🎉 Welcome to the 1.4.1 release of the agentgateway project!

Artifacts

Docker images are available:

• cr.agentgateway.dev/agentgateway:v1.4.1
• cr.agentgateway.dev/controller:v1.4.1

Helm charts are available:

• cr.agentgateway.dev/charts/agentgateway:v1.4.1
• cr.agentgateway.dev/charts/agentgateway-crds:v1.4.1
• cr.agentgateway.dev/charts/agentgateway-standalone:v1.4.1

Binaries for agentgateway and the agctl CLI are available below.

Quick Start

Follow the Kubernetes or Standalone quick start guide to get started!

Agentgateway v1.4.1

This release fixes a few bugs around LLM and MCP, increasing compatibility with the new 07-28-2026 specification.

Upgrade notes

• Top-level standalone llm and mcp listeners may no longer share a port. To expose both on one port, attach them to the same configured gateway.
• When a model references a named custom provider, that provider’s configured name is now used for custom model-catalog lookup. Catalog entries keyed under the generic custom provider name may need to be updated.
• OAuth token-exchange configurations that relied on an implicit fallback to validated JWT claims must explicitly select jwt.rawToken.unredacted() as the subject-token source.

MCP improvements

• Added MCP Tasks support, including task retrieval, updates, cancellation, multiplexed task IDs, capability advertisement, RBAC enforcement, and task context in CEL and telemetry.
• MCP upstream responses are now validated against the expected response type.
• Asynchronous MCP errors are included in access logs.
• Fail-open fan-out requests now return an error when every upstream fails instead of producing an empty success.
• OpenAPI-derived MCP tools use the operation summary as their human-readable title.
• Synthetic internal session identifiers are no longer logged as MCP session IDs.

LLM and model handling

• Model catalogs now hot reload consistently when changed through either configuration files or the UI/configuration store.
• Fixed Amazon Bedrock requests containing tool-call history but no current tool definitions. Agentgateway now supplies the tool configuration Bedrock requires to continue these conversations.
• Fixed GitHub Copilot embedding responses that omit required OpenAI-compatible object and model fields.
• Prompt-cache writes are no longer charged as both cache writes and ordinary input. Catalogs without a cache-write price fall back to the standard input rate.

Prompt guards

• Prompt guards now preserve structured Anthropic tool-use and tool-result content when masking text, preventing malformed requests and upstream 400 responses.
• Consecutive text blocks are evaluated together, allowing patterns spanning block boundaries to be detected.
• Non-text blocks and metadata such as Anthropic cache controls are preserved during masking.
• Zero-width regular-expression matches no longer insert masking placeholders throughout the input.
• Webhook prompt guards can access the full llmRequest CEL variable and add CEL-computed headers through standalone configuration, Kubernetes CRDs, and xDS.

Authentication and security

• OAuth token exchange now fails closed when its configured subject-token source is missing or empty. Validated JWT claims are no longer used as an implicit fallback; configurations that intentionally use the validated token can select it explicitly with CEL.
• Cross-namespace JWKS backend references now honor the configured Gateway API ReferenceGrant policy.

Configuration and operations

• Configuration storage and request logging can use separate databases when their settings differ, while identical configurations continue to share resources.
• Environment expansion now happens before configuration parsing, allowing variables in fields needed during startup.
• External authorization and processing services can return large response bodies without an artificial size limit.

Networking

• Added a full connection-handshake timeout so requests do not accumulate behind hung HTTP/2 connections.

What's Changed

• krt: fix Equals signatures by @stevenctl in #2704
• openapi: set title based on summary by @stevenctl in #2697
• refactor(controller): use apiequality.Semantic.DeepEqual for K8s API comparisons by @dongjiang1989 in #2687
• better cpu profile defaults by @ilrudie in #2682
• standalone: reject shared port for llm and mcp by @howardjohn in #2698
• fix: rewatch replaced model catalog files by @iploooox in #2702
• add Goose to Client Setup by @mkorbi in #2722
• Adding Configuration for GatewayClass and Controller Name by @jaiveerk in #2694
• Bump wiremock-rs by @markuskobler in #2726
• database: make connection pool size configurable by @sj-louw in #2705
• ext*: do not limit serve response size by @howardjohn in #2728
• database: split or share based on whether config is the same by @howardjohn in #2730
• client: avoid waiting on hung h2 connections by @howardjohn in #2729
• connect: scope internal bind lookup based on IP by @howardjohn in #2731
• llm: price prompt cache writes once by @danehans in #2727
• waypoint: accept traffic when serving as a weighted waypoint by @ymesika in #2716
• mcp: move off rmcp fork by @howardjohn in #2708
• webhook guardrail: expose llmRequest CEL var by @howardjohn in #2733
• fix(copilot): add OpenAI metadata to embedding responses by @iandvt in #2684
• feat: expose webhook prompt guard headers through Kubernetes CRD and xDS API (fixes #2718) by @ibariens in #2723
• Bump to rmcp v3 beta5 by @howardjohn in #2738
• fix(config): run shellexpend before parsing the config by @yanir75 in #2736
• jwks: add ref grant support by @howardjohn in #2706
• Add initial extensible standalone configuration importer by @danehans in #2605
• mcp tasks support by @stevenctl in #2745
• mcp: avoid logging synthetic session id by @howardjohn in #2743
• llm: remove guardrail deadcode by @howardjohn in #2746
• promptGuard: scan anthropic tool output by @stevenctl in #2732
• fix(bedrock): set toolConfig when messages carry tool history by @howardjohn in #2747
• llm: when using custom provider ref, override provider name by @howardjohn in #2754
• catalog: always hot reload by @howardjohn in #2753
• auth: fail closed when OAuth subject token source is missing by @markuskobler in #2740
• mcp: validate response body shape and log async errors by @howardjohn in #2744
• promptGuard: apply guard to merged consecutive text blocks by @stevenctl in #2755

New Contributors

• @ilrudie made their first contribution in #2682
• @mkorbi made their first contribution in #2722
• @jaiveerk made their first contribution in #2694
• @sj-louw made their first contribution in #2705
• @iandvt made their first contribution in #2684
• @ibariens made their first contribution in #2723

Full Changelog: v1.4.0...v1.4.1