Skip to content
ReleasesGitHub

Changelog — MCPNew features

Subscribe with RSS

MCP
New Feature
Clear all

MCP Identity Gateway 1.35.6086 release

Aembit has released MCP Identity Gateway version 1.35.6086, which relays change notifications to MCP clients and checks tool results against their output schemas.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Change notifications: An MCP client using the 2026-07-28 revision of the MCP specification can send subscriptions/listen to learn when the tools, resources, or prompts it can reach change. MCP Identity Gateway relays these notifications from MCP servers using the 2026-07-28 revision. It also sends one when the client’s assigned Server Workloads or MCP Tool Access Control rules change, and when it reconnects to an MCP server. See Change notifications.
  • Tool output validation: When a tool publishes an output schema, MCP Identity Gateway checks the tool’s completed results against it. The MCP client gets error -32004 in place of a result that doesn’t match. For the results MCP Identity Gateway doesn’t check, see Tool output validation.
  • Subscription refresh interval: AEMBIT_MCP_GATEWAY_TIMEOUT accepts the subscriptions_workload_refresh_interval timeout name, which sets how often MCP Identity Gateway checks for assignment and rule changes. The default is 30 seconds.

Access token, credential, and error handling improvements and a security update also shipped in this build.

Tags:

MCP user session management now available

Each Identity Provider in the Aembit Tenant UI now has a Sessions tab that lists the MCP user sessions of the people who signed in through it. Filter the list, revoke one session, or revoke every session for a user or an MCP client at once. When you delete an Identity Provider that has active sessions, Aembit prompts you to revoke them.

Sessions exist when the Client-to-Gateway Access Policy uses an OIDC ID Token Credential Provider with Enable Refresh Token Support turned on. To get started, see Manage MCP user sessions. For what revoking a session does, see MCP user sessions.

Tags:

Agent Proxy now injects credentials for MCP Server Workloads

Agent Proxy 1.34.6014 injects credentials for Server Workloads whose Application Protocol is MCP. Agent Proxy handles this traffic as HTTP and injects the credential the same way it does for HTTP Server Workloads. Earlier versions passed MCP traffic through without injecting a credential.

Agent Proxy doesn’t read the MCP messages in this traffic, so these features of the MCP Identity Gateway don’t apply to it:

Tags:

MCP Identity Gateway 1.34.6034 release

Aembit has released MCP Identity Gateway version 1.34.6034, which serves the 2026-07-28 revision of the MCP specification.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • 2026-07-28 MCP specification support: MCP Identity Gateway serves MCP clients using the 2026-07-28 revision and earlier revisions. A client’s revision and a server’s revision don’t have to match, because MCP Identity Gateway negotiates each connection. The 2026-07-28 revision removes sessions, so MCP Identity Gateway doesn’t create a session for clients using that revision. See Proxied MCP methods.
  • Prompts, resources, and tasks across all assigned MCP servers: MCP Identity Gateway lists prompts and resources from every assigned MCP server. It sends each prompt or resource read to the MCP server that owns it. It routes task requests to the MCP server that created the task. It advertises the capabilities its assigned MCP servers support. It prefixes prompt and resource names with the Server Workload they came from, and returns each resource URI exactly as the MCP server reported it.
  • More timeout names: AEMBIT_MCP_GATEWAY_TIMEOUT accepts seven more timeout names, which tune the prompts/list fanout, the fan-out cap, upstream calls, upstream session caching, and Multi Round-Trip Request backoff.

Access token validation and error reporting improvements and a security update also shipped in this build.

Tags:

MCP Enterprise Managed Access Token Credential Provider now available

The MCP Enterprise Managed Access Token Credential Provider is now available in the Aembit Tenant UI. It obtains each user’s MCP server access token through your corporate identity provider, so users reach MCP servers behind the MCP Identity Gateway without a per-user consent prompt.

Aembit Cloud makes two token requests on the user’s behalf. The first asks your identity provider for an identity assertion that vouches for the user to one MCP server. The second presents that assertion to the MCP server’s authorization server in exchange for an access token, which the MCP Identity Gateway injects into the request.

To get started, prepare your identity provider for enterprise-managed access, then configure the Credential Provider. For how the exchange works, see About the MCP Enterprise Managed Access Token Credential Provider.

Tags:

MCP Identity Gateway 1.34.5794 release

Aembit has released MCP Identity Gateway version 1.34.5794.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • MCP Tool Access Control enforcement: The Gateway now enforces MCP Tool Access Control, a Content Security Provider you add to an Access Policy. The Tool Visibility control decides which MCP tools an AI agent discovers, and the Tool Invocation control decides which MCP tools an AI agent can call.
  • Glob patterns for MCP tool names: An entry in either control takes an exact MCP tool name or a glob pattern, and matching is case-sensitive. A pattern matches the name the MCP server publishes, not the prefixed name an AI agent displays. See MCP Tool Access Control tool name reference.
  • Tool filtering decisions in your events: MCP workload events record which control decided an MCP tool’s fate, which rules matched, which MCP tools a listing removed, and how many it returned, under application.mcp.contentSecurity.

A security update also shipped in this build.

Tags:

Content Security now available

Aembit now offers Content Security, an Access Policy component that inspects content and enforces the verdict an inspection service returns. Content Security inspects Model Context Protocol (MCP) traffic that flows through the Aembit MCP Identity Gateway.

In the Access Policy Builder, Content Security is an optional component positioned between Access Conditions and Credential Providers. It adds inspection to the request path without changing how the policy’s other components authorize access.

What’s new:

  • Content Security Access Policy component: Add Content Security to a policy to inspect the MCP traffic that policy governs. Inspection applies only to the policies you add it to.
  • CrowdStrike AIDR integration: CrowdStrike AI Detection and Response (AIDR) inspects tool listings, tool call inputs, and tool call outputs, and returns an allow, block, or transform verdict that Aembit enforces. AIDR requires an active CrowdStrike AIDR for Agents subscription.
  • Inspection decisions in your events: Access Authorization Events record the Content Security component a policy identified, and MCP Workload Events record the decision AIDR returned, including CrowdStrike’s request ID for correlating an event with the CrowdStrike console.

CrowdStrike AIDR Content Security is separate from the CrowdStrike Access Condition, which evaluates endpoint posture. Configuring one doesn’t enable the other.

To add the component to a policy, see Add CrowdStrike AIDR to a policy.

Tags:

MCP Identity Gateway sessions can persist across restarts

A self-hosted MCP Identity Gateway can now keep its MCP sessions in Valkey instead of in process memory. Persisted sessions survive a service restart or an upgrade, and more than one Gateway instance can share them.

Set AEMBIT_VALKEY_URL on the install command to enable it. The Gateway keeps sessions in memory when you leave that variable unset, which remains the default. An in-memory store ends every open session on restart. AEMBIT_MCP_SESSION_IDLE_TTL_SECS sets how long an unused session lives, and it defaults to 12 hours for both store types.

Sessions hold MCP protocol state, not authentication state. The Gateway still validates every request’s token and evaluates Access Policies per request, so persistence doesn’t extend anyone’s access.

This change requires no configuration if you use the Aembit-managed service or want the in-memory default. It ships in MCP Identity Gateway 1.32.5098, alongside the session ID binding in this build; see the session IDs bound to the authenticated user entry. For configuration and operational detail, see Session persistence.

Tags:

Client ID Metadata Document (CIMD) identification now available

Aembit can now identify MCP client workloads with a Client ID Metadata Document (CIMD). A CIMD is a JSON document the client hosts at a public HTTPS URL, and the URL itself serves as the client’s identity. When the client presents the URL-formatted client_id, Aembit fetches the document and validates the client’s metadata, so the client can authenticate without Dynamic Client Registration.

CIMD has reached general availability, and Aembit enables it by default. To identify a Client Workload by its CIMD URL, see CIMD Client ID.

Tags:

Refresh token support for MCP authorization flows

OIDC ID Token and Aembit Access Token Credential Providers now support refresh tokens for MCP Authorization Server flows. This feature applies exclusively to MCP Authorization Server use cases.

What’s new:

  • An Enable Refresh Token Support option on OIDC ID Token and Aembit Access Token Credential Providers.
  • An Absolute Token Lifetime setting that controls how long refresh tokens remain valid for exchanging for new access tokens after initial issuance.
  • Refresh tokens are single-use. Each exchange returns a new refresh token.

When enabled, the MCP Authorization Server returns refresh tokens alongside access tokens during OAuth token requests. MCP clients can exchange a refresh token for a new access token and a new refresh token, maintaining an active session without completing a new authorization flow. This setting doesn’t affect other credential flows, such as Agent Proxy.

To use this feature, edit your Credential Provider, toggle Enable Refresh Token Support to on, and set the Absolute Token Lifetime.

For details, see Token refresh, OIDC ID Token, and Aembit Access Token.

Tags:

MCP Authorization Server now supports unauthenticated flows

Aembit’s MCP Authorization Server now supports OAuth flows that don’t require end-user authentication. This enables use cases like ChatGPT apps and other MCP integrations where user sign-in isn’t needed or desired.

What’s new:

  • An Enforce SSO option on Client Workloads with the Redirect URI identifier type. Enforce SSO is on by default, preserving the current behavior of requiring user authentication.
  • When Enforce SSO is on, a multi-select dropdown lets you choose which SSO identity providers appear on the MCP authentication page. By default, the dropdown selects all configured identity providers.
  • When Enforce SSO is off, the MCP Authorization Server issues access tokens without redirecting users to an identity provider. The flow needs no Trust Provider, but a Credential Provider is still required.
  • Access Policies still apply as an authorization control. You can turn off policies or entities to block token issuance.

To use this feature, edit your Client Workload, select the Redirect URI client identifier, and configure Enforce SSO under MCP Authorization Configuration.

For details, see Authentication support and MCP Authorization Server architecture.

Tags:

MCP Identity Gateway now supports MCP resources

Aembit has released MCP Identity Gateway version 1.29.4419.

Key Updates:

  • MCP resource support for the Identity Gateway

The MCP Identity Gateway now proxies MCP resource requests alongside tool requests. MCP servers that expose resources, such as files, database schemas, or application data, are now accessible through the Gateway. The same identity-aware access policies, credential isolation, and audit logging that govern tool invocations apply.

What’s new:

  • resources/list discovers available resources across all assigned MCP servers. The Gateway fans out the request and aggregates results from all connected servers.
  • resources/read retrieves a specific resource by URI from the appropriate MCP server.

No action required. Resource support is available automatically after upgrading to MCP Identity Gateway 1.29.4419. Your existing access policies, Trust Providers, and Credential Providers apply to resource requests with no configuration changes.

For details, see MCP resource support.

Tags:
Copyright © 2026. All rights reserved.Privacy PolicyTerms of ServiceTrust CenterMetadata collectionContact Aembit