Skip to content
Releases GitHub

Changelog

Subscribe with RSS

All areas
All changes

End-to-end mTLS between Client and Server Workloads with SPIFFE X.509-SVID certificates

Introducing end-to-end mutual TLS (mTLS) between Client Workloads and Server Workloads using SPIFFE-compliant X.509-SVID certificates.

Aembit has released new versions of the following components and packages:

  • Agent Proxy
  • Cloud (Tenant UI + API)
  • EdgeAPI
  • Terraform Provider
  • Helm Chart
  • Terraform ECS module
  • AWS Lambda Extension
  • AWS Lambda Layer

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Agent Proxy outbound mTLS with X.509-SVID: Agent Proxy can now establish outbound mTLS connections to Server Workloads using SPIFFE-compliant X.509-SVID certificates, with no application code changes required.
  • mTLS Authentication method for Server Workloads: A new authentication method, mTLS Authentication with the x509 Certificate scheme, lets Server Workloads validate the client certificate that Agent Proxy presents during the mTLS handshake.
  • X.509-SVID Credential Provider: A new Credential Provider type that issues SPIFFE-compliant X.509 certificates. This release’s Agent Proxy update is what consumes them for outbound mTLS to Server Workloads.

Agent Proxy can now establish outbound mTLS connections to Server Workloads using SPIFFE-compliant X.509-SVID certificates, enabling certificate-based workload-to-workload authentication without application code changes.

What’s new:

  • In-memory private key: Agent Proxy generates an ECDSA key pair in memory for each X.509-SVID certificate. The private key is never written to disk and is never transmitted to Aembit Cloud.
  • Automatic rotation at 80% of certificate lifetime: Agent Proxy refreshes the certificate well before expiration, generating a new key pair on each refresh. In-progress mTLS connections continue using the prior certificate until they close.
  • mTLS Authentication for Server Workloads: A new Server Workload authentication method (mTLS Authentication with the x509 Certificate scheme) lets the Server Workload side validate the X.509-SVID certificate that Agent Proxy presents during the handshake.

For the end-to-end workflow and procedure, see Enable mTLS on a Server Workload. For the authentication-method catalog, see Authentication methods and schemes.

Aembit is introducing a new X.509-SVID Credential Provider type that issues SPIFFE-compliant X.509 certificates to Client Workloads, signed by an Aembit Standalone CA.

What’s new:

  • SPIFFE-compliant identity in the URI Subject Alternative Name (SAN): Every issued certificate embeds the workload’s SPIFFE ID as a URI SAN, so SPIFFE-aware Server Workloads can authenticate the Client Workload during the TLS handshake.
  • Literal or dynamic Subject and SPIFFE ID: Configure either field with a fixed value or with template expressions that resolve at issuance time using workload attestation attributes.
  • Configurable Extended Key Usage: Default to id-kp-clientAuth for outbound mTLS, or add id-kp-serverAuth to use the same certificate as a server credential.
  • Configurable certificate lifetime: Set the lifetime in minutes (default 15). Agent Proxy automatically refreshes the certificate before expiration (typically at 80% of the configured lifetime).

For setup instructions, see Create an X.509-SVID Credential Provider. For concepts and the end-to-end issuance flow, see About the X.509-SVID Credential Provider.

Tags:

Expanded MCP and AI IAM event coverage

Aembit has expanded the event coverage and reporting surfaces for troubleshooting MCP and AI IAM failures:

  • New access.discovery event type: Access Authorization Events now include an access.discovery event that lists the Client Workloads and Server Workloads Aembit Cloud considered during evaluation. Use it to diagnose requests that match no workload or policy, or that match multiple. See Access Discovery events.
  • User identity on MCP Workload Events: MCP Workload Events now include a userId field at application.mcp.userId for flows that involve a human identity, such as MCP Authorization Server flows. The Workload Events view exposes a matching User (MCP App Protocol only) filter for per-user investigations and SIEM scoping.
  • Trust Provider failures emit at Error severity: Trust Provider attestation failures in MCP flows now emit at Error severity rather than warning, so SIEM alerts that watch for Error events catch real authorization failures reliably.
  • Clearer expired-credential explanations: The access.credential event’s reason now identifies which token expired and at which step, making it easier to decide between re-authentication, credential refresh, or Credential Provider reconfiguration.
  • MCP Authorization Tracing view: A new live diagnostic view in the Reporting dashboard surfaces inbound authorization requests at the MCP Identity Gateway in real time, with the redirect URI, resource, matched Client Workload, and policy outcome for each request. See MCP Authorization Tracing.

For an end-to-end investigation flow that uses these reporting surfaces together, see Troubleshoot MCP and AI IAM access.

Tags:

MCP Identity Gateway 1.31.4955 release

Aembit has released MCP Identity Gateway version 1.31.4955.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Session deletion: Support for deleting MCP sessions, enabling clients to explicitly end MCP Identity Gateway sessions when finished.
  • MCP-level error metrics: New Prometheus metrics expose MCP protocol-level errors, giving operators visibility into request failures at the MCP layer.
  • Application-specific Prometheus metrics: Additional Prometheus metrics scoped to the MCP Identity Gateway application for improved observability.
Tags:

Aembit Secrets Operator now available

Aembit Secrets Operator 1.31.298 is now available.

Secrets Operator is a Kubernetes operator that authenticates to the Aembit platform and synchronizes credentials into Kubernetes Secrets. Applications consume managed secrets the same way they consume any other Kubernetes Secret.

Key capabilities in this release:

  • Kubernetes Service Account authentication: Authenticate using the operator’s in-cluster ServiceAccount token, validated against the cluster’s OIDC endpoint. No per-cluster signing key required. Verified on Amazon EKS and K3s. See Set up Secrets Operator for configuration.
  • OIDC symmetric key authentication: Alternatively, authenticate using OIDC tokens with symmetric key signing (HS256) for custom claims and non-Kubernetes identity scenarios.
  • Proactive credential renewal: Credentials refresh at 80% of their TTL, or sooner when you configure a shorter refreshInterval, ensuring applications always have a valid credential.
  • Multi-namespace install: You can now use the same Helm release name across multiple namespaces on the same cluster without resource name conflicts.
Tags:

MCP Identity Gateway 1.31 release

Aembit has released MCP Identity Gateway version 1.31.

Key Updates:

  • User identity on workload events: The userId field now appears on mcp.request and mcp.response workload events when the MCP client is identified, making it easier to attribute MCP activity to authenticated users in audit reports.
  • Client-initiated session termination: MCP clients can now end their session with the Gateway by sending an HTTP DELETE request to the /mcp endpoint, per MCP specification section 2.5.5. See Session management for the request contract.
Tags:

Dynamic claims now support custom environment variables

Custom environment variables on Agent Proxy and Aembit CLI can now feed into OIDC and JWT-SVID dynamic claims, gated by an explicit allowlist.

What’s new:

  • AEMBIT_ENV_VAR_ALLOWLIST: A new environment variable that defines which custom variables Agent Proxy and Aembit CLI may capture for use in dynamic claims. By default, Agent Proxy and Aembit CLI capture no custom variables.
  • Always-available Kubernetes variables: K8S_POD_NAME, K8S_NAMESPACE, and KUBERNETES_PROVIDER_ID are now usable in dynamic claims regardless of the allowlist.

For setup instructions, see Configure custom environment variables for Agent Proxy. For the dynamic claims expression syntax, see OIDC and JWT-SVID dynamic claims.

Tags:

Edge components release with Oracle GA and HTTP proxy support

Aembit has released new versions of the following components and packages:

  • Helm Chart
  • Terraform ECS module
  • VM Agent Proxy package
  • Agent CLI
  • AWS Lambda Extension
  • AWS Lambda Layer
  • Agent Injector
  • Agent Proxy

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Oracle Application Protocol GA: Oracle Database protocol support is now available for production use, including mid-connection TLS support, improved client error handling, Prometheus metrics for Oracle credential injection events, and internal packet-handling improvements.
  • Upstream HTTP proxy support: Agent Proxy and Aembit CLI now support upstream HTTP proxy configuration for gRPC and Server-Workload-bound HTTP/HTTPS traffic, with NO_PROXY honored.
  • S3 upload size restriction removed: Large file uploads to AWS S3 Log Streams are now supported via streaming AWS chunked signing, removing the previous upload size limit. See How Aembit uses AWS SigV4 and SigV4a for more details.
  • Expanded credential resolver capabilities: Enhanced support for credential provider resolution across deployment types.
  • Dynamic claims from environment variables: Agent Proxy and Aembit CLI can now gather dynamic claims from environment variables, controlled by the AEMBIT_ENV_VAR_ALLOWLIST.
  • CLI enhancements: Aembit CLI adds the --client-workload-id flag and OIDC token expiration validation.
  • General improvements: Numerous stability reliability improvements across edge components.
  • Security upgrades: Security dependency upgrades across edge components.
  • Improved logging and observability: Improved request logging and enhanced error reporting for common failure conditions.
Tags:

Oracle Database now generally available

Oracle Database protocol support is now available for production use.

What’s new:

  • Oracle Database GA: Support for Oracle 19c and 21c is now available for production use. Aembit injects username/password credentials into Oracle TNS connections at authentication time, eliminating static database passwords without modifying your application code.
  • TLS connections: Oracle database connections can now use TLS via the TCP/IP with TLS (TCPS) protocol. You can enable TLS independently on the client-to-proxy and proxy-to-database sides by checking the TLS checkbox on the Port and Forward to Port fields in the Server Workload configuration.
  • Improved Oracle error handling: Agent Proxy now returns clearer ORA-* error messages when Oracle authentication fails, making it easier to diagnose credential injection and configuration issues.
  • Prometheus observability: Oracle credential injection events now appear in the aembit_agent_proxy_credential_injections_total metric with application_protocol="oracleDatabase", so you can monitor Oracle credential operations alongside other supported protocols.

For setup instructions, see Create an Oracle Database Server Workload. For a technical overview, see About Oracle Databases.

Tags:

OAuth 2.0 Authorization Code now uses centralized callback URL

The OAuth 2.0 Authorization Code Credential Provider now uses a centralized callback URL and supports an optional Final Redirect URL that supports custom or embedded integration scenarios.

What’s new:

  • Centralized Callback URL - OAuth 2.0 Authorization Code Credential Providers now use a single, centralized callback URL shared across Credential Providers on your Aembit stack. If you previously registered a per-tenant callback URL with a third-party provider, you don’t need to take any action.
  • Final Redirect URL - A new optional field that redirects users to a specified URL after completing the OAuth authorization flow, instead of returning to the Aembit Credential Provider page. Contact Aembit support to enable this feature.

For details, see OAuth 2.0 Authorization Code Credential Provider.

Tags:

Agent Proxy now honors HTTP proxy environment variables

Aembit has released new versions of the following components and packages:

  • Helm Chart
  • Terraform ECS module
  • VM Agent Proxy package
  • AWS Lambda Extension
  • AWS Lambda Layer
  • Agent Proxy

Agent Proxy now honors HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables. If your network routes outbound traffic through an HTTP proxy, you can configure these environment variables so that Agent Proxy routes its outbound connections through the proxy.

For details, see Agent Proxy environment variables.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Tags:

Refresh token support for MCP authorization flows

OIDC ID Token and Aembit Access Token Credential Providers now support refresh tokens for MCP Authorization Server flows. This feature applies exclusively to MCP Authorization Server use cases.

What’s new:

  • An Enable Refresh Token Support option on OIDC ID Token and Aembit Access Token Credential Providers.
  • An Absolute Token Lifetime setting that controls how long refresh tokens remain valid for exchanging for new access tokens after initial issuance.
  • Refresh tokens are single-use. Each exchange returns a new refresh token.

When enabled, the MCP Authorization Server returns refresh tokens alongside access tokens during OAuth token requests. MCP clients can exchange a refresh token for a new access token and a new refresh token, maintaining an active session without completing a new authorization flow. Other credential flows, such as Agent Proxy, are not affected by this setting.

To use this feature, edit your Credential Provider, toggle Enable Refresh Token Support to on, and set the Absolute Token Lifetime.

For details, see Token refresh, OIDC ID Token, and Aembit Access Token.

Tags:

MCP Identity Gateway 1.30 release

Aembit has released MCP Identity Gateway version 1.30.4549.

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • The Gateway now authenticates requests before proxying them to upstream MCP servers (new default behavior)
  • Tool annotations are included in MCP responses
  • The Gateway returns HTTP 405 for GET requests to the MCP endpoint
  • Unauthorized (401) responses now include additional metadata for easier troubleshooting
  • Errors from upstream MCP servers are forwarded to MCP clients
  • The Gateway honors the AEMBIT_TRUSTED_ISSUER_DOMAINS environment variable for trusted issuer configuration
  • A new metrics endpoint provides Gateway operational metrics on a configurable port
  • Improved compatibility with Claude Desktop and other MCP clients
  • Improved handling of MCP servers that don’t support resources
  • General improvements to session management, installer reliability, and internal performance
Tags:

MCP Authorization Server now supports unauthenticated flows

Aembit’s MCP Authorization Server now supports OAuth flows that don’t require end-user authentication. This enables use cases like ChatGPT apps and other MCP integrations where user sign-in isn’t needed or desired.

What’s new:

  • An Enforce SSO option on Client Workloads with the Redirect URI identifier type. Enforce SSO is on by default, preserving the current behavior of requiring user authentication.
  • When Enforce SSO is on, a multi-select dropdown lets you choose which SSO identity providers appear on the MCP authentication page. By default, all configured identity providers are selected.
  • When Enforce SSO is off, the MCP Authorization Server issues access tokens without redirecting users to an identity provider. No Trust Provider is needed, but a Credential Provider is still required.
  • Access Policies still apply as an authorization control. You can turn off policies or entities to block token issuance.

To use this feature, edit your Client Workload, select the Redirect URI client identifier, and configure Enforce SSO under MCP Authorization Configuration.

For details, see Authentication support and MCP Authorization Server architecture.

Tags:

MCP Identity Gateway now supports MCP resources

Aembit has released MCP Identity Gateway version 1.29.4419.

Key Updates:

  • MCP resource support for the Identity Gateway

The MCP Identity Gateway now proxies MCP resource requests in addition to tool requests. MCP servers that expose resources (such as files, database schemas, or application data) are now accessible through the Gateway with the same identity-aware access policies, credential isolation, and audit logging that govern tool invocations.

What’s new:

  • resources/list discovers available resources across all assigned MCP servers. The Gateway fans out the request and aggregates results from all connected servers.
  • resources/read retrieves a specific resource by URI from the appropriate MCP server.

No action required. Resource support is available automatically after upgrading to MCP Identity Gateway 1.29.4419. Your existing access policies, Trust Providers, and Credential Providers apply to resource requests with no configuration changes.

For details, see MCP resource support.

Tags:

Edge components release with S3 stability and OpenShift improvements

Aembit has released new versions of the following components and packages:

  • Helm Chart
  • Terraform ECS module
  • VM Agent Proxy package
  • VM Agent Controller package
  • Agent Proxy
  • Agent Controller

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Apply stability improvements for S3 uploads and downloads
  • Improve Helm Chart compatibility across Kubernetes platforms including Red Hat OpenShift (ROSA)
Tags:

Oracle Database support enters beta with new process-based identifiers

Aembit has released new versions of the following components and packages:

  • Helm Chart
  • VM Agent Proxy package
  • VM Agent Controller package
  • AWS Lambda Extension
  • AWS Lambda Layer
  • Agent Injector
  • Agent Proxy
  • Agent Controller

For the latest available versions of these components, see the Edge Components Supported Versions page.

Key Updates:

  • Oracle Database protocol support (Limited Beta)
  • Support Process Command Line and Process Path client workload identification

Aembit’s Agent Proxy now supports the Oracle Database application protocol in Limited Beta. This enables Aembit to manage access for client workloads connecting to Oracle databases by intercepting the TNS wire protocol and injecting credentials transparently.

Key capabilities:

  • Username/password credential injection for Oracle 19c and 21c databases (12C password verifier only)
  • Support for thin Oracle clients (Java, Python), with experimental thick client support
  • Tested with AWS RDS for Oracle and containerized Oracle environments
  • Transparent steering on Linux VM deployments

For setup instructions, see the Oracle Database Server Workload guide. For an overview of how Oracle protocol support works, see About Oracle Databases.

Aembit’s Agent Proxy now supports Process Command Line and Process Path as Client Workload identifiers. These identifiers allow you to identify client workloads based on their full command line or executable path, providing more granular control over which applications can access your protected resources.

Key capabilities:

  • Process Command Line: Identify workloads by the full command used to start them, including arguments. Supports wildcard matching to target specific arguments (for example, *--env production*).
  • Process Path: Identify workloads by the exact filesystem path of the executable.
  • Combine with other identifiers like Process Name and Process User Name for precise matching.
  • Supports Linux virtual machine deployments.

For configuration details, see Process Command Line and Process Path.

Tags:

MCP Identity Gateway enters beta with MCP Server and component copying

Aembit now offers an MCP Identity Gateway (Beta) that sits between AI agents and MCP servers, enforcing Access Policies, performing secure token exchange, and providing visibility into MCP activity. Deployed on a Linux VM, the Gateway ensures AI agents never hold direct credentials for enterprise systems.

Key capabilities:

  • Proxies MCP traffic with identity-aware policy enforcement
  • Performs secure token exchange using OAuth 2.0 and API key credentials
  • Provides per-user credential management and centralized MCP routing
  • Logs agent identity, user identity, and policy decisions for auditability
  • Fail-closed behavior—denies access by default unless explicitly allowed

For setup instructions and architecture details, see MCP Identity Gateway.

Aembit now provides an MCP Server that enables AI agents and users to query Aembit event logs using structured commands. Built on the Model Context Protocol specification, the MCP Server enables agentic observability and auditability for organizations using Aembit.

Key capabilities:

  • Query audit logs, authorization events, and workload events
  • Integrations with MCP Inspector, Claude Code, GitHub Copilot, and Visual Studio
  • Resource-set-based access scoping for least-privilege access
  • Read-only access—no create, update, or delete operations
  • Full audit trail of all MCP Server queries

For setup and connection guides, see Aembit MCP Server.

Aembit has added a new MCP User-Based Access Token Credential Provider type. This type enables per-user OAuth credentials for MCP servers using the OAuth 2.0 Authorization Code flow. The MCP Identity Gateway manages user-specific tokens when connecting to downstream MCP servers.

Key capabilities:

  • OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE) support
  • MCP Server URL discovery with auto-population of OAuth endpoints
  • Per-user credential scoping
  • Token introspection and lifetime management

For configuration details, see MCP User-Based Access Token Credential Provider.

Aembit now supports component copying between Resource Sets. You can replicate Access Policy components—including Client Workloads, Server Workloads, Trust Providers, Credential Providers, and Access Conditions—from one Resource Set to another. You can also copy entire Access Policies with all related components at once.

Key capabilities:

  • Copy individual components or entire Access Policies between Resource Sets
  • Each copy receives a unique identifier while the original remains unchanged
  • Supports environment promotion, regional deployments, and safe experimentation

For details, see About component copying and Copy components.

Tags:
Copyright © 2026. All rights reserved.Privacy PolicyTerms of ServiceTrust CenterContact Aembit