v0.10.0
Released October 28, 2026. Supported until April 28, 2027.
v0.10.0 ships 34 behavior changes, 15 security updates, 24 new features, 24 bug fixes, and 2 deprecations. Behavior between the management plane and the data plane changed in this release. The most severe security issue cleared is critical.
A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.
The full release notes are opened from the Admin Console, as described in Check the management plane version.
Upgrade and rollback
- The release carries no breaking change. 50 changes name operator steps of their own, given with each change in the full release notes in the Admin Console.
- The upgrade does not roll through without dropping traffic. Plan a maintenance window.
- Rollback to v0.9.1 is conditional. See the note below.
Rollback keeps re-scoped MCP profiles on the customer's gateway.
Behavior changes
Catalog sync
The catalog sync job now runs the tetrate command-line image rather than the tare one.
Data plane
A caller admitted through a project's OIDC contract is served as its own API key when the management plane is 0.10.0 or later, which marks the contract for it; a data plane older than 0.10.0 serves that caller keyless. Available once the data plane is on 0.10.0 or later.
Management plane API
Updating a fallback policy is refused with INVALID_ARGUMENT when a changed chain is sent alone for a policy with several entries, or when chain and entries are both changed so they disagree.
Creating a gateway auth policy, or changing its extraction_header, is now refused when the header is x-tars-project or x-tars-project-id, because the data plane reads either one as the request's project.
Fleet audit reads require explicit platform permissions; organization admin and audit reader scopes no longer grant fleet access.
Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the gateway serves.
Existing metrics_reader keys can read their organization's individual MCP calls.
Project member removal and demotion protect assignments of the built-in Project Owner role held by users who have not been deleted.
MCP profile audit entries name the person who acted.
Deleting a model now also removes its project assignments, in the same change.
In single-organization installs, a Model Admin can now create, edit and delete models through the API with their own session.
Listing fallback or traffic-split policies for one API key now returns them only to the key's owner, the owners of its project, organization admins and admin keys.
Corporate OIDC sign-in now requests the scopes saved on the SSO provider, always including openid and email, and fetches the discovery document from its saved Discovery URL.
Writing a project's OIDC contract is refused on Agent Router Service (SaaS).
Active admin-scoped admin secrets gain the admin_console machine role at management-plane startup, so the Admin Console can read the effective attribute-routing policy of a key or a tag preview, and a policy's coverage.
Auth
Sign-in now refuses an email address that matches two or more accounts that are not deleted and differ only in case ([email protected] and [email protected]): corporate SSO with ambiguous_account_email, and password sign-in and email verification by saying the address belongs to more than one account.
Changing a password in the Developer Console signs the user out of every session except the one they changed it from.
Each OIDC SSO provider now signs in with the callback URL stored on it.
Consoles
Saving an API key's fallback or traffic split in the Developer Console is refused while it lists a model, or a model's provider, that the key's project can no longer use, even one saved earlier.
Signing out of the Developer Console now ends the session through the management plane only and no longer also calls the auth service.
The Developer Console now signs users in with Google and GitHub through the management plane and shows only the providers it has an OAuth app for, so a deployment without one no longer shows buttons that fail.
MCP Analytics shows the MCP profile URL as the route of calls that the data plane reports over OpenTelemetry, as it already does for the other calls.
My MCP Profiles no longer shows profiles in projects you have left.
/api/mcp-profiles and /api/mcp-profiles/<id> keep their response fields, with these differences: a POST takes the profile ID from the server, GET lists all your profiles except those in projects you have left, backends[].id is the server ID (as backendName), and metadata and most backend object fields are always null.
The management plane now makes the token requests of MCP OAuth sign-ins, refreshes and disconnects.
In the Developer Console, a user who is not a member of the default project no longer sees its data planes or starred endpoint, and gets the default endpoint instead, as on every other project.
In the Admin Console menu, Budgets moved from Usage to Policies, and a project's Guardrails pages moved under Policies → Guardrails.
The Developer Console menu no longer lists Alert Destinations.
Helm charts
New installs made with tare or helm install give identity providers the API host's SSO callback, https://api.<domain>/v1/auth/sso/callback/<provider>.
Upgrading now builds an index on the request logs table without blocking inserts, so the migrate step takes longer on installs with very large request logs while requests keep being logged.
Gateway
MCP profiles created before projects existed keep their stored organization.
A call authenticated by an IdP token that reaches the gateway right after an administrator changes its gateway auth policy now gets 503 gateway_auth_reloading with x-should-retry: true. Available once the data plane is on 0.10.0 or later.
Adding a second project to a data plane that has one gateway, or deleting or moving a gateway so that one gateway is left serving several projects, is refused unless the data plane runs 0.10.0 or later. Available once the data plane is on 0.10.0 or later.
tare CLI
The scheduled doctor run now uploads its health report without the support bundle.
Security updates
Gateway
On a data plane with one gateway that serves several projects, an API key can call only the models of its own project. Available once the data plane is on 0.10.0 or later.
The AAA Certificate Services and emSign ECC Root CA - G3 roots are removed from the system trust bundle of the gateway, shared Envoy and envoy-tars images, so TLS verification in those images rejects chains that depend on them. Available once the data plane is on 0.10.0 or later.
The AI Gateway controller and external processor are built with Go 1.27.3, which includes the Go fix for blocked intermediate certificates (CVE-2026-111943), so they reject certificate chains that pass through those intermediates. Available once the data plane is on 0.10.0 or later.
Fraser's Envoy images include the upstream fix for the critical Brotli decoder vulnerability CVE-2026-111497, protecting proxies that decode Brotli-compressed requests.
Model providers no longer receive internal identity, routing or signature headers. Available once the data plane is on 0.10.0 or later.
The data plane fetches a project OIDC contract's signing keys without a proxy, follows no redirect, refuses a non-public address and stops reading a key set past 256 KiB, and the management plane refuses a contract whose discovery document names a jwks_uri on a non-public address. Available once the data plane is on 0.10.0 or later.
Helm charts
The rate limit service, the kubectl image, and berglas, the Google Secret Manager client that the management plane service images run at startup, are built with Go 1.26.10, which includes the Go fix for blocked intermediate certificates (CVE-2026-111943), so they reject certificate chains that pass through those intermediates.
Management plane API
When the signed-in user's session names no organization, policy, team, budget, and guardrail reads now return data only for organizations that user belongs to, even when the request names another organization's customer ID.
Customer-scoped audit reads show records with trusted ownership stamps; fleet-wide reads require an explicit platform audit grant.
Provisioned admin-scoped secrets also gain QueryAuditLogs and GetAuditLog, with the same fleet visibility already available through QueryPlatformAuditLogs.
Banning or deleting a user now revokes their MCP OAuth refresh tokens and unredeemed authorization codes, and /oauth/token refuses every grant for a banned or deleted user with invalid_grant.
Project admins can now create budgets only for their own project's API keys, and edit, enable, disable or delete only the budgets of their own project and its API keys.
Creating, renaming or deleting a team, and adding or removing its members, through the API now needs an organization admin.
Removing a catalog MCP server from a project now also detaches it from the legacy MCP profiles of the project's members, and editing the tools of a server that the project no longer grants is refused with PERMISSION_DENIED.
Consoles
Test connection on an MCP profile now needs a signed-in member of the profile's project, and tests only servers granted to that project.
New features
Management plane API
GET /v1/me/assignable-key-scopes lists the scopes an organization API key can carry and which of them you can grant, to anyone who can create the key, including the User Admin role.
Your identity provider can now manage users and groups over SCIM 2.0 at https://api.<domain>/v1/customers/{customer_id}/scim/v2, with an organization API key whose only scope is SCIM Provisioner.
A user your identity provider provisions over SCIM is treated as new at their first corporate SSO sign-in, so on_create role sync applies.
GetMe session claims carry can_open_admin_console, which says whether the Developer Console should offer the Admin Console: true when the user holds any org-level permission, or a project admin row or project binding that can add, edit or remove project members.
GET /v1/mcp-operations and GET /v1/mcp-operations/stats list and summarize an organization's MCP calls by session, profile, backend, tool, client or method.
MCP profile reads can span every project you are a member of (all_projects, CLI --all-projects) and can include each attached server's name, icon and tools (include_tools).
ListModels and GetModel take an optional customer_id and project_id, so a user with an organization role that can read models, such as a Viewer, can read the model catalog.
CreateModel adds a model and returns ALREADY_EXISTS when the provider already has a model of that name.
UpsertModel takes clear_fields, to clear stored values such as a price, the context window or the backend URLs, and remove_metadata_keys, to remove metadata keys.
GET /v1/usage/stats takes a caller_type filter: idp keeps the usage of identity-provider applications and api_key keeps every other caller's.
Organization audit log reads now include customer update and archive, project, project member, AI key, model assignment, MCP profile, MCP profile act-as, MCP OAuth client, API key, budget alert, data plane and project gateway changes, and on a single-customer deployment user role and SSO provider changes.
A project's OIDC contract now names the token claim that identifies one caller, identity_claim, which is sub unless you name another, and how many callers the project may hold, principal_cap, which is 100 unless you set one at least 1. Available once the data plane is on 0.10.0 or later.
The data plane status endpoint returns reported_version, the release the data plane's liaison last reported on a configuration fetch, and reported_version_at, the time the management plane recorded it.
Consoles
Creating an organization-wide management key in the Dashboard now lets you choose its scopes, from the list the management plane offers, including SCIM Provisioner, which must be the key's only scope.
The Tag filter on the API Keys page now finds matching keys on every page, and the page count and total include only those keys.
Forgot password, reset password, change password, sign-up and email verification in the Developer Console now go through the management plane, as sign-in does.
The Developer Console now signs users in with email and password, and with corporate SSO, through the management plane.
Project admins, and users whose project role can manage the project's members, now see the Admin Console button in the Developer Console.
The Developer Console shows each API key's UID, with a copy button, on the API Keys page, on each key version, and in the API key picker.
Request Logs shows the latest message and the start of the reply at the top of a request's details, and the request and response in a readable view: the system prompt, tools and earlier messages fold to one line, and a streamed response shows the message it delivered.
Data plane
The egress chart can render Prometheus alert rules on router_token_calls_total, which counts every token call and the reason for each refusal.
tare CLI
tetrate agentrouter api policy attribute-routing-policies analytics shows an attribute routing policy's analytics.
Auth
A * entry in CORPORATE_EMAIL_DOMAINS (global.corporate.emailDomains) now lets corporate SSO users from any email domain sign in, while corporate login stays on.
Gateway
An application can leave out x-tars-project when its gateway auth policy binds a claim value to a project, and the data plane acts in that project. Available once the data plane is on 0.10.0 or later.
Bug fixes
tare CLI
Publishing a patch for an older release line, such as v0.7.3 after v0.9.0, no longer replaces the stable channel that tare install and the default installer read.
tetrate agentrouter doctor now reports a known error from a pod's log only if it was written in the last hour, so a data plane that recovered from a one-off error no longer shows Degraded in the Admin Console for days.
tare doctor warns when a data plane has no readiness probe route, so /healthz/membership answering 404 is no longer silent.
Management plane API
Editing chain in a fallback policy you read back now saves; before, the entries sent with it won and the edit was ignored.
Listing your projects no longer shows the admin role on every project for a custom organization role that can add, remove or edit project members.
Listing your reachable projects now includes every project you or one of your groups in the organization hold a project binding on with any project permission, whether it comes from a custom project role or a permission granted on the binding itself.
UpdateMCPProfile clears a profile's description when the request sends a blank description, as the API reference says.
A server attached to an MCP profile through the API reaches every data plane at once.
Gateway
Rotating a bring-your-own provider key (add the new key, then revoke the old one) no longer fails requests with HTTP 500 while routes switch over. Available once the data plane is on 0.10.0 or later.
An API key created right after a bring-your-own provider key is added now uses that provider key, instead of the platform credential until the next full sync. Available once the data plane is on 0.10.0 or later.
Anthropic Messages API requests to API key providers with slugs starting with anthropic now include the provider credential.
Requests that fail upstream, such as a 401 or 429 from the provider, no longer add estimated tokens to usage by model, user, API key or tag.
MCP catalog servers no longer answer HTTP 500 for several minutes after a data plane is installed or a project gateway is added.
A request for a model whose provider has a bring-your-own key in your project, or a personal one of yours, is no longer refused with HTTP 402 when the balance is below the minimum balance.
Data plane
A data plane upgrade no longer fails because the signed release manifest named a serve-helm chart build that was never published.
Adding, removing or moving a gateway on a data plane re-renders the routes of the API keys it serves, so a hostname no longer returns model_not_routed for most keys.
A key whose routes were rendered less than five minutes before a gateway change on its data plane now picks up the new hostname too.
When a data plane install or upgrade stops on the cluster's Gateway API version, tare and the chart's pre-upgrade check now recommend the standard-channel manifest, and on GKE they say to upgrade the cluster so its Gateway API addon reaches v1.6.0.
When a key's routes change, the data plane now removes the previous routes and their retry policies once the new ones have served for the cleanup delay, even if a data plane component restarted or the first cleanup failed.
A newly installed data plane no longer logs errors while it waits for its first providers, routes and routed-model list.
Auth
Self sign-up in the Developer Console keeps working where the auth service allowed it, now that the management plane answers sign-up.
Consoles
Try again on the Developer Console error page now reloads the page, so it recovers from a dropped connection.
The Developer Console Home page loads faster, and on return visits it renders once.
Older API keys whose last four characters were never stored now show sk-... in the Developer Console, instead of a hint that did not match the key.
Deprecations
Management plane API
Calling the fleet audit methods as an organization admin, without a platform audit grant, is deprecated and will be refused in a later release.
Consoles
The /api/mcp-profiles and /api/mcp-profiles/<id> routes are deprecated.