> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/change-logs/ai-gateway.md).

# AI Gateway

This page lists the features, changes and fixes in each release of the P0 AI Gateway.

## 1.3.0-beta (2026-10-19)

### Added

* **MCP protocol revision 2026-07-28 (Preview).** The gateway now accepts MCP clients that use protocol revision 2026-07-28, alongside clients on 2025-11-25. This applies to external HTTP and Docker MCP servers. There's nothing to configure, and existing clients keep working as before.

### Changed

* **Bundled Valkey keeps its data across restarts.** In the batteries-included chart, Valkey now stores its data on a persistent volume. Before, a restart emptied it. Set `valkey.storageClass` to an encrypted StorageClass before you upgrade, because the chart won't render without it. See the upgrade steps below.

### Upgrade steps

These steps apply to existing gateways that run the bundled Valkey from the batteries-included chart. If you install the gateway chart on its own, or use your own Redis-compatible cache, you don't need to change any values.

1. **Set `valkey.storageClass` to an encrypted class.** The Valkey volume holds users' credentials for SaaS MCP servers. Reuse your `postgresql.storageClass` only if that class is encrypted. On EKS, use a class with `encrypted: "true"`. The stock `gp2` class isn't encrypted. GKE and AKS encrypt disks by default. If you leave it out, the upgrade stops before it changes anything in your cluster.
2. **Upgrade the gateway** as described in [Upgrade the gateway](/agentic-access/agentic-gateway/gateway/deploy/upgrade-the-gateway.md). The upgrade creates the Valkey volume for you. Valkey is down for up to a minute and comes back empty.
3. **Register headless agent credentials again.** Because Valkey comes back empty, the upgrade erases all OAuth credentials. Users sign in to their SaaS MCP servers again, and admins register their headless agent credentials again. See [OAuth servers from a headless agent](/agentic-access/using-the-gateway/headless-oauth-credentials.md#register-an-oauth-credential).

Proof-of-concept installs on a cluster with no storage class turn off the bundled Valkey and keep the cache in memory instead. Before you upgrade, set these values:

```yaml
valkey:
  enabled: false
ai-gateway:
  authServer:
    caches: '{"defaults":[{"type":"memory"}]}'
```

With the memory cache, the gateway loses all OAuth credentials whenever the Auth Server pod restarts. See [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md#evaluating-without-a-storage-class).

If you roll back to 1.2.0-beta, Helm deletes the Valkey volume.

## 1.2.0-beta (2026-10-15)

### Added

* **Token exchange credential source (Preview).** The gateway can trade its own token for an upstream access token at any token endpoint that supports RFC 8693. Certain SaaS MCP servers use it to call the service's hosted MCP server as each session's own user. See [SaaS](/agentic-access/agentic-gateway/mcp-server/saas.md).
* **Access token lifetime setting.** Set `authServer.accessTokenTtlSeconds` in the gateway chart to choose how long Auth Server access tokens last. The same lifetime applies to credentials the gateway mints for MCP servers. Leave it empty to keep the default of 1024 seconds. Keep it at 300 or more. The gateway won't start an MCP server whose credential has less than two minutes left. See [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md).

### Changed

* **Workload identity federation settings.** If you write MCP server configurations by hand, GCP workload identity federation credentials must now set `audience`. P0 rejects a GCP credential without it. MCP servers that P0 manages for you need no change.

### Fixed

* **Requests with underscores in header names.** On clusters with Envoy Gateway v1.1.0 or later, the chart now drops these headers, so Envoy Gateway no longer answers the request with a bare 400 error. This error stopped certain SaaS MCP servers from reading the gateway's signing keys. If you already have a `ClientTrafficPolicy` that targets the Gateway, it takes priority and the error comes back. Point your policy at one listener with `sectionName`, and keep `withUnderscoresAction: DropHeader`.

## 1.1.0-beta (2026-10-13)

### Added

* **Revoke a headless agent's OAuth credentials (Preview).** See the OAuth credentials stored for a headless agent's client, and revoke one if it leaks or is no longer needed. Before, such a credential stayed usable until it expired. If you deploy the Auth Server and the gateway separately, upgrade the Auth Server first. See [OAuth servers from a headless agent](/agentic-access/using-the-gateway/headless-oauth-credentials.md#see-and-revoke-credentials).

### Changed

* **Renamed Helm values keys.** In the gateway chart, `agenticAuthServer` is now `authServer` and `agenticGatewayServer` is now `accessProxy`. The old keys still work, but if an old key and its new key disagree, the chart refuses to render. Check your values before you run `helm upgrade`. You no longer need to set `accessProxy.authServerUrl`, because it points at the release's own Auth Server by default. See [Helm chart values reference](/agentic-access/agentic-gateway/gateway/deploy/chart-values.md#renamed-values-keys) and [Upgrade the gateway](/agentic-access/agentic-gateway/gateway/deploy/upgrade-the-gateway.md).
* **JWT bearer requests with client credentials.** A JWT bearer token request (RFC 7523) that also includes client credentials is now checked and accepted, where before it was rejected. The agent's identity still comes from the assertion. See [JWT-SVID](/agentic-access/using-the-gateway/spiffe-svid.md).

### Fixed

* **AWS federated sign-in.** AWS no longer rejects the gateway's tokens with `InvalidIdentityToken` ("Couldn't retrieve verification key from your identity provider"). This error broke the AWS and RDS PostgreSQL MCP servers in 1.0.0-beta. See [AWS](/agentic-access/agentic-gateway/mcp-server/aws.md) and [PostgreSQL on AWS RDS](/agentic-access/agentic-gateway/mcp-server/rds-postgres.md).

## 1.0.0-beta (2026-10-08)

The first release of the P0 AI Gateway, part of [P0 Runtime Access for AI](/readme/agentic-control-plane.md). It sits between your AI agents and the systems they use, and gives agents just-in-time access through P0.

* **MCP servers with just-in-time access.** The gateway puts each of your MCP servers at its own path and checks identity on every tool call. Agents get built-in tools to request access through P0, wait for approval, and give access back when done. A tool call fails unless it carries an approved request, so an agent can't skip the request. See [Using the P0 AI Gateway](/agentic-access/using-the-gateway.md) and [Requesting access](/agentic-access/using-the-gateway/requesting-access.md).
* **Tool-level access control.** Choose how each MCP server decides what an agent may do. Native mode leaves it to the upstream system's own permissions. Tool mode grants named tools. Annotation mode grants groups of read-only, write or destructive tools. Tool and Annotation modes are in preview. See [Custom](/agentic-access/agentic-gateway/mcp-server/custom.md#access-control-method).
* **User and agent identity together.** A person signs in through your identity provider and approves a consent page that names both the MCP server and the agent. The token they get ties the user to the agent and works for one server only. MCP clients such as Claude Code find the sign-in endpoints on their own. See [Connect an MCP client](/agentic-access/using-the-gateway/connect-an-mcp-client.md).
* **Sign-in options.** People can sign in with any OIDC provider, such as Google, Okta, Entra ID or Ping, and you can limit sign-in to your email domains. If you can't create an OAuth client, use password sign-in through Google Cloud Identity Platform. See [Gateway chart values](/agentic-access/agentic-gateway/gateway/deploy/chart-values/gateway-chart.md).
* **Headless and workload agents.** Agents with no person at the keyboard can sign in with a signed JWT from an issuer you trust, including SPIFFE JWT-SVIDs. Add each issuer to P0 as an identity provider. See [JWT-SVID](/agentic-access/using-the-gateway/spiffe-svid.md) and [Identity provider](/agentic-access/identity-provider.md).
* **Short-lived credentials, no standing secrets.** For each approved request, the gateway gets a short-lived credential for the upstream system, and the agent never sees it. Sources include AWS IAM federation, GCP workload identity federation, OAuth, secrets P0 stores in your vault, and RDS IAM. See [MCP server](/agentic-access/agentic-gateway/mcp-server.md).
* **Predefined MCP servers.** Connect agents to the [AWS](/agentic-access/agentic-gateway/mcp-server/aws.md), [GCP](/agentic-access/agentic-gateway/mcp-server/gcp.md) (BigQuery, Compute Engine, Cloud Monitoring, Cloud Storage and IAM), [Google Drive](/agentic-access/agentic-gateway/mcp-server/google-drive.md), and [PostgreSQL on AWS RDS](/agentic-access/agentic-gateway/mcp-server/rds-postgres.md). The PostgreSQL server is in preview.
* **Custom MCP servers.** Point the gateway at an MCP server's URL, or have it run a Docker image for you. Each container serves one user, session and request, and stops when its credential expires. Container servers are in preview. See [Custom](/agentic-access/agentic-gateway/mcp-server/custom.md).
* **SaaS MCP servers that use OAuth.** The gateway signs each person in to the upstream service with their own account, then stores and refreshes the credential for them. For headless agents, an admin can register one OAuth credential for an agent. See [SaaS](/agentic-access/agentic-gateway/mcp-server/saas.md) and [OAuth servers from a headless agent](/agentic-access/using-the-gateway/headless-oauth-credentials.md).
* **Agent-to-agent calls.** Put an agent host behind the gateway so calls between agents are checked and logged. An agent requests access to a specific agent, and the called agent can act for the original user. See [A2A bridge](/agentic-access/agentic-gateway/a2a-bridge.md).
* **Activity logs.** The gateway records every tool call and agent call with the user, agent, session and request, and exports them over OpenTelemetry. P0 reads them from Google Cloud Logging or VictoriaLogs to fill its event log. See [Event log](/agentic-access/using-the-gateway/event-log.md) and [Log provider](/agentic-access/agentic-gateway/log-provider.md).
* **Access ends right away.** When an agent gives access back, or P0 revokes a request or it expires, the agent loses access at once. If P0 is briefly unreachable, agents keep the access they already have. See [Requesting access](/agentic-access/using-the-gateway/requesting-access.md#session-behavior).
* **Runs in your Kubernetes cluster.** Install the gateway with a Helm chart, from the P0 console or by hand. It works with any Gateway API class, such as Envoy Gateway or GKE, and supports private image registries and proxies that inspect TLS. A batteries-included chart also installs what the gateway needs to run. See [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md).