release notes

Every version, dated and documented.

MCPIP follows semantic versioning and Keep a Changelog. Every release is a set of SHA-256 artifact digests signed with an offline Ed25519 release key, plus a source integrity manifest the gateway re-hashes at every boot. There is no auto-updater — upgrading is your change-control action.

current · v3.0.0 · GAfull changelog on GitHub →

v3.0.0

GAJul 17, 2026v3.0.0

General availability

The GA cut of the fail-closed, opaque authorization gateway. It gathers every additive, backward-compatible wave shipped since 2.1.0 behind one version — no removed or renamed API, no breaking change. The authorization hot path, the payload lock, and the WORM epoch-header signed bytes are byte-for-byte unchanged.

  • Standards interop: an AuthZEN / COAZ decision surface, OAuth 2.1 Resource-Server metadata + issuer pinning, RFC 8693 delegation chains, and the MCP MRT step-up transport.
  • A2A task connector — a seventh provider dialect normalized at the gate, byte-identical to the other six.
  • Author-your-own community skills with reviewer approval, plus a deny-only community-gate seam.
  • Read-only compliance-evidence bundle generated from the real audit record and cross-walked to SOC 2, the EU AI Act, ISO 42001, DORA, and NIST 800-53.
  • Portable WORM attestation endpoint + SLSA build provenance for externally-checkable proof.
  • Opt-in, privacy-bounded vendor telemetry and off-hot-path license refresh — both default-OFF and fail-safe.
  • ReBAC relation-tuple projection for the operator knowledge graph, and off-hot-path JWKS key-set rotation that never goes empty.

v2.1.0

stableJul 17, 2026v2.1.0

Step-up delivery, economic caps, forensics

Made the step-up code delivery pluggable, added per-tenant economic policy ceilings, and shipped an access-audited forensic reconstruction surface — all additive, with the payload lock unchanged.

  • Out-of-band authenticator delivery for the one-time step-up code — pluggable and SSRF-guarded, without touching the payload-bound lock.
  • Deny-only policy overlay: per-tenant velocity caps and amount ceilings.
  • Forensic payload reconstruction — an access-audited investigator surface.
  • 11 new connector vendor aliases (hash-pinned registry v2).

v2.0.0

stableJul 14, 2026v2.0.0

The foundation

The first release: the gateway edges, the tamper-evident audit chain, and signed, verifiable packaging.

  • The /v1/authorize REST edge (JWT-only identity, atomic exactly-once approval lock, staged PIN challenges, opaque fail-closed denials) and the /v1/mcp MCP-standard edge exposing the gateway as an MCP server.
  • Merkle-epoch WORM audit log: per-epoch Ed25519-signed root chain, external anchor file, O(log n) inclusion proofs, and verify_chain tamper detection.
  • Signed release manifest + a source integrity manifest the gateway re-hashes at every boot.

Versioning note · every wave since 2.1.0 was strictly additive and backward-compatible — default-OFF opt-ins, new endpoints, and audit-only fields. By strict SemVer that is a minor bump; 3.0.0 is the deliberate GA milestone, with no removed or renamed API and no breaking change.