This is a patch release for v0.26.0. It fixes bugs in vMCP profiles and the vMCP UI, makes group lookups against the auth provider more resilient, and adds support for Bitbucket Cloud catalogs.
Important
This is not the upgrade patch release. The v0.26.0 notes said that existing installations should not upgrade to v0.26.0, and that upgrade support for vMCPs would follow in a patch release. v0.26.1 does not include that upgrade support. The patch release with upgrade support is planned for next week. Until then, the guidance from v0.26.0 still applies: existing installations should not upgrade to v0.26.1, and only net new installations should install it. See #7802 for details.
Fixes and Improvements
- vMCP profiles are more predictable. A profile created by enabling every tool now saves that list of tools instead of being treated as an "As-is" profile. Profiles can refresh their tool list after the underlying MCP server changes, and users are told when a tool change on a component affects existing profiles. Tools that a profile lists but the server does not allow are now removed from the profile instead of causing an error.
- When an MCP server used by a vMCP is modified, the vMCP now shows that an update is available and offers the update action. The vMCPs page can also be filtered by connection state.
- vMCP profiles now tell apart groups that come from the identity provider and groups that Obot manages, so administrators can see where a group grant comes from when assigning groups to a profile.
- Group lookups against the auth provider no longer fail logins when the provider rate limits Obot. Concurrent lookups for the same user are combined into one call, and after a failed lookup Obot uses the groups it already has until a short cooldown passes.
- Fixed a bug where vMCPs and
npx/uvxservers rejected valid MCP list requests that omitted the optionalparamsfield. - Connections to Kubernetes-hosted MCP servers now retry briefly while a server's pod is being replaced, instead of failing right away.
- MCP and Skills catalogs can now use Bitbucket Cloud repository URLs, with or without
.git. Private repositories can authenticate with a personal API token or a repository access token. - The maximum repository size for Git-backed catalogs can now be set with
--git-max-repo-size-mborOBOT_SERVER_GIT_MAX_REPO_SIZE_MB. The default is still 100 MB. - Smaller UI fixes: the message policy navigation links are restored, the local login page focuses the email field, and the auth provider page explains how to change or discard a staged provider switch.
What's Changed
- fix: coalesce auth provider group refreshes and back off after failures by @njhale in #7928
- fix(mcp): tolerate connection failures during pod replacement by @thedadams in #7952
- fix: remove tools from profiles that aren't allowed by @thedadams in #7962
- chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in the go_modules group across 1 directory by @dependabot[bot] in #7963
- enhance: better group handling for authorization by @thedadams in #7959
- chore: docs and UI dependabot security fixes by @ivyjeong13 in #7972
- fix: refresh stale version on vmcp tester by @ivyjeong13 in #7956
- fix: clarify how to change or discard a staged auth provider switch by @njhale in #7973
- chore: format tests by @calvinmclean in #7954
- feat(vmcp): add vMCP GitOps by @thedadams in #7982
- Revert "feat(vmcp): add vMCP GitOps (#7982)" by @thedadams in #7993
- fix: only move latest image tag for the newest stable release by @cjellick in #8009
- chore: release v0.26 docs by @thedadams in #8004
- feat: make git clone repository size limit configurable by @calvinmclean in #7995
- fix(mcp): use Claude Code DCR name for Figma by @calvinmclean in #8003
- fix: prevent scrollbar in Git source URL dialog by @calvinmclean in #8015
- fix: adds vmcps filter additions & option to update vmcps on MCP server update by @ivyjeong13 in #7970
- fix: support Bitbucket Cloud catalog URLs and token authentication by @calvinmclean in #7989
- fix: vMCP Profiles related bugfixes by @ivyjeong13 in #7990
- fix(ui): focus the email input on the local login page by @thedadams in #8018
- fix: bump mmmcp to pickup tool list fix by @thedadams in #8021
- fix(deps): patch OpenTelemetry OTLP exporters by @calvinmclean in #8019
- chore: verbiage update for welcome splash and register callouts by @ivyjeong13 in #8020
- fix: tweak ux for profiles & granting mcp servers vs. allowAllComponents by @ivyjeong13 in #8022
- fix: restore message policy navigation links by @sunyue940-lab in #8012
New Contributors
- @sunyue940-lab made their first contribution in #8012
Full Changelog: v0.26.0...v0.26.1