obot-platform/obot v0.28.1

on GitHub

We're excited to announce the v0.28.1 release of the Obot Platform. This release adds migration of existing model-provider configuration to the unified LLM gateway, restores legacy provider-specific endpoints, adds PingFederate authentication, and fixes MCP OAuth and vMCP connection issues.

Big Updates

LLM Gateway Migration and Compatibility

Supported v0.27 model-provider credentials and connection settings now migrate to the LLM gateway. Default model selections and explicit model bindings in Model Access Policies, now shown as Profiles, migrate when a matching gateway model is available. Existing gateway provider configuration takes precedence. Profile membership, associated budgets and guardrails, and wildcard rules are preserved, and unmatched bindings remain intact for retry or administrator correction. Legacy configuration is retained for recovery, but legacy models are not served as separate running backends.

The legacy provider-specific LLM routes are available for supported operations again, including the AWS Bedrock, Azure OpenAI, and Generic Responses routes that returned HTTP 410 in v0.28.0. They use the unified gateway's access checks, budgets, guardrails, and audit logging. These routes are deprecated; use the unified endpoint for new client configurations. See the docs for supported operations and limitations.

PingFederate Authentication

Organizations can now use PingFederate as an authentication provider. Obot records group memberships received at sign-in so administrators can use those groups to manage access. See the docs for setup requirements and group refresh behavior.

Improvements

• Users can generate an API key directly from the LLM Gateway Connect tab, and the setup commands update to use it. The gateway pages also have several UI consistency improvements.
• Streamed OpenAI Responses now retain approved or redacted completion text after guardrail evaluation, fixing the missing completion text reported with Codex CLI.
• MCP OAuth now prefers administrator-configured static client credentials when an upstream server also advertises Client ID Metadata Document support.
• MCP OAuth requests now include offline_access when the authorization server advertises support for it and refresh tokens, allowing servers such as Vercel to issue refresh tokens.
• Internal vMCP component requests no longer consume the user's request rate limit, preventing large vMCPs from exhausting that limit during initialization. Client requests remain rate-limited.
• Administrators can set OBOT_SERVER_DISABLE_MCPAUDIT_LOG=true to stop storing new MCP audit logs, including local-agent tool calls from managed devices. Existing logs remain readable and exportable.

Upgrade Notes

Review model access before restoring traffic. Check every Profile under LLM Gateway > Profiles, including users and groups, model bindings, default-alias references, and wildcard patterns; confirm the intended gateway providers, correct unmatched bindings, and verify defaults such as llm and llm-mini. See #8509 for details.

Legacy disabled-model settings are not migrated. Express restrictions through Profiles, since broad grants such as * can allow models that were previously disabled. See #8509 for details.

Legacy custom model display names, custom model aliases, usage settings, and cost overrides are not copied. Reconfigure required custom pricing and review its effect on budget accounting; migration of default model aliases is separate from custom model aliases. See #8509 for details.

Provider-specific LLM endpoints are deprecated and will be removed in a future release. Update clients using /api/llm-proxy/openai, /api/llm-proxy/anthropic, /api/llm-proxy/generic-responses, or the AWS Bedrock and Azure variants to use https://<your-obot-host>/api/llm-proxy/v1 with provider-qualified model names such as openai/gpt-4.1; direct use of old m1-... model-record IDs is not supported by the migration. See #8509 for details.

The other v0.28.0 upgrade requirements still apply, including the embedded PostgreSQL upgrade. Review the v0.28.0 Upgrade Notes; the migration and endpoint guidance above replaces that release's instruction to wait for migration support and its notice that legacy provider routes are unavailable.

What's Changed

• docs: remove unsupported embeddings endpoint by @calvinmclean in #8499
• fix: prefer static OAuth credentials over CIMD by @thedadams in #8501
• ci: skip Go and Docker workflows for skill, ADR, and top-level Markdown changes by @cjellick in #8497
• chore: sync the winget-pkgs fork before publishing releases by @njhale in #8506
• fix(vmcp): exempt vMCP loopback requests from the user rate limit by @cloudnautique in #8507
• chore: drop 18 unused indexes from mcp_audit_logs by @g-linville in #8517
• fix: import legacy provider configuration into the gateway by @calvinmclean in #8514
• chore: fixes for trivy reported issues by @drpebcak in #8513
• chore: bump mmmcp to v0.2.2 by @thedadams in #8519
• enhance: add env var to turn off MCP audit logs by @g-linville in #8520
• chore: update mcp-images tags by @drpebcak in #8529
• enhance: add generate token option to llm gateway by @ivyjeong13 in #8518
• enhance: llm gateway ux consistencies by @ivyjeong13 in #8531
• fix: restore legacy LLM gateway routes by @calvinmclean in #8515
• docs: add Google tag to the docs site by @cloudnautique in #8532
• fix: restore Responses completion text after guardrail replay by @calvinmclean in #8537
• fix: request offline_access when the OAuth server supports refresh by @thedadams in #8538
• feat: add PingFederate authentication provider by @g-linville in #8508
• fix: use Bedrock Mantle for AWS setup and legacy imports by @calvinmclean in #8541

Full Changelog: v0.28.0...v0.28.1