Skip to content
ReleasesGitHub

Changelog — MCP

Subscribe with RSS

MCP
All changes
Clear all

MCP Identity Gateway 1.34.5794 release

Aembit has released MCP Identity Gateway version 1.34.5794.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • MCP Tool Access Control enforcement: The Gateway now enforces MCP Tool Access Control, a Content Security Provider you add to an Access Policy. The Tool Visibility control decides which MCP tools an AI agent discovers, and the Tool Invocation control decides which MCP tools an AI agent can call.
  • Glob patterns for MCP tool names: An entry in either control takes an exact MCP tool name or a glob pattern, and matching is case-sensitive. A pattern matches the name the MCP server publishes, not the prefixed name an AI agent displays. See MCP Tool Access Control tool name reference.
  • Tool filtering decisions in your events: MCP workload events record which control decided an MCP tool’s fate, which rules matched, which MCP tools a listing removed, and how many it returned, under application.mcp.contentSecurity.

A security update also shipped in this build.

Tags:

MCP Identity Gateway 1.34.5733 release

Aembit has released MCP Identity Gateway version 1.34.5733.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Higher fanout timeout defaults: The Gateway now waits longer for your assigned MCP servers on most of the MCP methods it fans out, which gives a server that’s still starting up, or one answering from a cold cache, room to respond. A self-hosted Gateway can override any of these timeouts as a last resort; see MCP Identity Gateway raises fanout timeout defaults.
  • Nine new Prometheus metrics: The Gateway’s metrics endpoint reports on upstream fanout behavior, authentication failures, JWKS refreshes, session cleanup, and readiness probe stability.
  • Every Gateway metric documented: The metrics reference now lists all 20 MCP-specific metrics the Gateway exposes, with the type and labels for each and the values each label takes. See Prometheus metrics.
Tags:

MCP Identity Gateway raises fanout timeout defaults

MCP Identity Gateway 1.34.5733 raises how long the Gateway waits for your assigned MCP servers when it fans a request out to them. The earlier defaults were short enough that a server still starting up, or one answering from a cold cache, could run past them.

Timeout1.33.56541.34.5733
initialize3s10s
notifications_initialized500ms1s
tools_list1s3s
proactive_tools_list3s5s
resources_list1s3s
reinit_initialize10s10s
reinit_notifications_initialized500ms1s
reinit_tools_list1s5s

reinit_initialize is the one timeout this build leaves unchanged.

The new defaults require no configuration and apply to both deployment models as soon as you upgrade. They’re high enough that an AI client typically reaches its own timeout before the Gateway reaches one of these, so most deployments never need to change them.

A self-hosted Gateway can override any of these timeouts as a last resort, using the AEMBIT_MCP_GATEWAY_TIMEOUT environment variable. The installer doesn’t forward this variable to the running service, so setting it takes a systemd drop-in. For the accepted names, the value format, and the drop-in, see MCP Identity Gateway environment variables. Aembit sets these values for you on the Aembit-managed service.

These updates shipped in the same build as the MCP Identity Gateway 1.34.5733 release.

Tags:

Content Security now available

Aembit now offers Content Security, an Access Policy component that inspects content and enforces the verdict an inspection service returns. Content Security inspects Model Context Protocol (MCP) traffic that flows through the Aembit MCP Identity Gateway.

In the Access Policy Builder, Content Security is an optional component positioned between Access Conditions and Credential Providers. It adds inspection to the request path without changing how the policy’s other components authorize access.

What’s new:

  • Content Security Access Policy component: Add Content Security to a policy to inspect the MCP traffic that policy governs. Inspection applies only to the policies you add it to.
  • CrowdStrike AIDR integration: CrowdStrike AI Detection and Response (AIDR) inspects tool listings, tool call inputs, and tool call outputs, and returns an allow, block, or transform verdict that Aembit enforces. AIDR requires an active CrowdStrike AIDR for Agents subscription.
  • Inspection decisions in your events: Access Authorization Events record the Content Security component a policy identified, and MCP Workload Events record the decision AIDR returned, including CrowdStrike’s request ID for correlating an event with the CrowdStrike console.

CrowdStrike AIDR Content Security is separate from the CrowdStrike Access Condition, which evaluates endpoint posture. Configuring one doesn’t enable the other.

To add the component to a policy, see Add CrowdStrike AIDR to a policy.

Tags:

MCP Identity Gateway 1.33.5654 release

Aembit has released MCP Identity Gateway version 1.33.5654.

For the latest available versions of these components, see the Edge Components Supported Versions page.

For each Content Security decision, the Gateway records a single MCP Workload Event carrying the severity, outcome result, and outcome reason.

This build also broadens the MCP traffic that Content Security inspects; see MCP Identity Gateway content inspection coverage. For Content Security inspection of MCP traffic, use MCP Identity Gateway version 1.33.5654 or later.

Tags:

MCP Identity Gateway content inspection coverage

A security update for the MCP Identity Gateway broadens the MCP traffic that Content Security inspects.

The Gateway normalizes responses that MCP servers stream as server-sent events before inspection, so Content Security inspects those responses along with the rest of the session. The Gateway also applies the policy’s Fail Open on Error setting to requests it can’t read and to protocol errors. A policy set to fail closed blocks those requests.

These updates shipped in the same build as the MCP Identity Gateway 1.33.5654 release.

Tags:

MCP Identity Gateway 1.33.5547 release

Aembit has released MCP Identity Gateway version 1.33.5547.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • More reliable upstream reconnection: When the Gateway reestablishes a connection to an MCP server, it now refreshes the available tools as part of that reconnection, and reports a clear error if the reconnection doesn’t succeed.
  • Deployment modes documented: The MCP Identity Gateway concepts page now describes the two ways to run the Gateway: self-hosted on your own host, or managed by Aembit at your per-Tenant endpoint. The traffic flow and policy model are identical in both. See MCP Identity Gateway concepts.

Dependency security updates also shipped in this build; see MCP Identity Gateway dependency security updates.

Tags:

MCP Identity Gateway sessions can persist across restarts

A self-hosted MCP Identity Gateway can now keep its MCP sessions in Valkey instead of in process memory. Persisted sessions survive a service restart or an upgrade, and more than one Gateway instance can share them.

Set AEMBIT_VALKEY_URL on the install command to enable it. The Gateway keeps sessions in memory when you leave that variable unset, which remains the default. An in-memory store ends every open session on restart. AEMBIT_MCP_SESSION_IDLE_TTL_SECS sets how long an unused session lives, and it defaults to 12 hours for both store types.

Sessions hold MCP protocol state, not authentication state. The Gateway still validates every request’s token and evaluates Access Policies per request, so persistence doesn’t extend anyone’s access.

This change requires no configuration if you use the Aembit-managed service or want the in-memory default. It ships in MCP Identity Gateway 1.32.5098, alongside the session ID binding in this build; see the session IDs bound to the authenticated user entry. For configuration and operational detail, see Session persistence.

Tags:

Client ID Metadata Document (CIMD) identification now available

Aembit can now identify MCP client workloads with a Client ID Metadata Document (CIMD). A CIMD is a JSON document the client hosts at a public HTTPS URL, and the URL itself serves as the client’s identity. When the client presents the URL-formatted client_id, Aembit fetches the document and validates the client’s metadata, so the client can authenticate without Dynamic Client Registration.

CIMD has reached general availability, and Aembit enables it by default. To identify a Client Workload by its CIMD URL, see CIMD Client ID.

Tags:

MCP Identity Gateway event correlation and platform fixes

This update brings event correlation to MCP Identity Gateway workload events, along with fixes across Credential Provider, Access Policy, and Client Workload workflows.

This update includes:

  • MCP Identity Gateway 1.32.5098

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Workload event correlation: MCP Identity Gateway workload events now carry the client and server workload identity (name and id), so you can tie an event to a specific workload in the Cloud UI without mapping it by hand.
  • Azure OAuth Credential Provider verification: Resolved an issue that caused Azure OAuth Credential Provider verification to fail after a recent build, so these providers verify successfully again.
  • Access Condition URL validation: The Endpoint and Token Endpoint URL fields for Access Condition integrations now show the correct “Invalid Value” message instead of a “Required” message.
  • Concurrent policy edits: Deleting an Access Policy at the same time as a patch request no longer produces errors, preserving data integrity during high-volume policy updates.
  • CIMD authorization flow: Fixed an issue where an OIDC session expiring mid-flow could clear the Client Workload cookie and interrupt authorization.
  • Form validation focus: Saving a form with an invalid URL field now scrolls that field into view across entity editors, and External ID tooltips no longer get cut off in long list views.

Session IDs are now bound to the authenticated user in this build, closing a privilege-escalation gap; see the Security entry. Client ID Metadata Document (CIMD) identification also reached general availability in this update; see the announcement.

Tags:

MCP User-Based Access Token callback URL format

MCP User-Based Access Token Credential Providers now generate their read-only callback URL in the form https://<tenantId>.id.<region>.aembit.io/mcp-auth/userauth/<cp-id>/callback.

What this means for you:

  • Existing Credential Providers - Providers created before this change keep their original callback URL, which takes the form https://<tenantId>.mcp.<region>.aembit.io/userauth/<cp-id>/callback. Updating a provider doesn’t regenerate its callback URL. Both formats remain valid, so you don’t need to take any action or re-register anything with your MCP server vendor.
  • New Credential Providers - Aembit assigns the callback URL when you save the Credential Provider. Save the provider first, then copy the read-only value and register it with the MCP server vendor.

Always copy the exact value shown in the Credential Provider rather than constructing the URL yourself.

For details, see Configure MCP User-Based Access Token Credential Provider.

Tags:

MCP Identity Gateway 1.32.5006 release

Aembit has released MCP Identity Gateway version 1.32.5006.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • MCP ping support: The Gateway now supports the MCP ping method, responding to client connection-health checks per the MCP specification.
  • Authorization chain in workload events: MCP Identity Gateway workload events now include an ordered authorization chain, the ordered list of authorization-event context IDs behind each request. The chain spans both sides of the proxied connection, carried from the access token on the agent-to-Gateway side and forward through the directive and credential calls on the Gateway-to-MCP-server side, so you can confirm both belong to the same logical request. Take any context ID from the chain and filter your authorization events on it to trace a request end-to-end, from the traffic you observe back to the token, directive, and credential decisions that allowed it.
  • Microsoft Copilot Studio compatibility: Fixed an issue where some tools could fail to load for Microsoft Copilot Studio clients.
  • Health endpoint status: The Gateway’s health endpoint now returns an HTTP 503 status when the Gateway is unhealthy, so orchestrators and load balancers can detect an unhealthy Gateway accurately.
  • More reliable session timing: Session lifetimes now track wall-clock time, so sessions expire and renew correctly across events such as a host suspend and resume.
Tags:

Expanded MCP and AI IAM event coverage

Aembit has expanded the event coverage and reporting surfaces for troubleshooting MCP and AI IAM failures:

  • New access.discovery event type: Access Authorization Events now include an access.discovery event that lists the Client Workloads and Server Workloads Aembit Cloud considered during evaluation. Use it to diagnose requests that match no workload or policy, or that match multiple. See Access Discovery events.
  • User identity on MCP Workload Events: MCP Workload Events now include a userId field at application.mcp.userId for flows that involve a human identity, such as MCP Authorization Server flows. The Workload Events view exposes a matching User (MCP App Protocol only) filter for per-user investigations and SIEM scoping.
  • Trust Provider failures emit at Error severity: Trust Provider attestation failures in MCP flows now emit at Error severity rather than warning, so SIEM alerts that watch for Error events catch real authorization failures reliably.
  • Clearer expired-credential explanations: The access.credential event’s reason now identifies which token expired and at which step, making it easier to decide between re-authentication, credential refresh, or Credential Provider reconfiguration.
  • MCP Authorization Tracing view: A new live diagnostic view in the Reporting dashboard surfaces inbound authorization requests at the MCP Identity Gateway in real time, with the redirect URI, resource, matched Client Workload, and policy outcome for each request. See MCP Authorization Tracing.

For an end-to-end investigation flow that uses these reporting surfaces together, see Troubleshoot MCP and AI IAM access.

Tags:

MCP Identity Gateway 1.31.4955 release

Aembit has released MCP Identity Gateway version 1.31.4955.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Session deletion: Support for deleting MCP sessions, enabling clients to explicitly end MCP Identity Gateway sessions when finished.
  • MCP-level error metrics: New Prometheus metrics expose MCP protocol-level errors, giving operators visibility into request failures at the MCP layer.
  • Application-specific Prometheus metrics: Additional Prometheus metrics scoped to the MCP Identity Gateway application for improved observability.
Tags:

MCP Identity Gateway 1.31 release

Aembit has released MCP Identity Gateway version 1.31.

Key Updates:

  • User identity on workload events: The userId field now appears on mcp.request and mcp.response workload events when the MCP client is identified, making it easier to attribute MCP activity to authenticated users in audit reports.
  • Client-initiated session termination: MCP clients can now end their session with the Gateway by sending an HTTP DELETE request to the /mcp endpoint, per MCP specification section 2.5.5. See Session management for the request contract.
Tags:

Refresh token support for MCP authorization flows

OIDC ID Token and Aembit Access Token Credential Providers now support refresh tokens for MCP Authorization Server flows. This feature applies exclusively to MCP Authorization Server use cases.

What’s new:

  • An Enable Refresh Token Support option on OIDC ID Token and Aembit Access Token Credential Providers.
  • An Absolute Token Lifetime setting that controls how long refresh tokens remain valid for exchanging for new access tokens after initial issuance.
  • Refresh tokens are single-use. Each exchange returns a new refresh token.

When enabled, the MCP Authorization Server returns refresh tokens alongside access tokens during OAuth token requests. MCP clients can exchange a refresh token for a new access token and a new refresh token, maintaining an active session without completing a new authorization flow. This setting doesn’t affect other credential flows, such as Agent Proxy.

To use this feature, edit your Credential Provider, toggle Enable Refresh Token Support to on, and set the Absolute Token Lifetime.

For details, see Token refresh, OIDC ID Token, and Aembit Access Token.

Tags:
Copyright © 2026. All rights reserved.Privacy PolicyTerms of ServiceTrust CenterMetadata collectionContact Aembit