Skip to content
ReleasesGitHub

Changelog

Subscribe with RSS

All areas
All changes

Aembit Cloud and Aembit Edge stop trusting compromised eMudhra certificates

In October 2026, a compromise exposed the private keys of eight emSign intermediate certificate authorities operated by eMudhra. Anyone holding those keys can issue certificates that chain to a widely trusted root certificate. Aembit Cloud and the Aembit releases in this entry reject certificates from these certificate authorities.

Aembit Cloud

Aembit Cloud no longer trusts the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, so it rejects certificates from the compromised certificate authorities. Aembit applied this change to Aembit Cloud for you.

Aembit Edge

Upgrade each of the following that you run to the listed version or later:

  • Agent Proxy 1.35.6254, for the container image and the virtual machine installers. Agent Proxy rejects certificates from the compromised certificate authorities whatever the host trust store contains.
  • Aembit CLI 1.35.6254, which rejects them the same way.
  • Agent Controller 1.35.3776, for the Linux container image. On a virtual machine, Agent Controller uses the host operating system’s trust store, so it rejects these certificates only after the host stops trusting both root certificates.
  • Agent Injector 1.35.446
  • AWS Lambda Extension and AWS Lambda Layer 1.35.199, which include Agent Proxy 1.35.6254.
  • MCP Identity Gateway 1.35.6263
  • Aembit Secrets Operator 1.35.394
  • Helm Chart 1.35.575, which deploys Agent Proxy 1.35.6254, Agent Controller 1.35.3776, and Agent Injector 1.35.446 by default.
  • AWS ECS Terraform 1.35.5, which deploys Agent Proxy 1.35.6254 and Agent Controller 1.35.3776 by default.

Aembit Terraform Provider

Aembit Terraform Provider 1.35.1 and later reject certificates from the compromised certificate authorities.

Tags:

Edge Components release with faster PostgreSQL and Amazon Redshift connections

Aembit has released new versions of the following components and packages:

  • Agent Proxy 1.35.6254
  • Aembit CLI 1.35.6254
  • Agent Injector 1.35.446
  • AWS Lambda Extension 1.35.199
  • AWS Lambda Layer 1.35.199
  • Helm Chart 1.35.575
  • AWS ECS Terraform 1.35.5

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Faster PostgreSQL and Amazon Redshift connections - When Agent Proxy injects the credential, it passes the connection’s traffic through after the database authenticates the connection. Connections handle more load and use less memory.
  • PostgreSQL and Amazon Redshift workload events - When Agent Proxy injects the credential, events end at authentication. Otherwise, Agent Proxy now records an event for every message on the connection, as PostgreSQL and Amazon Redshift describes.
  • Large database messages over TLS - Agent Proxy now delivers large messages from a Client Workload when it connects to the Server Workload over TLS. This applies to MySQL, PostgreSQL, Amazon Redshift, Oracle Database, and Redis Server Workloads.
  • Credentials without a value - Agent Proxy and Aembit CLI no longer cache a credential that Aembit Cloud returns without a value, so the next request retrieves the credential again.
  • AWS Lambda packages - AWS Lambda Extension and AWS Lambda Layer bundle Agent Proxy 1.35.6254.
Tags:

Agent Controller 1.35.3776 release

Aembit has released Agent Controller version 1.35.3776 for Linux and Windows. For the latest available versions, see the Edge Components Supported Versions page.

  • AWS Metadata Service attestation behind an HTTP proxy - Agent Controller now bypasses an HTTP proxy when it calls the AWS instance metadata service for AWS Metadata Service Trust Provider attestation. It already bypassed the proxy for the Azure instance metadata service.
  • Agent Controller ID in authentication errors - When Agent Controller fails to authenticate with the Agent Controller ID you configured, the error now names that ID. The error asks you to confirm that the ID is valid and active in your Aembit Tenant.

Security updates also shipped in this build. See Agent Controller 1.35.3776 security updates.

Tags:

MCP Identity Gateway 1.35.6263 release

Aembit has released MCP Identity Gateway version 1.35.6263, which reports its version in its protected resource metadata and returns MCP server errors more reliably.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Version in protected resource metadata - The protected resource metadata document includes an aembit_gateway_version field, which you can read without an access token. See Check the MCP Identity Gateway version.
  • Credential available after authorization - After a user authorizes an MCP User-Based Access Token Credential Provider, MCP Identity Gateway uses the new credential on the user’s next request. Earlier versions returned errors for those requests until the cached credential expired.
  • MCP server errors with MCP Tool Access Control - If an MCP server returns an error while MCP Tool Access Control filters its tool list, the MCP client receives that error.
  • Header parameters across specification revisions - Some MCP servers on the 2026-07-28 MCP specification take a tool argument as a request header. MCP Identity Gateway sends that header for MCP clients on earlier revisions.
  • Credential injection failures in workload events - MCP Identity Gateway sometimes cannot add a credential to a request as a header or query parameter. The workload event then records the credential injection as failed.

A security update also shipped in this build.

Tags:

MCP Identity Gateway 1.35.6263 security updates

MCP Identity Gateway version 1.35.6263 includes security updates.

A self-hosted MCP Identity Gateway can limit the MCP servers it connects to with the AEMBIT_NETWORK_ACCESS_POLICY environment variable. The default, any, allows MCP servers at any address. public allows only MCP servers at publicly reachable addresses. With public, MCP Identity Gateway does not use a proxy set in the host’s environment. If MCP Identity Gateway reaches MCP servers through a proxy, use any. See AEMBIT_NETWORK_ACCESS_POLICY.

This version also updates dependencies to address published security advisories.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Other improvements also shipped in this build.

Tags:

Access Authorization Events now record MCP client registrations

Access Authorization Events now include the access.registration event type. It records each Dynamic Client Registration (DCR) request that an MCP client sends to the MCP Authorization Server.

  • A successful registration has severity Info and lists the client ID, client name, redirect URIs, grant types, and response types that the MCP client registered.
  • A failed registration has severity Error and carries a reason and the attribute that failed, so you can see why an MCP client couldn’t register. When the request supplied a value for that attribute, the event also carries that value.

See Access registration events.

Tags:

Edge SDKs support the same Trust Providers in TypeScript and Python

The Edge SDKs for TypeScript and Python now attest with the same nine Trust Providers, so the language you pick no longer limits which Trust Providers your workload can use. For the full list, see Edge SDK Trust Providers.

What’s new:

  • Python Trust Providers: The Python SDK adds AWS Metadata Service, Azure Instance Metadata Service, GCP Identity Token, Kubernetes Service Account, and OIDC ID Token.
  • TypeScript Trust Providers: The TypeScript SDK adds GitLab, Kubernetes Service Account, and Terraform Cloud.
  • Python package on PyPI: Install the Python SDK with pip install aembit-edge-sdk. It requires Python 3.10 or later. See the Edge SDK quickstart.
  • Integration guides: New guides cover Azure Functions, Azure virtual machines, GitHub Actions, GitLab CI/CD, Kubernetes, and Terraform Cloud. Every integration guide now shows both languages.
  • Logging reference: Edge SDK logging and network activity lists the events the SDKs log, how to send them to your logger, and which hosts the SDKs contact.

Minimum version required:

  • Edge SDK for TypeScript 1.34.1
  • Edge SDK for Python 1.35.0
Tags:

Improved MCP Identity Gateway token, credential, and error handling

MCP Identity Gateway version 1.35.6086 accepts more access token audiences and sends credentials in named headers. It also reports more detail when an MCP server or a CrowdStrike AIDR inspection fails.

For the latest available versions of these components, see the Edge Components Supported Versions page.

  • Access token audience: MCP Identity Gateway accepts an access token whose audience is its /mcp endpoint URL with a trailing slash. See Token and credential details.
  • Credentials in a named header: When a Server Workload uses the Header authentication scheme, MCP Identity Gateway sends the credential to the MCP server in the header you name. MCP servers that take an API key in a custom header now receive it. See Authentication sent to the MCP server.
  • Longer list timeouts: The default tools_list, resources_list, and prompts_list timeouts are 5 seconds, up from 3 seconds. See AEMBIT_MCP_GATEWAY_TIMEOUT.
  • CrowdStrike AIDR timeouts in workload events: When a CrowdStrike AIDR inspection request times out, the workload event’s error message says so and gives the timeout. See Fail-open and fail-closed behavior.
  • MCP server connection errors: When MCP Identity Gateway can’t connect to the MCP server for a request such as tools/call, the MCP client gets error -32603. The error message names the failure, such as failed to connect to upstream MCP server. When the MCP server answered with an HTTP status, the error’s data carries it in upstreamHttpStatus, which replaces the status field that earlier versions sent. Update any client code that reads status.
  • Workload events for each MCP server: For tools/list, resources/list, and prompts/list, MCP Identity Gateway now emits a request event for each MCP server it fans the request out to. This includes a server it then skips because that server doesn’t support the method. These request events, and the event for each MCP server that fails, now name the Server Workload. A failure event also records the MCP server’s host and HTTP status when known. Review retention and alerting thresholds for the added request events. See Requests that fan out to multiple servers.

This build also adds change notifications and tool output validation and a security update.

Tags:

MCP Identity Gateway 1.35.6086 release

Aembit has released MCP Identity Gateway version 1.35.6086, which relays change notifications to MCP clients and checks tool results against their output schemas.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Change notifications: An MCP client using the 2026-07-28 revision of the MCP specification can send subscriptions/listen to learn when the tools, resources, or prompts it can reach change. MCP Identity Gateway relays these notifications from MCP servers using the 2026-07-28 revision. It also sends one when the client’s assigned Server Workloads or MCP Tool Access Control rules change, and when it reconnects to an MCP server. See Change notifications.
  • Tool output validation: When a tool publishes an output schema, MCP Identity Gateway checks the tool’s completed results against it. The MCP client gets error -32004 in place of a result that doesn’t match. For the results MCP Identity Gateway doesn’t check, see Tool output validation.
  • Subscription refresh interval: AEMBIT_MCP_GATEWAY_TIMEOUT accepts the subscriptions_workload_refresh_interval timeout name, which sets how often MCP Identity Gateway checks for assignment and rule changes. The default is 30 seconds.

Access token, credential, and error handling improvements and a security update also shipped in this build.

Tags:

Access Policy builder search and Credential Provider value checks

The Select Existing tab in the Access Policy builder now searches and pages through all the entities you can access. Lists of more than 100 Client Workloads, Server Workloads, Trust Providers, Credential Providers, or Access Conditions no longer hide entries past the first page.

Credential Provider fields that take a Literal or Dynamic value now check the value against its type. Aembit rejects a save, including one through the API or Terraform, when a Literal value contains a ${...} expression or a Dynamic value contains no valid ${...} expression. In the Aembit Tenant UI, entering a ${...} expression in a field switches it to Dynamic. See Dynamic claims.

Tags:

MCP user session management now available

Each Identity Provider in the Aembit Tenant UI now has a Sessions tab that lists the MCP user sessions of the people who signed in through it. Filter the list, revoke one session, or revoke every session for a user or an MCP client at once. When you delete an Identity Provider that has active sessions, Aembit prompts you to revoke them.

Sessions exist when the Client-to-Gateway Access Policy uses an OIDC ID Token Credential Provider with Enable Refresh Token Support turned on. To get started, see Manage MCP user sessions. For what revoking a session does, see MCP user sessions.

Tags:

Agent Proxy now injects credentials for MCP Server Workloads

Agent Proxy 1.34.6014 injects credentials for Server Workloads whose Application Protocol is MCP. Agent Proxy handles this traffic as HTTP and injects the credential the same way it does for HTTP Server Workloads. Earlier versions passed MCP traffic through without injecting a credential.

Agent Proxy doesn’t read the MCP messages in this traffic, so these features of the MCP Identity Gateway don’t apply to it:

Tags:

Improved MCP Identity Gateway token validation and error reporting

MCP Identity Gateway version 1.34.6034 validates more access tokens and reports conflicting tool and prompt names. It also changes which timeout names take effect and what its request duration metric measures.

For the latest available versions of these components, see the Edge Components Supported Versions page.

  • ES256-signed access tokens: MCP Identity Gateway validates access tokens signed with ES256 as well as RS256. See Set up the MCP Identity Gateway.
  • Access token audience: MCP Identity Gateway accepts an access token whose audience is its /mcp endpoint URL, or its own URL with or without a trailing slash.
  • Tool and prompt name conflicts: Two Server Workloads assigned to the same MCP client can produce the same name prefix. MCP Identity Gateway then leaves both Server Workloads’ tools and prompts out of the client’s lists and logs the conflict. Rename one of the Server Workloads to fix it. See Tool and prompt names.
  • Timeout names with no effect: The initialize, notifications_initialized, proactive_tools_list, reinit_initialize, reinit_notifications_initialized, and reinit_tools_list timeout names no longer have an effect. MCP Identity Gateway still accepts them, so the service starts. If you set one of them, set upstream_call_timeout or the matching list timeout instead. See AEMBIT_MCP_GATEWAY_TIMEOUT.
  • Request duration excludes MCP server time: aembit_mcp_gateway_mcp_request_duration_seconds measures only the time MCP Identity Gateway spends processing a request, and excludes time spent waiting on MCP servers. Expect lower values, and review alerts and dashboards built on this metric. See Prometheus metrics.

This build also adds support for the 2026-07-28 MCP specification.

Tags:

MCP Identity Gateway 1.34.6034 release

Aembit has released MCP Identity Gateway version 1.34.6034, which serves the 2026-07-28 revision of the MCP specification.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • 2026-07-28 MCP specification support: MCP Identity Gateway serves MCP clients using the 2026-07-28 revision and earlier revisions. A client’s revision and a server’s revision don’t have to match, because MCP Identity Gateway negotiates each connection. The 2026-07-28 revision removes sessions, so MCP Identity Gateway doesn’t create a session for clients using that revision. See Proxied MCP methods.
  • Prompts, resources, and tasks across all assigned MCP servers: MCP Identity Gateway lists prompts and resources from every assigned MCP server. It sends each prompt or resource read to the MCP server that owns it. It routes task requests to the MCP server that created the task. It advertises the capabilities its assigned MCP servers support. It prefixes prompt and resource names with the Server Workload they came from, and returns each resource URI exactly as the MCP server reported it.
  • More timeout names: AEMBIT_MCP_GATEWAY_TIMEOUT accepts seven more timeout names, which tune the prompts/list fanout, the fan-out cap, upstream calls, upstream session caching, and Multi Round-Trip Request backoff.

Access token validation and error reporting improvements and a security update also shipped in this build.

Tags: