agent-router

Agent Router v1.2.1

Agent Router v1.2.1 is a security and stability patch for the v1.2 series. It tightens MCP session handling and makes the external processor tolerate malformed upstream responses. It also keeps MCP session encryption seeds out of Pod specs and logs, and moves to Go 1.27.2 for standard library CVE fixes. Upgrading rolls Gateway pods that serve MCPRoutes once. An MCP session ID now works only on the MCPRoute that created it. Envoy Gateway stays at v1.9.2, with Envoy Proxy v1.39.1 and Gateway API v1.6.1.

🐛 Bug Fixes

• MCP proxy listens on loopback only — The MCP proxy in the external processor sidecar now binds to 127.0.0.1:9856 instead of every interface, so only the Envoy proxy in the same pod can reach it. The controller rolls existing Gateway pods whose sidecar still listens on all interfaces. aigw run no longer exposes the port on the host network.
• MCP sessions are bound to their MCPRoute — A session ID is now accepted only on requests routed through the MCPRoute that created it, so that route's security policy always applies to its sessions. Reusing a session ID on a different MCPRoute returns 400; the client must initialize a new session.
• promptSelector is enforced on prompts/get and completions — Prompts filtered out of prompts/list by a backend's promptSelector could still be fetched by name. prompts/get and completion/complete with a prompt reference now return 400 for those prompts, matching how toolSelector already applied to tools/call.
• MCP session encryption seeds stay out of Pod specs — The controller used to pass the MCP session encryption seeds to the external processor as command-line arguments, where anyone who could read Gateway Pods could see them. It now delivers them in the filter config Secret, so changing a seed no longer rolls the Gateway pods. The controller reads the seeds from the MCP_SESSION_ENCRYPTION_SEED and MCP_FALLBACK_SESSION_ENCRYPTION_SEED environment variables. The Helm chart stores controller.mcp.sessionEncryption.fallback.seed in its own Secret, and restarts the controller on every helm upgrade while a fallback seed is set so that a seed rotation takes effect.
• Malformed upstream responses no longer crash the external processor — A 2xx response with missing or null fields could panic the external processor. This covered Anthropic messages without usage on Anthropic, AWS, and GCP backends, null image generation or Gemini bodies, and null Bedrock Converse content blocks. Such responses are now handled as empty responses or responses without usage. OpenInference tracing of Anthropic responses without usage and of null rerank results no longer panics either.
• More credential headers redacted in debug logs — Debug logs now redact the api-key (Azure API key) and x-amz-security-token (AWS session token) headers, in addition to authorization and x-api-key. Header mutations in immediate (locally generated) responses are redacted too.
• OAuth metadata fetch is size-limited — When resolving an MCPRoute's OAuth authorization server metadata, the controller reads at most 1 MiB of each response. Larger documents are skipped and the next well-known URL is tried.
• Controller replicas no longer restart on a fresh install — With controller.replicaCount of 2 or more, replicas that started together raced to patch the admission webhook's caBundle, and the losers exited with a conflict error. The update is now retried, and a replica that finds the bundle already in place does nothing.
• Go 1.27.2 — Built with Go 1.27.2, which includes standard library CVE fixes.

📖 Upgrade Guidance

v1.2.1 has no API changes and no new breaking changes. Upgrade from v1.2.0 by upgrading both charts:

helm upgrade -i aieg-crd oci://docker.io/envoyproxy/ai-gateway-crds-helm \
  --version v1.2.1 \
  --namespace envoy-ai-gateway-system

helm upgrade -i aieg oci://docker.io/envoyp