For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Release notes

Review the release notes for agentgateway.

Review the release notes for agentgateway.

🔥 Breaking changes

Gateway API v1.6 and TCPRoute v1

Agentgateway now builds against Gateway API v1.6, and the controller uses the v1 version of TCPRoute instead of v1alpha2. Re-apply the Gateway API CRDs that match this release before you upgrade, and update any automation that references TCPRoute by its v1alpha2 version.

MCP request-phase guardrail rejections return HTTP 200

When an MCP guardrail rejects a request during the request phase, agentgateway now returns the rejection as an HTTP 200 with a JSON-RPC error body, matching the existing response-phase behavior. Update any clients or tests that expected a non-200 status for request-phase rejections.

musl container images removed

The musl-based container image variants are no longer published. If you pin a musl image in your Helm values or in an AgentgatewayParameters resource, switch to the standard (glibc) image before you upgrade.

🔒 Security

Stateful MCP sessions can cross routes and overwrite the authorization policy

This release fixes the security advisory GHSA-mvgg-jvj2-4frq, a High severity (CVSS 8.1) issue in MCP authorization. In earlier versions, a client could present an MCP session ID on a different route than the route that created the session. Agentgateway then applied the second route’s MCP authorization policy, but stayed connected to the first route’s backend. That mismatch bypassed the authorization controls that you configured. Only stateful MCP setups with more than one MCP backend on separate routes are affected. HTTP authorization policies are not affected. Now, a stateful MCP session is pinned to the backend endpoint that created it.

Upgrade to version 1.4.0 or later. No workaround exists for earlier versions. For details, review the advisory.

Request and response body CEL attributes in authorization policies

The request.body and response.body CEL attributes behave differently in this release, and the change affects any authorization policy that reads a body. The gateway buffers a body only up to the frontend.http.maxBufferSize limit, which defaults to 2 MB.

The split between body and bodyPrefix gives you more control over a body that exceeds the buffer limit. Use body when the policy must see the complete body, and bodyPrefix when a prefix is enough.

In either version, an authorization policy that matches on a body is prone to bypass. Consider the following expression:

string(request.bodyPrefix).contains("attacker-payload")

If the request is larger than the buffer limit, the payload can be in the part of the body that agentgateway did not buffer, and the expression does not match. Request encoding schemes, such as compression, can also hide a payload from the expression.

Review each authorization policy that reads request.body or response.body, and make sure that the policy degrades safely when the body exceeds the buffer limit or arrives encoded. This guidance is a security recommendation for how you use these attributes, not a defect in agentgateway. For the attribute descriptions, see the CEL reference.

🌟 New features

MCP protocol 2026-07-28 support

Agentgateway adds support for the upcoming MCP 2026-07-28 protocol version.

• Stateful and stateless servers: Agentgateway supports both stateful and stateless MCP servers, including closing the SEP-2575 server-stateless conformance gap and skipping the synthetic initialize handshake for modern requests.
• Trace context propagation: Distributed trace context propagates through the MCP _meta field (SEP-414).
• MCP Apps: Basic support for MCP Apps, including multiplexing fixes for app-originated tool calls.
• Capability and multiplexing improvements: Preserved multi-resource tool result (MRTR) capabilities for modern clients, multi-target subscriptions and listen, and opaque resource URI multiplexing.

Because the MCP 2026-07-28 support is new in this release, most of it is not yet covered by a dedicated guide. For the fields available today, see the API reference.

Cross App Access (XAA) for MCP

Agentgateway supports MCP Enterprise-Managed Authorization through the OAuth Identity Assertion Authorization Grant (ID-JAG), also known as Cross App Access (XAA). An enterprise identity provider can broker access between a client application and the MCP server without the end user completing a separate OAuth flow for each downstream app. For more information, see Cross App Access (ID-JAG).

OAuth token exchange backend authentication

Agentgateway can exchange an incoming token for a backend credential by using RFC 8693 OAuth 2.0 token exchange and the RFC 7523 JWT bearer grant. This release adds controller support, custom token types and OAuth 2.1 exchange defaults, the ability to inject multiple secret-sourced headers, and an override for the resolved secret key. For more information, see OAuth token exchange.

Microsoft Entra ID as an MCP authentication provider

Agentgateway includes a native Entra MCP authentication provider that bridges the OAuth behaviors that Microsoft Entra ID (Azure AD) implements differently from the MCP authorization specification, such as serving RFC 8414 metadata from Entra’s OIDC discovery document, stripping the RFC 8707 resource parameter, and short-circuiting Dynamic Client Registration with your pre-registered application ID. For more information, see Set up Microsoft Entra ID.

Model-centric LLM configuration with AgentgatewayModel

A new experimental AgentgatewayModel API provides a model-centric way to serve LLMs in Kubernetes. Each resource declares one client-facing model and attaches directly to a Gateway listener, so you no longer assemble a listener, an HTTPRoute that matches on the request body, an AgentgatewayBackend for each provider, and an AgentgatewayPolicy for the AI behavior.

• Listener opt-in: A listener serves LLM traffic when it allows the AgentgatewayModel route kind in allowedRoutes.kinds. The same listener can also allow HTTPRoute, so LLM endpoints and ordinary HTTP routes coexist on one port.
• Aggregated model table: Models that attach to the same listener are aggregated into one table that serves request model extraction, the standard LLM API paths, /v1/models discovery, per-model provider routing, and OpenAI-compatible responses for unknown models.
• Concrete and virtual models: A concrete model names the provider that serves it. A virtual model routes across other models with weighted, failover, or conditional strategies.
• Per-model policies: Concrete models accept an inline policies block for credentials, authorization, transformations, guardrails, health, TLS, tunnel, and header changes.

The API is disabled by default. To enable it, set the agentgatewayModels.enabled=true Helm value on the control plane. For more information, see About models, Serve a model, and Virtual models.

Virtual keys from ConfigMaps and hashed keys

Virtual keys can now be sourced from a ConfigMap in addition to a Secret, and API keys can be stored as SHA-256 hashes so that raw key material never needs to live in the cluster. For more information, see Virtual keys.

CEL enhancements

• Custom CEL functions: Register custom CEL functions for use in policies.
• CEL filters for telemetry: An opt-in CEL filter selects which requests emit OpenTelemetry spans, exposed in Kubernetes, and CEL filters decouple OTLP log fields and filtering from stdout logging.
• New CEL context and functions: Access inbound CONNECT request headers through source.connectHeaders, and use a CEL replace mode for header transformations.

For the full CEL surface, see the CEL reference.

Fault injection: request delay

A new delay traffic policy injects latency before a request is forwarded to the backend, for fault-injection and chaos testing. The delay.duration field accepts a duration string or a CEL expression that returns a duration (or a number interpreted as milliseconds), so you can inject latency conditionally, for example on a percentage of requests. Injected delay counts against the request timeout. For more information, see Fault injection.

AWS assume-role session tags and session name

AWS assumeRole backend authentication supports STS session tags and a configurable RoleSessionName. Both the session name (sessionNameExpression) and per-tag values (tags[].expression) can be set from CEL expressions that are evaluated per request, so you can propagate identity attributes such as jwt.sub into the assumed AWS session. For the available fields, see the API reference.

Guardrail enhancements

• Backend connection policy for callouts: A BackendConnectionPolicy controls the TCP, TLS, HTTP, and tunnel settings agentgateway uses when it calls out to a guardrail service, and is available on the OpenAI moderation, Bedrock guardrails, and Google Model Armor policies.
• Default callout timeouts: Guardrail callouts now apply a default timeout.
• Improved logs and UI: Guardrail decisions surface more clearly in logs and the UI.
• failureMode for external processing: External processing (extProc) supports a failureMode for fail-open or fail-closed behavior.

For more information, see the LLM guardrails and MCP guardrails docs.

External processing enhancements

The controller supports metadataContext, requestAttributes, and responseAttributes for external processing, and extProc exposes a failureMode. For more information, see External processing.

LLM gateway enhancements

• Bedrock: Added Responses-to-Bedrock image translation, sanitized tool names that exceed the 64-character Converse limit, and propagated cache-write tokens to the access log.
• Gemini: Fixed embeddings handling and generateContent model and usage extraction in detect mode.
• Vertex AI: Gemini requests use the native generateContent and streamGenerateContent endpoints, and rawPredict requests are rewritten for any publisher, not only Anthropic.
• Azure AI Foundry: Support for Anthropic endpoints on Foundry.
• Detect mode and audio: Fixed the detect-mode and audio endpoint paths.

For the list of supported providers, see the LLM providers docs.

A2A v1.0 agent cards

Agentgateway supports the A2A v1.0 agent card format when it rewrites agent card URLs. For more information, see the A2A docs.

Frontend TLS with multiple CAs

Frontend TLS client certificate validation can trust multiple CAs, so you can rotate or federate client CAs without downtime. For the available fields, see the API reference.

Deployment and operations

• DaemonSet workloads: Deploy the data plane as a DaemonSet.
• Sidecars in control plane pods: A Helm extraContainers value runs sidecar containers in control plane pods.
• Metrics scraping: Scrape proxy metrics with a PodMonitor, and a new agentgateway_controller_build_info metric reports controller build details.
• XDS resource versioning: XDS resources are now versioned.
• Security hardening: Fixed timing attacks in authentication and added an admin IP allowlist.