Changelog

What shipped across recent mcpgate releases. Self-host operators get the full prose in the image's CHANGELOG.md.

v2.0.2347latest

18 August 2026

✨ Features

  • Metabase now exposes its read surface.
  • Play Vitals error search now takes a time window.
  • Google Ads recommendations can be generated for a brand-new account.
  • Service accounts now carry an explicit permission for receiving customer data unmasked.
  • Service-account lifecycle and permission changes are recorded in the durable audit log.
  • Three engineering rules moved from advisory to enforced.
  • Reach-debt ratchet: unreachable source files can no longer be added.
  • Fix branches now prove their changes are reachable by tests.
  • The reachability sweep now watches for new credential-like required parameters.
  • Adds a machine-readable engineering-rules layer (beliefs/) with CI integrity checking.

🔧 Improvements

  • The engineering-rules layer now re-proves its own guards instead of trusting a label.
  • A scope an action needs is now checked against what the connector actually asks for.
  • AGENTS.md update
  • Metabase reads are now an explicit allowlist, and one verdict decides whether a call failed.
  • Nightly image scan now pages once per advisory.
  • Play vitals error search is audited against the right operation, and can now be ordered.
  • Container images now carry the distribution's current security patches.
  • Connector coverage now notices an operation that disappears upstream.
  • Google Analytics report actions are audited against their upstream operation.
  • Tighter redaction in the Redis privacy audit report.
  • Wider connector vocabulary in the Redis privacy audit report.
  • The engineering-rules layer refuses to describe itself incompletely.
  • A service-wide hook declaration now reports what it cannot bind.
  • Service-wide hook declarations survive the file merge, and a misspelled hook name is reported at load.

🐛 Fixes

  • A declarative guard that cannot run now refuses the call instead of being skipped.
  • Cached credentials are now scoped to the connector that minted them.
  • A refused connector file no longer leaves the connector serving without credentials.
  • Pins the hosts that may receive a connector credential.
  • A stored instance credential no longer follows an instance to a different address.
  • Corrects the recorded threat model for connector declarations.
  • The slow-test gate now measures machine load across the whole run.
  • The test suite no longer reaches a developer's own Redis.
  • A rule's self-check now has to show that a passing check turned failing.
  • A connector declaration can no longer choose the host its credential is sent to.
  • Short-lived credentials in the auth cache are now encrypted at rest.
  • The BI connector's read surface deliberately keeps recently-viewed routes out.
  • A check an action declares either runs, or the call is refused.
  • The BI connector's request path is now covered by a test that issues a request.
  • A connector whose auth block cannot be acted on is now refused at load time instead of calling upstream without a credential.
  • The pre-commit suite reports up to five failures per run instead of stopping at the first.
  • Each parallel test worker now uses its own data directory.
  • Tightens the static audit that catches an advertised-but-unwired parameter.
  • Instance-wide guards shipped in a release now reach every replica.
  • Tightens the read-only boundary of the BI connector's imported action set.
  • One answer to whether a call failed, across every surface that reports it.
  • The image-scan alert survives its own edge cases.
  • The nightly image scan is harder to silence.
  • The GitHub mirror recovers from a merge conflict on its own.
  • Self-healing runs no longer share a temporary file.
  • Custom methods that hang off the API version now build a reachable URL.
  • Operators can now see when the PII rules in force are not the ones on disk.
  • Google Ads now targets the current API version.
  • The Google Ads long-tail catalogue follows the connector's API version.
  • Slack search now reports how many results there are.
  • A write is no longer allowed through when the PII configuration cannot be read.
  • The observability tools stay reachable when the PII configuration cannot be read.
  • The stored-key compliance report no longer prints a plain name.
  • The engineering-rules check reports a malformed entry instead of stopping on it.
  • A rules file that declares what it is has that honoured.
  • Slack admin listings return their data again.
  • A malformed hook binding is reported instead of stopping the connector catalogue.
  • Slack surfaces every API refusal as a gateway error.
  • Slack listings can be paged.
  • Slack responses keep their provenance.
  • Redirect protection now covers connectors whose credential comes from a pluggable auth resolver.
  • Connector error responses now pass through their response hooks.
  • Tightens which read-labelled actions count as reads for delegation.
  • Delegated callers are recognised by the identity the gateway verified, not by the name a client gives itself.
  • Clarifies a note in the Slack reminder hook.
  • Async execution refuses a body it can already tell is wrong.
  • Slack direct messages and reminder listings hold up at their edges.
  • Corrects a stale note in the Slack reminder hook.
  • Keeps the full response envelope on filtered Slack reminders.
  • Async tool execution answers a malformed request with a client error.
  • Document Review admin page now has a contract test.
  • Saves that only redirect now report a failed write too.
  • A redirect can no longer carry a credential to the host it points at.
  • Delegation risk now reads the HTTP method, not only the declared mode.
  • Imported connectors stay on their declared server.
  • Steadier test suite for contributors.
  • One CSV-injection guard for every admin export.
  • Passthrough endpoints stay on their own service.
  • Config saves now report what they achieved.
  • Extends cross-origin write protection to every session-authenticated route.
  • Refines cross-origin write protection for programmatic clients.
  • Parallel test runs keep a file's tests on one worker.
  • Tests hand the process environment back unchanged.
  • Write operations no longer report success when the write did not happen.
  • Hardens the automations API against malformed requests.
  • Provider health counts each connected user once.
  • Tightens input handling on the clients admin API.
  • Tightens the Organization page save path.
  • Sharpens the fix gate's reach verdict and its mutation budget.
  • The fix gate no longer accepts a shared symbol name as proof that a test covers a file.
  • Clients keep their identity across gateway instances.
  • A connection that names no client no longer inherits the previous name.
  • Slack direct messages are now discoverable from the tool surface.
  • Service-account access tokens now live as long as the work, not a quarter.
  • A submodule pointer can no longer move by accident.
  • A token's validation record is never kept shorter than the token itself.
  • The self-heal worker's gateway client recovers from a rejected token instead of failing every later call.
  • The local test suite now gates the push instead of every commit.
  • Slack long-tail actions no longer demand an unfillable auth token.
  • Signing in no longer leaves behind an access token nobody receives.
  • MCP access tokens are recorded with the lifetime their client was told, on the record the request validator actually reads.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2347

v2.0.2255

14 August 2026

✨ Features

  • Telemetry records which source identified the calling client.
  • Connectors can front several upstream hosts.
  • Client-side list shaping is declarative.
  • Browser error collection for Next.js prototypes.

🔧 Improvements

  • Preview configuration is applied reliably across frameworks.
  • Saving a preview reports the commit it made.
  • A connector's multi-step actions live in its own module.
  • Connector parameter fidelity is asserted, not assumed.
  • Preview instrumentation is easier to audit.

🐛 Fixes

  • A preview session is never torn down over an incomplete save.
  • A save that failed on a leftover lock can now succeed on retry.
  • Preview edits reach the dev server whatever entry point the session was opened with.
  • Preview commits no longer carry build state.
  • A preview's reload endpoint no longer shadows an application route.
  • A refused file access names the right cause.
  • Every refusal the caller can resolve now reads as a warning.
  • Client-source telemetry is reset per request and its counter documents every value.
  • Log queries say what the returned data actually covers.
  • Parameters an action cannot apply are reported even when a hook answers the call directly.
  • Connection status for services that authorise per workload.
  • Clearer permission verdicts where a connector cannot be fully read.
  • A permission verdict now says clean only about what it checked.
  • Audit rows band a caller's own mistake as a warning, not a failure.
  • Permanent Gmail delete now states the permission it needs.
  • Permission reporting for connectors that authorise per workload.
  • Steadier permission verdicts on connectors that authorise per workload.
  • Quieter reporting when a connector's routing table cannot be read.
  • JSON:API sparse fieldsets reach the wire.
  • Tightens the multi-backend transport.
  • Sharpens the multi-backend guard rails.
  • Failed tool calls now record the upstream cause, not the envelope around it.
  • The Context Map answers a get call that arrives without a page id.
  • The audit view keeps red for genuine failures.
  • Prototype config patches no longer reach the branch.
  • Connector action sets generated from an API specification are now verified against a fresh import.
  • Regeneration of the generated connector action sets no longer depends on files outside the repository.
  • Generated connector action sets now record the API spec revision they were built from.
  • The test suite no longer reaches the network to resolve names it never connects to.
  • Google Workspace connector metadata brought back in step with its API specification.
  • Tighter network isolation for the test suite and steadier connector-metadata checks.
  • Connection attempts to names that only resemble local addresses are now refused as well.
  • Both network entry points now share one hostname rule.
  • Hostnames that merely resemble local ones are no longer treated as local.
  • Host names are compared only in the way a resolver treats as identical.
  • Fewer false-alarm bug reports from routine cancellations.
  • Local test runs answer instead of stalling when Redis is unreachable.
  • Tighter guards on the noise filters shipped alongside.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2255

v2.0.2222

13 August 2026

✨ Features

  • A connector can teach the gateway its own refusal dialect.
  • Acting as a person is now a permission on the service account, not an environment variable.
  • A trusted service can run an action as an authenticated person.
  • An automation approval waiting for a decision now says so, from any page.

🔧 Improvements

  • The act-as permission is a switch, matching every other immediate-effect setting on the clients page.
  • A connector can declare its audience as all explicitly.
  • A refused log query no longer reads as a gateway fault.
  • Log queries, Home Assistant errors and live configuration changes each hold to a limit they previously only mentioned.
  • Two checks that only ran on a developer's machine now also guard the shared branch.
  • A lookup that was refused no longer looks like a lookup that found nothing.

🐛 Fixes

  • A permission error no longer blocks the retry that follows the fix.
  • Microsoft 365 can now set mailbox settings, and a denied Graph call says which permission it needed.
  • A permission error now says which of the three things went wrong.
  • The high-risk delegation gate now fails closed when it cannot classify an action.
  • A refusal that could not be delivered, and three that overstated their case.
  • Refusals now say who can lift them.
  • A refused shared-automation run now names the step you can take alone.
  • The design-system check judges the stylesheets a commit actually ships.
  • Prototype workspaces report setup failures instead of serving the wrong branch.
  • Prototype sessions and their pods now expire together.
  • Prototype sessions belong to the person who started them.
  • Prototype workspace reclamation is more careful about what it ends.
  • Extending a prototype session keeps the window in which its expiry is acted on.
  • Prototype files under a dynamic route can be opened again.
  • A shortened log query says so instead of quietly returning less.
  • Container CVE findings now reach someone.
  • The letter shown when a service logo fails to load is readable again.
  • The design system's own palette is contrast-checked where its bytes are real.
  • The link to a waiting approval lands on it reliably, and the count stays honest.
  • A failing local run is never lost from its own record.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2222

v2.0.2194

12 August 2026

✨ Features

  • An on/off setting looks the same on every admin page, and setting up a Context Map repository is one step.
  • The Context Map admin page is now a browsable corpus, not a list.
  • GitLab: reply inside an existing merge-request discussion.
  • GitLab connector gains discussions, labels, milestones, boards and todos.
  • GitLab: label, milestone, token and comment options the connector could not reach.
  • Admin pages are now checked in a real browser against a running backend.
  • Every admin page is now captured as an image, and a sixth review perspective reads them.
  • Every admin page now shows its own title.

🔧 Improvements

  • A failed upstream call is now a distinct type rather than a convention.
  • Failed connector calls carry their error type along the delegation chain, not only where the error is built.
  • Failed connector calls are recognisable as failures on the paths a call actually takes.
  • Error envelopes the gateway builds itself are recognisable too.
  • A failing pre-commit run now answers whether the suite or the change decided it.
  • A vendor moving its API documentation no longer goes unnoticed.

🐛 Fixes

  • Prototype saves keep their push credential across gateway restarts.
  • Clearer guidance when an upstream answers with more data than the gateway will carry.
  • A failed call stays recognisable after the gateway enriches it.
  • Structured body fields now advertise their real shape.
  • A test that fails in two different output shapes is now recorded as one test.
  • Red status text stays readable on the lighter surfaces it appears on.
  • Three pieces of status text that were hard to read now aren't.
  • A brand colour that would make the panel unreadable is refused at save time.
  • The review ledger records the design round that shipped this week.
  • A spreadsheet operation now names the tab it could not find instead of using another one.
  • Text across the admin panel is checked against WCAG AA, and three places that missed it are fixed.
  • A colour token now belongs to one stylesheet.
  • Service discovery answers on every connected service.
  • Follow-ups from an adversarial review of the evening's admin-panel work.
  • The Context Map now names its type gap by what would close it.
  • One kind is now one entry in the Context Map, however it was spelled.
  • Gmail says when an attachment request cannot be met, instead of sending the mail without it.
  • The test suite no longer inherits the machine's own gateway configuration.
  • The sidebar shows one current page again, and the operations page leads with its answer.
  • Spacing across the admin panel now has a scale to drift from.
  • Operations that cannot be completed correctly now stop instead of doing something else.
  • Forwards and moves handle awkward inputs and partial failures correctly.
  • Two actions that destroy more than they looked like now warn before the dialog does.
  • On the clients page, a control's weight now matches what it does.
  • A failed lookup no longer answers as if it had succeeded.
  • The setup-help panel keeps its distance from the list below it.
  • Switching the Context Map to a different repository now writes the starter files into the new one.
  • Calendar and Gmail now say when a parameter had no effect, instead of succeeding quietly.
  • The dropped-parameter diagnostic no longer reports fields that are sent.
  • Transient upstream failures no longer open an issue on first sight.
  • The allowed-services picker on the clients page says what it is offering.
  • Log queries return the line budget you asked for.
  • A sync that never answers can no longer freeze its own button.
  • Restores the admin panel's styling.
  • The hidden attribute now hides, everywhere in the admin panel.
  • "Sync now" on the Context Map page shows that it is working.
  • A shared admin stylesheet drops the half of it that styled nothing.
  • The setup help panel lines up with the fields it explains.
  • The Context Map browser's toolbar lines up with the panes beneath it.
  • The panel chrome stops overruling pages about their own buttons.
  • Two repositories with the same name no longer collapse into one Context Map page.
  • The admin panel stops overriding the pages it hosts.
  • The Context Map page preview is bounded, and setting up a repository can be retried.
  • Admin page styling moves out of the markup and into stylesheets.
  • Two admin pages stop being separate documents, and the panel stops arguing with them.
  • The sidebar's current entry goes back to looking as it did.
  • The navigation says where you are, not just where your pointer is — and every admin page carries a name.
  • Two addresses and one credential no longer sit in Redis in the clear.
  • Admin pages name themselves once, and the usage toolbars line up.
  • Every admin page states its own name, and actions sit where the eye looks.
  • One switch component across the admin, and the date filter stays on screen.
  • Every connector's API-documentation link resolves again.
  • Deliberate refusals now read as warnings in the audit log.
  • Read tools band their deliberate refusals like write tools do.
  • Pages no longer say their own name twice, and Action Usage gets the room Data Usage has.
  • Page titles now sit exactly on the box they name.
  • Page titles line up with the content again, and the scanning pages get their width back.
  • The browser check now verifies that a message survives a page reload, and reports its coverage accurately.
  • One way for admin pages to report what happened.
  • In-page messages now behave the way the dialogs they replaced did.
  • Admin pages now share one content width.
  • The test suite no longer reaches the network.
  • Destructive maintenance actions now look destructive.
  • The admin navigation on narrow screens says that it continues.
  • Empty sections and expandable areas now look the same wherever they appear.
  • Tightened the checks that guard the admin page captures and titles.
  • The suite-cost line reports what it measures.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2194

v2.0.2117

8 August 2026

✨ Features

  • A repository that already carries a knowledge bundle is recognised as it is.
  • Log lines carry the id of the trace they belong to.
  • Context Map pages can declare when they go stale, and foreign knowledge bundles are read correctly.
  • A repository can now contribute several Context Map pages instead of one.
  • Context Map pages now carry an Open Knowledge Format type.

🐛 Fixes

  • Bug reports keep their classification when the triage answer runs long.
  • Hook-computed request parameters now reach the API.
  • Keeps the field selector on Confluence content search.
  • A local guard catches the suite getting more expensive, on the commit that causes it.
  • The structural test suite parses the connector catalogue once instead of sixteen times.
  • One more structural test reads the connector catalogue through the shared parse.
  • CI reports how much CPU a test job actually got.
  • The suite-cost guard no longer mistakes a busy machine for a slower test.
  • The admin pages are rendered once per test run, not twice.
  • Updates pypdf and cryptography to their fixed releases.
  • MCP access tokens now record the lifetime their client was told, and rotations are audited.
  • Only a top-level index file can override the Context Map index.
  • An unreachable trace collector no longer reads as a gateway fault.
  • Remediation links now honour APP_BASE_URL.
  • Adding or renaming a connector takes effect for the sign-in check immediately.
  • Connector auth-retry logging masks the account address
  • Provider-side authorization refusals are reported as what they are.
  • Audit-log CSV export now matches what the page shows for any search term.
  • Context Map kinds survive an index built by an earlier release.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2117

v2.0.2095

7 August 2026

✨ Features

  • Imported connectors gain the operations that were silently dropped.
  • Imports now report which operations produced no action.
  • The confirmation prompt now asks about blast radius, not the HTTP verb.
  • Risk categories now recognise imported action names.
  • A risk category now says whether it prompts or disables.
  • Confirmation now tracks reach, not recoverability.
  • One decision for what a path addresses.
  • Confirmation now explains itself, and reach is read from the API's own structure.
  • Shared automations now advertise the arguments they accept.
  • A shared automation's approval now remembers what it accepted.
  • Pipedrive notes are now readable.
  • Form-encoded request bodies.
  • Connection tiles can now verify the upstream is actually reachable.

🐛 Fixes

  • A parameter a connector cannot apply is refused instead of ignored.
  • Confirmation gate covers vendor resource:verb endpoints.
  • A destroying operation is recognised when the path names it, not only when the method does.
  • The advertised automation arguments stay current.
  • Pipedrive deals, contacts and notes accept quoted ids.
  • Four auth error paths now name the failure.
  • Auto-merge intent is never silently lost.
  • Confirmation gate now covers irreversible POST operations.
  • Names the failure in two more connector error paths.
  • A field the upstream really has is no longer shadowed by the caller's identity.
  • An OpenAPI import now says what it will not be able to send.
  • Guest invites now cover per-user-credential services.
  • Concurrent admin visibility changes no longer overwrite each other, and a freshly connected hidden service says so.
  • Outbound request errors now name the failure.
  • Grafana log search now applies every search term.
  • Actions no longer ask for metadata the service does not want.
  • Starting an MCP session no longer scales with the size of the install.
  • Refreshing a token from the connections page uses the same coordination as everywhere else.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2095

v2.0.2065

5 August 2026

✨ Features

  • Release assets and translation files move as files in both directions.

🐛 Fixes

  • A connection must be finished by the person who started it.
  • Connection ownership is judged by canonical identity.
  • Starting a service connection always requires signing in.
  • Transfer-route reachability is checked against the running code.
  • Uploads refuse a destination they cannot honour.
  • Connect flows no longer trust an identity the upstream or the link supplied.
  • Signing in and connecting a service are now separate acts.
  • A connector cannot become the sign-in provider.
  • Authorization flows keep working while service connections stay gated.
  • Turned-away connection attempts are recorded as such.
  • The listings that make a download addressable.
  • Analytics report listings accept the field selector Apple offers.
  • Parameters an action documents can now actually be passed.
  • Hardened OAuth connect identity and token revocation.
  • Sturdier token storage and permission adoption.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2065

v2.0.2052

5 August 2026

🐛 Fixes

  • MCP OAuth authorization responses now carry the RFC 9207 iss parameter.
  • OAuth error redirects now carry state and the RFC 9207 iss parameter.
  • Hardened authorization-response composition.
  • Fail-closed error handling on the ChatGPT authorization entry point.
  • Authorization error responses are bound to the redirect allow-list.
  • Three parameters that were silently ignored now take effect.
  • Calmer logging for caller-input errors after token refresh.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2052

v2.0.2045

5 August 2026

✨ Features

  • Files from Microsoft 365 and Home Assistant now stream instead of filling the context window.
  • Adds a check that a page's scripts only address elements the page contains.
  • Upload routes for repository files, release artifacts, translations and product images.
  • Group conversation attachments and Pipedrive product images now stream.
  • Five more Microsoft 365 file shapes now stream.
  • GitHub, Figma and Sentry can now stream files.

🐛 Fixes

  • Repository files from GitLab now stream as files.
  • Hardens the check that a page's scripts only address elements the page contains.
  • Your brand colour now actually reaches the admin panel.
  • Hardens the check that keeps operator branding visible.
  • Cuts the service-import page from 1.2 MB to 217 KB.
  • Tightens admin-surface HTML escaping and import validation.
  • Closes a hook-import dead end.
  • Trims further dead stylesheet rules from the service-import page.
  • A lost permission mapping is no longer reported as a resolved one.
  • The gateway can now tell which Microsoft 365 actions your permissions cannot run.
  • The transfer coverage inventory can no longer drift.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2045

v2.0.2032

4 August 2026

✨ Features

  • OneNote support for Microsoft 365.
  • A connector can now select an upstream representation by request header.
  • Teams meeting recordings and transcripts download as files.
  • OneDrive and SharePoint files download by drive id, and via sharing links.
  • Teams inline images are now retrievable.
  • Responses that carry a file inline now say so.
  • File coverage is now guarded, and reaches calendar attachments.

🐛 Fixes

  • A single-workload grant now reaches that workload's file transfers.
  • Endpoint identity in the action importers is now decided the same way on both sides.
  • Binary responses now point at a tool that exists.
  • Long-tail action catalogues no longer lose an endpoint to a name collision.
  • Jenkins credentials are checked when they are entered.
  • A credential check that cannot answer no longer blocks connecting.
  • Per-user credentials are checked when they are entered, not when they are first used.
  • A CI job log no longer arrives unbounded, and keeps the part that matters.
  • A log search is no longer silently truncated.
  • Per-user connectors can derive the account login from the signed-in identity.
  • A paused shared automation is now described as paused on every surface.
  • Clearer operator alert when a shared automation pauses itself.
  • Transfer tickets now always carry size_bytes and sha256.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2032

v2.0.2012

4 August 2026

✨ Features

  • Microsoft 365 files now move in both directions.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2012

v2.0.2011

3 August 2026

🐛 Fixes

  • Confluence scope adoption connects and saves safely.
  • A credential saved in the admin UI now counts as configured everywhere.
  • Service availability now reflects every required credential, wherever it is stored.
  • Search-discovery tests follow the full credential requirement set.
  • Startup encryption sweep now follows owner-declared key policies.
  • Action search reflects configuration and permission changes immediately.
  • The action catalogue reports credential state from the same gate the tool list uses.
  • The PII sweep leaves deliberately-unencrypted annotations alone.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2011

v2.0.2003

3 August 2026

🐛 Fixes

  • Connectors stay available when an optional setup field is empty.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2003

v2.0.2002

2 August 2026

✨ Features

  • Connector for a role-aware internal CRM/admin API.

🔧 Improvements

  • Service detail page uses the shared status colours.
  • Removes a duplicated sign-in stylesheet and lets admin cards follow the theme.
  • Stylesheets are now covered by the design-system check.
  • CI now verifies the merge result, not only the branch.
  • Faster self-heal correction before review.
  • Leaner service detail page.
  • The admin UI's page shell is now enforced, not just documented.
  • Lighter hook builder.

🐛 Fixes

  • Fixes an unreadable active filter button in the support view.
  • Restores the missing focus outline on four input fields.
  • Clear self-heal approval hand-offs.
  • Consistent service visibility across replicas.
  • Admin pages now answer a refusal instead of rendering an empty shell.
  • Quieter logs when a request is abandoned.
  • Two query-parameter shapes the gateway could not send at all.
  • Tightens authorization on the operator console.
  • Hardened how the admin pages embed data for the browser.
  • Steadier hook builder and a tighter action feed.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.2002

v2.0.1985

2 August 2026

✨ Features

  • A user is told when their own connection has fallen behind.

🔧 Improvements

  • Consistent loading placeholders across the admin surface.
  • Much lighter services page.
  • The Branding and Welcome pages move into their own modules.
  • The Tokens and Subscription pages move into their own modules.
  • The Organization and Overview pages move into their own modules.
  • Admin pages render substantially faster.
  • Faster service detail page.
  • The service detail page moves into its own module.
  • Steadier admin section rendering under the section split.
  • The services list moves into its own module.

🐛 Fixes

  • The last floating tag in the build chain is pinned too.
  • Release numbering only ever moves forward.
  • Release numbering stays reliable even with an unusual tag in history.
  • The whole CI docker toolchain is pinned, not floating.
  • Image builds push a single manifest again.
  • Hardens the admin render-path caches.
  • Tightens the key-cache lifetime.
  • Saving an action change no longer rebuilds every connector's tool schema.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1985

v2.0.1970

1 August 2026

🔧 Improvements

  • Every place that reports an unconfirmed permission now offers the next step.
  • The per-connection drift line is gone from the service page.
  • The action summary opens with what is switched on.
  • Permissions can be requested for on-demand actions without promoting them.
  • The action table asks one question fewer.
  • Switching actions on or off is now near-instant.
  • A published version number describes exactly one release.
  • Unconfirmed permissions are visible where an operator looks for work.
  • Permissions for newly enabled actions are derived, not retyped.
  • Every published version number now identifies a build you can pull.
  • A service tile stops reporting green once a capability it exposes is unproven.
  • Action table columns line up, and the summary line is now a filter.
  • A playbook for diagnosing slow test runs.

🐛 Fixes

  • Saving an action change is roughly ten times faster.
  • The permission marker on an action row is drawn instead of typed.
  • A governance save no longer costs the other container a full catalogue re-parse.
  • The permission marker on an action row is legible and no longer clipped.
  • Context Map sync re-scans the configured discovery groups.
  • Connectors can declare that a provider's scope lists are permission tiers.
  • The affected-actions list now matches the permission it is shown next to.
  • Clearer signal when a parameter is not applied.
  • A governance change now reaches every container, and the fix button only appears where it can act.
  • Service tiles now receive the permission status the server computes for them.
  • Workspace exports honour the format you ask for.
  • Four parameters that were being silently ignored now take effect.
  • Paging through starred projects.
  • Four corrections to the permission-adoption flow.
  • A promoted action no longer disappears on the next save.
  • A Google permission failure reaching the connections tile is now pinned by tests.
  • File transfers now validate every redirect they follow.
  • Configuration writes now survive a host crash, and an empty environment variable no longer shadows a configured value.
  • The shared configuration file now has the last word in every case.
  • The magic-link confirmation step is bound to the browser that opened it.
  • Configuration ordering across containers is now anchored on the file, not the broadcast.
  • Public URL resolution now honours APP_BASE_URL everywhere.
  • A configuration save that cannot get the shared lock no longer writes the file.
  • A configuration file that is behind what a container already applied is now left alone entirely.
  • The magic-link confirmation step now requires proof that the request came from the gateway's own page.
  • Configuration saves are now ordered across containers.
  • Magic-link login now shares the hardened same-origin rule.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1970

v2.0.1936

31 July 2026

✨ Features

  • Service pages now say which actions a connection cannot run.
  • The OAuth scope field now shows the whole set, not just your additions.
  • The permission warning moved to the moment it matters.
  • Admins can now see which connected users hold an out-of-date OAuth grant.
  • Saving a service now warns when its actions need OAuth permissions the installation does not request.
  • Extra OAuth scopes are now the operator's to configure.
  • Actions now record the OAuth scopes they need.

🔧 Improvements

  • Service definitions are read once per test process instead of repeatedly.
  • An automatically filed bug report now says when it is one of several from the same failure.
  • Test collection no longer waits on a Redis that is not there.
  • Test collection parses service definitions with the fast YAML reader.
  • Test runs report how much parallel capacity they were given.
  • Release numbering no longer needs a hand-picked version.
  • Merge validation checks the specifications this repository ships.
  • Admin pages are verified to parse in a browser before release.
  • The OpenAPI import checks parse their catalogue once instead of four times.
  • The dependency audit runs when dependencies change, and nightly.
  • Page-output verification runs alongside the rest of the suite again.
  • The permission-surface checks build their catalogue once instead of per assertion.
  • Page-output verification runs when a page can have changed, not on every commit.
  • Test runs report the machine they got at both ends, not just the start.
  • Startup stops resolving a Redis hostname it cannot reach.
  • Startup no longer waits out a full retry budget it has already spent.
  • Continuous-integration runs record the CPU they were given.
  • Page-level verification reaches the parameterised admin pages.
  • The admin surface begins splitting into per-section modules.
  • The log viewer inherits the shared admin layout.
  • Admin page output is pinned at the HTTP-response level.
  • Setup page rendering is pinned against silent drift.

🐛 Fixes

  • Configuration saves inside one container stay strictly ordered.
  • Switching read-only mode now tells you whether it actually took effect everywhere.
  • Importing a spec through the admin interface now routes each API family correctly.
  • Log searches survive more regular-expression shapes, and a self-healing change parked for review is now reported.
  • A parameter alias can no longer shadow another parameter.
  • A guessed action name can no longer run a different operation.
  • The service configuration page recovers its interactive controls.
  • An expired connection is reported as a reconnect prompt, not as a gateway fault.
  • Credential and permission fields are no longer spell-checked.
  • Signing in with Google works again on every entry point.
  • Saved-question and dashboard reads keep their timeout retries.
  • Connector connect links no longer advertise a narrower scope than they grant.
  • Configuration saves report what the gateway actually observed.
  • Two follow-ups from an external review of the same batch.
  • A long-running statement that can modify data is no longer retried after a timeout.
  • A wrong-typed action parameter now gets an actionable answer instead of an internal error.
  • Every operation in an imported specification now reaches the action catalogue.
  • Tightens what a governance Save confirms.
  • The gateway's public URL is configuration, not something a request can set.
  • A contact write is refused when an identifying field still holds an unresolved placeholder.
  • Same-origin check now derives the gateway's own origin from the request the browser addressed.
  • Governance saves report what actually happened, on every route.
  • Contact notes sent as HTML are allow-listed before they leave the gateway.
  • Connector scope sets are chosen by the gateway, not by the caller.
  • Confirmation now covers writes that destroy content or lower a security control, not only deletes.
  • Governance saves report a truthful, ordered outcome.
  • Stricter same-origin checks on state-changing admin endpoints.
  • Bulk action-governance saves now confirm success only when the save is complete.
  • Tightens the everyday/on-demand and high-risk approval toggles to real booleans.
  • Self-healing reports why a commit was refused, and stops repeating a refusal it cannot clear.
  • Multi-action saves on a service page apply in one request.
  • The per-service tool-search switch can no longer be routed around.
  • Sharper permission diagnostics and honest permission reporting.
  • The per-service tool-search switch now bounds what runs, not just what is found.
  • 403 responses now say which side has to grant the permission.
  • Curated action lists now only advertise actions a stock install can call.
  • The additional-scopes field is checked against the page an operator actually sees.
  • The admin page-rendering gate no longer expires overnight.
  • Confluence installs can now request scopes beyond the connector default.
  • Imported API specifications are validated more strictly.
  • Scope metadata reads an API spec's "no scope required" marker correctly.
  • Permission advice no longer points at site administration, and 17 dead Jira actions are gone.
  • Confluence's searchable action catalogue is reachable.
  • A missing-permission error now names the permission.
  • Actions that take a list accept a single value.
  • Jira board actions are now opt-in, so upgrading never blocks a connection.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1936

v2.0.1869

29 July 2026

✨ Features

  • Jira boards, sprints and backlogs are now reachable.
  • Action required for Jira operators.

🔧 Improvements

  • The stylesheet cache-buster check reports what it could not verify.
  • Local pre-commit and CI now provably run the same test lane.
  • The admin route module is ready to be split by section.
  • Groundwork for splitting the admin route module.
  • Every setup and admin page now inherits one shared layout.
  • The design-system check now runs where the work happens.
  • Three accessibility rules are enforced at commit time.
  • The setup and admin pages render through a real template engine.

🐛 Fixes

  • Board listings return usable fields, and Atlassian scope errors name the right tab.
  • Stylesheet updates reach browsers reliably.
  • Restores the design-token cache-busting references.
  • Jira long-tail actions now route correctly.
  • Form fields and the hook preset cards show keyboard focus.
  • The design-system check also runs in the pipeline.
  • Protecting an extra term in a document review no longer needs a mouse.
  • Popup menus no longer announce interactions they do not support.
  • Two admin pages are usable on a narrow screen.
  • Payment-card detection no longer misses numbers written next to short digit runs.
  • Boolean tool parameters accept the string "false" as false.
  • The review ledger tracks per-file review anchors.
  • The review-ledger consistency check now fails on every output path.
  • Test isolation for read-only mode no longer depends on run order.
  • Curating an OpenAPI import no longer requires a mouse.
  • The Hook Builder action picker opens from the keyboard.
  • Sortable table headers can now be operated by keyboard, and announce their sort state.
  • The "Send test via …" action in notification settings is reachable by keyboard.
  • Risk classification badges are reachable by keyboard.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1869

v2.0.1850

28 July 2026

✨ Features

  • Object- and array-typed write fields accept JSON text.
  • Metabase database description now rides schema and inspect responses.
  • Metabase schema tools now surface table and column descriptions.
  • Hook Builder: disabled hooks grouped and dimmed.
  • Hook Builder: enable/disable switch in the hook detail pane.

🔧 Improvements

  • Log queries and the automated review gate are harder to mislead.
  • The self-healing review gate judges a fix with the context it needs.
  • A failing test run now re-checks its failures before going red.
  • Windmill connections explain how to run code that is not yet deployed.
  • Deliberate guard refusals read as warnings in the audit log, not errors.

🐛 Fixes

  • Toggles and icon pickers now show keyboard focus.
  • Remaining page-level focus styles adopt the shared ring.
  • Keyboard focus is now clearly visible on every surface and with any brand colour.
  • Destructive buttons meet the contrast standard for their label.
  • Screen readers now announce toggle state, field names and async results across the admin panel.
  • Text that was effectively invisible is readable again.
  • Button text on a filled brand colour now picks itself.
  • The connections page no longer reloads itself every five minutes.
  • The audit stream labels its severity in text.
  • The CI flaky-test retry now actually runs.
  • Missing-parameter checks follow what the handler actually needs.
  • Long-tail action generation is reproducible, and drift is now detected.
  • Test isolation for the read-only switch.
  • The GitHub mirror no longer fails on its own concurrency.
  • A call missing a required parameter gets an actionable answer.
  • Spec refreshes now produce the actions they describe.
  • Actions accept the upstream API's own parameter names.
  • Log search tolerates any search text.
  • Long-tail actions return their full payload when the spec omits a response schema.
  • Plain-line postal addresses reach the CRM.
  • Organization writes now cover every field the CRM accepts.
  • Recognises operator-provisioned connectors in the automation connection precheck.
  • Removes a stray design note from the delegated-access card.
  • Tightens the delegated-access environment gate.
  • Adds pseudonym resolution for CRM person email fields.
  • Restricts placeholder resolution to minted placeholders.
  • Requires explicit service ids when an operator mints delegated access.
  • Windmill connections can now run scripts and flows.
  • Multi-service scope declarations parse whitespace as a separator.
  • Scheduled log scan no longer stalls after its first run.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1850

v2.0.1818

24 July 2026

✨ Features

  • Hook Builder: enable/disable toggle on every hook.
  • A content connector's note-write action can now request HTML rendering.

🔧 Improvements

  • Makes the Metabase connector engine-agnostic.

🐛 Fixes

  • Sharper payment-card detection.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1818

v2.0.1814

23 July 2026

✨ Features

  • A content connector can now append a note to a customer record.
  • The context-memory grade gate is now a runtime toggle on the Context Map admin page.
  • Context memory can now collect owed grades at the next write (grade gate).

🔧 Improvements

  • Enforces tool visibility at execution time.
  • Retires two completed one-time startup migrations.
  • Removes unused internal modules and dead code paths.
  • Strengthens automated verification of the OAuth and admin-authorization surfaces.
  • Trims unused internal modules.

🐛 Fixes

  • Isolates PKCE verifiers per authorization flow.
  • Fixes the toggle switches on the Context Map admin page.
  • Fixes several latent defects in token refresh, action routing, and metrics.
  • Tightens the context-memory grade gate: delegated (run-as-invoker) calls are never gated.
  • Operator alerts now timestamp in the configured display timezone.
  • Extends the operator deny-by-default gate to guest-management endpoints.
  • Hardens session, task, and token-refresh handling.
  • Hardens OAuth connection storage against transient decryption failures.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1814

v2.0.1798

22 July 2026

🔧 Improvements

  • Hardens PII scanning for large and grouped-path inputs.
  • Tightens self-heal approval clicks.
  • Release notes stay customer-neutral automatically.
  • Operators-only restriction now holds on grouped-service tools.
  • Standalone pages join the design-token system.
  • Requires proof of ownership before registering an automation.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1798

v2.0.1790

21 July 2026

✨ Features

  • Email-to-user-id resolution for the content connector.
  • Context Map: assign a review by name, resolved against active gateway users.
  • Context Map: an open-requests board + clearer review pings.
  • Context Map: a report can ask a specific colleague to review a page — and closes the loop.
  • Context Map: expertise routing is on by default with a one-click admin toggle.
  • Context Map: request a colleague's review from a page.
  • Context Map: reader issue reports.
  • Context Map: verify reviewed sources.
  • Context Map: read-time staleness signal.
  • Context Map: change ledger for declared sources.
  • Context Map: typed page sources.

🔧 Improvements

  • Consistent page titles and cleaner stylesheet loading in the admin panel.
  • Design-system guardrails now block style drift at commit time.
  • Tightens per-action authorization for grouped services.
  • Leaner admin styling foundation.
  • Recurring review ledger.
  • MCP proxy unknown-tool errors now list the available tools and suggest the closest match.
  • Clearer Google Admin SDK Reports setup.
  • Skip privacy scrubbing for vendored specification reads.
  • Clearer message when a response is withheld for privacy.

🐛 Fixes

  • Admin tab titles follow the gateway display name.
  • Refreshes design-token stylesheet cache-busters.
  • Context Map: review notifications are in English and use first names.
  • Context Map: name-based review assignment now understands real names.
  • Context Map: review notifications use people's names, not email addresses.
  • Context Map: tighter safety on reports.
  • Context Map: clearer, safer expertise requests.
  • Context Map: freshness epoch also applies to search previews.
  • Context Map: freshness cursors survive a metadata-store reset.
  • Context Map: harden freshness watch + reader reports.
  • Context Map: freshness watcher fix + pass visibility.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1790

v2.0.1758

16 July 2026

✨ Features

  • Sharper parameter feedback for AI clients.
  • Sharing decisions close the loop for everyone involved.

🔧 Improvements

  • Build-time guard against actions that expose a parameter they do not apply.

🐛 Fixes

  • Filters and fields now take effect on more search and write actions.
  • Project-scoped GitLab issue search.
  • Token refreshes for a connection now serialize behind a single lock.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1758

v2.0.1752

15 July 2026

✨ Features

  • Silently-ignored parameters are now visible to the caller.
  • Shared-automation approvals now cover the code version, not just the name.
  • User-submitted bug reports can now be fixed hands-free — with a maintainer approve step.
  • Terms-of-service onboarding for the vocabulary connector.
  • Creators can now share their automations self-serve, gated by a one-click operator approval.
  • Windmill path errors now come with directions.
  • WebMCP browser-agent surface (experimental).
  • Multipart passthrough for batch binary uploads.
  • Direct binary upload for vocabulary card images.
  • Bulk card edits for the vocabulary connector.
  • Self-heal MRs now carry a structured Confidence Card.
  • OpenTelemetry trace export (OTLP).
  • Duplicate bug reports are now caught before they fork.

🔧 Improvements

  • Browser-agent (WebMCP) controls moved to the Clients page.
  • Calibrated risk weighting on the self-heal confidence card.
  • Hook writes are now traceable.

🐛 Fixes

  • Manually configured service credentials now remain connected until explicitly removed.
  • Shared service access is reflected consistently.
  • Complete audit exports and clearer authorization errors.
  • Connection cards now reflect shared and external setup states accurately.
  • Clearer external connection guidance.
  • Reconnect prompts now catch status-only refresh rejections.
  • Per-page attachment listing for Confluence and honest body passthrough for Outlook reply actions.
  • Smoother terms acceptance on slow upstreams.
  • Hardens the shared-automation approval flow.
  • Hardened the untrusted-report self-heal flow.
  • The automation scope check now reads JSON-serialized definitions correctly.
  • The automation register action now accepts JSON-string list parameters.
  • Dependency locks refreshed against new advisories.
  • Confluence CQL search now works out of the box.
  • Connect errors now land on the connections page.
  • Bulk vocabulary writes now report skipped cards.
  • Hardens the vocabulary connector's media handling and read reliability.
  • Hardened the action off-switch and honest discovery copy.
  • The action catalogue is strictly two kinds: curated or searchable.
  • Action catalogue speaks one vocabulary: curated, searchable, or disabled.
  • Jira/Confluence Markdown rendering: nested formatting around inline code now converts to spec-valid ADF.
  • Action-catalogue discoverability: search flags, curated-subset markers, teaching errors.
  • Bot MRs stay clean of run artifacts.
  • Self-heal confidence proof now runs reliably in every engine.
  • Sub-service grants now unlock their umbrella tools.
  • Hot-reload no longer blocks the gateway.
  • Slack search results now render natively in Slack.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1752

v2.0.1709

11 July 2026

✨ Features

  • Edit vocabulary cards in place, with images.
  • Browse a deck's units and cards.
  • Generated cover images for content decks.
  • Service headers can bind to the calling user.
  • Token-exchange auth resolver gains per-request base-URL routing and custom exchange payloads.

🔧 Improvements

  • Dedupe against a whole deck in one call.
  • Smarter deck organisation.
  • Readable cover titles.
  • Guided deck creation — no more surprise decks.
  • Fewer accidental duplicate decks.
  • Clearer defaults when creating a vocabulary deck.
  • Setup wizard gates Connect/Verify behind the activation toggle.

🐛 Fixes

  • Reworks connector image-fetch rebind protection.
  • Further hardens connector image handling.
  • Hardens server-side image fetching for content connectors.
  • More robust card/cover image fetching.
  • Session renewal now slides the backing store too.
  • Reliable photo covers from a URL.
  • Better generated deck covers.
  • Per-environment routing now applies to the whole request.
  • IP-address masking no longer trips on dotted number runs.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1709

v2.0.1688

10 July 2026

✨ Features

  • Oversight tools can log the query they ran, not just that they ran.
  • Operators-only audience toggle on the service admin page.
  • Google Admin SDK Reports connector (Drive audit).
  • Operators-only service visibility.
  • Pipedrive deal, organization and person creation.

🔧 Improvements

  • Official Google Admin icon for the Admin SDK Reports connector.
  • Single 3-state visibility control for built-in services.
  • Google Cloud Logging defaults to operators-only.
  • Encrypts the download replay cache at rest.
  • Extends audit coverage to every tool-execution channel.

🐛 Fixes

  • Drive folder/search now honour the result limit.
  • Service registry never hands back an empty snapshot after a reload.
  • Drive folder listing and shared-drive search now work correctly.
  • Hardened MCP tools/list auth and operator recognition.
  • Audit-report reads keep the real actor identity.
  • Operators-only services are now hidden from search and can be widened to all.
  • Operators-only services are now hidden on the connections page too.
  • Session validation rides out transient backend blips.
  • Pipedrive single-record reads return full detail.
  • Run-as-invoker automations no longer fail on repeated runs.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1688

v2.0.1668

8 July 2026

🔧 Improvements

  • Broadens automated security test coverage.
  • Microsoft profile photos on by default.
  • Pinned the magic-link (passwordless) token security contract.
  • Pinned the authorization-decision matrix with adversarial tests.
  • Extended Google OAuth handler test coverage.
  • Removed an unwired token-security policy layer.
  • Hardened test coverage of the OAuth connect flow.
  • Consolidated OAuth callbacks onto one hardened path.
  • Added tamper-evidence to the audit trail.
  • Tightened credential-at-rest, delegated-access scope, and cross-session content isolation.
  • Hardened outbound request validation on spec-import and transfer paths.

🐛 Fixes

  • Hardens authentication, OAuth and logging edge cases.
  • Tightens OAuth and email input validation.
  • Audit log distinguishes caller-side argument errors from real failures.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1668

v2.0.1655

8 July 2026

🐛 Fixes

  • Profile photos render consistently across the admin area.
  • More robust OAuth, health and connector paths.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1655

v2.0.1653

8 July 2026

🐛 Fixes

  • Resolved edge-case defects surfaced by the coverage pass.
  • Deterministic OpenAPI spec-cache test.
  • Hardened OAuth redirects, webhook verification and diagnostics.
  • Hardened spec import, redaction and connector robustness.

Full changelog: https://mcpgate.de/changelog/

Docker: docker pull mcpgate/mcpgate:2.0.1653