1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents muster v5.5.5

    Fixed

    • (aggregator) Attribute aggregated resources to their source server in #1098 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.5.4...v5.5.5

  • AI Agents muster v5.5.4

    Fixed

    • Dex cross-client audience scopes are resolved per authorization request instead of once when the OAuth server is built. An MCPServer with forwardToken: true that registers after muster starts now reaches the next login, so the forwarded ID token carries the audience its backend expects. Existing sessions are not repaired: affected users must log in again once. A background refresher re-reads the set every 10 seconds, so no login costs an MCPServer list call, and a read that fails serves the last known set instead of an empty one.
    • A change in the cross-client audiences muster requests from Dex is recorded as a dex_audiences_changed security audit event, alongside a log line. The set comes from MCPServer requiredAudiences and now changes without a muster restart.
    • Listing MCPServers reports a read failure instead of reporting an empty list. core_mcpserver_list now reports a failure when the MCPServer definitions cannot be read, auto-start reports the failure instead of starting no servers silently, and periodic resync logs it instead of treating it as “no MCPServers exist”.
  • AI Agents muster v5.5.3

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.5.2...v5.5.3

  • AI Agents muster v5.5.2

    Changed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.5.1...v5.5.2

  • AI Agents muster v5.5.1

    Fixed

    • (aggregator) Drop pending-auth registrations when their server is deleted in #1094 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.5.0...v5.5.1

  • AI Agents muster v5.5.0

    Changed

    • Outbound OAuth flows now send the RFC 8707 resource parameter on both the authorization request and the token request, for backends and for the muster agent login. The value is the resource field of the target’s RFC 9728 metadata, sent exactly as declared; when that metadata omits the field, or spec.auth.authorizationServer opts out of discovery, it is derived from the configured URL by dropping the query and the fragment and changing nothing else, which is the value mcp-go derives for the refresh request. A token muster obtains for one backend is no longer accepted at another backend that trusts the same issuer, provided the authorization server honors the parameter. An authorization server that rejects an unknown resource will fail the login.
    • Authorization server metadata is now rejected when its issuer does not identify the server the document was fetched from (RFC 8414 §3.3, trailing slash ignored), and when it carries no issuer at all. Deployments whose authorization server reports an issuer other than the URL muster fetches it from must correct the configured issuer.
    • RFC 9728 protected resource metadata advertised by a backend is now bound to that backend. A resource_metadata= pointer in a WWW-Authenticate header is followed only when it is on the backend’s own scheme and host, and a resource the document declares is used only when it is on that same origin (the path may differ, so a backend serving at <base>/mcp may declare <base>). A pointer to another origin is ignored and discovery falls through to the well-known path; a foreign declared resource is dropped and the indicator is derived from the backend URL. Without these checks a backend could name a document that binds muster’s token to a resource the backend does not own.
    • Breaking (Go API): pkg/oauth.Client.BuildAuthorizationURL takes an AuthorizationRequest struct instead of six positional arguments, and pkg/oauth.Client.ExchangeCode takes a trailing resource argument. Callers pass the same values through the new shapes; an empty Resource omits the parameter.
    • OAuth callbacks are now validated per RFC 9207 before anything else on the response is acted on. A present iss must equal the issuer the authorization server publishes in its own metadata (simple string comparison, no normalization), and an absent iss is refused when that server advertises authorization_response_iss_parameter_supported. When the metadata is unreachable the comparison falls back to the issuer recorded with the flow and then ignores a trailing slash on either side, because that value is operator-configured rather than published by the server. A response that fails the check is rejected whole: its error and error_description are neither acted on nor displayed. An error response that carries no valid state now renders “missing required parameters” instead of the OAuth denial page.
  • AI Agents muster v5.4.0

    Fixed

    • AWS SigV4 request signing for MCPServers. spec.auth.type: sigv4 with spec.auth.sigv4 (region, optional service, optional roleArn) makes muster sign every request to a streamable-http backend with AWS Signature Version 4, as its own machine identity rather than the caller’s, using the default AWS credential chain so IRSA needs no extra configuration; spec.family plus one roleArn per MCPServer puts many AWS accounts behind a single tool set with an account selector. Every signed request carries X-Amz-Content-Sha256 inside its SignedHeaders, so a backend that requires the payload-hash header (S3 and the services sharing its request model, reachable because auth.sigv4.service is user-settable) accepts the signature.
    • spec.meta for remote MCPServers. The map is merged into the params._meta object of every outbound JSON-RPC request that carries params, for a backend that reads call-scoped configuration from MCP metadata rather than tool arguments — the AWS-hosted server takes the region it operates in from params._meta.AWS_REGION, which is a different value from the SigV4 signing region, and omitting it does not fail but answers about the wrong region. Injection happens in an HTTP round tripper shared by every remote client, so it applies to streamable-http and sse alike, with any auth type and with none, and it survives the switch to the per-session connection that an OAuth server’s tool calls run on; for a SigV4 server the round tripper sits in front of the signer, because the body has to be rewritten before it is signed. type: stdio rejects the field (CEL rule plus the same check in filesystem mode): a stdio server speaks over a pipe, so no HTTP transport can inject the entries, and a dropped entry fails nowhere.
  • AI Agents agent-platform v2.13.0

    Added

    • kyvernoPolicies.policyExceptionNamespace (policy-exceptions), kyvernoPolicies.seccompPolicyName (restrict-seccomp-strict) and kyvernoPolicies.seccompRuleNames, the cluster-owned names the seccomp PolicyException targets. They default to the Giant Swarm cluster policy names; a cluster that names its policies differently must override them, or the exception matches nothing.

    Changed

    • kyvernoPolicies.seccompRuleNames must hold at least one non-empty name, and the connectivity chart fails the render when agentSandbox.podSecurity.enabled is on without kyvernoPolicies.enabled. Both configurations used to render an object that silently matched nothing.
    • The agent-sandbox pod-security ClusterPolicy no longer carries helm.sh/resource-policy: keep. Helm prunes it now whenever it stops rendering (kyvernoPolicies.enabled: false, agentSandbox.podSecurity.enabled: false, or the planned v0.5.0 removal of the template), instead of leaving an orphan ClusterPolicy that has to be deleted by hand.
    • The agent-sandbox component dependsOn the agent-platform-connectivity release, so Kyverno holds the mutate policy that carries the controller Deployment’s securityContext before the Deployment applies. The agent-sandbox release no longer fails its first install on a restricted-PSS cluster and then converges on a retry. The window is narrowed, not closed: dependsOn waits for the ClusterPolicy to apply, not for the Kyverno webhook to serve it, so the release retries still cover the rest. The agent-sandbox release now also waits on the whole connectivity release, so a connectivity failure holds it back. Flux only: the argo engine has no dependsOn, and its sync waves do not express this order yet.
  • AI Agents muster v5.3.1

    Fixed

    • (oauth) Complete the callback flow despite duplicate delivery and client disconnect in #1090 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.3.0...v5.3.1

  • AI Agents muster v5.3.0

    Added

    • (mcpserver) Add core_mcpserver_detect for transport auto-detection in #1087 by @teemow

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.2.1...v5.3.0