Release notes
Currently running v2.0.3406
✨ 🚀 Features
- Destructive-action approvals per operation for generic MCP tools. An MCP connector whose tools take the operation as an argument can declare that argument; the gateway then judges each operation, as well as the tool, against the destructive-action categories, and an approval covers one operation instead of every operation the tool can run. Storyblok connections now offer deletes this way.
📝 🔧 Improvements
- Updates 14 dependencies. This release carries boto3 1.43.114 → 1.43.115, botocore 1.43.114 → 1.43.115, cachetools 7.2.3 → 7.2.4, fastapi 0.143.3 → 0.149.0, griffelib 2.3.2 → 2.4.0, httpcore2 2.13.1 → 2.14.0, httpx2 2.13.1 → 2.14.0, hypothesis 6.170.1 → 6.170.2, joserfc 1.7.5 → 1.7.7, litellm 1.105.1 → 1.106.0, platformdirs 4.13.4 → 4.13.5, s3transfer 0.19.2 → 0.19.3, starlette 1.8.0 → 1.9.0, websockets 17.2 → 17.3.
✨ 🚀 Features
- MCP connectors can use each user's own access token. A connector whose vendor accepts no gateway OAuth callback can now ask each user for a personal access token on the connections page. The gateway checks the token with one real read call before it saves it (and says so when that check cannot run), sends it only for that user, and names an expired token with a link to enter a new one. Storyblok now connects this way.
📝 🔧 Improvements
- The service-availability check no longer holds up other requests. Reading which secrets a service has stored can decrypt a data key at the key management service; that call now runs in a worker thread, so other requests keep being served while it waits.
📝 🔧 Improvements
- Every image builds on one pinned Python base. All Dockerfiles now name the same digest of the Python base image, and an update of that base merges only after the production image is built on it and starts up healthy.
📝 🔧 Improvements
- The detector card on the PII page follows the page layout. The detector modes are one option per row, like the other choices on the page, and the mode that lets the second detector decide is marked as experimental.
📝 🔧 Improvements
- An event-loop stall names the code that held it. When the event loop is held for 250 ms or longer, a watchdog thread logs where the loop thread was, as file, line and function only, at most six times a minute. A garbage collection of 100 ms or longer is logged as well, so a stall can be told from a collection.
📝 🔧 Improvements
- The second detector is updated to its latest release. The pinned detection library moves to 0.7.5, which also finds names in camel-case record fields and table name columns, leaves fixture names such as Jane Doe alone, and finds a phone number written as one run of digits after a phone word.
✨ 🚀 Features
- A third detector mode adds what the built-in detector missed. On the PII page the detector mode can now be set so that a second detector reads each response after the built-in one and replaces what it found in addition, such as names and addresses, with key-only tokens. Credentials it finds are masked for good, and paging cursors are left alone. It never finds less than the built-in detector, and a failure of the second detector counts the field as unscannable. The new token forms (NAME, ADDRESS, USERNAME, PII) are recognised in every mode; the default mode scrubs as before.
📝 🔧 Improvements
- Large tool results no longer hold up other requests. The privacy scrub of a tool result now runs in a worker thread, so a large result no longer delays the requests that arrive while it is scrubbed.
✨ 🚀 Features
- A second detector can be measured beside the built-in one. The PII page has a detector mode: in shadow mode the built-in detector still decides every tool response alone, and the maisecrets library reads the same response in the background. Only counts per class leave the comparison (found by both, by one only, partial overlaps, run time, errors), as Prometheus metrics with no value in them. The default mode leaves every response as it was, and the library is pinned to one release and the hash of its archive.
📝 🔧 Improvements
- Updates 4 dependencies. This release carries aiohttp-retry 2.9.1 (new), h2 4.4.1 (new), hpack 4.2.0 (new), hyperframe 6.1.0 (new).
📝 🔧 Improvements
- Updates 2 dependencies. This release carries fastmcp 4.1.0 → 4.1.1, fastmcp-slim 4.1.0 → 4.1.1.
📝 🔧 Improvements
- Event-loop stalls are measured. A new histogram, event_loop_lag_seconds, records how long each worker's event loop was held, and a stall over 200 ms is logged, so operators can see when one slow request delays all others.
🐛 🐛 Fixes
- A client that disconnects early is no longer reported as an error. When a client or webhook sender closes the connection before its request was read, the gateway logs it as information and answers 499 instead of recording an internal error.
📝 🔧 Improvements
- Bulk questions on CRM records are routed to the reporting database. The CRM connector's listings now tell AI clients to answer questions over many records (counts, duplicates, full lists) with one database query instead of paging through every record.
📝 🔧 Improvements
- Audit rows name the provider's reason for a refused call. When a provider refuses a call with 403 and the gateway cannot classify why, the admin audit row now records the provider's own reason next to the error code; the answer to the AI client is unchanged.
🐛 🐛 Fixes
- A slow key service no longer holds up the gateway. Calls to the cloud key service now give up after a few seconds (
KMS_RPC_TIMEOUT_SECONDS, default 5) instead of retrying for up to a minute, and the existing fallback takes over sooner.
🐛 🐛 Fixes
- Jira issue edits work for every user with edit rights. The gateway asks Jira to skip watcher notifications on an edit only where the user is a project or Jira administrator; for everyone else the edit goes out with the normal notification instead of being refused.
🐛 🐛 Fixes
- Bulk reads of personal data no longer slow the gateway down for everyone. Each scrub now detects changes and reuses its cached pseudonym mapping without whole-mapping copies. One user's mapping has a size limit (
max_keys_per_user, default 25,000): past it, new values in a response get an irreversible mask instead of a token, the response says how many, and known values keep their tokens. The slow-scrub log line now names the time of the whole mapping transaction and the mapping size.
📝 🔧 Improvements
- A seam for measuring a second privacy detector. Development builds can run an additional detection library beside the built-in privacy detector and compare the two on a labelled corpus. The built-in detector remains the only one that scrubs; production images are unchanged.
📝 🔧 Improvements
- Updates 2 dependencies. This release carries certifi 2026.7.22 → 2026.10.19, pillow 12.3.0 → 13.0.0.
📝 🔧 Improvements
- Updates 5 dependencies. This release carries ast-serialize 0.13.0 → 0.13.1, cachetools 7.2.2 → 7.2.3, platformdirs 4.13.3 → 4.13.4, pypdf 6.21.0 → 6.21.1, smart-open 8.0.3 → 8.0.4.
🐛 🐛 Fixes
- Jira search takes ready-made JQL, and GitLab deployments filter by date. The Jira issue search now accepts a JQL string in
jql as well as a plain search in query; a call that sends both with different values is refused instead of using one of them. The GitLab deployment list now sorts by the field that an updated_* or a finished_* date filter needs, and accepts order_by and sort.
🐛 🐛 Fixes
- The Storyblok connector shows the Storyblok logo. The connections page and the tool list now show the vendor's mark for the Storyblok connector instead of the gateway logo.
✨ 🚀 Features
- Adds a Storyblok connector for content modelling. Each person connects their own Storyblok account on the connections page; the gateway registers itself with Storyblok's hosted MCP server, so there is no app to create. The connection reads a space and reads and changes components. It cannot change or publish pages and cannot delete a whole resource; changing a component can remove fields from its schema.
✨ 🚀 Features
- Dashboards can be renamed and their filters changed without the raw API. The BI connector has an update_dashboard action for a dashboard's name, description, filters, width and filter behaviour. It sends only the fields given and leaves cards and tabs out of the request, and it needs no confirmation for each call. Moving or archiving a dashboard still goes through the confirmed raw path.
📝 🔧 Improvements
- Dashboard card and tab actions describe the call they make. The BI connector's actions that add or remove a card, or create or rename a tab, now name the dashboard update they perform, so confirmation rules and API audits judge the real request. Removing a card still asks for confirmation.
🐛 🐛 Fixes
- An MCP authorization code no longer works as an access token. A client exchanges the code once at the token endpoint, with its PKCE verifier, as the MCP sign-in describes. Standard MCP clients work as before; a code presented directly is refused and logged as a warning.
📝 🔧 Improvements
- The legacy ChatGPT Actions sign-in is retired. The /auth/chatgpt token endpoints and the tokens they issued are removed. ChatGPT connects through the standard MCP sign-in, which is unchanged.
🐛 🐛 Fixes
- Self-healing scrubs only its own log output. The runner's log scrub now applies to the output of its own log handlers and leaves the log record unchanged for every other handler in the process.
🐛 🐛 Fixes
- Saving the team settings changes who may sign in only through the saved file. The sign-in domains take effect when the access-control file is written and read back; a save that writes no file leaves the running gateway's sign-in rules as they were.
🐛 🐛 Fixes
- Self-healing on the CI runner pushes the change its review gate read. Before the push, everything the fix branch adds on top of the remote main, as read right after the fetch, is compared with the reviewed change, path by path, and one commit with the checked content is pushed. A change that the review did not read stops the push and goes to a maintainer; a main that had changed the reviewed files sends the fix to a new run.
🐛 🐛 Fixes
- Self-healing redacts credentials in what it publishes. Commit messages, merge requests, issue notes, session logs and notifications that the self-healing runner writes now replace the token shapes the gateway knows, named credentials, URL credentials and email addresses with fixed labels. If the redaction rules cannot load, the runner publishes nothing.
📝 🔧 Improvements
- The audit read tool names more actions and marks the client family. A failure of an action that the service's shipped catalogue names, in the tool's mode, now shows the action, not only actions in the tool's curated list; names from an operator's own extension files stay hidden. A client name that is not a plain identifier is shown as a fixed marker of the family its text mentions, such as Claude or ChatGPT; any other free text stays hidden.
🐛 🐛 Fixes
- Self-healing scripts and log tails cut at a value boundary in more places. The self-healing entry scripts now cut agent output, reviewer text, git errors and upstream responses at a value boundary. A cut that keeps the end of a log drops a private key block whose start it does not keep, and a named value that contains a bracket.
📝 🔧 Improvements
- Updates 1 dependency. This release carries pypdf 6.20.1 → 6.21.0.
📝 🔧 Improvements
- Updates 2 dependencies. This release carries fastapi 0.143.2 → 0.143.3, hypothesis 6.170.0 → 6.170.1.
🐛 🐛 Fixes
- The self-healing runner imports its own modules when it starts. A fix agent works in the checkout the runner runs from. The runner now imports its own modules before the agent runs, so a runner module file that the agent changes is not imported into the runner later.
✨ 🚀 Features
- Per-call environment for session-based connectors. A connector can now route a single read to a named environment (for example dev or devops) through its declared backends, with the API host and the session host switching together for that call only. Non-default environments are limited to read actions and operators, results name the environment they came from, and audit rows record it.
🐛 🐛 Fixes
- Token exchange keeps the identity token on the declared host. A connector that names its session-exchange host through a setting now refuses the exchange when that setting is empty, instead of trying another host.
🐛 🐛 Fixes
- Error, log and notification texts are shortened between values. Exception messages, upstream error details, echoed request values, Slack summaries, prototype logs and self-healing reports are now cut at a value boundary, also where only the end of a log is kept. A credential or an account number in such a text is kept whole, so the scrubber can find it, or it is left out. Where a view shows the start of the caller's own data, such as a table cell or a search query, one long value keeps its start. Self-healing runners that cannot import the gateway package now cut the same way.
🐛 🐛 Fixes
- An HTTP 404 from an MCP upstream is reported as the upstream's answer. If the upstream answers a call in a session with a 404 that does not answer that call, for example because the session ended, the gateway opens a new session and sends the call once more. A 404 that carries the call's id is not sent again. If the 404 stays, the caller gets the error
upstream_not_found with the service, the tool name and what the upstream said. The gateway no longer files the 404 as a gateway bug, and the audit shows a 404 on a read tool as an expected answer.
🐛 🐛 Fixes
- Upstream error bodies are shortened between values. When a connector or an auth flow shortens an upstream response for an error, a log line or a preview, it now cuts where no value is split, so an address, a credential or an account number the scrubber recognises is kept whole or left out. Previews of a response keep their head.
📝 🔧 Improvements
- Shorter rule checks in CI. The empty-population scan now runs once per pipeline, and its job also checks the numbers its rule declares.
📝 🔧 Improvements
- Leaner test job. The test job no longer runs two suite files a second time, so its last report shows the slowest tests of the full suite.
🐛 🐛 Fixes
- Steadier instance readiness. The readiness probe for multi-instance services now reads the current service registry after a reload.
✨ 🚀 Features
- Admins can read failed tool calls from their AI client. A new admins-only tool, gateway_audit_read_actions, groups the audit log's failed tool calls by tool, action, upstream tool and error code with exact counts and their most frequent reasons, lists them and counts them per hour. It returns failed tool calls only, in a fixed set of fields with callers as one-answer aliases and reasons reduced to plain words, the scrubber's placeholders and folded numbers, labels every recorded text as data, is available only through an MCP client and never on a delegated call, and writes a best-effort record of each read to the audit log.
📝 🔧 Improvements
- Recorded failure reasons are scrubbed before the gateway shortens them. For the audit log, the request log line and traces, a failed tool call's reason is now scrubbed before it is cut to length, so that cut keeps no part of an address, credential or account number the scrubber recognises. A cut reason ends in an ellipsis.
🐛 🐛 Fixes
- The scrubbers now remove a whole private key and an IPv6 address written after a separator colon. A PEM private key in a failure reason, a log line or a tool response is replaced from its header through its body and END line, also when it is encrypted, when its newlines are escaped or when its end was cut, and an IPv6 address that follows a colon after a space or punctuation mark (
peer :<address>) is replaced like any other, also before the text reaches an AI model.
🐛 🐛 Fixes
- A read of the gateway's log buffer records its parameters in the audit log. A gateway_get_logs call now leaves its own audit row with the caller, the limit and the scrubbed filter, level and logger, so an operator can see who read which slice of the service logs.
📝 🔧 Improvements
- Updates 5 dependencies. This release carries cachetools 7.2.1 → 7.2.2, fastapi 0.143.1 → 0.143.2, hypothesis 6.169.1 → 6.170.0, platformdirs 4.13.0 → 4.13.3, pluggy 1.6.0 → 1.7.0.
🐛 🐛 Fixes
- The Home Assistant connector links its current API documentation. The documentation link points at the REST API page in its new location.
🐛 🐛 Fixes
- The Context Map index is stored encrypted. The served index of the Context Map is encrypted at rest and decrypted once per stored value in each process; an index written before is encrypted at startup or at the next sync.
- Encrypting a stored value at startup no longer holds up requests. The startup pass that encrypts older stored values now does that work off the request path.
- A new Redis key finding is logged as a warning. The startup Redis health line is logged at warning level when it reports an undeclared key family or a family that should be encrypted but holds plaintext, and at info level when it is clean.
🐛 🐛 Fixes
- The MCP client mirror stores only names. The cross-instance copy of what a client declared at connect time now keeps only capability and extension ids and a plain client name and version.
- Scoped client names are kept in the MCP client mirror. A client that names itself with an npm scope, such as @scope/client, keeps its name across instances.
- Client names with an npm scope are checked part by part. The scope and the name of a scoped MCP client name are each held to their own character set.
🐛 🐛 Fixes
- Hook effect samples are stored encrypted. The latest observed effect of each hook, shown on the hooks admin page, is now stored encrypted at rest; samples written before are encrypted at startup.
- The service visibility map stores no admin address. Who changed a service's visibility or audience is kept in the override audit; the map that every visibility check reads now holds only the state, and existing entries drop the address at startup.
- Hook effect samples are encrypted off the request path. Encrypting a captured sample no longer holds up the tool call it came from.
- The override history stores no admin address. Entries of the service visibility history name the admin only as a pseudonym; older entries drop the address at startup.
- The startup cleanup of the override history is bounded. It waits a few seconds at most for the history database and is tried again on the next start.
🐛 🐛 Fixes
- The context map settings are stored encrypted. The settings, which can hold a repository address with credentials and a copy of the content, are now written encrypted, and a plain copy from before is encrypted at startup.
- Service visibility settings and hook samples can be read encrypted. This release reads both in encrypted form as well, so a later release can store them encrypted without a gap during an update.
- The context map corpus can be read encrypted. This release reads the context map index and the federated page cache in encrypted form as well, so a later release can store them encrypted without a gap during an update.
- Context map settings are never overwritten after a failed read. If the stored settings cannot be read, the gateway still serves its defaults but refuses to save them over the stored settings, and an unchanged stored value is decrypted only once.
- An unreadable Context Map configuration pauses the map. If the stored settings cannot be read, the gateway keeps serving the last map, does not sync or record, retries soon, and the admin page says so instead of saving over the settings.
- The Context Map admin page explains unreadable settings. It shows a notice and locks editing while the stored settings cannot be read, lets an operator enter them again when they can never be decrypted, and webhooks get a temporary-failure answer instead of a token error.
- Unreadable Context Map settings are never replaced. No save, agent write or secret rotation replaces settings that cannot be read, also when they do not decrypt on one instance, and the admin page keeps its form locked.
- The Context Map admin page reads its settings once per load. The settings form and the notice about unreadable settings always come from the same read.
🐛 🐛 Fixes
- An MCP revoke deletes a grant only when it can retire the grant's tokens. If the key service stops answering during a revoke, the revoke now fails and can be retried, instead of removing the grant while its access token stays valid.
- Encoded addresses inside links are protected too. An address in a link field whose at sign is written as an HTML entity or an escape is now replaced by a privacy token, and the rest of the link stays unchanged.
- Long links are scanned for encoded addresses in proportion to what they hold. Only the stretch around an encoded at sign is searched, and the MCP grant limit no longer removes a grant it cannot fully retire.
🐛 🐛 Fixes
- Local vault bindings are tighter. A vault binding can only be activated by the account it belongs to, two simultaneous bindings of one key bind neither account, a binding record is only trusted in its encrypted form, and a vault connected at sign-in now sends the same notice as a pending one.
- Disconnecting an MCP client is reliable during a key service outage. If the key service cannot answer, a disconnect or a connection revoke now reports a failure and can be retried, instead of reporting success while the client could still refresh.
- A Google service connection is never a sign-in. Connecting Drive, Calendar or another Google service ignores sign-in markers in the link, so the connection always checks that the person who finishes it is the person who started it.
- Identity fields are checked in linear time. The check for a masked value that was not resolved now costs time in proportion to the field length, so a very long argument no longer slows other requests.
- Audit records name who confirmed a call. A confirmation or choice that the assistant sent itself is recorded as the assistant's, not as a person's answer, the client name in header-mismatch log lines is scrubbed for credentials, and the PII admin page describes the IBAN display and the email name rule.
- Privacy tokens keep counting after a day. When a user's token mapping expires, the next one continues the numbering, so a token an assistant still holds from an earlier session never resolves to a different person.
- Encoded email addresses are protected too. An address written with an encoded at sign (in a link, an HTML body or an escaped string) is now replaced by a privacy token like a plain one, and the rest of the text stays unchanged.
- Vault bindings, revocations and audit labels are tighter still. A vault binding record now names its key and serves nowhere else, a sign-in restores a vault whose record could not be read, a disconnect also ends a grant from a sign-in without a client id, and audit records and logs name who answered a confirmation more exactly.
- The vault resolve endpoint reads only what it accepts. A request body larger than the endpoint accepts is refused without being collected in full first.
- Plus-addressed and other encoded addresses are protected in full. An encoded address whose name holds an encoded plus sign or apostrophe is replaced as a whole, a vault restored at sign-in cannot come back after a revoke, and the asynchronous tool endpoint ignores dispatch-only arguments like the synchronous one.
- Every tool endpoint ignores dispatch-only arguments. The REST tool call and the act-as endpoint now drop arguments that only the gateway itself may set, as the MCP endpoint does.
🐛 🐛 Fixes
- Connecting a single workload follows the same access rules as using it. A connect link that names a workload is now decided on that workload or its owning service, including the operator's blocks and operators-only settings, and never on a sibling workload or a provider alias; an unknown workload is refused.
- A connect started from any of a connector's sign-in addresses completes. Every alias address of a connector now starts the sign-in with the connector's own callback address, so the flow finishes instead of ending with a missing-handler error.
- Connecting a Google service follows the same access rules as using it. A connect through the Google sign-in route now checks that the user may use that service, and a Gmail, Calendar or Drive connect is decided like Google Workspace tools, so a grant for one Google workload no longer starts the consent for another.
- More stored password formats are kept out of AI responses. md5-crypt, Apache apr1 and yescrypt hashes are now recognised and replaced before a tool result reaches the model, like the bcrypt, argon2 and sha-crypt forms already were.
- Automated fixes are checked against the exact starting point they were made from. The self-healing run now refuses to start when it cannot record that starting commit, and its review, focused tests and confidence card all compare against it rather than a branch name the fixing agent could move.
- Plain-text settings explain why they are plain. Bookkeeping and switch families the startup report flagged now declare, next to their writer, that they hold no personal data or secret, and the Context Map settings reader is ready for encrypted settings.
- Prototype branches and history stay with their owner. The gateway now records who creates a prototype branch. Only that owner, or an admin, can delete it, also through discard. A save or finish on a branch you do not own goes to a new branch of your own. Other users' branches and session history are listed to admins only.
📝 🔧 Improvements
- Faster rule-count checks. The check that re-derives each rule's numbers now runs its counts side by side.
🐛 🐛 Fixes
- Test runs inside git hooks stay in their own repositories. The local suite gate now drops the hook's repository-local git variables before it starts any check, so a test it runs that builds a temporary repository can no longer write the developer's index, config or tags.
- Recorded belief counts are checked on the tree that will be merged. A recorded value other than zero now has to declare how it may move, and the count check runs against the merge result rather than the branch tip, so counts moved by two branches at once are caught before the second merge.
- Accurate notes on expired privacy placeholders. The source documentation now states how an expired placeholder is reported: a call that holds an expired key is refused with a re-read instruction.
📝 🔧 Improvements
- Faster checks for branch pushes. The proof replay on a branch now replays only the proofs a change can affect; the nightly run still replays all.
📝 🔧 Improvements
- Personal data in Redis is encrypted at rest. Reports, queued notifications, solved cases and owner records are now stored encrypted, and records stored before are encrypted when the gateway starts.
🐛 🐛 Fixes
- More accurate Redis health summary. Values stored with the sealed format are now always counted as encrypted.
📝 🔧 Improvements
- Stored personal data can be encrypted at rest. The gateway now reads report, notification and owner records in both encrypted and plain form, which prepares encrypting them.
📝 🔧 Improvements
- Faster feedback on rule proofs before a push. The pre-push check now verifies that each rule proof still points at real code when a push touches the code it names.
🐛 🐛 Fixes
- Stored secrets are sealed at startup. A gateway now seals instance secrets that were stored before sealing existed when it starts, instead of waiting for the next read.
🐛 🐛 Fixes
- Rule counts block only when they regress. A recorded debt count that shrinks, or a coverage count that grows, is now reported with the value to record instead of failing the pipeline; a move in the other direction still fails, and invariants are compared exactly.
🐛 🐛 Fixes
- Instance secrets, claims and transfers are encrypted at rest. The instance secret, the first-run setup token, the subscription token, sign-in claims, transfer records and staged uploads are now written encrypted, and existing plaintext values are encrypted on their next read.
🐛 🐛 Fixes
- Every stored key family now carries a declared storage policy. Flags, counters, locks, timestamps and other values that hold no personal data or secret are declared plaintext next to their writers, and families that are already encrypted are declared encrypted.
- Readers understand encrypted instance secrets, claims and transfers. The instance secret, the first-run setup token, the subscription token, sign-in claims, transfer records and staged uploads can now be read in encrypted form; a following release starts writing them encrypted, so no instance of a rolling update meets a value it cannot read.
🐛 🐛 Fixes
- Pending write confirmations are encrypted at rest. A write that waits for a confirmation click is now stored encrypted, including the requester and the operation's parameters.
🐛 🐛 Fixes
- Every Redis key family needs a declared storage policy. The test suite now reads every Redis write in the shipped code and fails on a new key family that has no declared encryption policy, not only on families under the encryption sweep.
- Translated file downloads keep the connection advice. When a Transifex translated file download fails because the connection is expired, refused or briefly unavailable, the download now answers with the same remedy a tool call gives (reconnect or retry), and the gateway logs it as a warning instead of an error.
🐛 🐛 Fixes
- OAuth refresh cool-downs keep the correct remedy. The gateway now replays client, grant, and retry advice without repeated token requests, and a successful reconnect clears stale cool-downs.
- Home Assistant temperature changes for several rooms name the token remedy. When the configured access token is refused, a temperature change for a list of rooms now gives the same answer as a change for one room, with the cause and the next step for the administrator, instead of one line of text per room.
🐛 🐛 Fixes
- Cheap CI failures stop the push before the suite. The pre-push gate now re-derives belief counts reached by the diff, checks reached population tests for vacuous success, and runs the connector catalogue contracts for module changes. It reports the lane's wall time, so these checks fail locally in seconds instead of after a CI round.
🐛 🐛 Fixes
- Figma MCP catalogue stays current. The shipped catalogue now includes code import and the latest upstream descriptions.
- Vault binding records are encrypted at rest. A local-vault binding record is now stored encrypted like the other per-user records, an existing plaintext record is re-encrypted on its next read, and by the startup sweep where KMS encryption is configured, and every vault key carries a declared storage policy.
- Notion MCP catalogue stays current. The shipped catalogue now includes eight calendar tools and the latest upstream descriptions.
- OAuth refresh alerts name the proven remedy. Cooldown keys now declare their Redis policy, and unknown refresh failures no longer claim that reconnection is certainly required.
- Query-only write actions start without false alarms. DNS support-session and contact-note actions now declare that their POST requests need no body.
🐛 🐛 Fixes
- Connector sign-in errors now say whether to retry or who must fix them. When a connector signs in with a service key, a client secret, a signed token, a workload identity or a stored password, an error now tells the caller what to do: retry when the sign-in endpoint does not answer, enter new sign-in data on the connector's own form when the per-user data is missing or refused, or ask the operator when an operator key is missing or refused or a connector definition has an unusable field. The error names that field.
📝 🔧 Improvements
- Updates 8 dependencies. This release carries boto3 1.43.113 → 1.43.114, botocore 1.43.113 → 1.43.114, fastapi 0.143.0 → 0.143.1, hypothesis 6.169.0 → 6.169.1, litellm 1.105.0 → 1.105.1, more-itertools 11.2.0 → 11.2.1, pydantic-settings 2.15.0 → 2.16.0, wrapt 2.5.0 → 2.5.1.
🐛 🐛 Fixes
- Connector sign-in errors name their remedy. When Jenkins, Grafana, Metabase, a multi-instance connector such as WordPress, or a file transfer cannot authenticate, the answer now says what fixes it: retry for a temporary failure, reconnect or re-enter a per-user credential with a direct link to its form, or a fix by the operator for a key the operator configures. A file download no longer asks for a reconnect when a token refresh failed only for a moment.
🐛 🐛 Fixes
- Connectors with per-user sign-in use each person's own credentials. A connector that declares per-user credentials now always acts with the stored credentials of the person who calls it, across stored values, header and query tokens, the admin token field and secret-backed headers. A person who has not connected yet is asked to connect. Connectors that combine an operator token with an optional per-user override keep working as before.
🐛 🐛 Fixes
- Sign-in problems found before an action runs now name the remedy. When a connector action reads the record it is about to change first, and that read fails on the sign-in, the caller now gets the same remedy as from the action itself: retry, reconnect or ask an administrator, with the reconnect link and the scopes the action needs. Slack file downloads through the transfer tool now answer a revoked, expired or rejected Slack token with the reconnect answer of the other Slack actions, and mark a dead connection on the connections page. When the AI connector uses the model library, it now passes on the retry and reconnect advice of a failed credential lookup, for credential types that give such advice.
📝 🔧 Improvements
- Updates 6 dependencies. This release carries boto3 1.43.112 → 1.43.113, botocore 1.43.112 → 1.43.113, more-itertools 11.1.0 → 11.2.0, smart-open 8.0.2 → 8.0.3, starlette 1.7.0 → 1.8.0, truststore 0.10.4 → 0.10.5.
🐛 🐛 Fixes
- Google Workspace actions keep the reconnect and retry advice of their own Google requests. Some actions send their own Google request before the main request or in place of it. When that request fails on the connection, the caller now gets the same message, reconnect link and retry advice as a direct Google request. This applies to a Gmail reply, forward or draft reply, an answer to a calendar invitation, a Drive file move, the suggestions of a Google Doc, the free-slot search and the meeting scheduler, the generic Google API actions for GET, POST, PUT and PATCH, and the Sheets actions that find a tab by its name (delete, copy and rename a tab, delete rows, auto filter, freeze, named range). When an automation grant does not cover such a request, the caller gets the grant refusal with its own remedy.
🐛 🐛 Fixes
- A rejected OAuth client now names the operator, not a reconnect. When a token endpoint rejects the OAuth client of a connector (for example with invalid_client), the tool answer and the connection check on the connections page now say that the operator must fix the client configuration. They no longer offer a reconnect, and the connections page no longer marks the connection as "Reconnect needed". A connector with a dynamically registered client still registers a new client and asks for one reconnect.
🐛 🐛 Fixes
- Google connectors pause a repeated failed sign-in refresh. When a Google sub-service such as Gmail, Drive or Google Ads cannot renew its sign-in, repeated calls in the next minute get the same answer and do not contact the Google sign-in service again. When a renewed token still lacks access to an endpoint, repeated calls get the same permission answer without a new renewal. Each sub-service and each user has its own pause, and a temporary outage of the Google sign-in service still gets a retry answer.
✨ 🚀 Features
- Support sessions can now be started from the CRM connector. A new write action starts a support session on a customer account and returns its temporary password; the existing action ends it.
- The CRM connector reports a customer's remaining free contents. A new read action returns how many free contents are left from a package.
🐛 🐛 Fixes
- Tool icons in the REST tool list point at real files. A tool without a working icon of its own now shows its connector's icon, and a tool without either shows the operator's brand logo when that logo has a URL. Newly imported connectors no longer name an icon file that does not exist.
🐛 🐛 Fixes
- Jira issue creation keeps the connection answer. When create_issue has no project and the project lookup fails on the Jira connection, the caller now gets the same reconnect, retry or administrator advice as any other Jira call, instead of a prompt to select a project. A failed lookup is no longer remembered as an empty project list.
✨ 🚀 Features
- Shared gateway links show the operator's logo. Links to the connections and welcome pages now carry the brand logo as their preview image in Slack, Teams, LinkedIn and other link previews, when the logo is a PNG, JPEG, WebP or GIF file. An SVG logo or an uploaded logo keeps the text-only preview. The Figma tools now carry the Figma icon in the REST tool list.
✨ 🚀 Features
- WebDriver connector for Appium and Selenium sessions. A new connector types into, taps and finds elements of a running WebDriver session on a device grid or a self-hosted Appium or Selenium server. The tester's own client keeps control of the session; the connector acts in it by session id with each user's own grid credentials. Because typing is a write, a value the AI only knows as a placeholder reaches the device as the real value, so the AI does not need to see personal test data in order to type it.
🐛 🐛 Fixes
- Google connectors name their authentication errors. When renewing access to a Google service fails, the answer now says whether to retry (the token service was briefly unavailable) or to reconnect (the access was revoked), instead of passing on Google's raw error, and the connections page marks a revoked connection. A permission refusal and a Google Ads developer-token refusal get named answers too, reconnect links for Drive and Calendar now open the right page, and renewing access no longer pauses other requests.
🐛 🐛 Fixes
- One answer for a connection problem, whatever the cache holds. Jira, Confluence, Pipedrive and Transifex look up the account's site, domain or organisation before the first call. When that lookup meets an expired, temporarily unrenewable or refused connection, the answer is now the same as for any other call, with the same advice to retry, reconnect or ask an administrator, also for file downloads and uploads.
✨ 🚀 Features
- Read actions now search with the real value behind a privacy token. A search, a lookup or a filter the AI sends gets the real customer value on every service, not only on the services with a field list, so it finds the person instead of nothing; the model still never sees the value. A token the gateway can no longer resolve stops the read instead of returning an empty result. Operators who want the previous narrow behaviour set
rehydrate_reads: listed.
✨ 🚀 Features
- A local vault can now link without a new sign-in. A vault that appears after the sign-in waits one day before it can read values, and the user gets a notice and can activate or revoke it on the connections page. Operators turn the feature on with one switch on the data sanitization page, and the protected-resource metadata names the endpoint while it is on.
✨ 🚀 Features
- Write actions now put the real value where a privacy token stands. A ticket, comment, message or page the AI writes gets the real customer value behind each token, so colleagues can read it; the model still never sees it. A token the gateway can no longer resolve, or whose shown part no longer fits its value, stops the write instead of storing a placeholder. Operators who want the previous narrow behaviour set
rehydrate_writes: listed.
✨ 🚀 Features
- Local vaults can fetch the values behind PII keys. A client-side vault that announces itself with a
Client-Vault header at sign-in can fetch the real values behind PII keys from /.well-known/client-vault/mcp, to put them into local files without the model reading them. Off by default; a cluster-wide switch and an allow list control it, each value is audited and capped per day.
🐛 🐛 Fixes
- Slack asks for a reconnect when its token is no longer valid. When Slack rejects the connection's token as revoked, expired or deactivated, the gateway now answers with its standard reconnect notice and marks the connection on the connections page, and the connection check reads Slack's answer instead of its HTTP status. When Slack rejects the authentication for a reason a reconnect may not fix, such as an IP allowlist, the answer says so.
🐛 🐛 Fixes
- Connector auth errors keep their advice. When a connected service answers with an authentication or permission error, the answer now keeps the gateway's advice fields — whether to retry, whether a reconnect helps, which scopes are missing — instead of only the error name and message.
📝 🔧 Improvements
- Updates 5 dependencies. This release carries ast-serialize 0.12.1 → 0.13.0, boto3 1.43.111 → 1.43.112, botocore 1.43.111 → 1.43.112, google-auth 2.61.0 → 2.62.0, pypdf 6.20.0 → 6.20.1.
🐛 🐛 Fixes
- Clearer answers when a connected MCP service needs a new token. When renewing access to a proxied MCP service fails only briefly, the gateway now says to retry the call instead of asking the user to reconnect. When the service also rejects the renewed token, the gateway now says that a retry will not help and points to the account's permissions or a reconnect, instead of passing on a bare internal error.
🐛 🐛 Fixes
- Self-registered OAuth clients recover when the provider forgets them. For services where the gateway registers its own OAuth client, a provider that rejects that client at its token endpoint now makes the gateway drop the stored registration, so the next connect registers a fresh client instead of failing until the registration expires. A provider that keeps rejecting clients gets at most one new registration per ten minutes. A registration that another gateway process already renewed is kept, and an operator-configured client is never changed.
🐛 🐛 Fixes
- A repeated connect redirect no longer reports a successful connection as an expired link. When the browser delivers a service's sign-in redirect twice, the second request now lands on the connections page, which shows the service as connected, instead of the expired-link message. Only the user who completed the connection gets that answer; a repeat of a failed or unknown connection still asks the user to start again, and each link still works only once. A connection whose tokens could not be saved is now reported as failed instead of connected.
✨ 🚀 Features
- LambdaTest (TestMu AI) connector. Adds a built-in connector for the hosted LambdaTest MCP server. Each user connects with their own LambdaTest account through OAuth; the gateway registers its own client, so no app or credentials need to be set up first. Read tools (test runs, sessions, logs, videos, Test Manager, SmartUI, analytics) and write tools are offered separately; accessibility scans, which start a new billable run, are offered as write tools. Tools that delete, stop or update builds, sessions or apps fall under the destructive-action policy, so an operator who turns that policy on holds them for approval.
🐛 🐛 Fixes
- Log lines carry no personal data. Every line the gateway writes to its log output now passes a filter. The filter replaces email addresses, IBANs, card numbers and token shapes with stable pseudonyms, so logs can still be correlated without holding the values. IDs and IP addresses stay as they are.
🐛 🐛 Fixes
- Notion uploads no longer log a false credential warning. An upload that resolves its credential through the general resolver no longer logs an unknown-service warning first.