service (STS) Federation Credential Provider to use when an Access Policy holds more than one.

An Access Policy can hold more than one AWS STS Federation Credential Provider, each with its own Access Key ID selector. Until now, a GitHub Actions workflow needed a self-hosted runner running Aembit Edge to reach more than one IAM role from a single Access Policy. The alternative was a direct call to the Edge API.

Key capabilities:

Minimum version required:

  • Aembit GitHub Action 1.3.0
  • Edge SDK 1.34.0

For how Aembit matches a selector to a Credential Provider, see Using multiple AWS STS Credential Providers.

Tags:

Aembit Cloud configuration updates

Aembit Cloud corrects configuration workflows across Content Security, Client Workloads, Trust Providers, and authorization event reporting.

Key Updates:

  • Content Security tool lists: Switching between Allow and Block in a Content Security Provider keeps the tool list you configured, and Remove Tools clears the whole list in a separate step that asks you to confirm.
  • Redirect URI fields: A Redirect URI field on a Client Workload accepts a pasted value in every position, inserts a long pasted value rather than overwriting the text around it, and shows one validation message at a time. Copying the full contents of a field leaves the browser responsive.
  • Trust Provider secrets in custom Resource Sets: Terraform reads the state of a Trust Provider secret when that Trust Provider belongs to a custom Resource Set.
  • Authorization event timespan filters: The date filters on Access Authorization Events offer a maximum timespan of 24 hours, the window over which the Aembit Tenant UI makes authorization events available.
Tags:

MCP Identity Gateway 1.34.5794 release

Aembit has released MCP Identity Gateway version 1.34.5794.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • MCP Tool Access Control enforcement: The Gateway now enforces MCP Tool Access Control, a Content Security Provider you add to an Access Policy. The Tool Visibility control decides which MCP tools an AI agent discovers, and the Tool Invocation control decides which MCP tools an AI agent can call.
  • Glob patterns for MCP tool names: An entry in either control takes an exact MCP tool name or a glob pattern, and matching is case-sensitive. A pattern matches the name the MCP server publishes, not the prefixed name an AI agent displays. See MCP Tool Access Control tool name reference.
  • Tool filtering decisions in your events: MCP workload events record which control decided an MCP tool’s fate, which rules matched, which MCP tools a listing removed, and how many it returned, under application.mcp.contentSecurity.

A security update also shipped in this build.

Tags:

Developer Guide combines the API, CLI, and SDK documentation

The Developer Guide is now the single home for every way you integrate with Aembit from code, commands, or infrastructure. It replaces the separate API Guide and CLI Guide, which each covered one surface and left you to work out which one fit your workload. The new Edge SDK section lands inside it rather than beside it.

The guide opens by separating the two decisions an integration involves. First, choose how your workload gets a credential at runtime, through Agent Proxy, the Edge SDK, the Aembit CLI, or the Edge API. Second, choose how you manage the Aembit configuration behind that path, in the Aembit Tenant UI, through the Cloud API, or as Terraform code.

What’s new:

  • One guide for every developer surface: Aembit SDKs, Aembit APIs, Aembit CLI, Agent Proxy, and the local development and testing pages all sit under /dev-guide/.
  • A comparison of every credential path: The overview compares Agent Proxy, the Edge SDK, the Aembit CLI, and the Edge API side by side, so you can pick one before you read its section.
  • Shared local development and testing pages: One page covers local development and one covers testing and debugging across every integration path.

Every URL under the old /api-guide/ and /cli-guide/ paths redirects to its new location, so existing bookmarks and links keep working.

Tags: