Skip to content
ReleasesGitHub

Changelog — MCP

Subscribe with RSS

MCP
All changes
Clear all

Aembit Cloud and Aembit Edge stop trusting compromised eMudhra certificates

In October 2026, a compromise exposed the private keys of eight emSign intermediate certificate authorities operated by eMudhra. Anyone holding those keys can issue certificates that chain to a widely trusted root certificate. Aembit Cloud and the Aembit releases in this entry reject certificates from these certificate authorities.

Aembit Cloud

Aembit Cloud no longer trusts the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, so it rejects certificates from the compromised certificate authorities. Aembit applied this change to Aembit Cloud for you.

Aembit Edge

Upgrade each of the following that you run to the listed version or later:

  • Agent Proxy 1.35.6254, for the container image and the virtual machine installers. Agent Proxy rejects certificates from the compromised certificate authorities whatever the host trust store contains.
  • Aembit CLI 1.35.6254, which rejects them the same way.
  • Agent Controller 1.35.3776, for the Linux container image. On a virtual machine, Agent Controller uses the host operating system’s trust store, so it rejects these certificates only after the host stops trusting both root certificates.
  • Agent Injector 1.35.446
  • AWS Lambda Extension and AWS Lambda Layer 1.35.199, which include Agent Proxy 1.35.6254.
  • MCP Identity Gateway 1.35.6263
  • Aembit Secrets Operator 1.35.394
  • Helm Chart 1.35.575, which deploys Agent Proxy 1.35.6254, Agent Controller 1.35.3776, and Agent Injector 1.35.446 by default.
  • AWS ECS Terraform 1.35.5, which deploys Agent Proxy 1.35.6254 and Agent Controller 1.35.3776 by default.

Aembit Terraform Provider

Aembit Terraform Provider 1.35.1 and later reject certificates from the compromised certificate authorities.

Tags:

MCP Identity Gateway 1.35.6263 release

Aembit has released MCP Identity Gateway version 1.35.6263, which reports its version in its protected resource metadata and returns MCP server errors more reliably.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Version in protected resource metadata - The protected resource metadata document includes an aembit_gateway_version field, which you can read without an access token. See Check the MCP Identity Gateway version.
  • Credential available after authorization - After a user authorizes an MCP User-Based Access Token Credential Provider, MCP Identity Gateway uses the new credential on the user’s next request. Earlier versions returned errors for those requests until the cached credential expired.
  • MCP server errors with MCP Tool Access Control - If an MCP server returns an error while MCP Tool Access Control filters its tool list, the MCP client receives that error.
  • Header parameters across specification revisions - Some MCP servers on the 2026-07-28 MCP specification take a tool argument as a request header. MCP Identity Gateway sends that header for MCP clients on earlier revisions.
  • Credential injection failures in workload events - MCP Identity Gateway sometimes cannot add a credential to a request as a header or query parameter. The workload event then records the credential injection as failed.

A security update also shipped in this build.

Tags:

MCP Identity Gateway 1.35.6263 security updates

MCP Identity Gateway version 1.35.6263 includes security updates.

A self-hosted MCP Identity Gateway can limit the MCP servers it connects to with the AEMBIT_NETWORK_ACCESS_POLICY environment variable. The default, any, allows MCP servers at any address. public allows only MCP servers at publicly reachable addresses. With public, MCP Identity Gateway does not use a proxy set in the host’s environment. If MCP Identity Gateway reaches MCP servers through a proxy, use any. See AEMBIT_NETWORK_ACCESS_POLICY.

This version also updates dependencies to address published security advisories.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Other improvements also shipped in this build.

Tags:

Access Authorization Events now record MCP client registrations

Access Authorization Events now include the access.registration event type. It records each Dynamic Client Registration (DCR) request that an MCP client sends to the MCP Authorization Server.

  • A successful registration has severity Info and lists the client ID, client name, redirect URIs, grant types, and response types that the MCP client registered.
  • A failed registration has severity Error and carries a reason and the attribute that failed, so you can see why an MCP client couldn’t register. When the request supplied a value for that attribute, the event also carries that value.

See Access registration events.

Tags:

Improved MCP Identity Gateway token, credential, and error handling

MCP Identity Gateway version 1.35.6086 accepts more access token audiences and sends credentials in named headers. It also reports more detail when an MCP server or a CrowdStrike AIDR inspection fails.

For the latest available versions of these components, see the Edge Components Supported Versions page.

  • Access token audience: MCP Identity Gateway accepts an access token whose audience is its /mcp endpoint URL with a trailing slash. See Token and credential details.
  • Credentials in a named header: When a Server Workload uses the Header authentication scheme, MCP Identity Gateway sends the credential to the MCP server in the header you name. MCP servers that take an API key in a custom header now receive it. See Authentication sent to the MCP server.
  • Longer list timeouts: The default tools_list, resources_list, and prompts_list timeouts are 5 seconds, up from 3 seconds. See AEMBIT_MCP_GATEWAY_TIMEOUT.
  • CrowdStrike AIDR timeouts in workload events: When a CrowdStrike AIDR inspection request times out, the workload event’s error message says so and gives the timeout. See Fail-open and fail-closed behavior.
  • MCP server connection errors: When MCP Identity Gateway can’t connect to the MCP server for a request such as tools/call, the MCP client gets error -32603. The error message names the failure, such as failed to connect to upstream MCP server. When the MCP server answered with an HTTP status, the error’s data carries it in upstreamHttpStatus, which replaces the status field that earlier versions sent. Update any client code that reads status.
  • Workload events for each MCP server: For tools/list, resources/list, and prompts/list, MCP Identity Gateway now emits a request event for each MCP server it fans the request out to. This includes a server it then skips because that server doesn’t support the method. These request events, and the event for each MCP server that fails, now name the Server Workload. A failure event also records the MCP server’s host and HTTP status when known. Review retention and alerting thresholds for the added request events. See Requests that fan out to multiple servers.

This build also adds change notifications and tool output validation and a security update.

Tags:

MCP Identity Gateway 1.35.6086 release

Aembit has released MCP Identity Gateway version 1.35.6086, which relays change notifications to MCP clients and checks tool results against their output schemas.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Change notifications: An MCP client using the 2026-07-28 revision of the MCP specification can send subscriptions/listen to learn when the tools, resources, or prompts it can reach change. MCP Identity Gateway relays these notifications from MCP servers using the 2026-07-28 revision. It also sends one when the client’s assigned Server Workloads or MCP Tool Access Control rules change, and when it reconnects to an MCP server. See Change notifications.
  • Tool output validation: When a tool publishes an output schema, MCP Identity Gateway checks the tool’s completed results against it. The MCP client gets error -32004 in place of a result that doesn’t match. For the results MCP Identity Gateway doesn’t check, see Tool output validation.
  • Subscription refresh interval: AEMBIT_MCP_GATEWAY_TIMEOUT accepts the subscriptions_workload_refresh_interval timeout name, which sets how often MCP Identity Gateway checks for assignment and rule changes. The default is 30 seconds.

Access token, credential, and error handling improvements and a security update also shipped in this build.

Tags:

MCP user session management now available

Each Identity Provider in the Aembit Tenant UI now has a Sessions tab that lists the MCP user sessions of the people who signed in through it. Filter the list, revoke one session, or revoke every session for a user or an MCP client at once. When you delete an Identity Provider that has active sessions, Aembit prompts you to revoke them.

Sessions exist when the Client-to-Gateway Access Policy uses an OIDC ID Token Credential Provider with Enable Refresh Token Support turned on. To get started, see Manage MCP user sessions. For what revoking a session does, see MCP user sessions.

Tags:

Agent Proxy now injects credentials for MCP Server Workloads

Agent Proxy 1.34.6014 injects credentials for Server Workloads whose Application Protocol is MCP. Agent Proxy handles this traffic as HTTP and injects the credential the same way it does for HTTP Server Workloads. Earlier versions passed MCP traffic through without injecting a credential.

Agent Proxy doesn’t read the MCP messages in this traffic, so these features of the MCP Identity Gateway don’t apply to it:

Tags:

Improved MCP Identity Gateway token validation and error reporting

MCP Identity Gateway version 1.34.6034 validates more access tokens and reports conflicting tool and prompt names. It also changes which timeout names take effect and what its request duration metric measures.

For the latest available versions of these components, see the Edge Components Supported Versions page.

  • ES256-signed access tokens: MCP Identity Gateway validates access tokens signed with ES256 as well as RS256. See Set up the MCP Identity Gateway.
  • Access token audience: MCP Identity Gateway accepts an access token whose audience is its /mcp endpoint URL, or its own URL with or without a trailing slash.
  • Tool and prompt name conflicts: Two Server Workloads assigned to the same MCP client can produce the same name prefix. MCP Identity Gateway then leaves both Server Workloads’ tools and prompts out of the client’s lists and logs the conflict. Rename one of the Server Workloads to fix it. See Tool and prompt names.
  • Timeout names with no effect: The initialize, notifications_initialized, proactive_tools_list, reinit_initialize, reinit_notifications_initialized, and reinit_tools_list timeout names no longer have an effect. MCP Identity Gateway still accepts them, so the service starts. If you set one of them, set upstream_call_timeout or the matching list timeout instead. See AEMBIT_MCP_GATEWAY_TIMEOUT.
  • Request duration excludes MCP server time: aembit_mcp_gateway_mcp_request_duration_seconds measures only the time MCP Identity Gateway spends processing a request, and excludes time spent waiting on MCP servers. Expect lower values, and review alerts and dashboards built on this metric. See Prometheus metrics.

This build also adds support for the 2026-07-28 MCP specification.

Tags:

MCP Identity Gateway 1.34.6034 release

Aembit has released MCP Identity Gateway version 1.34.6034, which serves the 2026-07-28 revision of the MCP specification.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • 2026-07-28 MCP specification support: MCP Identity Gateway serves MCP clients using the 2026-07-28 revision and earlier revisions. A client’s revision and a server’s revision don’t have to match, because MCP Identity Gateway negotiates each connection. The 2026-07-28 revision removes sessions, so MCP Identity Gateway doesn’t create a session for clients using that revision. See Proxied MCP methods.
  • Prompts, resources, and tasks across all assigned MCP servers: MCP Identity Gateway lists prompts and resources from every assigned MCP server. It sends each prompt or resource read to the MCP server that owns it. It routes task requests to the MCP server that created the task. It advertises the capabilities its assigned MCP servers support. It prefixes prompt and resource names with the Server Workload they came from, and returns each resource URI exactly as the MCP server reported it.
  • More timeout names: AEMBIT_MCP_GATEWAY_TIMEOUT accepts seven more timeout names, which tune the prompts/list fanout, the fan-out cap, upstream calls, upstream session caching, and Multi Round-Trip Request backoff.

Access token validation and error reporting improvements and a security update also shipped in this build.

Tags:

Dynamic claims now support SAML assertions

Dynamic claims can now read values from a SAML 2.0 response, so a Credential Provider can issue a credential bound to each SAML user’s own identity.

Aembit receives SAML responses when users sign in through the MCP Authorization Server or the MCP Identity Gateway. A SAMLv2 Response Trust Provider validates each response, and three expressions read values from its assertion:

  • ${saml.response.subject.nameId} returns the Subject NameID that identifies the user.
  • ${saml.response.issuer} returns the identity provider that issued the assertion.
  • ${saml.response.attributes['<name>']} returns a named attribute, such as a user’s groups.

If a SAML expression can’t resolve to a value, Aembit denies the request and issues no credential. The Credential Provider form in the Aembit Tenant UI shows the SAML syntax with examples. See SAML assertion claims.

Tags:

MCP Enterprise Managed Access Token Credential Provider now available

The MCP Enterprise Managed Access Token Credential Provider is now available in the Aembit Tenant UI. It obtains each user’s MCP server access token through your corporate identity provider, so users reach MCP servers behind the MCP Identity Gateway without a per-user consent prompt.

Aembit Cloud makes two token requests on the user’s behalf. The first asks your identity provider for an identity assertion that vouches for the user to one MCP server. The second presents that assertion to the MCP server’s authorization server in exchange for an access token, which the MCP Identity Gateway injects into the request.

To get started, prepare your identity provider for enterprise-managed access, then configure the Credential Provider. For how the exchange works, see About the MCP Enterprise Managed Access Token Credential Provider.

Tags:

MCP Identity Gateway 1.34.5794 release

Aembit has released MCP Identity Gateway version 1.34.5794.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • MCP Tool Access Control enforcement: The Gateway now enforces MCP Tool Access Control, a Content Security Provider you add to an Access Policy. The Tool Visibility control decides which MCP tools an AI agent discovers, and the Tool Invocation control decides which MCP tools an AI agent can call.
  • Glob patterns for MCP tool names: An entry in either control takes an exact MCP tool name or a glob pattern, and matching is case-sensitive. A pattern matches the name the MCP server publishes, not the prefixed name an AI agent displays. See MCP Tool Access Control tool name reference.
  • Tool filtering decisions in your events: MCP workload events record which control decided an MCP tool’s fate, which rules matched, which MCP tools a listing removed, and how many it returned, under application.mcp.contentSecurity.

A security update also shipped in this build.

Tags:

MCP Identity Gateway 1.34.5733 release

Aembit has released MCP Identity Gateway version 1.34.5733.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Higher fanout timeout defaults: The Gateway now waits longer for your assigned MCP servers on most of the MCP methods it fans out, which gives a server that’s still starting up, or one answering from a cold cache, room to respond. A self-hosted Gateway can override any of these timeouts as a last resort; see MCP Identity Gateway raises fanout timeout defaults.
  • Nine new Prometheus metrics: The Gateway’s metrics endpoint reports on upstream fanout behavior, authentication failures, JWKS refreshes, session cleanup, and readiness probe stability.
  • Every Gateway metric documented: The metrics reference now lists all 20 MCP-specific metrics the Gateway exposes, with the type and labels for each and the values each label takes. See Prometheus metrics.
Tags:

MCP Identity Gateway raises fanout timeout defaults

MCP Identity Gateway 1.34.5733 raises how long the Gateway waits for your assigned MCP servers when it fans a request out to them. The earlier defaults were short enough that a server still starting up, or one answering from a cold cache, could run past them.

Timeout1.33.56541.34.5733
initialize3s10s
notifications_initialized500ms1s
tools_list1s3s
proactive_tools_list3s5s
resources_list1s3s
reinit_initialize10s10s
reinit_notifications_initialized500ms1s
reinit_tools_list1s5s

reinit_initialize is the one timeout this build leaves unchanged.

The new defaults require no configuration and apply to both deployment models as soon as you upgrade. They’re high enough that an AI client typically reaches its own timeout before the Gateway reaches one of these, so most deployments never need to change them.

A self-hosted Gateway can override any of these timeouts as a last resort, using the AEMBIT_MCP_GATEWAY_TIMEOUT environment variable. The installer doesn’t forward this variable to the running service, so setting it takes a systemd drop-in. For the accepted names, the value format, and the drop-in, see MCP Identity Gateway environment variables. Aembit sets these values for you on the Aembit-managed service.

These updates shipped in the same build as the MCP Identity Gateway 1.34.5733 release.

Tags:

Content Security now available

Aembit now offers Content Security, an Access Policy component that inspects content and enforces the verdict an inspection service returns. Content Security inspects Model Context Protocol (MCP) traffic that flows through the Aembit MCP Identity Gateway.

In the Access Policy Builder, Content Security is an optional component positioned between Access Conditions and Credential Providers. It adds inspection to the request path without changing how the policy’s other components authorize access.

What’s new:

  • Content Security Access Policy component: Add Content Security to a policy to inspect the MCP traffic that policy governs. Inspection applies only to the policies you add it to.
  • CrowdStrike AIDR integration: CrowdStrike AI Detection and Response (AIDR) inspects tool listings, tool call inputs, and tool call outputs, and returns an allow, block, or transform verdict that Aembit enforces. AIDR requires an active CrowdStrike AIDR for Agents subscription.
  • Inspection decisions in your events: Access Authorization Events record the Content Security component a policy identified, and MCP Workload Events record the decision AIDR returned, including CrowdStrike’s request ID for correlating an event with the CrowdStrike console.

CrowdStrike AIDR Content Security is separate from the CrowdStrike Access Condition, which evaluates endpoint posture. Configuring one doesn’t enable the other.

To add the component to a policy, see Add CrowdStrike AIDR to a policy.

Tags:
Copyright © 2026. All rights reserved.Privacy PolicyTerms of ServiceTrust CenterMetadata collectionContact Aembit