v0.12.0
Released November 11, 2026. Supported until May 11, 2027.
v0.12.0 ships 30 behavior changes, 11 security updates, 35 new features, 17 bug fixes, and 1 deprecation. Behavior between the management plane and the data plane changed in this release. The most severe security issue cleared is high.
A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.
The full release notes are opened from the Admin Console, as described in Check the management plane version.
Upgrade and rollback
- The release carries no breaking change. 43 changes name operator steps of their own, given with each change in the full release notes in the Admin Console.
- The upgrade rolls through without dropping traffic.
- Rollback to v0.11.1 is conditional. See the note below.
After a rollback of the management plane to a release before 0.12.0, the usage that the older release rolls up has no caller kind or authentication method, and GET /v1/usage/stats and GET /v1/usage/caller-adoption count it as unknown until the usage-rollup backfill that this release describes runs over that window on 0.12.0. Before rolling a data plane back to 0.11, set controller.config.mcpOAuthStrictProfiles: true on the 0.11 release.
Behavior changes
Management plane API
Developer request-log responses add ordered policy decision records and fallback status for unavailable-model fallback chains and budget exhaustion reroutes.
A guardrail trigger whose rules ran only in monitor mode now reports its verdict as WOULD_HAVE_BLOCKED or WOULD_HAVE_REDACTED instead of WOULD_HAVE.
GetGuardrailTriggerStats now covers the last 24 hours by default instead of every event ever recorded, and refuses a range longer than 30 days.
On a self-hosted install, an oauth MCP profile takes its issuer, keys, audiences and required scopes from its project's gateway auth policy.
On a self-hosted install, creating an oauth MCP profile, switching one to oauth or changing an oauth profile's settings, in a project that accepts only API keys on every gateway where it has a gateway auth policy, returns failed_precondition instead of saving a profile that is never served.
Super Admin now also holds principals.read, principals.edit, passthrough_settings.read, passthrough_settings.edit, project.mcp_profile.read, project.mcp_profile.edit and idp_registrations.read, .create, .edit and .delete, and the admin management key holds the two principals permissions.
Creating a project with the name of a deleted project hides the revoked API keys that the deleted project still listed.
The management plane API's /v1/billing/stripe/webhook now handles every Stripe event, and the Developer Console's /api/webhooks/stripe forwards each Stripe and low-balance event to it unchanged.
ListApiKeys called with a management key bound to an organization now lists only the keys of that organization that match the filters, when the request names no customer_id, including a request filtered by project_id or application_keys_only.
Request-log lists cap total_count at 10,000 and set total_count_capped when more matches exist.
Fallback and traffic-splitting policy lists without a key filter, and policy Gets, now show a key's policies only to its owner, its project's owners and admins.
Management plane
The upgrade runs database migrations 0220, 0221, 0222, 0232 and 0233.
Data plane
The AI Gateway controller serves Prometheus metrics on port 8080 of the ai-gateway-controller Service (http-metrics), where it actually listens; the Service exposed 9090 before, which answered nothing.
Gateway
MCP_OAUTH_STRICT_PROFILES is off by default in 0.12, so an existing self-hosted oauth MCP profile with its own issuer and key set keeps working, with any audience and a warning, when its project has no gateway auth policy. Available once the data plane is on 0.12.0 or later.
On a self-hosted install, an oauth MCP profile backed by the project's gateway auth policy refuses a token issued for another audience, or missing one of the policy's required scopes, with 403, and the request never reaches the MCP server. Available once the data plane is on 0.12.0 or later.
On a self-hosted install, an oauth MCP profile backed by a gateway auth policy is served on a project gateway only while its project accepts IdP tokens there (accepted credentials token or both). Available once the data plane is on 0.12.0 or later.
On a self-hosted install, an oauth MCP profile is never sent to a gateway with more than one gateway auth policy for its project, or one it cannot use, such as a policy with no audience.
A request to an endpoint its provider cannot serve, such as /v1/responses to a Vertex AI or Vertex Anthropic provider, now returns 422 instead of 500.
A request that carries an identity-provider token in Authorization: Bearer and the same token once in X-API-Key is now served as a token call, which is how Claude Code sends the output of its apiKeyHelper. Available once the data plane is on 0.12.0 or later.
Helm charts
If you set a secure controller.mcp.sessionEncryption.seed, the upgrade keeps using it.
Request-log archival now runs one job at a time (concurrencyPolicy: Forbid) and starts no new batch in the last 3 minutes of LOG_ARCHIVAL_RUN_BUDGET (default 50m), so its archive pass ends within that budget.
Consoles
The console saves the Usage you pick for a provider's first key together with the key.
The Admin Console's user edit API (PATCH /api/admin/users/{id}) no longer changes a user's role, and refuses a request that sends a role with 422.
Banning, unbanning, or changing the team of a user on the Admin Console's Users page now leaves only the management plane's audit records (BAN_USER, UNBAN_USER, ADD_USER_GROUP_MEMBERS and REMOVE_USER_GROUP_MEMBERS).
A user's automatic join to your organization's default project is now recorded in the audit log as AUTO_JOIN_DEFAULT_PROJECT instead of project_member.auto_join.
Auto top-up counts a payment method as set only when you have a default card.
In a time zone with a half-hour offset, the days and comparison periods on the Usage page start on the hour.
The bonus credit card on the Developer Console Home page no longer shows when ENABLE_CORPORATE_LOGIN is on, even with ENABLE_BONUS_CLAIM set.
In the Admin Console, a project's page no longer has the API Keys, Providers, MCP Servers, Routing and Requests tabs.
The Admin Console's Audit Logs page opens on the last 24 hours instead of all events, and pages through a fixed time window, so rows no longer repeat or go missing while new events arrive.
Security updates
Consoles
Fetch tools on an MCP server in the Admin Console now checks the server's URL and each redirect before it calls them.
An MCP server sign-in in the Developer Console now connects an account only for the user who started it, in the browser that started it.
An MCP server sign-in that an app starts with a delegated token now returns to the app, and the app's server finishes it.
A project owner can no longer add the Goose sign-in tags to their own API key to claim the Goose bonus.
Playground tool calls on an MCP profile now go through the profile's MCP address on the data plane, so the profile's authentication applies as it does for any MCP client.
Data plane
MCP session IDs can no longer be forged with the publicly known seed that every data plane used to encrypt them (GHSA-953h-535j-jg2v).
Agent Router components built with Go 1.27.4 include the net/http security fix.
Management plane API
Building the Go SDK requires Go 1.27.4 or later, which includes the net/http security fix.
Granting or revoking super_admin changes nothing for a user who is not in your organization, which returns NOT_FOUND, or who is also in another organization, which returns FAILED_PRECONDITION.
Adding a user to a project, or to the default project, returns NOT_FOUND and changes nothing for a user who is not in your organization.
A Project Owner can no longer create, change, turn off or delete traffic-splitting policies outside their project.
New features
Management plane API
GuardrailTriggersService.ListGuardrailTriggers sorts by page.order_by (triggered_at or execution_duration_ms, with an optional asc or desc), and filters on the new WOULD_HAVE_BLOCKED and WOULD_HAVE_REDACTED verdicts.
GetGuardrailTriggerStats takes a date range, a time zone and guardrail type filters.
GetGuardrailStats takes types and exclude_types, so its counts can leave out evaluators or any other guardrail type.
Each request log carries authentication_method, which is how the data plane verified the caller: api_key for an Agent Router API key, idp_token for an identity-provider token, including a caller admitted through a project's OIDC contract, or unknown. Available once the data plane is on 0.12.0 or later.
Each request log carries app_id, end_user_id and agent_name. Available once the data plane is on 0.12.0 or later.
The management plane stamps caller_kind on each request log when it stores it and never changes it: person or application when the API key is linked to a principal of that kind, otherwise person when a user owns the key, including an agent or CI job that runs with that user's key, and otherwise unknown.
QueryRequestLogs, GetRequestLogStats and GetCustomerRequestLogStats take caller_kind and authentication_method filters, and the two stats calls group by caller_kind and by authentication_method. Available once the data plane is on 0.12.0 or later.
An identity mapping rule takes caller_kind_default (person, application or unknown), which the management plane copies into each principal that the rule creates.
A project's OIDC contract takes caller_kind_default (person, application or unknown), which the management plane copies into each principal that the contract creates.
GET /v1/usage/stats takes caller_kind (person, application or unknown) and authentication_method (api_key, idp_token or unknown) as filters, group_by and subgroup_by values, and groups add up to the totals. Available once the data plane is on 0.12.0 or later.
GET /v1/usage/caller-adoption counts, from the usage rollups, the distinct users recorded as people, as applications and as unknown in a time range of up to 400 days.
ListPrincipals, GetPrincipal and UpdatePrincipalCallerKind let an admin list an organization's principals, read one, and correct whether it is a person or an application with a required reason, which the audit log records as UPDATE_PRINCIPAL_CALLER_KIND with the old and the new kind.
The SCIM server stores the userType attribute of a user, trimmed and at most 256 bytes, returns it on GET and in lists, and lists it in the User schema.
Request logs persist policy summaries and QueryRequestLogs filters by policy (policy_filter, policy_type) across attribute_routing, rate_limit, budget, fallback_chain and traffic_split. Available once the data plane is on 0.12.0 or later.
Admins can count requests attributed to a policy over a required time window and filter request logs to that policy.
GuardrailsService.ListGuardrails sorts by page.order_by (name, type, severity, created_at or updated_at, with an optional asc or desc), and with include_rules returns each guardrail's rules in Guardrail.rules.
MeService.ListMyProjects accepts include_member_summary to return project user counts and permission-controlled previews of up to three users per project.
Signed-in users can read their own built-in role without user-directory access.
Users with project.mcp_profile.read list and use every MCP profile in the project; users with project.mcp_profile.edit (Project Owner and org Admins by default, or a custom role) edit and delete them, and a creator always edits their own.
CatalogService.AssignModelsToProject grants a project up to 100 catalog models in one call.
Signed-in users can see their bonus claim state, claim a bonus and start its card verification through the API.
Adds an organization setting, Count passthrough in budgets, that makes passthrough usage count toward every budget at list price.
GET /v1/request-logs filters by status class with status_class: ERROR keeps the requests with status code 400 or above, CLIENT_ERROR 400 to 499, and SERVER_ERROR 500 to 599, the same rule the usage rollups count errors by.
GET /v1/request-logs filters by several users with user_ids and by team with team_ids, with the same rule GetUsageStats filters teams by: a team ID keeps the requests of its current members, and Untagged the requests with no user or of a user with no team, a deleted team, or a team of another organization than the request's.
GetModelStats and GetClientStats read request, error, latency, token and cost figures for each model and each client application, with user, team and name filters, ordering and pages.
Developers can read MCP call logs and call statistics for their own MCP profiles through GET /v1/me/mcp-operations and GET /v1/me/mcp-operations/stats.
Gateway
The data plane now runs Envoy Gateway v1.9.3, and every gateway pod restarts once during the upgrade.
The data plane now runs Envoy AI Gateway v1.2.0, and every gateway pod restarts once during the upgrade.
Helm charts
GET /v1/usage/stats and GET /v1/usage/caller-adoption read the usage rollups, where usage recorded before 0.12.0 stays under unknown until the rollups of that window are rebuilt once.
tare CLI
tetrate agentrouter idp login signs a person in to the organization's identity provider in a browser or with a device code, and tetrate agentrouter idp token prints a current access token for Claude Code's apiKeyHelper, refreshing it before it expires. Available once the data plane is on 0.12.0 or later.
Request logs
Request logs include structured policy-decision steps for attribute routing, budget policies, rate-limit policies, fallback policies and traffic-splitting policies, and indicate whether a fallback served the request. Available once the data plane is on 0.12.0 or later.
Consoles
The Developer Console lists a project's MCP profiles, each marked Mine or Shared, with an All, Mine or Shared filter.
The Admin Console's Request Logs page shows every policy that acted on a request in the order it ran, now including budget, fallback and traffic-splitting policies, and filters requests by any of these policy types. Available once the data plane is on 0.12.0 or later.
In the Playground, model reasoning and tool calls show as collapsible lines, with failed tool calls labeled "Tool failed".
The Developer Console adds a Logs page to each MCP profile, with that profile's calls, filters, grouped statistics and call details.
Bug fixes
tare CLI
tare upgrade, tare precheck and remote upgrades from the Admin Console accept data planes installed from release charts again.
tetrate agentrouter api help shows a flag's value type where it showed a word from its description instead, for example --search string for --search x-request-id.
Data plane
The AI Gateway pod-mutating webhook now ships with the CA of its certificate in the same render, so a data plane installed from rendered manifests, such as with Argo CD, no longer applies a webhook and certificate that disagree.
Management plane API
Archiving an organization removes its private-address settings, so a new organization created with the same ID cannot inherit the old settings.
Usage statistics grouped or split by API key now return the key's current name in apiKeyName, where they returned an empty name.
MCP call-log reads are now covered by the cross-organization test suite.
A management key with the Read, Write or Admin scope can now list and get MCP profiles, where it was refused before.
Consoles
Request Logs no longer shows the previous filter's log count while the list reloads.
The Developer Console Home page and the MCP sign-in user info now show only the endpoint URL that you can see, no longer show an empty URL that another user caused, and show a newly attached data plane's URL straight away.
A bulk ban on the Admin Console's Users page that the management plane partly refuses is now recorded as a failure.
Where low-balance events go to the Developer Console's /api/webhooks/stripe, auto top-up no longer charges your card after you turn it off, or a second time when the same low-balance event is delivered again.
Cancelling a top-up that Stripe is already processing now fails.
The Playground MCP picker lists every MCP profile of the project you can read, with a Shared badge on profiles other members created.
On the Admin Console's Audit Logs page, a day picked in the Date filter now covers that day in your time zone (west of UTC it started on the day before), and events with no HTTP status no longer show "HTTP 0".
The Admin Console's Usage charts no longer freeze when the range includes the day daylight saving time starts in Chile or Cuba.
A bulk ban on the Admin Console's Users page that leaves some users unbanned now records its audit record as a failure, even when other users in the request were banned.
When the management plane refuses an API key the Admin Console asked for and records the refusal as an ISSUE_MY_KEY failure, the Admin Console no longer adds a second failure record.
Deprecations
Gateway
Sending X-API-Key more than once beside an identity-provider token is deprecated.