Download Latest Version agctl-windows-amd64.exe (33.1 MB)
Email in envelope

Get an email when there's a new version of agentgateway

Home / v1.4.0
Name Modified Size InfoDownloads / Week
Parent folder
agctl-darwin-arm64 2026-07-27 31.4 MB
0
agctl-darwin-arm64.sha256 2026-07-27 85 Bytes
0
agctl-linux-amd64 2026-07-27 32.4 MB
0
agctl-linux-amd64.sha256 2026-07-27 84 Bytes
0
agctl-linux-arm64 2026-07-27 30.3 MB
0
agctl-linux-arm64.sha256 2026-07-27 84 Bytes
0
agctl-windows-amd64.exe 2026-07-27 33.1 MB
0
agctl-windows-amd64.exe.sha256 2026-07-27 90 Bytes
0
agentgateway-darwin-arm64 2026-07-27 82.5 MB
0
agentgateway-darwin-arm64.sha256 2026-07-27 100 Bytes
0
agentgateway-linux-amd64 2026-07-27 86.8 MB
0
agentgateway-linux-amd64.sha256 2026-07-27 99 Bytes
0
agentgateway-linux-arm64 2026-07-27 80.9 MB
0
agentgateway-linux-arm64.sha256 2026-07-27 99 Bytes
0
agentgateway-windows-amd64.exe 2026-07-27 94.5 MB
0
agentgateway-windows-amd64.exe.sha256 2026-07-27 105 Bytes
0
README.md 2026-07-27 49.1 kB
0
v1.4.0 source code.tar.gz 2026-07-27 6.3 MB
0
v1.4.0 source code.zip 2026-07-27 7.6 MB
0
Totals: 19 Items   485.9 MB 0

🎉 Welcome to the 1.4.0 release of the agentgateway project!

This release brings a number of highlight features.

First, we have full support for the new MCP 2026-07-28 protocol, which we have been working with the MCP community to develop over the past year. Additionally, Enterprise-Managed Authorization (also known as Cross App Access) for MCP has been added, enabling centralized access control for MCP servers. Along the same authentication line, a flexible and feature-rich OAuth token exchange backend authentication mode has been added, enabling a number of security authentication strategies.

The standalone mode has a number of enhancements: configuration created in the UI can now be stored in the database (sqlite for local usage, postgres for remote or HA setups), avoiding the need for a persistent disk. A new gateways configuration replaces the low-level binds API and enables serving LLM, MCP, generic routes, and the UI on the same port; additionally, this enables authentication (such as OIDC) for the UI. A new agentgateway-standalone Helm chart is available for deploying standalone agentgateway in Kubernetes.

The Kubernetes deployment has a new (off by default) experimental AgentgatewayModel API, bringing the standalone LLM experience to Kubernetes. AgentgatewayModel allows serving a number of LLM models under the same gateway, routed based on the model name in the request. This offers a higher level API than AgentgatewayBackend, simplifying the common configuration cases; the existing API remains available.

The release also includes Gateway API v1.6 support, fault injection, richer guardrails, and many other enhancements and bug fixes.

Artifacts

Docker images are available:

  • cr.agentgateway.dev/agentgateway:v1.4.0
  • cr.agentgateway.dev/controller:v1.4.0

Helm charts are available:

  • cr.agentgateway.dev/charts/agentgateway:v1.4.0
  • cr.agentgateway.dev/charts/agentgateway-crds:v1.4.0
  • cr.agentgateway.dev/charts/agentgateway-standalone:v1.4.0

Binaries are available below.

Quick Start

Follow the Kubernetes or Standalone quick start guide to get started.

🔥 Breaking changes

Gateway API v1.6 and TCPRoute v1

Agentgateway now builds against Gateway API v1.6, and the Kubernetes controller uses the v1 version of TCPRoute instead of v1alpha2. Re-apply the Gateway API CRDs that match this release before you upgrade.

MCP request-phase guardrail rejections return HTTP 200

When an MCP guardrail rejects a request during the request phase, agentgateway now returns the rejection as an HTTP 200 with a JSON-RPC error body, matching the existing response-phase behavior. Update any clients or tests that expected a non-200 status for request-phase rejections.

For more information, see Kubernetes MCP guardrails and Standalone MCP guardrails.

(Standalone) auth.location no longer nests expression

The auth.location configuration no longer uses a double-nested expression field. Update any policies that set a custom token location to use the flattened form.

musl container images removed

The musl-based container image variants are no longer published. Switch to the standard (glibc) images.

The binary releases are still built with musl.

🔒 Security

Stateful MCP sessions can cross routes and overwrite the authorization policy

This release addresses the security advisory GHSA-mvgg-jvj2-4frq of a High (8.1) severity impacting MCP authorization.

Please see the advisory for details and mitigation steps.

Thank you to Aonan Guan for this report.

Request/Response Body CEL policies

A report was made to us that authorization policies written against the request.body or response.body CEL variables may result in unexpected behavior due to the truncation behavior of these attributes.

This is a security recommendation on the usage of these fields in authorization policies, and not a bug in agentgateway.

This behavior has also changed in this release; see below:

Attribute Version Behavior
request.body 1.3.x and earlier Truncated to http.maxBufferSize (default 2MB)
request.body 1.4 Not available if truncated
request.truncatedBody 1.3.x and earlier Not available
request.truncatedBody 1.4 Truncated to http.maxBufferSize (default 2MB)

The split between body and truncatedBody allows more control over the body when it exceeds the maximum buffer size.

In all cases, usage of these fields in authorization requests is prone to mistakes. For example, consider this request:

string(request.truncatedBody).contains("attacker-payload")

If the request is over 2MB, the attacker-payload may be present but missed. Additionally, request encoding schemes (compression, etc) can result in additional bypasses. When using these fields in authorization policies, ensure the policy correctly degrades in these cases.

Thank you to Aonan Guan for this report.

🌟 New features

MCP protocol 2026-07-28 support

Agentgateway adds support for the upcoming MCP 2026-07-28 protocol version.

  • Stateful and stateless servers: Agentgateway supports both stateful and stateless MCP servers, including closing the SEP-2575 server-stateless conformance gap and skipping the synthetic initialize handshake for modern requests.
  • Trace context propagation: Distributed trace context propagates through the MCP _meta field.
  • MCP Apps: Basic support for MCP Apps, including multiplexing fixes for app-originated tool calls.
  • Capability and multiplexing improvements: Preserved multi-resource tool result capabilities for modern clients, multi-target subscriptions and listen, and opaque resource URI multiplexing.

Because MCP 2026-07-28 support is new in this release, most of it is not yet covered by a dedicated guide. For the fields available today, see the Kubernetes API reference and Standalone configuration reference.

Cross App Access for MCP

Agentgateway supports MCP Enterprise-Managed Authorization through the OAuth Identity Assertion Authorization Grant, also known as Cross App Access or ID-JAG. An enterprise identity provider can broker access between a client application and the MCP server without the end user completing a separate OAuth flow for each downstream app.

For more information, see Kubernetes Cross App Access and Standalone Cross App Access.

OAuth token exchange backend authentication

Agentgateway can exchange an incoming token for a backend credential by using RFC 8693 OAuth 2.0 token exchange and the RFC 7523 JWT bearer grant. This release adds Kubernetes controller support, custom token types and OAuth 2.1 exchange defaults, the ability to inject multiple secret-sourced headers, and an override for the resolved secret key.

For more information, see Kubernetes OAuth token exchange and Standalone OAuth token exchange.

New MCP authentication providers

Agentgateway adds native MCP authentication provider support for Microsoft Entra ID. Standalone also adds native providers for Descope and authentik.

The entra provider bridges OAuth behaviors that Microsoft Entra ID implements differently from the MCP authorization specification, including serving RFC 8414 metadata from Entra's OIDC discovery document, stripping the RFC 8707 resource parameter, and short-circuiting Dynamic Client Registration with your pre-registered application ID.

For more information, see Kubernetes MCP authentication, Standalone MCP authentication, and the Standalone Descope integration guide.

New standalone gateways configuration model

Standalone configuration gains a new top-level gateways concept that unifies the UI, LLM, MCP, and routes so that they can share a single listener and port. gateways supersedes binds; existing binds configuration continues to work, and the UI offers a one-click migration from binds to gateways.

This release also adds simpler host and TLS configuration, the ability to serve LLM and MCP traffic on the same port, and an internal bind mode with wildcard fallback. For the full configuration surface, see the Standalone configuration reference.

Virtual keys from ConfigMaps and hashed keys

Virtual keys can now be sourced from a ConfigMap in addition to a Secret, and API keys can be stored as SHA-256 hashes so that raw key material never needs to live in the cluster or in plaintext configuration.

For more information, see Kubernetes virtual keys and Standalone virtual keys.

CEL enhancements

This release expands the CEL surface across policy, telemetry, and transformations:

  • Custom CEL functions: Register custom CEL functions for use in policies.
  • CEL filters for telemetry: An opt-in CEL filter selects which requests emit OpenTelemetry spans, and CEL filters decouple OTLP log fields and filtering from stdout logging.
  • New CEL context and functions: Access inbound CONNECT request headers through source.connectHeaders, and use a CEL replace mode for header transformations.

For the full CEL surface, see the Kubernetes CEL reference and Standalone CEL reference.

Fault injection: request delay

A new delay traffic policy injects latency before a request is forwarded to the backend, for fault-injection and chaos testing. The delay duration accepts a duration string or a CEL expression that returns a duration, or a number interpreted as milliseconds. Injected delay counts against the request timeout.

For more information, see Kubernetes fault injection and Standalone fault injection.

AWS assume-role session tags and session name

AWS assumeRole backend authentication supports STS session tags and a configurable RoleSessionName. Both the session name (sessionNameExpression) and per-tag values (tags[].expression) can be set from CEL expressions evaluated per request, so you can propagate identity attributes such as jwt.sub into the assumed AWS session.

For more information, see Standalone backend authentication. For Kubernetes fields, see the Kubernetes API reference.

Guardrail enhancements

Guardrails include several new operational and policy controls:

  • Backend connection policy for callouts: A BackendConnectionPolicy controls the TCP, TLS, HTTP, and tunnel settings agentgateway uses when it calls out to a guardrail service, and is available on the OpenAI moderation, Bedrock guardrails, and Google Model Armor policies.
  • Default callout timeouts: Guardrail callouts now apply a default timeout.
  • Improved logs and UI: Guardrail decisions surface more clearly in logs and the UI.
  • failureMode for external processing: External processing supports fail-open or fail-closed behavior.

For more information, see Kubernetes LLM guardrails, Standalone prompt guards, Kubernetes MCP guardrails, and Standalone MCP guardrails.

External processing enhancements

The Kubernetes controller supports metadataContext, requestAttributes, and responseAttributes for external processing, and extProc exposes a failureMode for fail-open or fail-closed behavior.

For more information, see Kubernetes external processing and Standalone external processing.

LLM gateway enhancements

  • Frontend TLS with multiple CAs: Client certificate validation can trust multiple CAs.
  • Bedrock: Added Responses-to-Bedrock image translation, sanitized tool names that exceed the 64-character Converse limit, and propagated cache-write tokens to the access log.
  • Gemini: Fixed embeddings handling and generateContent model and usage extraction in detect mode.
  • A2A v1.0: Support for the A2A v1.0 agent card format in URL rewriting.
  • Azure AI Foundry: Support for Anthropic endpoints on Foundry.

For the list of supported providers, see Kubernetes LLM providers and Standalone LLM providers.

Deployment, operations, and packaging

  • Standalone Helm chart: A new agentgateway-standalone Helm chart deploys standalone agentgateway, with support for a metrics service and ServiceMonitor. For more information, see Standalone Helm deployment.
  • DaemonSet workloads: Kubernetes can deploy the data plane as a DaemonSet.
  • Sidecars in control plane pods: A Helm extraContainers value runs sidecar containers in control plane pods.
  • Metrics scraping: Kubernetes can scrape proxy metrics with a PodMonitor, and a new agentgateway_controller_build_info metric reports controller build details.
  • Database logging: Standalone logging writes both successes and errors to the SQL database, with optimized write performance.

For more information, see Kubernetes Helm installation, Kubernetes control plane metrics, and Standalone metrics.

Contributors

Thank you to everyone who contributed code, reviews, documentation, bug reports, and CI improvements for this release!

See the full contributor list below.

What's Changed

New Contributors

Full Changelog: https://github.com/agentgateway/agentgateway/compare/v1.3.1...v1.4.0

Source: README.md, updated 2026-07-27