Release 1.24.5 - Coding-Assistant OAuth, Custom Entity Types, and a New Identity Provider

June 2026

Upgrading from 1.24.4

This section covers everything you need to know to upgrade from 1.24.4 to 1.24.5.

Breaking Changes

There are no breaking changes in this release. Every new capability is gated behind a feature flag or an unset environment variable, so existing deployments behave exactly as before until you opt in:

• Custom Entity Types are off unless CUSTOM_ENTITY_TYPES_ENABLED=true.
• IDE OAuth login keeps the static-token Connect config unless IDE_OAUTH_CLIENT_ID is set.
• PingFederate is only active when AUTH_PROVIDER=pingfederate.
• Internal/workshop telemetry labels default to off and never affect access control.

New Environment Variables

Optional PingFederate variables (PINGFEDERATE_M2M_CLIENT_ID, PINGFEDERATE_M2M_CLIENT_SECRET, PINGFEDERATE_APPLICATION_ID_URI) are commented out in .env.example and default to the web client or empty.

Upgrade Instructions

Docker Compose

cd mcp-gateway-registry
git pull origin main
git checkout 1.24.5

# Review new env vars in .env.example and update your .env if needed
# Then rebuild and restart:
./build_and_run.sh

Kubernetes / Helm (EKS)

Chart templates, values, and helpers changed across the registry, auth-server, mongodb-configure, and stack charts in this release (PingFederate wiring, MongoDB password auto-generation, custom-entity and IDE-OAuth env vars). The packaged subchart .tgz files inside charts/mcp-gateway-registry-stack/charts/ are gitignored and only repackage when you rebuild dependencies, so a plain git pull + helm upgrade would otherwise use stale subcharts.

cd mcp-gateway-registry
git pull origin main
git checkout 1.24.5

# REQUIRED: rebuild packaged subcharts so the stack chart picks up the changes
cd charts/mcp-gateway-registry-stack
helm dependency build
helm dependency update

# Update values.yaml if needed, then upgrade:
helm upgrade mcp-gateway . -f your-values.yaml

Terraform / ECS

cd mcp-gateway-registry
git pull origin main
git checkout 1.24.5

# Update your .tfvars with any new variables (e.g. Cognito IDE OAuth, custom entities)
cd terraform/aws-ecs
terraform plan
terraform apply

DockerHub Images

Pre-built images are available:

docker pull mcpgateway/registry:1.24.5
docker pull mcpgateway/auth-server:1.24.5
docker pull mcpgateway/currenttime-server:1.24.5
docker pull mcpgateway/realserverfaketools-server:1.24.5
docker pull mcpgateway/fininfo-server:1.24.5
docker pull mcpgateway/mcpgw-server:1.24.5
docker pull mcpgateway/metrics-service:1.24.5

Major Features

Custom Entity Types

Registry admins can now define new catalog entity types at runtime, schema-driven, with their own dynamic tabs and endpoints. Each type carries its own embedding collection for semantic search, and the feature ships with guardrails: per-type record caps, a cap on the number of types, and a short-TTL descriptor cache for fast convergence across replicas. Off by default, so existing deployments see no change until an admin enables it.

PR #1173

Coding-Assistant OAuth Login (Cursor, Claude Code, Codex)

The Connect dialog can now hand an AI coding assistant a real OAuth login instead of a static gateway token. A server's Connect config advertises a pre-registered public client_id, so the IDE shows a login button and runs the OAuth/PKCE flow against your identity provider. Per-server oauth_client_id overrides and a /mcp path option let each server tune its connect behavior, and a fixed loopback callback port supports IdPs (Okta, Entra, Cognito) that match the redirect URI literally including the port.

PR #1224, PR #1235

PingFederate Identity Provider

PingFederate joins Cognito, Keycloak, Entra, Okta, and Auth0 as a supported identity provider. The integration covers token exchange, JWKS, and userinfo, a browser-facing external URL for redirects, a configurable groups claim, and an admin-API path for creating OAuth clients and PCV users. A local PingFederate container is available via the pingfederate Docker Compose profile for evaluation. Because PingFederate has no built-in groups scope, a local idp_user_groups fallback can populate empty JWT groups claims.

PR #1163

Amazon Cognito Support (Terraform/ECS)

Amazon Cognito is now wired end to end for Terraform/ECS deployments, including an IAM manager and documentation. Access tokens from Cognito (which carry no aud claim) are validated by client_id against an allowlist, and the cognito:groups claim drives access derivation.

PR #1210

Canonical server.json Export

A new read-only endpoint, GET /api/servers/{path}/server.json, projects a stored server document into the canonical shape that conforms to the official Model Context Protocol (MCP) registry server schema. The server details modal in the UI gained a "Canonical" toggle to view and copy that projection. Auth mirrors the bespoke server read, and backend URLs are redacted for non-admin callers in with-gateway mode.

PR #1225, PR #1239

What's New

Authentication

• Coding-assistant OAuth login with per-server client_id and /mcp path override (#1224)
• IDE OAuth follow-ups: CSRF fix on connect-config, PRM advertised-scopes default, frontend error surfacing, deployment-surface wiring, and per-IdP public-client setup scripts (#1235)
• PingFederate identity provider with local-group fallback for empty JWT groups claims (#1163)
• Amazon Cognito Terraform/ECS support with IAM manager and docs (#1210)
• Batched per-scope reads on the auth hot path to cut /api/auth/me latency (#1230)

Registry Features

• Custom Entity Types: admin-defined, schema-driven catalog types with dynamic tabs and endpoints (#1173)
• Canonical server.json export endpoint (#1225) and a "Canonical" copy toggle in the server details modal (#1239)
• mcpgw discovery now dedupes candidates and itemizes withheld results (#1227)

Deployment

• Auto-generated MongoDB password with upgrade-safe persistence (#1222)
• Internal/workshop deployment classification via telemetry labels (#1220)

Infrastructure

• Hardened GitHub Actions workflow security (#1177)
• npm package updates and workflow automation (#1174)

Frontend Improvements

• Server details modal addresses the at-scale per-card resource exhaustion path and adds the canonical toggle (#1239)

Documentation

• Repositioned the registry as a true AI asset registry; refreshed roadmap and slide deck (#1223)
• Dynamic discovery receipt guidance (#1203)
• Contributor guidance to install pre-commit hooks (#1228)
• usage-report skill: deterministic template + LLM commentary, LTV counting rule, regrounded rates, daily-reporters chart, community-vs-internal deployment breakdown (#1214, #1236)
• macOS setup skill fixes: gettext prereq, /var/log bind mount, token file format (#1201)

Bug Fixes

• Logout failures caused by transient network issues (#1226)
• NGINX_ENABLE_IPV6 had no effect because IPv6 listeners were wiped when the registry re-rendered the nginx config; the flag now patches the templates so listeners survive a re-render (#1205)
• Unresolvable virtual-server backend host no longer crashes the nginx (registry) container at startup (#1206)
• mcpgw discovery returned duplicate candidates and silently dropped withheld results (#1227)

Closed Issues

Pull Requests Included

Security Dependency Updates

Contributors

Thank you to all contributors for this release:

• Amit Arora (@aarora79)
• omrishiv (@omrishiv)
• Gonçalo Faustino (@go-faustino)
• Vrinda Bhandari (@vrindabhandari)
• Caio Ribeiro (@caioribeiroclw-pixel)
• Prateek Sinha (@shekharprateek)

Support

• GitHub Issues
• GitHub Discussions
• Documentation

Full Changelog: 1.24.4...1.24.5

What's Changed

• macOS setup skill: add missing gettext prereq, fix /var/log bind mount, correct token file format by @vrindabhandari in #1201
• feat(auth): add PingFederate as supported identity provider (#1127) by @shekharprateek in #1163
• Feat/harden action security by @omrishiv in #1177
• add npm package updates and workflow automation by @omrishiv in #1174
• build(deps): bump the actions group in /.github/workflows with 11 updates by @dependabot[bot] in #1208
• build(deps): bump the docker-images group in /docker with 3 updates by @dependabot[bot] in #1207
• feat: Amazon Cognito support (Terraform/ECS, IAM manager, docs) by @aarora79 in #1210
• Feat/custom entities by @omrishiv in #1173
• chore: usage-report skill — LTV counting rule, regrounded rates, daily-reporters chart by @aarora79 in #1214
• dynamically generate mongodb password by @omrishiv in #1212
• fix(nginx): make NGINX_ENABLE_IPV6 patch templates so IPv6 listeners survive config re-render by @go-faustino in #1205
• Revert "dynamically generate mongodb password" by @omrishiv in #1219
• feat: track internal/workshop deployments via telemetry (#1216, #1217) by @aarora79 in #1220
• docs: position as true AI asset registry, refresh roadmap and slide deck by @aarora79 in #1223
• fix logout issues due to network issues by @omrishiv in #1226
• docs: add dynamic discovery receipt guidance by @caioribeiroclw-pixel in #1203
• fix(mcpgw): dedupe discovery candidates and itemize withheld results by @aarora79 in #1227
• Add canonical server.json export endpoint (#1187) by @vrindabhandari in #1225
• docs: tell contributors to install pre-commit hooks by @aarora79 in #1228
• Batch per-scope reads on the auth hot path to cut /api/auth/me latency by @omrishiv in #1230
• feat(charts): auto-generate MongoDB password with upgrade-safe persistence by @omrishiv in #1222
• feat(connect-config): per-server OAuth client_id login for Cursor/Claude/Codex + /mcp path override by @go-faustino in #1224
• build(deps): bump esbuild from 0.25.11 to 0.28.1 in /cli in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1234
• feat(connect-config): IDE OAuth login follow-ups (CSRF + PRM scopes fixes, surface wiring, docs, IdP scripts) by @aarora79 in #1235
• feat(usage-report): community-vs-internal deployment breakdown by @aarora79 in #1236
• feat(frontend): add Copy canonical toggle to server details modal by @aarora79 in #1239

New Contributors

• @vrindabhandari made their first contribution in #1201
• @go-faustino made their first contribution in #1205
• @caioribeiroclw-pixel made their first contribution in #1203

Full Changelog: 1.24.4...1.24.5