Improved MCP Identity Gateway token validation and error reporting

October 7, 2026

MCP Identity Gateway version 1.34.6034 validates more access tokens and reports conflicting tool and prompt names. It also changes which timeout names take effect and what its request duration metric measures.

For the latest available versions of these components, see the Edge Components Supported Versions page.

ES256-signed access tokens: MCP Identity Gateway validates access tokens signed with ES256 as well as RS256. See Set up the MCP Identity Gateway.
Access token audience: MCP Identity Gateway accepts an access token whose audience is its /mcp endpoint URL, or its own URL with or without a trailing slash.
Tool and prompt name conflicts: Two Server Workloads assigned to the same MCP client can produce the same name prefix. MCP Identity Gateway then leaves both Server Workloads’ tools and prompts out of the client’s lists and logs the conflict. Rename one of the Server Workloads to fix it. See Tool and prompt names.
Timeout names with no effect: The initialize, notifications_initialized, proactive_tools_list, reinit_initialize, reinit_notifications_initialized, and reinit_tools_list timeout names no longer have an effect. MCP Identity Gateway still accepts them, so the service starts. If you set one of them, set upstream_call_timeout or the matching list timeout instead. See AEMBIT_MCP_GATEWAY_TIMEOUT.
Request duration excludes MCP server time: aembit_mcp_gateway_mcp_request_duration_seconds measures only the time MCP Identity Gateway spends processing a request, and excludes time spent waiting on MCP servers. Expect lower values, and review alerts and dashboards built on this metric. See Prometheus metrics.

This build also adds support for the 2026-07-28 MCP specification.

Tags:

← Back to changelog