[release] Release Highlights: v0.3.1

[github-actions]

🌟 Release Highlights

This release focuses on security hardening, observability improvements, and significant internal code quality work that strengthens the foundation of MCP Gateway.

✨ What's New

• mTLS & HMAC Request Signing (ASI-07: Add mTLS and HMAC request signing for agent↔gateway communication #4679): Agent↔gateway communication is now secured with mutual TLS and HMAC request signing, significantly hardening the trust boundary between components.
• OTel/OTLP/Sentry Smoke Testing (feat: add smoke-otel-tracing workflow for OTel/OTLP/Sentry validation #4626): A new smoke-otel-tracing workflow validates OpenTelemetry, OTLP export, and Sentry integration on every release, ensuring tracing pipelines stay healthy.
• Long-Session Robustness Validation (Add smoke-long-session workflow to validate MCPG timeout robustness #4512): A new smoke workflow validates MCPG timeout robustness under extended sessions, improving confidence in production deployments.
• DIFC Audit Improvements (fix(integrity-filtering-audit): allow Azure Blob Storage, surface DIFC counts in summary, classify rate-limit failures #4696): Azure Blob Storage is now allowed through integrity filtering, DIFC decision counts are surfaced in audit summaries, and rate-limit failures are properly classified — giving operators clearer visibility into policy enforcement.

🐛 Bug Fixes & Improvements

• Guard (wazero) Fixes (fix(guard): wazero improvements — shutdown cache cleanup, operational log routing, ReadUint32Le #4700): Wasm guard shutdown now correctly cleans up the runtime cache, operational log routing is fixed, and ReadUint32Le is corrected — improving reliability of WASM-based policy enforcement.
• Duplicate Log Cleanup ([Repo Assist] fix(mcp): remove duplicate debug log statements in HTTP transport #4592, Remove duplicate "Attempting transport" log messages from connection.go #4605, Fix duplicate HTTP request/response log statements between sendHTTPRequest and executeHTTPRequest #4606): Removed duplicate debug log statements across HTTP transport and MCP connection layers, reducing log noise in production.
• Circuit Breaker & Guard Debug Logging ([log] Add debug logging to circuit breaker #4582, [log] Add debug logging to guard/guard.go #4639): Debug logging added to circuit breaker and guard components, making it easier to diagnose connectivity and policy issues with DEBUG=*.

⚡ Performance

• Rust Guard Heap Optimization ([Repo Assist] perf(rust-guard): eliminate heap allocs in extract_items_array and policy_scope_token #4654): Eliminated heap allocations in extract_items_array and policy_scope_token within the Rust guard, improving per-request performance in guard-enabled deployments.

📚 Documentation

• AGENTS.md, config.example.toml & CONTRIBUTING.md Reconciled (docs: reconcile AGENTS.md, config.example.toml, and CONTRIBUTING.md with implementation #4638): Developer-facing documentation has been updated to accurately reflect the current implementation — reducing onboarding friction.
• See the Environment Variables Reference, Configuration Guide, and Guard Response Labeling for updated details.

🔧 Internal Quality

This release includes extensive refactoring to improve maintainability: DIFC initialization deduplication, config loading cleanup, oversized file splits by responsibility, and a loggerFactory[T] abstraction for consistent logger setup. Automated test coverage was expanded across DIFC, proxy GraphQL functions, circuit breakers, and Docker system utilities.

🐳 Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.3.1
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

---

For complete details, see the full release notes.

Generated by Release · ● 106K · ◷