Agent Router v1.2.1

Agent Router v1.2.1 is a security and stability patch for the v1.2 series. It tightens MCP session handling and makes the external processor tolerate malformed upstream responses. It also keeps MCP session encryption seeds out of Pod specs and logs, and moves to Go 1.27.2 for standard library CVE fixes. Upgrading rolls Gateway pods that serve MCPRoutes once. An MCP session ID now works only on the MCPRoute that created it. Envoy Gateway stays at v1.9.2, with Envoy Proxy v1.39.1 and Gateway API v1.6.1.

🐛 Bug Fixes

• MCP proxy listens on loopback only — The MCP proxy in the external processor sidecar now binds to 127.0.0.1:9856 instead of every interface, so only the Envoy proxy in the same pod can reach it. The controller rolls existing Gateway pods whose sidecar still listens on all interfaces. aigw run no longer exposes the port on the host network.
• MCP sessions are bound to their MCPRoute — A session ID is now accepted only on requests routed through the MCPRoute that created it, so that route's security policy always applies to its sessions. Reusing a session ID on a different MCPRoute returns 400; the client must initialize a new session.
• promptSelector is enforced on prompts/get and completions — Prompts filtered out of prompts/list by a backend's promptSelector could still be fetched by name. prompts/get and completion/complete with a prompt reference now return 400 for those prompts, matching how toolSelector already applied to tools/call.
• MCP session encryption seeds stay out of Pod specs — The controller used to pass the MCP session encryption seeds to the external processor as command-line arguments, where anyone who could read Gateway Pods could see them. It now delivers them in the filter config Secret, so changing a seed no longer rolls the Gateway pods. The controller reads the seeds from the MCP_SESSION_ENCRYPTION_SEED and MCP_FALLBACK_SESSION_ENCRYPTION_SEED environment variables. The Helm chart stores controller.mcp.sessionEncryption.fallback.seed in its own Secret, and restarts the controller on every helm upgrade while a fallback seed is set so that a seed rotation takes effect.
• Malformed upstream responses no longer crash the external processor — A 2xx response with missing or null fields could panic the external processor. This covered Anthropic messages without usage on Anthropic, AWS, and GCP backends, null image generation or Gemini bodies, and null Bedrock Converse content blocks. Such responses are now handled as empty responses or responses without usage. OpenInference tracing of Anthropic responses without usage and of null rerank results no longer panics either.
• More credential headers redacted in debug logs — Debug logs now redact the api-key (Azure API key) and x-amz-security-token (AWS session token) headers, in addition to authorization and x-api-key. Header mutations in immediate (locally generated) responses are redacted too.
• OAuth metadata fetch is size-limited — When resolving an MCPRoute's OAuth authorization server metadata, the controller reads at most 1 MiB of each response. Larger documents are skipped and the next well-known URL is tried.
• Controller replicas no longer restart on a fresh install — With controller.replicaCount of 2 or more, replicas that started together raced to patch the admission webhook's caBundle, and the losers exited with a conflict error. The update is now retried, and a replica that finds the bundle already in place does nothing.
• Go 1.27.2 — Built with Go 1.27.2, which includes standard library CVE fixes.

📖 Upgrade Guidance

v1.2.1 has no API changes and no new breaking changes. Upgrade from v1.2.0 by upgrading both charts:

helm upgrade -i aieg-crd oci://docker.io/envoyproxy/ai-gateway-crds-helm \
  --version v1.2.1 \
  --namespace envoy-ai-gateway-system

helm upgrade -i aieg oci://docker.io/envoyproxy/ai-gateway-helm \
  --version v1.2.1 \
  --namespace envoy-ai-gateway-system

If you are upgrading from v1.1.x, follow the full v1.2 upgrade guidance first, using --version v1.2.1.

What to expect:

• Gateway pods that serve MCPRoutes roll once. The external processor sidecar's arguments change (loopback MCP address, no seeds on the command line), so the controller rolls those Gateway Deployments and DaemonSets after it starts. Gateways without MCPRoutes are not affected.
• Open MCP sessions survive the upgrade as long as the session encryption seed is unchanged: the seed is the same, it is only delivered differently.
• Clients that reuse one MCP session ID across MCPRoutes get 400 and must initialize a new session on each route.
• Rotating the seed. Changing the seed no longer rolls Gateway pods, so restart the controller after you change it (kubectl rollout restart deployment/<controller fullname> -n envoy-ai-gateway-system). The chart does this for you on every helm upgrade while controller.mcp.sessionEncryption.fallback.seed is set.
• Running the controller outside the chart? Prefer the MCP_SESSION_ENCRYPTION_SEED and MCP_FALLBACK_SESSION_ENCRYPTION_SEED environment variables over the --mcpSessionEncryptionSeed and --mcpFallbackSessionEncryptionSeed flags, so the seeds stay off the process command line. The flags still work and take precedence when set.

📦 Dependency Versions

• Go 1.27.2 — Updated from Go 1.27.1.
• Envoy Gateway v1.9.2 — Unchanged; still the latest v1.9 patch release.
• Envoy v1.39 — Envoy Proxy v1.39.1, as shipped by Envoy Gateway v1.9.2.
• Gateway API v1.6.1 — Unchanged.
• Gateway API Inference Extension v1.6.2 — Unchanged.
• MCP Go SDK v1.7.0 — Unchanged.

🙏 Acknowledgements

Thanks to everyone who contributed to v1.2.1: Abdulaziz Alharbi, Ignasi Barrera, Kota Kimura, Marc Navarro, and zirain, and to everyone who reported and reviewed these fixes.