Skip to content
ReleasesGitHub

Changelog — MCP

Subscribe with RSS

MCP
All changes
Clear all

MCP Identity Gateway 1.33.5654 release

Aembit has released MCP Identity Gateway version 1.33.5654.

For the latest available versions of these components, see the Edge Components Supported Versions page.

For each Content Security decision, the Gateway records a single MCP Workload Event carrying the severity, outcome result, and outcome reason.

This build also broadens the MCP traffic that Content Security inspects; see MCP Identity Gateway content inspection coverage. For Content Security inspection of MCP traffic, use MCP Identity Gateway version 1.33.5654 or later.

Tags:

MCP Identity Gateway content inspection coverage

A security update for the MCP Identity Gateway broadens the MCP traffic that Content Security inspects.

The Gateway normalizes responses that MCP servers stream as server-sent events before inspection, so Content Security inspects those responses along with the rest of the session. The Gateway also applies the policy’s Fail Open on Error setting to requests it can’t read and to protocol errors. A policy set to fail closed blocks those requests.

These updates shipped in the same build as the MCP Identity Gateway 1.33.5654 release.

Tags:

MCP Identity Gateway 1.33.5547 release

Aembit has released MCP Identity Gateway version 1.33.5547.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • More reliable upstream reconnection: When the Gateway reestablishes a connection to an MCP server, it now refreshes the available tools as part of that reconnection, and reports a clear error if the reconnection doesn’t succeed.
  • Deployment modes documented: The MCP Identity Gateway concepts page now describes the two ways to run the Gateway: self-hosted on your own host, or managed by Aembit at your per-Tenant endpoint. The traffic flow and policy model are identical in both. See MCP Identity Gateway concepts.

Dependency security updates also shipped in this build; see MCP Identity Gateway dependency security updates.

Tags:

MCP Identity Gateway sessions can persist across restarts

A self-hosted MCP Identity Gateway can now keep its MCP sessions in Valkey instead of in process memory. Persisted sessions survive a service restart or an upgrade, and more than one Gateway instance can share them.

Set AEMBIT_VALKEY_URL on the install command to enable it. The Gateway keeps sessions in memory when you leave that variable unset, which remains the default. An in-memory store ends every open session on restart. AEMBIT_MCP_SESSION_IDLE_TTL_SECS sets how long an unused session lives, and it defaults to 12 hours for both store types.

Sessions hold MCP protocol state, not authentication state. The Gateway still validates every request’s token and evaluates Access Policies per request, so persistence doesn’t extend anyone’s access.

This change requires no configuration if you use the Aembit-managed service or want the in-memory default. It ships in MCP Identity Gateway 1.32.5098, alongside the session ID binding in this build; see the session IDs bound to the authenticated user entry. For configuration and operational detail, see Session persistence.

Tags:

Client ID Metadata Document (CIMD) identification now available

Aembit can now identify MCP client workloads with a Client ID Metadata Document (CIMD). A CIMD is a JSON document the client hosts at a public HTTPS URL, and the URL itself serves as the client’s identity. When the client presents the URL-formatted client_id, Aembit fetches the document and validates the client’s metadata, so the client can authenticate without Dynamic Client Registration.

CIMD has reached general availability, and Aembit enables it by default. To identify a Client Workload by its CIMD URL, see CIMD Client ID.

Tags:

MCP Identity Gateway event correlation and platform fixes

This update brings event correlation to MCP Identity Gateway workload events, along with fixes across Credential Provider, Access Policy, and Client Workload workflows.

This update includes:

  • MCP Identity Gateway 1.32.5098

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Workload event correlation: MCP Identity Gateway workload events now carry the client and server workload identity (name and id), so you can tie an event to a specific workload in the Cloud UI without mapping it by hand.
  • Azure OAuth Credential Provider verification: Resolved an issue that caused Azure OAuth Credential Provider verification to fail after a recent build, so these providers verify successfully again.
  • Access Condition URL validation: The Endpoint and Token Endpoint URL fields for Access Condition integrations now show the correct “Invalid Value” message instead of a “Required” message.
  • Concurrent policy edits: Deleting an Access Policy at the same time as a patch request no longer produces errors, preserving data integrity during high-volume policy updates.
  • CIMD authorization flow: Fixed an issue where an OIDC session expiring mid-flow could clear the Client Workload cookie and interrupt authorization.
  • Form validation focus: Saving a form with an invalid URL field now scrolls that field into view across entity editors, and External ID tooltips no longer get cut off in long list views.

Session IDs are now bound to the authenticated user in this build, closing a privilege-escalation gap. See the Security entry. Client ID Metadata Document (CIMD) identification also reached general availability in this update. See the announcement.

Tags:

MCP User-Based Access Token callback URL format

MCP User-Based Access Token Credential Providers now generate their read-only callback URL in the form https://<tenantId>.id.<region>.aembit.io/mcp-auth/userauth/<cp-id>/callback.

What this means for you:

  • Existing Credential Providers - Providers created before this change keep their original callback URL, which takes the form https://<tenantId>.mcp.<region>.aembit.io/userauth/<cp-id>/callback. Updating a provider doesn’t regenerate its callback URL. Both formats remain valid, so you don’t need to take any action or re-register anything with your MCP server vendor.
  • New Credential Providers - Aembit assigns the callback URL when you save the Credential Provider. Save the provider first, then copy the read-only value and register it with the MCP server vendor.

Always copy the exact value shown in the Credential Provider rather than constructing the URL yourself.

For details, see Configure MCP User-Based Access Token Credential Provider.

Tags:

MCP Identity Gateway 1.32.5006 release

Aembit has released MCP Identity Gateway version 1.32.5006.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • MCP ping support: The Gateway now supports the MCP ping method, responding to client connection-health checks per the MCP specification.
  • Authorization chain in workload events: MCP Identity Gateway workload events now include an ordered authorization chain, the ordered list of authorization-event context IDs behind each request. The chain spans both sides of the proxied connection, carried from the access token on the agent-to-Gateway side and forward through the directive and credential calls on the Gateway-to-MCP-server side, so you can confirm both belong to the same logical request. Take any context ID from the chain and filter your authorization events on it to trace a request end-to-end, from the traffic you observe back to the token, directive, and credential decisions that allowed it.
  • Microsoft Copilot Studio compatibility: Fixed an issue where some tools could fail to load for Microsoft Copilot Studio clients.
  • Health endpoint status: The Gateway’s health endpoint now returns an HTTP 503 status when the Gateway is unhealthy, so orchestrators and load balancers can detect an unhealthy Gateway accurately.
  • More reliable session timing: Session lifetimes now track wall-clock time, so sessions expire and renew correctly across events such as a host suspend and resume.
Tags:

Expanded MCP and AI IAM event coverage

Aembit has expanded the event coverage and reporting surfaces for troubleshooting MCP and AI IAM failures:

  • New access.discovery event type: Access Authorization Events now include an access.discovery event that lists the Client Workloads and Server Workloads Aembit Cloud considered during evaluation. Use it to diagnose requests that match no workload or policy, or that match multiple. See Access Discovery events.
  • User identity on MCP Workload Events: MCP Workload Events now include a userId field at application.mcp.userId for flows that involve a human identity, such as MCP Authorization Server flows. The Workload Events view exposes a matching User (MCP App Protocol only) filter for per-user investigations and SIEM scoping.
  • Trust Provider failures emit at Error severity: Trust Provider attestation failures in MCP flows now emit at Error severity rather than warning, so SIEM alerts that watch for Error events catch real authorization failures reliably.
  • Clearer expired-credential explanations: The access.credential event’s reason now identifies which token expired and at which step, making it easier to decide between re-authentication, credential refresh, or Credential Provider reconfiguration.
  • MCP Authorization Tracing view: A new live diagnostic view in the Reporting dashboard surfaces inbound authorization requests at the MCP Identity Gateway in real time, with the redirect URI, resource, matched Client Workload, and policy outcome for each request. See MCP Authorization Tracing.

For an end-to-end investigation flow that uses these reporting surfaces together, see Troubleshoot MCP and AI IAM access.

Tags:

MCP Identity Gateway 1.31.4955 release

Aembit has released MCP Identity Gateway version 1.31.4955.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Session deletion: Support for deleting MCP sessions, enabling clients to explicitly end MCP Identity Gateway sessions when finished.
  • MCP-level error metrics: New Prometheus metrics expose MCP protocol-level errors, giving operators visibility into request failures at the MCP layer.
  • Application-specific Prometheus metrics: Additional Prometheus metrics scoped to the MCP Identity Gateway application for improved observability.
Tags:

MCP Identity Gateway 1.31 release

Aembit has released MCP Identity Gateway version 1.31.

Key Updates:

  • User identity on workload events: The userId field now appears on mcp.request and mcp.response workload events when the MCP client is identified, making it easier to attribute MCP activity to authenticated users in audit reports.
  • Client-initiated session termination: MCP clients can now end their session with the Gateway by sending an HTTP DELETE request to the /mcp endpoint, per MCP specification section 2.5.5. See Session management for the request contract.
Tags:

Refresh token support for MCP authorization flows

OIDC ID Token and Aembit Access Token Credential Providers now support refresh tokens for MCP Authorization Server flows. This feature applies exclusively to MCP Authorization Server use cases.

What’s new:

  • An Enable Refresh Token Support option on OIDC ID Token and Aembit Access Token Credential Providers.
  • An Absolute Token Lifetime setting that controls how long refresh tokens remain valid for exchanging for new access tokens after initial issuance.
  • Refresh tokens are single-use. Each exchange returns a new refresh token.

When enabled, the MCP Authorization Server returns refresh tokens alongside access tokens during OAuth token requests. MCP clients can exchange a refresh token for a new access token and a new refresh token, maintaining an active session without completing a new authorization flow. This setting doesn’t affect other credential flows, such as Agent Proxy.

To use this feature, edit your Credential Provider, toggle Enable Refresh Token Support to on, and set the Absolute Token Lifetime.

For details, see Token refresh, OIDC ID Token, and Aembit Access Token.

Tags:

MCP Identity Gateway 1.30 release

Aembit has released MCP Identity Gateway version 1.30.4549.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • The Gateway now authenticates requests before proxying them to upstream MCP servers (new default behavior)
  • MCP responses include tool annotations
  • The Gateway returns HTTP 405 for GET requests to the MCP endpoint
  • Unauthorized (401) responses now include additional metadata for easier troubleshooting
  • The Gateway forwards errors from upstream MCP servers to MCP clients
  • The Gateway honors the AEMBIT_TRUSTED_ISSUER_DOMAINS environment variable for trusted issuer configuration
  • A new metrics endpoint provides Gateway operational metrics on a configurable port
  • Improved compatibility with Claude Desktop and other MCP clients
  • Improved handling of MCP servers that don’t support resources
  • General improvements to session management, installer reliability, and internal performance
Tags:

MCP Authorization Server now supports unauthenticated flows

Aembit’s MCP Authorization Server now supports OAuth flows that don’t require end-user authentication. This enables use cases like ChatGPT apps and other MCP integrations where user sign-in isn’t needed or desired.

What’s new:

  • An Enforce SSO option on Client Workloads with the Redirect URI identifier type. Enforce SSO is on by default, preserving the current behavior of requiring user authentication.
  • When Enforce SSO is on, a multi-select dropdown lets you choose which SSO identity providers appear on the MCP authentication page. By default, the dropdown selects all configured identity providers.
  • When Enforce SSO is off, the MCP Authorization Server issues access tokens without redirecting users to an identity provider. The flow needs no Trust Provider, but a Credential Provider is still required.
  • Access Policies still apply as an authorization control. You can turn off policies or entities to block token issuance.

To use this feature, edit your Client Workload, select the Redirect URI client identifier, and configure Enforce SSO under MCP Authorization Configuration.

For details, see Authentication support and MCP Authorization Server architecture.

Tags:

MCP Identity Gateway now supports MCP resources

Aembit has released MCP Identity Gateway version 1.29.4419.

Key Updates:

  • MCP resource support for the Identity Gateway

The MCP Identity Gateway now proxies MCP resource requests alongside tool requests. MCP servers that expose resources, such as files, database schemas, or application data, are now accessible through the Gateway. The same identity-aware access policies, credential isolation, and audit logging that govern tool invocations apply.

What’s new:

  • resources/list discovers available resources across all assigned MCP servers. The Gateway fans out the request and aggregates results from all connected servers.
  • resources/read retrieves a specific resource by URI from the appropriate MCP server.

No action required. Resource support is available automatically after upgrading to MCP Identity Gateway 1.29.4419. Your existing access policies, Trust Providers, and Credential Providers apply to resource requests with no configuration changes.

For details, see MCP resource support.

Tags:

MCP Identity Gateway enters beta with MCP Server and component copying

Aembit now offers an MCP Identity Gateway (Beta) that sits between AI agents and MCP servers, enforcing Access Policies, performing secure token exchange, and providing visibility into MCP activity. Deployed on a Linux VM, the Gateway ensures AI agents never hold direct credentials for enterprise systems.

Key capabilities:

  • Proxies MCP traffic with identity-aware policy enforcement
  • Performs secure token exchange using OAuth 2.0 and API key credentials
  • Provides per-user credential management and centralized MCP routing
  • Logs agent identity, user identity, and policy decisions for auditability
  • Fail-closed behavior—denies access by default unless explicitly allowed

For setup instructions and architecture details, see MCP Identity Gateway.

Aembit now provides an MCP Server that enables AI agents and users to query Aembit event logs using structured commands. Built on the Model Context Protocol specification, the MCP Server enables agentic observability and auditability for organizations using Aembit.

Key capabilities:

  • Query audit logs, authorization events, and workload events
  • Integrations with MCP Inspector, Claude Code, GitHub Copilot, and Visual Studio
  • Resource-set-based access scoping for least-privilege access
  • Read-only access—no create, update, or delete operations
  • Full audit trail of all MCP Server queries

For setup and connection guides, see Aembit MCP Server.

Aembit has added a new MCP User-Based Access Token Credential Provider type. This type enables per-user OAuth credentials for MCP servers using the OAuth 2.0 Authorization Code flow. The MCP Identity Gateway manages user-specific tokens when connecting to downstream MCP servers.

Key capabilities:

  • OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE) support
  • MCP Server URL discovery with auto-population of OAuth endpoints
  • Per-user credential scoping
  • Token introspection and lifetime management

For configuration details, see MCP User-Based Access Token Credential Provider.

Aembit now supports component copying between Resource Sets. You can replicate Access Policy components—including Client Workloads, Server Workloads, Trust Providers, Credential Providers, and Access Conditions—from one Resource Set to another. You can also copy entire Access Policies with all related components at once.

Key capabilities:

  • Copy individual components or entire Access Policies between Resource Sets
  • Each copy receives a unique identifier while the original remains unchanged
  • Supports environment promotion, regional deployments, and safe experimentation

For details, see About component copying and Copy components.

Tags:

GitHub Action, MCP Authorization Server beta, and Access Policy Builder now available

Aembit now provides an official GitHub Action for injecting credentials into your CI/CD workflows. The action retrieves credentials from Aembit and makes them available to subsequent steps in your workflow.

Key capabilities:

  • Retrieve credentials using workload identity federation with GitHub’s OIDC tokens
  • Support for AWS, Azure, database, and API key credential types
  • Automatic credential masking in workflow logs

For setup instructions, see the GitHub Actions tutorial. For usage examples with different credential types, see the how-to guide.

Aembit now supports Private Network Access (PNA) for the AWS Secrets Manager Credential Provider. This allows your Aembit Edge components (Aembit CLI or Agent Proxy) to retrieve secrets directly from AWS Secrets Manager instances in private networks, such as AWS VPCs with private endpoints.

Key capabilities:

  • Retrieve secrets from AWS Secrets Manager without exposing your VPC to the public internet
  • Works with both Aembit CLI and Agent Proxy deployments
  • No changes required to your existing AWS IAM policies or VPC endpoint configuration

For configuration details, see Private Network Access for Credential Providers and AWS Secrets Manager Credential Provider.

Aembit has released the MCP Authorization Server (beta), which secures Model Context Protocol (MCP) workloads using OAuth 2.1 authorization flows. This enables you to apply Aembit Access Policies to AI agents and MCP clients, controlling which users can access which MCP servers.

Key capabilities:

  • OAuth 2.1 authorization code flow implementation for MCP-compliant workloads
  • Dynamic Client Registration support for tools like Claude Desktop and Gemini CLI
  • Integration with OIDC and SAML identity providers for user authentication
  • Access Policies with time and location-based conditions

Aembit has redesigned the Access Policy creation experience with the new Access Policy Builder. The builder provides a card-based interface that guides you through configuring each component of an Access Policy.

Access Policy Builder showing a completed policy configuration

Key capabilities:

  • Visual card-based navigation for policy components
  • Inline creation of Client Workloads, Server Workloads, Trust Providers, and other components
  • Clear indicators for required, recommended, and optional components based on Global Policy Compliance settings

To use the new builder, enable Use new access policy in your user profile preferences. For a walkthrough, see Create an Access Policy.

Tags:
Copyright © 2026. All rights reserved.Privacy PolicyTerms of ServiceTrust CenterMetadata collectionContact Aembit