Skip to content

Release History

Every stable release since General Availability, with the three most impactful changes in each. For the complete list of changes, see the CHANGELOG; for what's coming next, see the ContextForge Roadmap.

Release Date Changes
1.0.6 2026-07-21
  • MCP Apps support — interactive UI resources served by MCP servers and rendered securely in agent clients
  • RFC 8693 OAuth token exchange — on-behalf-of delegation for virtual servers, plus per-user Vault credential resolution
  • Dataplane capability publishing — resource URIs, capabilities, and original tool names published from the dataplane
1.0.5 2026-07-07
  • Versioned API — all endpoints served under the /v1 prefix, with OpenAPI-to-MCP tool schema generation
  • Auth hardening — environment-bound JWTs closing cross-environment token acceptance (GHSA-vgf8-3685-66j9)
  • A2A compatibility — JSON-RPC passthrough endpoints and sensitive-header forwarding controls
1.0.4 2026-06-23
  • Rust server migration — Rust benchmark server and A2A echo agent replace earlier implementations
  • SSO client_secret_basic token exchange for providers that require confidential-client authentication
  • HTTP compliance — RFC 6585 status codes and HTTP 202 Accepted responses for async operations
1.0.3 2026-06-10
  • Auth & JWT cleanup — OAuth audience parameter support and token-handling fixes
  • FedRAMP/FIPS hardening — opt-in FIPS compliance mode with parameterized base images
  • PII redaction in logs — sensitive data scrubbed from log output
1.0.2 2026-05-25
  • Admin UI rewrite — virtual server management, tools page cards, user management, and OAuth popup authorization flow
  • Database migrations — Alembic-based schema migration chain replaces ad-hoc bootstrapping
  • A2A plugin framework integration — agents participate in plugin hooks, with an A2A protocol version selector
1.0.1 2026-05-13
  • Security hardening — CSRF token validation, nonce-based CSP (no unsafe-inline), and a comprehensive password policy
  • UAID cross-gateway auth forwarding between federated gateways
  • Operational tooling — secrets-generation CLI and fail-closed environment-aware defaults
1.0.0 2026-05-01
  • General Availability — the first stable release of the ContextForge gateway
  • JWT security — server-side token revocation, idle timeout, and logout
  • Content security — malicious-pattern detection, prompt-template validation, and ReDoS defense for pattern scanning