Download Latest Version agctl-windows-amd64.exe (35.2 MB) Google Add to Preferred Sources
Home / v1.7.0
Name Modified Size InfoDownloads / Week
Parent folder
agctl-darwin-arm64 2026-10-27 33.3 MB
0
agctl-darwin-arm64.sha256 2026-10-27 85 Bytes
0
agctl-linux-amd64 2026-10-27 34.5 MB
0
agctl-linux-amd64.sha256 2026-10-27 84 Bytes
0
agctl-linux-arm64 2026-10-27 32.1 MB
0
agctl-linux-arm64.sha256 2026-10-27 84 Bytes
0
agctl-windows-amd64.exe 2026-10-27 35.2 MB
0
agctl-windows-amd64.exe.sha256 2026-10-27 90 Bytes
0
agentgateway-darwin-arm64 2026-10-27 89.6 MB
0
agentgateway-darwin-arm64.sha256 2026-10-27 100 Bytes
0
agentgateway-linux-amd64 2026-10-27 96.2 MB
0
agentgateway-linux-amd64.sha256 2026-10-27 99 Bytes
0
agentgateway-linux-arm64 2026-10-27 88.0 MB
0
agentgateway-linux-arm64.sha256 2026-10-27 99 Bytes
0
agentgateway-windows-amd64.exe 2026-10-27 106.4 MB
0
agentgateway-windows-amd64.exe.sha256 2026-10-27 105 Bytes
0
README.md 2026-10-27 55.7 kB
0
v1.7.0 source code.tar.gz 2026-10-27 6.2 MB
0
v1.7.0 source code.zip 2026-10-27 8.0 MB
0
Totals: 19 Items   529.6 MB 0

🎉 Welcome to the 1.7.0 release of the agentgateway project!

Agentgateway 1.7 knows more about your models and your traffic than ever. The model catalog now knows each model's context window, modalities, and capabilities, and shares them through /v1/models and CEL. Costs reflect the service tier that actually served each request. New analytics break down tokens, cost, cache hit rate, and latency by model, user, or anything else you log.

On the routing side, agentgateway speaks OpenAI Decisions and TypeSafe SystemOne natively, adds Perplexity, brings Copilot to Kubernetes, and lets virtual models choose a target by calling your own routing service. Guardrails now cover tool output from every vendor, and MCP traffic can be filtered with plain CEL.

Rounding it out are automatic agent session tracking, OIDC that works for both browsers and API clients, a new agctl standalone CLI, and a UI that lets you edit anything as raw YAML.

Before upgrading, review the breaking and behavior changes below. In particular, standalone deployments now always encrypt MCP sessions, prompt guards inspect tool outputs by default, and dynamic backends can no longer reach loopback or link-local addresses.

Artifacts

Docker images are available:

  • cr.agentgateway.dev/agentgateway:v1.7.0
  • cr.agentgateway.dev/controller:v1.7.0

Helm charts are available:

  • cr.agentgateway.dev/charts/agentgateway:v1.7.0
  • cr.agentgateway.dev/charts/agentgateway-crds:v1.7.0
  • cr.agentgateway.dev/charts/agentgateway-standalone:v1.7.0

Binaries are available below.

Quick Start

Follow the Kubernetes or Standalone quick start guide to get started.

🔥 Breaking changes

Standalone always encrypts MCP sessions

Agentgateway allows defining an MCP session key that encrypts MCP session IDs. On Kubernetes, this was auto-generated; standalone deployments now match this.

When config.session.key is unset, agentgateway generates a key and stores it in the config file or database, whichever is writable. If neither is writable, agentgateway logs a warning and asks you to set the key.

If you previously had session encryption enabled, MCP sessions established before the upgrade are rejected, and clients must establish new sessions. To keep sessions unencrypted, set config.session.key: disabled.

Prompt guards inspect tool outputs by default

All prompt guards except webhooks now honor scope, including OpenAI Moderation, Google Model Armor, and Azure Content Safety. The default request scope now also includes ToolOutput, so tool results are inspected by every guard that uses the default scope.

This can produce new rejections or masking, and increases the content sent to vendor guardrail APIs. To retain the 1.6 behavior, set the scope explicitly:

:::yaml
scope:

- SystemPrompt
- Messages

Webhook guards do not support scope and always inspect the system prompt and messages.

CEL header lookups return every value of a repeated header

request.headers["x"] and similar lookups now return a list when a header appears more than once. Previously this depended on whether the expression could be optimized (internally), so the same lookup could return a single value in one expression and a list in another depending on the exact syntax. Expressions that read headers which only appear once are unaffected.

Dynamic backends cannot connect to loopback or link-local addresses

Dynamic backends now reject destinations that resolve to loopback, link-local (such as cloud metadata servers), or unspecified addresses. Set config.backend.allowDynamicLoopback: true if a dynamic backend must reach a service local to the gateway.

Error responses no longer include internal details

Error responses sent to clients no longer include internal details such as addresses, file paths, CEL expressions, or upstream error text. The full error is still logged, and status codes are unchanged.

Some examples:

Before After
upstream tcp call failed: tcp connect to 10.12.4.7:5432 failed: Connection refused connection refused
authentication failure: no bearer token found authentication failed
policy failed: cel expression ... failed: no such key policy failed
failed to process LLM response: failed to parse response: ... failed to process LLM response

Removed

  • Messages-to-Completions preference: AGENTGATEWAY_MESSAGES_PREFER_COMPLETIONS has been removed, as planned in 1.6. Anthropic Messages requests always prefer the OpenAI Responses format when a provider supports both. For OpenAI-compatible servers that do not implement /v1/responses, configure a custom provider that advertises only Chat Completions.

🔄 Other behavior changes

  • Normalized service tier: llm.serviceTier is now one of standard, flex, priority, or reserved, regardless of the provider's own naming. Update CEL expressions and dashboards that compare against provider-specific values such as default.

  • Request log database migration: On startup, standalone request log databases (SQLite or PostgreSQL) gain new analytics columns that are backfilled from existing rows. This can take some time on large databases.

  • Bedrock tool_choice: tool_choice now reaches Bedrock Converse; it was previously dropped silently. Requests that force tool use on models that do not support it, such as with extended thinking, now return an error from Bedrock.

  • Token rate limits for non-chat APIs: Token-based LLM rate limits now count usage from Embeddings, Rerank, Decisions, and SystemOne requests.
  • LLM buffer size: The 32 MiB default LLM request buffer now applies before request policies run instead of after.
  • Webhook guardrail responses: A webhook pass response that contains any field other than reason is now an error instead of passing unmasked content.
  • Google Model Armor errors: A non-success response from Model Armor is now a guard failure and follows the guard's failureMode.
  • Backend mirrors: Request mirroring runs after backend policies, so requests rejected by backend authorization are no longer mirrored.
  • AgentgatewayModel wildcard precedence: On Kubernetes, an exact model name such as openai/gpt-5.5 now wins over a wildcard such as openai/*, matching standalone.
  • MCP OpenAPI paths: A non-root path in an OpenAPI MCP target's host URL or path field now overrides the spec's server prefix. Previously the path was ignored.
  • MCP OpenAPI responses: Non-JSON responses are returned as typed MCP content (text, image, audio, or blob) instead of a {code, message} wrapper.
  • MCP session errors: Session IDs that cannot be decoded return 404 instead of 400, so clients start a new session after a key change.
  • gRPC health: Errors that agentgateway itself returns to gRPC clients now record their grpc-status, and only server-side gRPC errors mark a backend unhealthy, matching the treatment of 5xx and 4xx for HTTP.
  • gRPC policy calls: A gRPC policy call, such as external processing, that fails before reaching the service now reports UNAVAILABLE instead of UNKNOWN.
  • Invalid OAuth configuration: Invalid token exchange or Cross App Access configuration no longer rejects the whole xDS update. The affected policy fails closed and reports Accepted=False.
  • Anthropic version header: The client's anthropic-version header is forwarded instead of being replaced.

🌟 New features

LLM APIs and providers

  • OpenAI Decisions and TypeSafe SystemOne: Agentgateway supports the OpenAI Decisions API and the TypeSafe SystemOne API natively, translates between them in both directions, and includes a native TypeSafe provider. Both work on standalone and Kubernetes, and on Azure Foundry.
  • Audio APIs: /v1/audio/transcriptions, /v1/audio/translations, and /v1/audio/speech are recognized LLM endpoints. Duration-billed models such as whisper-1 report llm.audioSeconds and can be priced per minute with the new perAudioMinute catalog rate.
  • Perplexity provider: Perplexity is available as a built-in provider.
  • Copilot on Kubernetes: AgentgatewayBackend and AgentgatewayModel can use the Copilot provider with credentials from a Kubernetes Secret.
  • Native Bedrock Runtime APIs (preview): Set AGENTGATEWAY_BEDROCK_RUNTIME_CONVERSE=false to send chat requests to Bedrock Runtime's native Anthropic Messages and OpenAI Chat Completions and Responses endpoints, like Mantle, instead of translating them to Converse. This avoids format conversion for clients such as Claude Code and Codex. Converse remains the default for now.
  • Callout router for virtual models: A virtual model can select its target model by calling an external HTTP service, on both standalone and Kubernetes.
  • Per-model HTTP transformations: Provider defaults can set requestTransformation to modify headers and metadata of requests to a specific model.
  • More accurate token counting: A new tokenizer estimates token counts more accurately, runs about 10x faster, and uses less memory.
  • Better format conversion: Reasoning from vLLM and OpenRouter is preserved when converting Chat Completions to Messages, Bedrock reasoning streams as reasoning items in Responses, Bedrock redacted reasoning is preserved, and Vertex Gemini accepts https:// URIs in file content.

Model catalog and cost

The model catalog now describes models as well as pricing them. Entries include display name, release date, lifecycle status, token limits, modalities, capabilities, and reasoning controls.

/v1/models returns this metadata, so clients can discover what each model supports:

:::json
{
  "id": "gpt-5.5",
  "object": "model",
  "owned_by": "openai",
  "name": "GPT-5.5",
  "context_window": 1050000,
  "max_input_tokens": 922000,
  "max_tokens": 128000,
  "architecture": {"input_modalities": ["text", "image", "file"], "output_modalities": ["text"]},
  "capabilities": {"reasoning": true, "structured_outputs": true, "tools": true, "temperature": false},
  "supported_parameters": ["max_tokens", "reasoning", "reasoning_effort", "response_format", "tool_choice", "tools"]
}

The same metadata is available in CEL as llm.model, such as llm.model.limits.context.

Pricing now accounts for the service tier that served each request. Agentgateway records the tier for OpenAI, Anthropic, Bedrock, Vertex, and Gemini as llm.serviceTier, and catalog pricing tiers can set serviceTier alongside contextOver, so flex or priority requests are costed at their actual rates. The built-in catalog includes Vertex service-tier prices; rates for other providers can be configured manually.

:::yaml
tiers:

- serviceTier: priority
  rates: {input: "2.5", output: "15"}
- serviceTier: priority
  contextOver: 272000
  rates: {input: "5", output: "22.5"}
  • 1-hour cache pricing: Anthropic cache writes with a 1-hour TTL are priced separately using the new cacheWrite1h rate.
  • Budgets without a window: An API-key budget without a window accumulates usage for its lifetime, providing a fixed spending limit.
  • More CEL during request policies: llmRequest and llm.requestModel are available to route-level request policies, before LLM processing.

Guardrails

  • Scope for vendor guardrails: OpenAI Moderation, Google Model Armor, and Azure Content Safety support scope, like regex and Bedrock Guardrails.
  • Reasoning and response scope: Guards scan reasoning and thinking content, and response prompt guards support scope.
  • Rejection headers on Kubernetes: Kubernetes prompt guard rejection responses can add, set, and remove headers.
  • CEL processor for MCP guardrails: mcpGuardrails can reject or transform MCP requests and responses with CEL, without an external service.

```yaml mcpGuardrails: processors:

- kind: cel
  methods: {"tools/call": request}
  condition: mcp.params.name == 'restricted_tool'
  reject: "This tool is unavailable"

```

Agent sessions

Agentgateway detects the agent session that a request belongs to from well-known agent headers, such as x-claude-code-session-id, and records it in logs and in CEL as request.agent.session. Set config.standardAttributes.session to a CEL expression to identify sessions yourself.

Security and identity

  • OIDC with bearer tokens: OIDC policies can set credentials: sessionOrBearer to accept a bearer ID token in addition to a browser session, so one policy covers both browser and API clients. credentials: permissive keeps browser login while letting other requests fall through to other authentication policies.
  • Backend credentials from CEL: Backend authentication keys can be computed from a CEL expression, such as a value returned by an external authorization server.
  • MCP authentication with token passthrough: MCP authentication works with JWT preserveToken: true.
  • Callouts through a proxy: Callouts such as JWKS fetches, OIDC discovery, external authorization, and cloud credential fetches can be tunneled through an HTTP proxy with config.callouts.tunnel or the standard HTTP_PROXY environment variables.

MCP

  • Conditional targets on Kubernetes: MCP conditional targets are available in the Kubernetes CRDs.
  • Session cleanup across replicas: DELETE requests resume the session on any replica so that upstream sessions are closed.
  • Idle timeouts: MCP requests respect the route's idle timeout.

Kubernetes and operations

  • Shared HTTPS and TLS ports: HTTPS and TLS passthrough listeners can share a port on the same Gateway, selected by SNI.
  • Optional RBAC: Set rbac.create=false to install the Helm chart without RBAC resources.
  • Native histogram scraping: The PodMonitor and ServiceMonitor in both Helm charts support native histogram scraping, relabelings, and metric relabelings.
  • Graceful HTTP/1 drain: HTTP/1 connections drain more gracefully during shutdown.
  • Faster controller: The controller does less work when unrelated resources change, and status and xDS output are more stable, reducing unnecessary writes and pushes.

CLI and UI

  • agctl standalone: Manage a standalone agentgateway through its admin API with get and apply, including API keys, models, policies, and MCP targets.
  • Richer analytics: The request log database records cache read and write tokens, reasoning tokens, time to first token, and time per output token. agctl standalone analytics summarizes requests, errors, tokens, cost, time to first token, tokens per second, and cache hit rate, grouped by provider, model, status, user, or any logged attribute, and can bucket results by time or into latency histograms:

agctl standalone analytics --by provider,model --since 168h agctl standalone analytics --by agentgateway.user --provider openai agctl standalone analytics --by model,ttft

  • agctl bug-report: Collect diagnostic information into a single archive for sharing.
  • Raw editing: Every form editor has a raw YAML mode, and fields the form does not support are preserved on save.
  • Clearer forms: Required fields and schema help are shown consistently, with errors reported in place.
  • Settings page: A top-level settings page groups gateway-wide settings.
  • Client Setup in xDS mode: Client Setup is available for models served in xDS mode, and includes a recipe for Continue.
  • More UI improvements: API keys can be rotated with an auto-generated value, and the Users and Groups log filters are searchable.

🪲 Notable fixes

  • Fixed custom providers with Detect or Passthrough formats duplicating the base path, such as /v1/v1/....
  • Fixed Gemini tool schemas that used oneOf returning empty tool calls, and counted Gemini reasoning tokens consistently with other providers.
  • Fixed Bedrock dropping cache markers on unsupported content and mid-stream system messages invalidating the prompt cache.
  • Fixed passthrough failing on SSE streams with an unterminated final event.
  • Fixed Azure prompt-cache token conventions.
  • Fixed MCP conditional targets being evaluated only when a session was initialized instead of on each request, and resumed sessions keeping outdated settings after a configuration change.
  • Fixed MCP rejecting Accept values sent as separate header lines.
  • Fixed MCP using stale information after a transformation, and a double // in some issuer URLs.
  • Fixed requests answered locally, such as unknown models or model authorization failures, missing request data in access logs and CEL.
  • Fixed AgentgatewayModel references from another namespace ignoring ReferenceGrants.
  • Fixed policies on unmanaged Gateways being reported as attached.
  • Fixed a route budget replacing a Gateway budget.
  • Fixed the standalone external authorization default body.
  • Fixed numeric keys in configuration serialization.
  • Fixed the controller resetting the Istio log level.
  • Fixed transparent huge pages not being disabled, which increased memory usage.
  • Fixed the UI MCP and LLM playgrounds implicitly sending the logged-in session's credentials.

Contributors

Thank you to everyone who contributed code, reviews, documentation, bug reports, and CI improvements for this release!

What's Changed

New Contributors

Full Changelog: https://github.com/agentgateway/agentgateway/compare/v1.6.0...v1.7.0

Source: README.md, updated 2026-10-27