MCP Gateway v0.5.0 - 2025-08-06 - Enterprise Operability, Auth, Configuration & Observability

[crivetimihai]

🚀 MCP Gateway v0.5.0 – 2025-08-05 - Enterprise Operability, Auth, Configuration & Observability

This enterprise-focused release delivers 42 resolved issues with major improvements to authentication, configuration management, error handling, and developer experience. Building on v0.4.0's security foundation, v0.5.0 brings enhanced JWT security, comprehensive UI/UX improvements, and strengthened input validation across all endpoints.

🏆 Enterprise Operability Achievements

This release enhances production readiness with:

• Enhanced JWT Security – Mandatory token expiration enforcement when configured
• Masked Sensitive Data – Authentication credentials properly hidden in API responses
• Improved Error Handling – User-friendly messages with actionable guidance
• Better Observability – Enhanced status reporting and service visibility
• Developer Productivity – File-specific linting and comprehensive Makefile improvements
• Stronger Validation – XSS prevention and input validation across all endpoints

Important: Admin UI remains development-only with enhanced security defaults. Never expose it in production. Build your own production UI with appropriate security controls. Refer to the Securing MCP Gateway documentation.
Beta Software Notice: MCP Gateway is in early beta. Expect breaking changes between minor versions. Use only with trusted upstream MCP servers. This is an OPEN SOURCE PROJECT with community-driven support and no official support from IBM. Please refer to SECURITY.md and our Roadmap for more info.

✨ Highlights

• 🔐 JWT Token Security – Mandatory expiration when REQUIRE_TOKEN_EXPIRATION=true ([SECURITY FEATURE]: Make JWT Token Expiration Mandatory when REQUIRE_TOKEN_EXPIRATION=true (depends on #87) #425)
• 🎭 Masked Auth Values – Sensitive credentials hidden in all API responses ([Bug]: APIs for gateways in admin and main do not mask auth values #601, Mask auth for gateways APIs reponse #602)
• 🧪 Enhanced Test Tool – Default values, array/boolean handling, multiline support ([Bug]: Test tool UI passes array inputs as strings #620-Fill default values in test tool #644)
• 🛠️ Developer Experience – File-specific linting with make lint filename ([CHORE]: Add make lint filename|dirname target to Makefile #410, CHORE(makefile): add comprehensive file-specific linting support #660)
• 📊 Better Visibility – MCP Server Name column in tools/resources overview ([Feature Request]: New column for "MCP Server Name" in Global tools/resources etc #506, feat: Add MCP Gateway Name to the Tools Overview #624)
• 🔍 Security Scanning – Snyk, DevSkim, and nodejsscan integration ([CHORE]: Integrate DevSkim static analysis tool via Makefile #590, [CHORE]: Add Makefile and GitHub Actions support for Snyk (test, code-test, container-test, helm charts) #638, Add snyk Makefile .snyk and github actions sample #639)
• ✅ UI Improvements – Checkbox selection, better error messages, form fixes ([Feature Request]: UI checkbox selection for servers, tools, and resources #392, checkbox implementation for selection in servers panel #619)
• 📝 SPDX Compliance – Automated file header verification ([CHORE] Check SPDX headers Makefile and GitHub Actions target - ensure all files have File, Author(s) and SPDX headers #315, [CHORE]: Script to add relative file path header to each file and verify top level docstring #317, chore(file-headers): add script to verify and fix file headers #656)

🚨 Important Updates

• UI Enabled by Default – .env.example now sets MCPGATEWAY_UI_ENABLED=true for easier onboarding
• API Docs Authentication – New DOCS_BASIC_AUTH_ENABLED flag for securing documentation endpoints
• Enhanced Validation – Stricter rules for gateway URLs, tool names, and input parameters
• Improved Scripts – Consolidated run-gunicorn.sh with better error handling ([CHORE]: Migrate run-gunicorn-v2.sh to run-gunicorn.sh and have a single file (improved startup script with configurable flags) #397, [Bug]: make serve doesn't check if I'm already running an instance (run-gunicorn.sh) letting me start the server multiple times #430)

🆕 Added

Security & Authentication

• JWT Token Expiration ([SECURITY FEATURE]: Make JWT Token Expiration Mandatory when REQUIRE_TOKEN_EXPIRATION=true (depends on #87) #425) – Mandatory expiration with REQUIRE_TOKEN_EXPIRATION=true
• Masked Credentials ([Bug]: APIs for gateways in admin and main do not mask auth values #601, Mask auth for gateways APIs reponse #602) – Auth values hidden in gateway API responses
• API Docs Auth ([Feature Request]: Add basic auth support for API Docs #663) – Basic authentication for /docs with DOCS_BASIC_AUTH_ENABLED
• XSS Prevention (Validate RPC method for XSS #576) – RPC method validation against injection attacks
• SPDX Headers ([CHORE] Check SPDX headers Makefile and GitHub Actions target - ensure all files have File, Author(s) and SPDX headers #315, [CHORE]: Script to add relative file path header to each file and verify top level docstring #317, chore(file-headers): add script to verify and fix file headers #656) – Automated license compliance checking

Developer Experience

• File-Specific Linting ([CHORE]: Add make lint filename|dirname target to Makefile #410, CHORE(makefile): add comprehensive file-specific linting support #660):

  make lint filename.py     # Lint single file
  make lint dirname/        # Lint directory
  make lint-changed        # Lint git changes

• Enhanced Makefile ([CHORE]: Fix Database Migration Commands in Makefile #365, [CHORE]: Migrate run-gunicorn-v2.sh to run-gunicorn.sh and have a single file (improved startup script with configurable flags) #397, [Bug]: Makefile missing .PHONY declarations and other issues #507, Cleaned up Makefile formatting for better readability and maintainability #597):

  • .PHONY declarations for all targets
  • Prevented multiple server startups
  • Better formatting and organization
  • Consolidated scripts and improved readability

• Test Tool Enhancements:

  • Default value display ([Feature Request]: Display default values from input_schema in test tool screen #623, Fill default values in test tool #644)
  • Boolean input fixes ([Bug]: Test tool UI passes boolean inputs as on/off instead of true/false #622)
  • Array input parsing ([Bug]: Test tool UI passes array inputs as strings #620, Fix: Correctly parse array inputs in Test Tool UI #641)
  • Multiline text support (support multiline text input in test tool panel #650)

UI/UX Improvements

• Checkbox Selection ([Feature Request]: UI checkbox selection for servers, tools, and resources #392, checkbox implementation for selection in servers panel #619) – Multi-select for servers, tools, resources
• MCP Server Name Column ([Feature Request]: New column for "MCP Server Name" in Global tools/resources etc #506, feat: Add MCP Gateway Name to the Tools Overview #624) – Better visibility in global views
• Connection String Export ([Feature Request]: Export connection strings to various clients from UI and via API #154) – One-click client configuration
• Time Server Integration ([CHORE]: Add time server (and configure it post-deploy) to docker-compose.yaml #403, Add time server to compose closes #403 #637) – Added to docker-compose for testing
• Error Message Clarity ([Bug]: Improve consistency of displaying error messages #357, [CHORE]: Improve Error Messages - Replace Raw Technical Errors with User-Friendly Messages #363, Improved Error for Add tool and edit Tool #569, Improved Error for Add Prompt and edit Prompt for Issue #361 and Issue #591 #629, Improved Error for edit gateway for Issue #363 and Bug fixing of issue #603 #648) – Actionable validation feedback

Code Quality & Testing

• Security Scanners:

  • Snyk integration ([CHORE]: Add Makefile and GitHub Actions support for Snyk (test, code-test, container-test, helm charts) #638, Add snyk Makefile .snyk and github actions sample #639)
  • DevSkim static analysis ([CHORE]: Integrate DevSkim static analysis tool via Makefile #590, 590 devskim #592)
  • nodejsscan for JavaScript ([CHORE]: Add nodejsscan security scanner #499)

• Web Linting ([CHORE]: Add lint-web to CI/CD and add additional linters to Makefile (jshint jscpd markuplint) #390, Add web linters to Makefile and lint-web.yml GitHub Actions #614) – CI/CD integration with jshint, jscpd, markuplint

• Package Linters ([CHORE]: Add pypi package linters: check-manifest pyroma and verify target to GitHub Actions #615, Add pypi package linters: check-manifest pyroma and verify target to GitHub Actions #616) – check-manifest and pyroma for PyPI compliance

🐛 Fixed

Critical Gateway Issues

• Gateway ID null in Create API ([Bug]: Gateway ID returned as null by Gateway Create API #521)
• Duplicate registration bypass ([Bug]: Unexpected error when registering a gateway with the same name. #603, [Bug]: Duplicate Gateway Registration with Equivalent URLs Bypasses Uniqueness Check #649)
• Silent update failures in UI ([Bug]: Gateway update fails silently in UI, backend throws ValidationInfo error #630)
• Invalid URL validation ([Bug]: Adding invalid gateway URL does not return an error immediately #578)
• STREAMABLEHTTP transport validation (fix(gateway): Correct validation for STREAMABLEHTTP transport #662)
• GitHub MCP Server registration ([Bug]: Can't register Github MCP Server in the MCP Registry #584)

Tool & Resource Handling

• REST tool update failures ([Bug]: Edit tool update fail integration_type="REST" #579)
• Inconsistent tool name lengths ([Bug]: Inconsistency in acceptable length of Tool Names for tools created via UI and programmatically #631, Consistency in acceptable length of Tool Names #651)
• Long input name reflection ([Bug]: Long input names in tool creation reflected back to user in error message #598)
• Invalid "STREAMABLE" value ([Bug]: Edit tool in Admin UI sends invalid "STREAMABLE" value for Request Type #610)
• Edit forms not populating ([Bug] Edit Prompt Fails When Template Field Is Empty #591, Use values.data.get() in GatewayUpdate to Fix Pydantic Error Issue#630 #633, Improved Error for edit gateway for Issue #363 and Bug fixing of issue #603 #648)

Authentication & Security

• Missing auth credentials ([Bug]: _populate_auth not working #471, [Bug]: auth_username and auth_password not getting set in GET /gateways/<gateway_id> API #472)
• Unmasked sensitive data ([Bug]: APIs for gateways in admin and main do not mask auth values #601)
• XSS in RPC methods (Validate RPC method for XSS #576)

🔄 Changed

Configuration Defaults

• UI Enabled – .env.example sets MCPGATEWAY_UI_ENABLED=true
• Enhanced Validation – Stricter rules across all inputs
• Better Scripts – Single run-gunicorn.sh with improved features

Performance & Reliability

• Improved connection handling and timeouts
• Better stateful session management
• Enhanced resource cleanup

📦 Upgrade Instructions

1. Update your package:

   pip install --upgrade mcp-contextforge-gateway==0.5.0

2. Review new settings in .env:

   cp .env.example .env
   # Check new DOCS_BASIC_AUTH_ENABLED setting

3. Run database migrations (automatic in Docker/Kubernetes):

   make db-upgrade

---

🌟 Release Contributors

This release demonstrates strong community growth with 14 new contributors joining the project!

🏆 Top Contributors in 0.5.0

• Mihai Criveti (@crivetimihai) - Release coordinator, infrastructure, security
• Madhav Kandukuri (@madhav165) - XSS prevention, validation, security fixes
• Keval Mahajan (@kevalmahajan) - UI enhancements, test tool improvements
• Manav Gupta - File-specific linting, Makefile improvements
• Rakhi Dutta (@rakdutta) - Comprehensive error message improvements
• Shoumi Mukherjee (@shoummu1) - Array parsing, tool fixes, UI improvements

🎉 New Contributors

• JimmyLiao - STREAMABLEHTTP transport validation
• Arnav Bhattacharya - File header verification script
• Guoqiang Ding - Tool parameter conversion, API docs auth
• Pascal Roessner - MCP Gateway Name in tools overview
• Kumar Tiger - Duplicate gateway name fix
• Shamsul Arefin - JavaScript validation, UUID support
• Emmanuel Ferdman - Prompt service test fixes
• Tomas Pilar - Gateway response fixes, auth flags
• ChrisPC-39 - UI enablement, tool search

💪 Returning Contributors

• Nayana R Gowda - Redundant expressions, formatting
• Mohan Lakshmaiah - Tool name consistency
• Abdul Samad - Continued UI polish
• Satya - Gateway URL validation

---

🔗 Resources

• 📚 Docs: https://ibm.github.io/mcp-context-forge/
• 🐳 Container: ghcr.io/ibm/mcp-context-forge:v0.5.0
• 🐍 PyPI: mcp-contextforge-gateway
• 📈 Full changelog: Compare v0.4.0…v0.5.0

---

This discussion was created from the release MCP Gateway v0.5.0 - 2025-08-06 - Enterprise Operability, Auth, Configuration & Observability.