diff --git a/content/docs/kubernetes/main/reference/release-notes.md b/content/docs/kubernetes/main/reference/release-notes.md index bf61ed2a9..b9859bea2 100644 --- a/content/docs/kubernetes/main/reference/release-notes.md +++ b/content/docs/kubernetes/main/reference/release-notes.md @@ -11,146 +11,174 @@ Review the release notes for agentgateway. For more details, check out the [release blog](https://agentgateway.dev/blog/2026-06-17-agentgateway-v1.3.0/), or review the [GitHub release notes in the agentgateway repository](https://github.com/agentgateway/agentgateway/releases). {{< /callout >}} -## 🔥 Breaking changes {#v13-breaking-changes} +## 🔥 Breaking changes {#v14-breaking-changes} -### `agctl` commands reorganized under `proxy` and `controller` +### Gateway API v1.6 and TCPRoute v1 -The experimental `agctl` CLI now groups its inspection and management commands under the `proxy` and `controller` parent commands, and adds new commands for log-level management and version information. Update any scripts or automation that call the previous top-level commands. + + -Before: +Agentgateway now builds against Gateway API v1.6, and the controller uses the `v1` version of `TCPRoute` instead of `v1alpha2`. Re-apply the Gateway API CRDs that match this release before you upgrade, and update any automation that references `TCPRoute` by its `v1alpha2` version. -```sh -agctl config all gateway/agentgateway-proxy -n agentgateway-system -o yaml -agctl config backends gateway/agentgateway-proxy -n agentgateway-system -agctl trace gateway/agentgateway-proxy -n agentgateway-system --port 80 -- http://www.example.com/ -``` +### Backend TLS `insecureSkipVerify` is now an enum -Now: + -```sh -agctl proxy config all gateway/agentgateway-proxy -n agentgateway-system -o yaml -agctl proxy config backends gateway/agentgateway-proxy -n agentgateway-system -agctl proxy trace gateway/agentgateway-proxy -n agentgateway-system --port 80 -- http://www.example.com/ -``` +The `insecureSkipVerify` field on backend TLS policies changed from a boolean to an enum. Replace `insecureSkipVerify: true` with `insecureSkipVerify: All` to skip all verification, or `insecureSkipVerify: Hostname` to skip only hostname verification. -The reorganization also introduces the following new capabilities: +### MCP request-phase guardrail rejections return HTTP 200 -- `agctl proxy log` gets or sets the proxy log level at runtime. For more information, see [Debug your setup]({{< link-hextra path="/operations/debug/#debug-logs" >}}). -- `agctl controller log` gets or sets the agentgateway controller log level per component at runtime. For more information, see [Debug your setup]({{< link-hextra path="/operations/debug/#debug-logs" >}}). -- `agctl version` prints version information for the `agctl` CLI. + -For more information, see [Install `agctl`]({{< link-hextra path="/operations/agctl/" >}}), [Inspect agentgateway configuration]({{< link-hextra path="/operations/inspect-config/" >}}), [Trace requests with `agctl`]({{< link-hextra path="/operations/trace-requests/" >}}), and the [`agctl` CLI reference]({{< link-hextra path="/reference/agctl/" >}}). +When an MCP guardrail rejects a request during the request phase, agentgateway now returns the rejection as an HTTP 200 with a JSON-RPC error body, matching the existing response-phase behavior. Update any clients or tests that expected a non-200 status for request-phase rejections. -## 🌟 New features {#v13-new-features} +### `auth.location` no longer nests `expression` -### New UI + -A refreshed UI exposes the new LLM capabilities through LLM, MCP, and traffic-native views, aligned with the new model-based routing model. Configure providers, models, costs, and guardrails and inspect MCP and traffic configuration from one place. +The `auth.location` configuration no longer uses a double-nested `expression` field. Update any policies that set a custom token location to use the flattened form. -### ExtMCP: MCP-aware external auth and processing +### musl container images removed - + -External authorization and external processing integrations can now make decisions using MCP request context, such as the tool being called and its arguments, rather than only generic HTTP metadata. This change makes it possible to enforce fine-grained, MCP-aware policy in an external service. For more information, see the [MCP guardrail docs]({{< link-hextra path="/mcp/guardrails/">}}). +The `musl`-based container image variants are no longer published. Switch to the standard (glibc) images. -### External processing enhancements +## 🌟 New features {#v14-new-features} - - - +### MCP protocol 2026-07-28 support -- **Per-phase processing modes**: Control whether headers, body, and trailers are sent to the ext_proc server for each phase, choose how the body is delivered (none, buffered, partially buffered, or full-duplex streamed), and optionally allow the ext_proc server to override the mode. -- **`ImmediateResponse` from body phases**: An ext_proc server can now return an `ImmediateResponse` from the request body and response body phases and have it returned to the client. + + + + + + + + + -### Request buffering +Agentgateway adds support for the upcoming [MCP `2026-07-28` protocol version](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/). - +- **Stateful and stateless servers**: Agentgateway supports both stateful and stateless MCP servers, including closing the [SEP-2575](https://github.com/modelcontextprotocol/modelcontextprotocol) server-stateless conformance gap and skipping the synthetic `initialize` handshake for modern requests. +- **Trace context propagation**: Distributed trace context propagates through the MCP `_meta` field ([SEP-414](https://github.com/modelcontextprotocol/modelcontextprotocol)). +- **MCP Apps**: Basic support for MCP Apps, including multiplexing fixes for app-originated tool calls. +- **Capability and multiplexing improvements**: Preserved multi-resource tool result (MRTR) capabilities for modern clients, multi-target subscriptions and listen, and opaque resource URI multiplexing. -A new buffering policy can accumulate request and response bodies in memory before forwarding, with configurable size limits. This change enables policies and extensions that need full request-body access before backend selection or dispatch. For more information, see [Body buffering]({{< link-hextra path="/traffic-management/buffer/" >}}). +Because the MCP `2026-07-28` support is new in this release, most of it is not yet covered by a dedicated guide. For the fields available today, see the [API reference]({{< link-hextra path="/reference/api/" >}}). -### Dynamic SSL certificates +### Cross App Access (XAA) for MCP - + + + -Dynamic SSL certificate support was added for listener TLS, improving certificate handling for deployments where serving certificates are supplied or rotated dynamically. +Agentgateway supports MCP [Enterprise-Managed Authorization](https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization) through the OAuth Identity Assertion Authorization Grant (ID-JAG), also known as Cross App Access (XAA). An enterprise identity provider can broker access between a client application and the MCP server without the end user completing a separate OAuth flow for each downstream app. For more information, see [Cross App Access (ID-JAG)]({{< link-hextra path="/security/backend-authn-cross-app-access/" >}}). -### LLM gateway enhancements +### OAuth token exchange backend authentication - - - - - + + + + + + -- **Rerank support**: Added rerank request and response support. -- **Custom LLM providers for InferencePool**: InferencePool backends can now use custom LLM providers. -- **AI backend policy composition**: Multiple AI backend policies can be composed on the same backend. -- **Per-model routing precision**: Model matching now prefers more exact matches, and the model can be detected from the request path when not set. -- **Per-model authorization**: LLM authorization can be configured per model, and `/v1/models` listings are gated by authorization. -- **Bedrock**: Detect-passthrough support, Application Inference Profile prompt-cache support, Anthropic beta header allowlisting, host override, URL-encoded model IDs, and reasoning-signature replay. -- **Anthropic**: Support for system messages and extra-high thinking. -- **Telemetry attributes**: LLM requests now expose latency and throughput attributes. +Agentgateway can exchange an incoming token for a backend credential by using [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693) OAuth 2.0 token exchange and the [RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523) JWT bearer grant. This release adds controller support, custom token types and OAuth 2.1 exchange defaults, the ability to inject multiple secret-sourced headers, and an override for the resolved secret key. For more information, see [OAuth token exchange]({{< link-hextra path="/security/backend-authn-oauth/" >}}). -### MCP improvements +### Microsoft Entra ID as an MCP authentication provider - - + -- Added Okta as a first-class MCP authentication provider. -- Added resource subscribe and unsubscribe support, and improved resource multiplexing. -- Advertised prompt, resource, and tool list-change capabilities. -- Added explicit service selector target names for MCP backends. +Agentgateway includes a native `Entra` MCP authentication provider that bridges the OAuth behaviors that Microsoft Entra ID (Azure AD) implements differently from the MCP authorization specification, such as serving RFC 8414 metadata from Entra's OIDC discovery document, stripping the RFC 8707 `resource` parameter, and short-circuiting Dynamic Client Registration with your pre-registered application ID. For more information, see [Set up Microsoft Entra ID]({{< link-hextra path="/mcp/auth/entra/" >}}). -### Authorization and authentication +### Virtual keys from ConfigMaps and hashed keys - - - - + + -- Authorization can now run in the pre-routing phase, including CORS. -- External auth now supports caching, with a configurable cache key and a TTL that can be a duration or a CEL expression. -- External auth derives scheme from `X-Forwarded-Proto` and preserves invalid header values. -- Webhook guardrails support `failureMode` for fail-open or fail-closed behavior. +Virtual keys can now be sourced from a `ConfigMap` in addition to a `Secret`, and API keys can be stored as SHA-256 hashes so that raw key material never needs to live in the cluster. For more information, see [Virtual keys]({{< link-hextra path="/llm/cost-controls/virtual-keys/" >}}). -### Backend references, TLS, and policy attachment +### CEL enhancements - - - - + + + + + + -- Generalized backend references and added a `BackendReferenceGrantMode` setting to control reference-grant enforcement. -- Generalized and cleaned up backend TLS policy handling, including multi-gateway backend mTLS and config-dump visibility. -- Added policy inheritance strategy configuration. +- **Custom CEL functions**: Register custom CEL functions for use in policies. +- **CEL filters for telemetry**: An opt-in CEL filter selects which requests emit OpenTelemetry spans, exposed in Kubernetes, and CEL filters decouple OTLP log fields and filtering from stdout logging. +- **New CEL context and functions**: Access inbound `CONNECT` request headers through `source.connectHeaders`, and use a CEL replace mode for header transformations. -### CEL enhancements +For the full CEL surface, see the [CEL reference]({{< link-hextra path="/reference/cel/" >}}). + +### Fault injection: request delay + + + +A new `delay` traffic policy injects latency before a request is forwarded to the backend, for fault-injection and chaos testing. The `delay.duration` field accepts a duration string or a CEL expression that returns a duration (or a number interpreted as milliseconds), so you can inject latency conditionally, for example on a percentage of requests. Injected delay counts against the request timeout. For more information, see [Fault injection]({{< link-hextra path="/resiliency/fault-injection/" >}}). - +### AWS assume-role session tags and session name -- Added route metadata to the CEL context and gRPC status to the response context. -- Added raw JWT bearer token access via `jwt.rawToken`. -- Added URL encode/decode functions, timestamp conversion helpers, and bit operations on bytes. -- Added support for CEL expressions in direct responses and retry conditions, and mTLS certificate passthrough via CEL. + + + -### Traffic, TLS, and networking +AWS `assumeRole` backend authentication supports STS session tags and a configurable `RoleSessionName`. Both the session name (`sessionNameExpression`) and per-tag values (`tags[].expression`) can be set from CEL expressions that are evaluated per request, so you can propagate identity attributes such as `jwt.sub` into the assumed AWS session. For the available fields, see the [API reference]({{< link-hextra path="/reference/api/" >}}). - - +### Guardrail enhancements -- Added support for terminating inbound `CONNECT` requests. -- Added service route port filtering and HTTP/1 header-case preservation. -- Added case-insensitive WebSocket upgrade tokens. -- Added configurable admin interfaces, including disablement and Unix Domain Socket support. -- Added AWS AssumeRole support, custom AWS service names, and request-signing allowlists. -- Added custom `secretRef` group and kind options, and waypoint endpoint resolution for ingress-use-waypoint. -- Updated to Gateway API v1.6.0-rc.1. + + + + -### Operations and observability +- **Backend connection policy for callouts**: A `BackendConnectionPolicy` controls the TCP, TLS, HTTP, and tunnel settings agentgateway uses when it calls out to a guardrail service, and is available on the OpenAI moderation, Bedrock guardrails, and Google Model Armor policies. +- **Default callout timeouts**: Guardrail callouts now apply a default timeout. +- **Improved logs and UI**: Guardrail decisions surface more clearly in logs and the UI. +- **`failureMode` for external processing**: External processing (`extProc`) supports a `failureMode` for fail-open or fail-closed behavior. - - +For more information, see the [LLM guardrails]({{< link-hextra path="/llm/guardrails/" >}}) and [MCP guardrails]({{< link-hextra path="/mcp/guardrails/" >}}) docs. + +### External processing enhancements + + + + +The controller supports `metadataContext`, `requestAttributes`, and `responseAttributes` for external processing, and `extProc` exposes a `failureMode`. For more information, see [External processing]({{< link-hextra path="/traffic-management/extproc/" >}}). + +### LLM gateway enhancements -- Added proxy timing measurements and a configuration synchronization metric. -- Added request and connection IDs for troubleshooting. -- Improved distributed trace output, including JSON mode, raw-output file opening, body snapshots, effective gateway and route policies, and CEL expression registration. + + + + + + + + + +- **Frontend TLS with multiple CAs**: Client certificate validation can trust multiple CAs. +- **Bedrock**: Added Responses-to-Bedrock image translation, sanitized tool names that exceed the 64-character Converse limit, and propagated cache-write tokens to the access log. +- **Gemini**: Fixed embeddings handling and `generateContent` model and usage extraction in detect mode. +- **A2A v1.0**: Support for the A2A v1.0 agent card format in URL rewriting. +- **Azure AI Foundry**: Support for Anthropic endpoints on Foundry. + +For the list of supported providers, see the [LLM providers]({{< link-hextra path="/llm/providers/" >}}) docs. + +### Deployment and operations + + + + + + + + +- **DaemonSet workloads**: Deploy the data plane as a `DaemonSet`. +- **Sidecars in control plane pods**: A Helm `extraContainers` value runs sidecar containers in control plane pods. +- **Metrics scraping**: Scrape proxy metrics with a `PodMonitor`, and a new `agentgateway_controller_build_info` metric reports controller build details. +- **XDS resource versioning**: XDS resources are now versioned. +- **Security hardening**: Fixed timing attacks in authentication and added an admin IP allowlist. diff --git a/content/docs/standalone/main/reference/release-notes.md b/content/docs/standalone/main/reference/release-notes.md index a764944bd..787417001 100644 --- a/content/docs/standalone/main/reference/release-notes.md +++ b/content/docs/standalone/main/reference/release-notes.md @@ -11,128 +11,170 @@ Review the release notes for agentgateway standalone. For more details, check out the [release blog](https://agentgateway.dev/blog/2026-06-17-agentgateway-v1.3.0/), or review the [GitHub release notes in the agentgateway repository](https://github.com/agentgateway/agentgateway/releases). {{< /callout >}} -## 🔥 Breaking changes {#v13-breaking-changes} +## 🔥 Breaking changes {#v14-breaking-changes} -### `agctl` commands reorganized under `proxy` and `controller` +### Backend TLS `insecureSkipVerify` is now an enum -The experimental `agctl` CLI now groups its inspection and tracing commands under the `proxy` parent command, and adds new commands for log-level management and version information. Update any scripts or automation that call the previous top-level commands. + -Before: +The `insecureSkipVerify` field on backend TLS configuration changed from a boolean to an enum. Replace `insecureSkipVerify: true` with `insecureSkipVerify: All` to skip all verification, or `insecureSkipVerify: Hostname` to skip only hostname verification. -```sh -agctl config all --file /tmp/agw-dump.json -o yaml -agctl trace --local --port 3000 -- http://example.com/headers -``` +### MCP request-phase guardrail rejections return HTTP 200 -Now: + -```sh -agctl proxy config all --file /tmp/agw-dump.json -o yaml -agctl proxy trace --local --port 3000 -- http://example.com/headers -``` +When an MCP guardrail rejects a request during the request phase, agentgateway now returns the rejection as an HTTP 200 with a JSON-RPC error body, matching the existing response-phase behavior. Update any clients or tests that expected a non-200 status for request-phase rejections. -The reorganization also introduces the following new capabilities: +### `auth.location` no longer nests `expression` -- `agctl version` prints version information for the `agctl` CLI. -- `agctl proxy log` and `agctl controller log` get or set log levels at runtime for agentgateway running in Kubernetes. + -For more information, see [Install `agctl`]({{< link-hextra path="/operations/agctl/" >}}), [Inspect agentgateway configuration]({{< link-hextra path="/operations/inspect-config/" >}}), [Trace requests with `agctl`]({{< link-hextra path="/operations/trace-requests/" >}}), and the [`agctl` CLI reference]({{< link-hextra path="/reference/agctl/" >}}). +The `auth.location` configuration no longer uses a double-nested `expression` field. Update any policies that set a custom token location to use the flattened form. -## 🌟 New features {#v13-new-features} +### musl container images removed -### New UI + -A refreshed UI exposes the new LLM capabilities through LLM, MCP, and traffic-native views, aligned with the new model-based routing model. Configure providers, models, costs, and guardrails and inspect MCP and traffic configuration from one place. +The `musl`-based container image variants are no longer published. Switch to the standard (glibc) images. -### Standalone LLM enhancements +## 🌟 New features {#v14-new-features} -This release brings a large set of improvements to the standalone LLM experience, expanding first-class support for model-based routing, where a single endpoint such as `/v1/chat/completions` is exposed and the model is specified in the request body. +### New `gateways` configuration model - - - - - - - - - - + + + + -- **Virtual models**: Define a public model name that routes to one or more concrete models using weighted, failover, or conditional (CEL-based) routing, and mark concrete models as `public` or `internal`. -- **Shared providers**: Define a named provider once with shared defaults and reference it from multiple models, with per-model overrides. -- **Model-cost catalog**: Supply a model-cost catalog so the gateway computes real per-request cost, surfaced through CEL, logs, traces, and metrics. Catalogs load from files or inline, and `agctl costs import` can generate one. -- **13 new first-class providers**: Mistral, Hugging Face, Cohere, Groq, Fireworks, DeepSeek, xAI, Together AI, OpenRouter, Cerebras, DeepInfra, Baseten, and Ollama can be selected by name with sensible defaults, and `baseUrl` replaces the older host and path override fields. For more information, see the [LLM providers section]({{< link-hextra path="/llm/providers/" >}}). -- **Custom provider**: Access providers without built-in support directly, rather than approximating them with the `OpenAI` provider and a custom `base_url`. A `providerOverride` tags a custom backend with a known provider name so cost and telemetry attribute correctly. -- **Serve LLM over TLS**: The standalone LLM listener can now serve HTTPS directly. -- **CORS for the local LLM listener**: Configure CORS on the LLM listener, including correct handling of non-matching requests and 404s. -- **Share a port for MCP and LLM**: Serve MCP and LLM traffic on a single shared listener port. +Standalone configuration gains a new top-level `gateways` concept that unifies the UI, LLM, MCP, and routes so that they can share a single listener and port. `gateways` supersedes `binds`; existing `binds` configuration continues to work, and the UI offers a one-click migration from `binds` to `gateways`. This release also adds simpler host and TLS configuration, the ability to serve LLM and MCP traffic on the same port, and an internal bind mode with wildcard fallback. For the full configuration surface, see the [Configuration reference]({{< link-hextra path="/reference/configuration/" >}}). -### Guardrails +### MCP protocol 2026-07-28 support - - - + + + + + + + + + -- **Shared guardrails**: Define guardrails as a shared top-level resource that applies to all models, merged with per-model guardrails. -- **Streaming guardrails**: Optionally run guardrails on streaming (SSE) and realtime responses. -- **Webhook `failureMode`**: Webhook guardrails support fail-open or fail-closed behavior. +Agentgateway adds support for the upcoming [MCP `2026-07-28` protocol version](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/). -### ExtMCP: MCP-aware external auth and processing +- **Stateful and stateless servers**: Agentgateway supports both stateful and stateless MCP servers, including closing the [SEP-2575](https://github.com/modelcontextprotocol/modelcontextprotocol) server-stateless conformance gap and skipping the synthetic `initialize` handshake for modern requests. +- **Trace context propagation**: Distributed trace context propagates through the MCP `_meta` field ([SEP-414](https://github.com/modelcontextprotocol/modelcontextprotocol)). +- **MCP Apps**: Basic support for MCP Apps, including multiplexing fixes for app-originated tool calls. +- **Capability and multiplexing improvements**: Preserved multi-resource tool result (MRTR) capabilities for modern clients, multi-target subscriptions and listen, and opaque resource URI multiplexing. - +Because the MCP `2026-07-28` support is new in this release, most of it is not yet covered by a dedicated guide. For the fields available today, see the [Configuration reference]({{< link-hextra path="/reference/configuration/" >}}). -External authorization and external processing integrations can now make decisions using MCP request context, such as the tool being called and its arguments, rather than only generic HTTP metadata. For more information, see the [MCP guardrail docs]({{< link-hextra path="/mcp/guardrails/">}}). +### Cross App Access (XAA) for MCP -### External processing enhancements - - - - + + -- **Per-phase processing modes**: Control whether headers, body, and trailers are sent to the ext_proc server for each phase, choose how the body is delivered, and optionally allow the ext_proc server to override the mode. -- **`ImmediateResponse` from body phases**: An ext_proc server can now return an `ImmediateResponse` from the request body and response body phases and have it returned to the client. +Agentgateway supports MCP [Enterprise-Managed Authorization](https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization) through the OAuth Identity Assertion Authorization Grant (ID-JAG), also known as Cross App Access (XAA). An enterprise identity provider can broker access between a client application and the MCP server without the end user completing a separate OAuth flow for each downstream app. For more information, see [Cross App Access]({{< link-hextra path="/configuration/security/backend-authn/cross-app-access/" >}}). -### Request buffering +### OAuth token exchange backend authentication - + + + + + -A new buffering policy can accumulate request and response bodies in memory before forwarding, with configurable size limits. For more information, see [Body buffering]({{< link-hextra path="/configuration/traffic-management/buffer/" >}}). +Agentgateway can exchange an incoming token for a backend credential by using [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693) OAuth 2.0 token exchange and the [RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523) JWT bearer grant. This release adds custom token types and OAuth 2.1 exchange defaults, the ability to inject multiple secret-sourced headers, and an override for the resolved secret key. For more information, see [OAuth token exchange]({{< link-hextra path="/configuration/security/backend-authn/oauth-token-exchange/" >}}). -### Authentication and authorization +### New MCP authentication providers - - - - + + + -- **Per-model authorization**: LLM authorization can be configured per model, and `/v1/models` listings are gated by authorization. -- **API key permissive mode**: A new permissive API key mode never rejects requests; valid keys add claims while missing or invalid keys pass through. -- **Pre-routing authorization**: Authorization, including CORS, can run in the pre-routing phase. -- **External auth caching**: External auth supports caching, with a configurable cache key and a TTL that can be a duration or a CEL expression. +Agentgateway adds native MCP authentication providers for **Microsoft Entra ID**, **Descope**, and **authentik**. The `entra` provider bridges the OAuth behaviors that Entra implements differently from the MCP authorization specification, including serving RFC 8414 metadata from Entra's OIDC discovery document, stripping the RFC 8707 `resource` parameter, and short-circuiting Dynamic Client Registration. For more information, see [MCP authentication]({{< link-hextra path="/mcp/mcp-authn/" >}}) and the [Microsoft Entra ID integration guide]({{< link-hextra path="/integrations/auth/entra/" >}}). -### MCP improvements +### Virtual keys from ConfigMaps and hashed keys - - + + -- Added Okta as a first-class MCP authentication provider. -- Added resource subscribe and unsubscribe support, and improved resource multiplexing. -- Advertised prompt, resource, and tool list-change capabilities. +Virtual keys can now be sourced from a `ConfigMap` in addition to a `Secret`, and API keys can be stored as SHA-256 hashes so that raw key material never needs to be stored in plain text. For more information, see [Virtual key management]({{< link-hextra path="/llm/cost-controls/virtual-keys/" >}}). ### CEL enhancements - + + + + + + +- **Custom CEL functions**: Register custom CEL functions for use in policies. +- **CEL filters for telemetry**: An opt-in CEL filter selects which requests emit OpenTelemetry spans, and CEL filters decouple OTLP log fields and filtering from stdout logging. +- **New CEL context and functions**: Access inbound `CONNECT` request headers through `source.connectHeaders`, and use a CEL replace mode for header transformations. + +For the full CEL surface, see the [CEL reference]({{< link-hextra path="/reference/cel/" >}}). + +### Fault injection: request delay + + + +A new `delay` traffic policy injects latency before a request is forwarded to the backend, for fault-injection and chaos testing. The `policies.delay.duration` field accepts a duration string or a CEL expression that returns a duration (or a number interpreted as milliseconds), so you can inject latency conditionally, for example on a percentage of requests. Injected delay counts against the request timeout. For more information, see [Fault injection]({{< link-hextra path="/configuration/resiliency/fault-injection/" >}}). + +### AWS assume-role session tags and session name + + + + + +AWS `assumeRole` backend authentication supports STS session tags and a configurable `RoleSessionName`. Both the session name (`sessionNameExpression`) and per-tag values (`tags[].expression`) can be set from CEL expressions that are evaluated per request, so you can propagate identity attributes such as `jwt.sub` into the assumed AWS session. For more information, see [Backend authentication]({{< link-hextra path="/configuration/security/backend-authn/" >}}). + +### Guardrail enhancements + + + + + +- **Default callout timeouts**: Guardrail callouts now apply a default timeout. +- **Improved logs and UI**: Guardrail decisions surface more clearly in logs and the UI. +- **`failureMode` for external processing**: External processing (`extProc`) supports a `failureMode` for fail-open or fail-closed behavior. + +For more information, see the [prompt guards]({{< link-hextra path="/llm/prompt-guards/" >}}) and [MCP guardrails]({{< link-hextra path="/mcp/guardrails/" >}}) docs. + +### External processing enhancements + + + +External processing (`extProc`) supports a `failureMode` for fail-open or fail-closed behavior. For more information, see [External processing]({{< link-hextra path="/configuration/traffic-management/extproc/" >}}). + +### LLM gateway enhancements + + + + + + + + + +- **Bedrock**: Added Responses-to-Bedrock image translation, sanitized tool names that exceed the 64-character Converse limit, and propagated cache-write tokens to the access log. +- **Gemini**: Fixed embeddings handling and `generateContent` model and usage extraction in detect mode. +- **A2A v1.0**: Support for the A2A v1.0 agent card format in URL rewriting. +- **Azure AI Foundry**: Support for Anthropic endpoints on Foundry. -- Added route metadata to the CEL context and gRPC status to the response context. -- Added raw JWT bearer token access via `jwt.rawToken`. -- Added URL encode/decode functions, timestamp conversion helpers, and bit operations on bytes. -- Added support for CEL expressions in direct responses and retry conditions. +For the list of supported providers, see the [LLM providers]({{< link-hextra path="/llm/providers/" >}}) docs. -### Operations and observability +### Operations and packaging - - + + + + + + + -- Added proxy timing measurements, a configuration synchronization metric, and request and connection IDs for troubleshooting. -- Improved distributed trace output, including JSON mode, body snapshots, and effective gateway and route policies. +- **Standalone Helm chart**: A new `agentgateway-standalone` Helm chart deploys standalone agentgateway, with support for a metrics service and `ServiceMonitor`. +- **Database logging**: Standalone logging writes both successes and errors to the SQL database, with optimized write performance. +- **Bundled certificates**: Support for bundled CA certificates. +- **Security hardening**: Fixed timing attacks in authentication and added an admin IP allowlist.