v0.6.0 - 2025-08-22 - Security, Scale & Smart Automation

[crivetimihai]

MCP Gateway v0.6.0 - 2025-08-22 - Security, Scale & Smart Automation

This release delivers 118 commits and 50+ resolved issues with transformative improvements to extensibility, intelligence, and enterprise operability. Building on v0.5.0's security foundation, v0.6.0 introduces revolutionary plugin architecture, AI agent integration, and comprehensive observability.

🏆 Enterprise Scale & Automation Achievements

This release transforms MCP Gateway into a true enterprise platform with:

• 🔌 Plugin Framework – Comprehensive extensible architecture with pre/post hooks and external plugin support
• 🤖 A2A Agent Integration – Native AI agent support for OpenAI, Anthropic, and custom agents as tools
• 📊 OpenTelemetry Observability – Vendor-agnostic observability with Phoenix integration and distributed tracing
• 🔄 Bulk Import System – Enterprise-grade bulk operations with 200-tool capacity and rate limiting
• 💾 Real-time Log Viewer – Built-in log monitoring with advanced filtering and export capabilities
• 🏷️ Comprehensive Tagging – Tag-based organization and filtering across all entities
• ⚡ Performance Optimizations – Enhanced caching, connection improvements, and mutation testing

✨ Highlights

• 🔌 Plugin Framework – Complete extensible architecture with manifest-based configuration and external plugin support ([Feature Request]: AI Middleware Integration / Plugin Framework for extensible gateway capabilities #319, [DESIGN]: Architecture Decisions and Discussions for AI Middleware and Plugin Framework (Enables #319) #313, [Feature]: add support for external plugins #773)
• 🤖 A2A Agent Integration – AI agents as native tools with comprehensive metrics and admin UI support ([Feature Request]: A2A Initial Support - Add A2A Servers as Tools #298, A2a catalog closes #298 #792)
• 📊 OpenTelemetry Observability – Full vendor-agnostic instrumentation with Phoenix integration ([Epic]: Vendor Agnostic OpenTelemetry Observability Support #735, [Feature]: Phoenix Observability Integration plugin #727)
• 🔄 Bulk Import System – Enterprise-grade bulk tool import with rate limiting and validation ([Feature Request]: Bulk Tool Import #737, feat(ui+backend): complete Bulk Import implementation (200 cap) #798)
• 💾 Admin Log Viewer – Real-time log monitoring with SSE streaming and advanced filtering ([Feature Request]: View & Export Logs from Admin UI #138, [Feature Request]: Add Log File Support to MCP Gateway #364)
• 🏷️ Tagging System – Comprehensive tag support across all entities with filtering ([Feature Request]: Tag support with editing and validation across all APIs endpoints and UI (tags) #586)
• 🚀 MCP Protocol Enhancements – Elicitation support and enhanced tool annotations ([Feature Request]: MCP Elicitation (v2025-06-18) #708, [Bug]: Tools Annotations not working and need specificity for mentioning annotations #774)

🚨 Important Updates

• Plugin Architecture – New plugins/config.yaml configuration system with enable/disable flags
• A2A Configuration – Comprehensive A2A feature flags for controlling agent functionality
• Enhanced Observability – Full OpenTelemetry integration with distributed tracing capabilities
• Performance Improvements – Mutation testing, async performance testing, and caching optimizations
• Virtual Server Fixes – Critical fixes for virtual servers not working as advertised in v0.5.0

🆕 Added

🔌 Plugin Framework & Extensibility

• Comprehensive Plugin System ([Feature Request]: AI Middleware Integration / Plugin Framework for extensible gateway capabilities #319, [DESIGN]: Architecture Decisions and Discussions for AI Middleware and Plugin Framework (Enables #319) #313) – Full plugin framework with manifest-based configuration and lifecycle management
• Pre/Post Request Hooks – Plugin hooks for request/response interception and modification across all operations
• Tool Invocation Hooks ([Feature]: Add tool hooks (tool_pre_invoke / tool_post_invoke) to plugin system #682) – Dedicated tool_pre_invoke and tool_post_invoke plugin hooks for tool-specific processing
• Plugin CLI Tools ([Feature]: Add CLI for authoring and packaging plugins #720) – Command-line interface for authoring, packaging, and managing plugins
• Phoenix Observability Plugin ([Feature]: Phoenix Observability Integration plugin #727) – Built-in Phoenix integration plugin for ML monitoring and observability
• External Plugin Support ([Feature]: add support for external plugins #773) – Load external plugins with comprehensive configuration management

🤖 A2A (Agent-to-Agent) Integration

• Multi-Agent Platform ([Feature Request]: A2A Initial Support - Add A2A Servers as Tools #298, A2a catalog closes #298 #792) – Complete integration for OpenAI, Anthropic, and custom AI agents
• Agent as Tools – A2A agents automatically exposed as tools within virtual servers for seamless integration
• Protocol Versioning – A2A protocol version support ensuring compatibility across different agent implementations
• Flexible Authentication – Support for API keys, OAuth, bearer tokens, and custom auth schemes for agents
• Comprehensive Metrics – Full metrics collection for agent interactions, performance tracking, and usage analytics
• Admin UI Integration – Dedicated A2A management tab in admin interface with full CRUD operations

📊 OpenTelemetry Observability

• Vendor-Agnostic Observability ([Epic]: Vendor Agnostic OpenTelemetry Observability Support #735) – Complete OpenTelemetry instrumentation across the entire gateway stack
• Phoenix Integration ([Feature]: Phoenix Observability Integration plugin #727) – Built-in Phoenix observability plugin for ML monitoring and model performance tracking
• Distributed Tracing – Request tracing across federated gateways, MCP servers, and A2A agents
• Metrics Export – Comprehensive metrics export to OTLP-compatible backends (Jaeger, Zipkin, etc.)
• Performance Monitoring – Detailed performance metrics for tools, resources, agents, and plugin operations

🔄 Bulk Operations & Enterprise Scale

• Bulk Tool Import ([Feature Request]: Bulk Tool Import #737, feat(ui+backend): complete Bulk Import implementation (200 cap) #798) – Enterprise-grade bulk import system supporting up to 200 tools per batch
• Intelligent Rate Limiting – Built-in rate limiting for bulk operations (10 requests/minute) with backoff strategies
• Batch Processing Engine – Efficient batch processing with progress tracking and error recovery
• Import Validation – Comprehensive validation during bulk import operations with detailed error reporting
• Export Capabilities ([Feature Request]: Granular Configuration Export & Import (via UI & API) #186, [Feature Request]: Portable Configuration Export & Import CLI (registry, virtual servers and prompts) #185) – Granular configuration export/import via UI & API for migration scenarios

💾 Admin UI Log Viewer

• Real-time Log Monitoring ([Feature Request]: View & Export Logs from Admin UI #138, [Feature Request]: Add Log File Support to MCP Gateway #364) – Built-in log viewer with live streaming via Server-Sent Events
• Advanced Filtering – Filter by log level, entity type, time range, and full-text search with regex support
• Export Capabilities – Export filtered logs to JSON or CSV format for external analysis
• In-memory Buffer – Configurable circular buffer (1MB default) with intelligent size-based eviction
• Color-coded Severity – Visual indicators for debug, info, warning, error, critical levels with theme support
• Request Tracing – Track logs by request ID for debugging complex distributed operations

🔐 Security Enhancements

• OAuth 2.0 Support (feat: Add OAuth 2.0 Authentication Support in Edit Gateway #799) – Complete OAuth authentication support in gateway edit functionality
• Well-Known URI Handler ([SECURITY FEATURE]: Configurable Well-Known URI Handler including security.txt and robots.txt #540) – Configurable handlers for security.txt, robots.txt, and other standard endpoints
• Enhanced Security Headers ([SECURITY FEATURE]: Add Additional Configurable Security Headers to APIs for Admin UI #533, [CHORE]: Implement additional security headers and CORS configuration #344) – Additional configurable security headers for Admin UI protection
• Header Passthrough Security ([Bug]: Multiple Fixes and improved security for HTTP Header Passthrough Feature #685) – Improved security validation for HTTP header passthrough operations
• Bearer Token Management ([Feature Request]: Option to completely remove Bearer token auth to MCP gateway #705) – Option to completely disable bearer token authentication for specific deployment scenarios

🏷️ Tagging & Metadata System

• Universal Tag Support ([Feature Request]: Tag support with editing and validation across all APIs endpoints and UI (tags) #586) – Comprehensive tags for tools, resources, prompts, gateways, and A2A agents
• Tag-based Filtering – Advanced filtering and search capabilities by tags across all entity types
• Tag Validation – Input validation and editing support for tags with autocomplete functionality
• Metadata Tracking ([Feature Request]: Track Creator & Timestamp Metadata for Servers, Tools, and Resources #137) – Creator and timestamp metadata for servers, tools, resources with audit trails

🔄 MCP Protocol Enhancements

• MCP Elicitation Support ([Feature Request]: MCP Elicitation (v2025-06-18) #708) – Implementation of MCP elicitation protocol (v2025-06-18) for enhanced interactions
• Streamable HTTP Virtual Server Support ([Feature Request]: Update Streamable HTTP to fully support Virtual Servers #320) – Complete virtual server support for Streamable HTTP transport
• SSE Keepalive Configuration ([Feature] Make SSE Keepalive Events Configurable #690) – Configurable keepalive events for SSE transport with connection health monitoring
• Enhanced Tool Annotations ([Bug]: Tools Annotations not working and need specificity for mentioning annotations #774) – Fixed and improved tool annotation system with better UI integration

🚀 Performance & Infrastructure

• Mutation Testing ([CHORE]: Add mutation testing with mutmut for test quality validation #280, [CHORE]: Implement comprehensive fuzz testing automation and Makefile targets (hypothesis, atheris, schemathesis , RESTler) #256) – Comprehensive mutation testing with mutmut for ensuring test quality and coverage
• Async Performance Testing ([CHORE]: Async Code Testing and Performance Profiling Makefile targets (flake8-async, cprofile, snakeviz, aiomonitor) #254) – Dedicated async code testing and performance profiling capabilities
• Database Caching Improvements (Use database as cache_type #794) – Enhanced caching strategies with database as cache type for better performance
• Connection Optimizations (decode auth before connection #787) – Improved connection handling, authentication decoding, and resource management

🐛 Fixed

🚨 Critical Bug Fixes

• Virtual Server Functionality ([Bug]: Virtual Servers don't actually work as advertised v0.5.0 #704) – Fixed virtual servers not working as advertised in v0.5.0, now fully operational
• Tool Invocation Errors ([BUG] Tool invocation returns 'Invalid method' error after PR #746 #753, [Bug]: SSE Tool Invocation Fails After Integration Type Migration post PR #678 #696) – Fixed tool invocation returning 'Invalid method' errors across all transports
• Streamable HTTP Issues ([Bug]: Streamable HTTP Translation Feature: Connects but Fails to List Tools, Resources, or Support Tool Calls #728, [Bug]: Can't list tools when running inside of a docker #560) – Fixed translation feature connection problems and tool listing issues
• Database Migration ([Bug]: Database migration runs during doctest execution #661, [Bug]: Alembic migration is broken #478, [Bug]: Update make commands for alembic #479) – Fixed database migration issues during doctest execution and deployment
• Resource & Prompt Loading ([Bug]: Resources and Prompts not displaying in Admin Dashboard while Tools are visible #716, [BUG] Both resources and prompts not loading after adding a federated gateway #393) – Fixed resources and prompts not displaying in Admin Dashboard

🔧 Tool & Gateway Management

• Tool Edit Screen Issues ([Bug]:Tool Edit Screen Issues – Field Mismatch & MCP Tool Validation Error #715, Fix Tool Edit Screen: Field Mapping Consistency and Custom Tool Naming Implementation #786) – Fixed field mismatch and MCP tool validation errors in edit interfaces
• Duplicate Gateway Registration ([Bug]: Duplicate Gateway Registration with Equivalent URLs Bypasses Uniqueness Check #649) – Fixed bypassing of uniqueness check for equivalent URLs
• Gateway Registration Failures ([Bug]: MCP Server/Federated Gateway Registration is failing  #646) – Fixed MCP Server/Federated Gateway registration issues and error handling
• Tool Description Display ([BUG] Cleanup tool descriptions to remove newlines and truncate text #557) – Fixed cleanup of tool descriptions including newline removal and text truncation

🚦 Connection & Transport Issues

• DNS Resolution Issues ([BUG] Gateway fails to connect to services behind CDNs/load balancers due to DNS resolution #744) – Fixed gateway failures with CDNs/load balancers and improved DNS handling
• Docker Container Issues ([Bug]: Can't list tools when running inside of a docker #560) – Fixed tool listing when running inside Docker containers with proper networking
• Connection Authentication – Fixed auth header issues and improved connection reliability across all transports
• Session Management ([Bug]: Runtime error from Redis when multiple sessions exist #518) – Fixed Redis runtime errors with multiple concurrent sessions

🖥️ UI/UX Improvements

• Tool Annotations Display ([Bug]: Tools Annotations not working and need specificity for mentioning annotations #774) – Fixed annotations not working with improved CSS specificity and rendering
• Escape Key Handler (Event handler for escape #802) – Added proper event handler for escape key functionality across modals
• Content Validation ([Bug]: Verify content length using the content itself when the content-length header is absent. #436) – Fixed content length verification when headers are absent or malformed
• Resource MIME Types ([Bug]: Resource mime-type is always stored as text/plain #520) – Fixed resource mime-type always storing as text/plain instead of actual type

🔄 Changed

🏗️ Architecture & Protocol Updates

• Wrapper Functionality Redesign ([Bug]: Refactor and Optimize MCP Gateway Wrapper for Performance and Maintainability #779, Redesigned wrapper functionality #780) – Major redesign of wrapper functionality for improved performance and reliability
• Integration Type Migration ([Bug]: integrationType should only support REST, not MCP (Remove Integration Type: MCP) (draft) #452) – Removed deprecated "Integration Type: MCP", now supports only REST for cleaner architecture
• Transport Protocol Updates – Enhanced Streamable HTTP support with complete virtual server integration
• Plugin Configuration System – New plugin configuration system with enabled/disabled flags and dependency management ([Feature] Add enabled field to plugins/config.yaml #679)

📊 Metrics & Monitoring Enhancements

• Enhanced Metrics Tab UI ([Feature Request]: Enhance Metrics Tab UI with Virtual Servers and Top 5 Performance Tables #368) – Updated metrics tab with virtual servers overview and top 5 performance tables
• Comprehensive Metrics Collection – Improved metrics for A2A agents, plugins, tools, and all system components
• Performance Monitoring – Better performance tracking across all system components with detailed instrumentation

🔧 Developer Experience Improvements

• Enhanced Error Messages ([Bug]:Vague/Unclear Error Message "Validation Failed" When Adding a REST Tool #666, [CHORE]: Part 2: Replace Raw Errors with Friendly Messages in main.py #672) – Improved error handling throughout main.py and frontend with actionable guidance
• Better Validation ([BUG]: Enhanced Validation Missing in GatewayCreate #694) – Enhanced validation for gateway creation and all API endpoints with clear feedback
• Documentation Updates – Improved plugin development workflow and comprehensive architecture documentation

⚙️ Configuration & Environment

• A2A Configuration – Comprehensive A2A configuration options with feature flags:

  MCPGATEWAY_A2A_ENABLED=true              # Enable/disable A2A features
  MCPGATEWAY_A2A_MAX_AGENTS=100            # Maximum number of agents
  MCPGATEWAY_A2A_DEFAULT_TIMEOUT=30        # HTTP timeout for agent calls
  MCPGATEWAY_A2A_MAX_RETRIES=3             # Retry attempts for failed calls
  MCPGATEWAY_A2A_METRICS_ENABLED=true      # Enable metrics collection

• Plugin Configuration – New plugins/config.yaml system with enable/disable flags and plugin management

• Security Configuration – Enhanced security configuration validation and startup health checks

📦 Upgrade Instructions

1. Update your package:

   pip install --upgrade mcp-contextforge-gateway==0.6.0

2. Review new configuration options in .env:

   cp .env.example .env
   # Check new A2A configuration settings
   # Review plugin configuration options
   # Verify OpenTelemetry settings if using observability

3. Configure plugins (optional):

   # Review plugins/config.yaml for available plugins
   # Enable/disable plugins as needed for your deployment

---

🌟 Release Contributors

This release represents a quantum leap in MCP Gateway's capabilities, with the largest feature set and contributor base to date!

🏆 Top Contributors in 0.6.0

• Mihai Criveti (@crivetimihai) - Release coordination, A2A architecture design, plugin framework implementation, OpenTelemetry integration, and comprehensive testing infrastructure
• Manav Gupta (@manavgup) - Transport-translation enhancements, MCP eval server implementation, reverse proxy functionality, and protocol optimizations
• Madhav Kandukuri (@madhav165) - Tool service refactoring, database optimizations, UI improvements, and performance enhancements across the stack
• Keval Mahajan (@kevalmahajan) - Plugin architecture design, A2A catalog implementation, authentication improvements, and security enhancements

🎉 New Contributors

Welcome to our growing community of first-time contributors who joined us in 0.6.0:

• Multiple Community Contributors - Various developers contributed to OAuth implementation, bulk import features, UI enhancements, and bug fixes across the entire codebase
• Plugin Ecosystem Contributors - Developers who helped establish the plugin development framework and created initial plugin examples
• Testing & Quality Contributors - Contributors who enhanced our mutation testing, performance testing, and overall code quality initiatives

💪 Returning Contributors

Thank you to our dedicated contributors who continue to drive MCP Gateway forward:

• Core Architecture Team - Continued contributions to system architecture, plugin framework design, and A2A agent integration
• UI/UX Team - Ongoing enhancements to admin interface, log viewer implementation, and overall user experience
• Testing & Quality Team - Comprehensive testing improvements, mutation testing implementation, and quality assurance initiatives
• Documentation Team - Enhanced documentation for new features, plugin development guides, and deployment instructions

This release showcases the power of open-source collaboration at scale, bringing together expertise in distributed systems, AI/ML integration, enterprise security, and developer experience to create a truly revolutionary MCP gateway platform.

---

🔗 Resources

• 📚 Docs: https://ibm.github.io/mcp-context-forge/
• 🐳 Container: ghcr.io/ibm/mcp-context-forge:v0.6.0
• 🐍 PyPI: mcp-contextforge-gateway
• 📈 Full changelog: Compare v0.5.0…v0.6.0

Beta Software Notice: MCP Gateway is in early beta. Expect breaking changes between minor versions. Use only with trusted upstream MCP servers. Please refer to SECURITY.md and our Roadmap for more info.

---

This discussion was created from the release v0.6.0 - 2025-08-22 - Security, Scale & Smart Automation.