> ## Documentation Index
> Fetch the complete documentation index at: https://www.truefoundry.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Release notes for TrueFoundry, covering AI Gateway, AI Engineering, and platform updates with per-version chart upgrade instructions.

<Update label="0.159.4" description="July 21, 2026">
  ## Updates

  ### LLM Gateway

  * Virtual models work with the Responses API now. The first turn load-balances across backends; follow-ups stay pinned to whichever backend created the conversation. [Read more](https://www.truefoundry.com/docs/ai-gateway/virtual-model#supported-api-types)
  * Claude Code hooks can apply guardrails to prompts and tool calls — block on failure or rewrite flagged tool input and output. Fail-closed by default. [Read more](https://www.truefoundry.com/docs/ai-gateway/claude-code-hooks)
  * Unified Provider Caching: Pass a cache hint once in the header or request body and the gateway maps it to the right cache point for Anthropic, Bedrock, Vertex, Azure, and other providers.
  * Guardrail error messages can show which rules failed using `{{failed_guardrails}}`, and metrics now split blocking failures from ignored soft-pass errors. [Read more](https://www.truefoundry.com/docs/ai-gateway/guardrails-configuration#custom_error_message-placeholders)
  * BugFix: Budget Config V2 had a bug which caused incorrect filtering of users when both "In" and "Not In" filters were used together.

  ### MCP Gateway

  * OpenAPI MCP servers can expose up to 200 tools per server now, up from 30.

  ### Platform

  * Airgapped installs can load templates and catalogue assets from local disk instead of reaching out to external hosts.
  * You can update your own display name from the console.

  ### AI Deployment

  * Model deployments can inherit default pod security settings — things like running vLLM as non-root with trimmed container permissions — applied automatically at deploy time.
  * EKS cluster discovery picks up Karpenter NodeOverlays, so fractional GPU setups (MIG and time-slicing) show up in nodepool configuration.
  * Kubernetes proxy access now requires manage permissions on workspace- and cluster-scoped paths, even for read-only HTTP calls. Roles with view-only access may lose access where GET used to work.
  * BugFix: Flyte propeller wasn't using the image pull credentials for Spark tasks, causing `403 Forbidden` errors when pulling private images from the Docker registry.
  * BugFix: Ephemeral storage was not being passed through to PySpark tasks. Upgrade the `tfy-workflow-propeller` to `v0.159.0` to pick up both Flyte propeller fixes above.
  * BugFix: Scheduled workflows weren't using the configured service account. Upgrade to the latest CLI with `pip install "truefoundry[workflow]"` and set `service_account` on the `@workflow` decorator. [Read more](https://www.truefoundry.com/docs/spark-task)

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.159.3`.
  * Update the `tfy-llm-gateway` chart to version `0.159.1`.
</Update>

<Update label="0.158.0" description="July 16, 2026">
  ## Updates

  ### LLM Gateway

  * Added Noma Security as a guardrail provider for AI-DR scanning of prompts and responses, configurable per tenant with secret-backed API key auth. [Read more](https://www.truefoundry.com/docs/ai-gateway/noma-security)
  * Anthropic, AWS Bedrock, Bedrock Mantle, and AWS Claude Platform provider accounts now support an optional custom `base_url`, letting traffic target VPC/PrivateLink or proxy endpoints instead of the default public host.
  * BugFix: Fixed a compatibility issue that caused 400 Bad Request errors when using newer Gemini CLI versions (v0.43+) with Vertex AI models.
  * Budget Limiting V2 is now available with independent rules, optional scope filters for broad tenant- and team-wide caps, provider account filtering, immutable `applies_to`, and per-user email alerts when a user crosses a threshold. Users can see their own budge usage. [Read more](https://www.truefoundry.com/docs/ai-gateway/budget-limiting-v2) · [Migration announcement](https://www.truefoundry.com/docs/change-announcements/budget-limiting-v2-v0.158.0)
      <Frame>
        <img src="https://mintcdn.com/truefoundry/UcopJYFW_T6f2hWH/images/budget-limit-v2-release.png?fit=max&auto=format&n=UcopJYFW_T6f2hWH&q=85&s=23d2782828d0202115c173066144dd0a" alt="Budget Limiting v2 page showing tenant and per-user budget rules with active use, limits, and enforcement toggles" width="2552" height="1008" data-path="images/budget-limit-v2-release.png" />
      </Frame>

  ### Platform

  * Secret group search now matches individual secret names in addition to group names. Enhances search functionality on secrets page.
  * HashiCorp Vault AppRole auth now supports a custom role path for non-standard mount points. [Read more](https://www.truefoundry.com/docs/hashicorp)

  ### AI Deployment

  * Spark jobs can now run on a schedule using cron, in addition to manual runs. [Read more](https://www.truefoundry.com/docs/spark-task)

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.158.1`.
  * Update the `tfy-llm-gateway` chart to version `0.158.0`.
</Update>

<Update label="0.157.2" description="July 2026">
  ## Updates

  ### LLM Gateway

  * Bug Fix: Assumed-role credential failures on Bedrock, SageMaker, and related AWS providers now return a clear 403 instead of a 500.

  ### Platform

  * Added a Last Accessed At column across Users, Personal Access Tokens, and Virtual Accounts.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/DAc6QCe6DkuglpzE/images/last-accessed-changelog.png?fit=max&auto=format&n=DAc6QCe6DkuglpzE&q=85&s=c778a778d21890be32b03c1c16fb1a86" alt="Users table showing the new Last Accessed At column" width="2294" height="998" data-path="images/last-accessed-changelog.png" />
      </Frame>
  * All users (member roles) can now create agents by default. Read more about roles and permissions [here](https://www.truefoundry.com/docs/platform/manage-user-roles-and-permissions).

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.157.2`.
  * Update the `tfy-llm-gateway` chart to version `0.157.0`.
</Update>

<Update label="0.156.0" description="July 2026">
  ## Updates

  ### LLM Gateway

  * Added support for reranking models in Azure OpenAI and Azure Foundry providers. [Read more](https://www.truefoundry.com/docs/ai-gateway/intro-to-llm-gateway#rerank-rerank)
  * Virtual models can route image requests too — including generate, edit, and variation. [Read more](https://www.truefoundry.com/docs/ai-gateway/virtual-model)
  * Wafer is available as a new model provider. Add it like any other provider and start using Wafer Serverless models. [Read more](https://www.truefoundry.com/docs/ai-gateway/wafer)
  * If a target fails for a non-HTTP reason (bad credentials, DNS, or TLS errors), load balancing now tries the next target instead of failing the whole request.
  * `reasoning_effort` now accepts provider-specific values like `xhigh` and `max`, not just a fixed list. This works for chat completions and agents.

  ### MCP Gateway

  * Fixed `invalid_client` errors when connecting to MCP servers via OAuth from clients such as Claude Code and Claude Desktop. Previously registered clients now keep working without needing to clear local configuration.
  * When setting up remote or OpenAPI MCP servers, header auth values can point to TrueFoundry secrets instead of pasting raw keys.
  * MCP client and upstream request timeouts now default to 30 minutes. You can change this with `MCP_CLIENT_REQUEST_TIMEOUT_MS`.

  ### Platform

  * Self-hosted Redis now supports Redis Sentinel, TLS/mTLS in transit, a configurable database index, and certificates from files or inline PEM values.
  * Audit logs got a refresh. You can see a diff of what changed on a resource, and also open activity logs from the resource itself. [Read more](https://www.truefoundry.com/docs/platform/audit-logging#resource-level-activity-logs)
      <Frame>
        <img src="https://mintcdn.com/truefoundry/01TQg6VJCzezYEEu/images/docs/platform/audit-logs-details.png?fit=max&auto=format&n=01TQg6VJCzezYEEu&q=85&s=ceacb526c8ebc88556e47488af48de81" alt="Audit log details showing a diff of changes made to a resource" width="1024" height="745" data-path="images/docs/platform/audit-logs-details.png" />
      </Frame>
  * Updated entity-caching under the hood for better performance and reliability.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.156.0`.
  * Update the `tfy-llm-gateway` chart to version `0.156.0`.
</Update>

<Update label="0.154.5" description="June 30, 2026">
  ## Updates

  ### AI Gateway

  * Custom endpoints now support metadata-based routing, letting you filter load-balance targets using request metadata headers before ordering and fallback — matching the behavior already available on virtual models.
  * Wafer Serverless is available as a new model provider with OpenAI-compatible chat completions, API key auth, and optional zero-data-retention mode.
  * Azure models and guardrails now support Workload Identity Federation as an authentication option, allowing keyless access via Kubernetes service account tokens exchanged with Entra ID.
  * OpenAI ChatGPT subscription passthrough (Codex) is supported — clients can route through the gateway using their own ChatGPT OAuth bearer token when no platform API key is configured on the provider account.
  * OCR is now a first-class model type with per-1,000-pages cost metrics, configurable pricing in provider accounts, and proper billing attribution through the gateway.
  * Default MCP and upstream request timeouts have been raised to 30 minutes, and per-request timeout can be set with the `x-tfy-request-timeout` header.
  * CrowdStrike AIDR guardrail requests now include request metadata (user, model, provider, tenant) for richer detection categorization.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.154.5`.
  * Update the `tfy-llm-gateway` chart to version `0.154.2`.
</Update>

<Update label="0.152.2" description="June 22, 2026">
  ## Updates

  ### AI Gateway

  * Support for AWS Bedrock Mantle is now available.
  * Microsoft Teams is available as a notification channel for alerts and budget notifications.
  * The agent playground sidebar has been revamped with a dedicated Runtime Config section covering iteration limit, sandbox, capabilities, and context management.

  ### AI Engineering

  * The workspace-editor role no longer includes `ManageWorkspace`, the secret-group-editor role no longer includes `ManageSecretGroup`, and the project-editor role no longer includes `ManageRepository`.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.152.2`.
  * Update the `tfy-llm-gateway` chart to version `0.152.0`.
</Update>

<Update label="v0.151.6" description="June 16, 2026">
  ### AI Gateway

  * Azure OpenAI, Azure AI Foundry, and Azure guardrail integrations now support Entra client-secret authentication alongside existing API key and certificate options.
  * Vertex AI workload identity federation now supports EKS-to-GCP federation (IRSA / EKS Pod Identity) in addition to GKE.
  * Virtual models now support audio transcription, audio translation, and text-to-speech model types with load-balanced routing.
  * Virtual model priority-based routing targets can now define a `time_to_first_token_ms` SLA cutoff so backends are cooled down when rolling TTFT breaches the configured threshold.
  * Default `max_tokens` values are no longer injected for providers where the field is optional, so omitted limits behave like a direct API call to the provider.
  * Agent requests now accept an optional `timeout` parameter (seconds) to cap background execution time for stateful and stateless runs.
  * Guardrail execution traces now record the evaluated input and provider output for improved debugging.
  * Gateway metadata now applies team-bound tags from virtual account and PAT sessions, so routing, rate limits, and budgets can key off subject tags.
  * MCP server OAuth2 client-credentials auth now supports per-organization token caching and refresh when the provider is Auth0 with `use_organization` enabled. [Read more](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-gateway-auth-security#how-do-i-use-auth0-organizations-for-mcp-gateway-authentication)
  * An Agent Details page is now available in Agent Registry, showing instructions, MCP servers, skills, and model configuration at a glance.

  ### AI Engineering

  * Opaque access tokens (`tfy_*`) are now supported as an alternative to JWTs for personal access tokens and virtual accounts, with the format chosen at creation time and authenticated via exact-match lookup.
  * Admins can now mandate `team` selection for PAT creation, ensuring that all API usage costs are attributed to a specific team. [Read more](https://www.truefoundry.com/docs/generating-truefoundry-api-keys#mandate-team-selection-for-pats)
  * Spark notebooks now support pause, resume, and edit with dedicated SparkConnect lifecycle management.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.151.5`.
  * Update the `tfy-llm-gateway` chart to version `0.151.0`.

      <Warning>
        **Important Announcement**: For customers using TrueFoundry AI Engineering
        features. Please upgrade your `tfy-agent` to version `0.2.95` before proceeding
        with the Control Plane upgrade. By default, `tfy-agent` comes with
        `external-secrets-operator` as a dependency subchart, in case your cluster
        already has an ESO, disable ESO in tfy-agent chart by following values:

        ```yaml theme={"dark"}
        external-secrets-operator:
          enabled: false
        ```

        Note: Please ensure that the K8s secret object containing the tfy-agent cluster token has a label `external-secrets.io/type: webhook` to be used by the ESO secret store for webhook authentication. [Read more](/docs/change-announcements/moving-to-eso-for-secret-management-v0.151.5)
      </Warning>
</Update>

<Update label="v0.148.11" description="June 9, 2026" tags={["Stable"]}>
  ### Updates

  * System prompts are excluded from Guardrail scanning so operator-authored system messages no longer trigger input guardrails.
  * A new TrueFoundry metadata validation guardrail lets you enforce required metadata keys, regex patterns, or allowed-value lists on request headers. [Read more](https://www.truefoundry.com/docs/ai-gateway/metadata-validation)
  * Groq API keys are now detected and redacted by the built-in secrets-detection guardrail.
  * Databricks Claude models now retain `cache_control` on messages and tools, enabling prompt caching on that provider path.
  * Custom-endpoint provider accounts now support aggregated load-balanced proxying with `weight` or `priority` routing across multiple upstream targets, with configurable fallback status codes and per-target cooldown.
  * Priority-tier billing is now supported — when an OpenAI-style response includes `service_tier: priority`, cost calculations use optional `priority_pricing` rates from model config.
  * File and image attachments (upload, paste, drag-and-drop) are now supported in Agent Hub and the Agent Playground.
  * MCP Auth Override credentials can now reference TrueFoundry secrets instead of storing raw values.
  * A new `Assign Role` permission (`tenant:AssignRole`) allows role assignment to be authorized separately from Manage Users or Manage Roles.
  * MCP Auth Override credentials can now reference TrueFoundry secrets instead of storing raw values.
  * Gateway metrics throughput charts now display requests per minute instead of requests per second across all dashboards.

  ### AI Engineering

  * Git integrations page is revamped with a unified table view, PAT-based credential creation alongside OAuth, and support for Bitbucket Data Center PAT-only connections.
  * Spark Notebook now supports Spark 4.0 by default (aligned with Databricks 17.3 LTS), with additional images for Databricks 16.4, 15.4, and 14.3 LTS runtimes, and the Spark UI is accessible through the notebook URL.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.148.10`.
  * Update the `tfy-llm-gateway` chart to version `0.148.4`.

  <Warning>
    **Troubleshooting**: MCP DCR client\_id & Redirect URL Validation error. [Read
    more](/docs/change-announcements/mcp-dcr-client-id-validation-v0.148)
  </Warning>

  <Warning>
    **Breaking Change**: We have non-compatible migrations in this version which
    requires an upgrade to v0.141.0 before proceeding to upgrade to higher
    versions. Please upgrade in 2 steps: Upgrade truefoundry to v0.141.0, then,
    upgrade truefoundry to any higher version of your will.
  </Warning>
</Update>

<Update label="v0.146.6" description="May 22, 2026">
  ## Updates

  * JWT audience validation for identity providers now supports tokens with an array `aud` claim, accepting authentication when any configured allowed audience matches any audience in the token.

  ### AI Gateway

  * Skills registry is now available, allowing you to register and manage agent skills on the platform.[You can learn more about it here](/docs/ai-gateway/skills/getting-started)
  * Latency-based routing now uses a deterministic, sticky-per-epoch target selection keyed by caller identity, improving cache-hit rates and providing more predictable traffic distribution. [Read more](https://www.truefoundry.com/docs/ai-gateway/virtual-model#latency-based-routing)
  * Provider accounts now support an optional `discount_percent` field (0–100) that applies to public cost calculations, with discounted prices surfaced in model metadata.
  * Anthropic extended-cache 1-hour write tokens are now tracked and billed separately from standard 5-minute cache writes via a new `cache_creation_input_token_cost_per_hour` rate.

  ### AI Engineering

  * Teams can now be created with an empty members list, removing the previous requirement for at least one member at creation time.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.146.6`.
  * Update the `tfy-llm-gateway` chart to version `0.146.2`.
</Update>

<Update label="v0.144.0" description="May 18, 2026">
  ## Updates

  * A new Provisioning settings (`settings/provisioning`) is available for configuring SCIM, JIT, and manual user provisioning modes. [You can learn more about it here](/docs/change-announcements/identity-and-access-revamp-v0.143#2-dedicated-provisioning-settings-page)
      <Frame>
        <img src="https://mintcdn.com/truefoundry/xnxwG9wbAPzCd_DD/images/docs/provisioning_settings.png?fit=max&auto=format&n=xnxwG9wbAPzCd_DD&q=85&s=3aa70cfef1d903fefea0a85100e9d8b4" width="2628" height="1274" data-path="images/docs/provisioning_settings.png" />
      </Frame>
  * Identity Providers configuration has been consolidated. A new Identity Providers section is available under Organization Settings. [You can learn more about it here](/docs/change-announcements/identity-and-access-revamp-v0.143#3-external-identity-replaced-by-identity-providers)
      <Frame>
        <img src="https://mintcdn.com/truefoundry/xnxwG9wbAPzCd_DD/images/docs/identity_provider_setting.png?fit=max&auto=format&n=xnxwG9wbAPzCd_DD&q=85&s=7d3a4819b031378b170d136e88516e13" width="2672" height="1486" data-path="images/docs/identity_provider_setting.png" />
      </Frame>
  * A new access control feature is available where you can see all the permission a user has access to and also you can Grant and revoke Access to Users using this feature.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/xnxwG9wbAPzCd_DD/images/docs/access_control.png?fit=max&auto=format&n=xnxwG9wbAPzCd_DD&q=85&s=438ef4288bc2ab128f9b8695429f72c8" width="2086" height="1484" data-path="images/docs/access_control.png" />
      </Frame>
  * To grant/update access to Users, you can click on Access Control button -> Grant Access button on top right corner -> Select Role.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/xnxwG9wbAPzCd_DD/images/docs/grant_access_to_user.png?fit=max&auto=format&n=xnxwG9wbAPzCd_DD&q=85&s=49d0ff4e1f98f8b5a1e48c2a65bf9086" width="2664" height="1486" data-path="images/docs/grant_access_to_user.png" />
      </Frame>
  * You can now assign multiple roles to a User.
  * You can now also assign roles to a Team.

  ### AI Gateway

  * Agents now support file uploads in user messages.
  * Tenant-scoped global guardrail settings are now available, allowing operators to configure a default guardrail timeout and whether input guardrails run in parallel with model execution.
  * Image-modality token usage is now tracked and priced separately from text tokens across Gemini/Vertex and image endpoints.
  * Client disconnects during inference now short-circuit load-balancing retries and return HTTP 499 instead of falling through to additional targets.
  * Bedrock proxy errors now propagate the real upstream HTTP status code instead of always returning 500.
  * Identity provider token resolution now supports mapping external JWTs to TrueFoundry users or virtual accounts based on configured claim rules, with team membership derived from JWT claims.
  * Support for Crowdstrike AIDR guardrail integration is now available, replacing the deprecated Pangea integration, Existing Pangea guardrail configurations must be migrated to CrowdStrike AIDR. [You can learn more about it here](/docs/ai-gateway/crowdstrike)
  * Quarterly budget limits are now supported for gateway cost enforcement, in addition to existing daily and monthly windows.

  ### AI Engineering

  * EKS 1.35 is now supported for new AWS cluster provisioning and is the new default Kubernetes version.
  * Custom Docker registry integrations now accept hostnames with optional port numbers and support HTTP-based registries.
  * The model weight validation for deployment now accepts any file ending in `.safetensors`, broadening compatibility with additional HuggingFace model layouts.
  * Spark Notebook is available as a new workbench type, with support for configuring driver/executor resources, scaling mode, and Spark Connect. This feature is gated behind a feature flag.
  * Human-in-the-loop signal support is now available for Flyte workflow executions, allowing users to list, approve, and set signals on running workflows.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.144.0`.
  * Update the `tfy-llm-gateway` chart to version `0.144.0`.
</Update>

<Update label="v0.142.3" description="May 6, 2026">
  ## Updates

  ### AI Gateway

  * Guardrails now inspect and moderate tool call inputs and tool result outputs (across Bedrock, Gemini, and Messages adapters), not just visible text content. Blocking verdicts correctly prevent content from leaking through the mutation/redaction path.
  * Guardrail plugins in audit mode now consistently emit `audit_mode_flag` in traces instead of silently passing, and multiple plugins have been aligned to a unified verdict and enforcement model.
  * AWS Bedrock guardrail violation messages now include topic policy hits alongside existing word, content, and PII policy violations.
  * Anthropic `anthropic_beta` headers are now forwarded to Bedrock and Vertex Anthropic Messages requests, with a configurable Bedrock-side allowlist (`BEDROCK_ANTHROPIC_BETA_ALLOWLIST`) that filters unsupported tokens.
  * Virtual Model name validation now allows uppercase characters and names up to 64 characters.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.142.3`.
  * Update the `tfy-llm-gateway` chart to version `0.142.3`.
</Update>

<Update label="v0.141.1" description="April 30, 2026">
  ## Updates

  ### AI Gateway

  * Custom Endpoints provider is now supported, enabling you to bring your own inference endpoints as a first-class provider type in the AI Gateway with full access control and model management.[You can learn more about it here](https://www.truefoundry.com/docs/ai-gateway/custom-endpoints)
  * Google Vertex AI now supports multi-region endpoints — you can set the Vertex region to `us`, `eu`, or `global` for both provider accounts and per-model integrations.
  * Smallest AI (Waves) is now available as a TTS and STT provider, supporting text-to-speech and speech-to-text proxy requests with API-key authentication.
  * Vertex AI embeddings for specific Gemini embedding models now route to the `:embedContent` API instead of `:predict`, with support for multimodal embedding inputs (text, image, video).

  ### AI Engineering

  * Snowflake task support is now available in Flyte workflows, allowing you to configure and run Snowflake SQL tasks alongside existing container and Spark tasks.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.141.1`.
  * Update the `tfy-llm-gateway` chart to version `0.141.1`.
  * An option to disable the security context for all TrueFoundry components has been added. This is useful for clusters with restricted Security Context Constraints (e.g. OpenShift). See [How to deploy on OpenShift with restricted SCCs](/docs/platform/deploy-control-plane-faq#how-to-deploy-on-openshift-with-restricted-security-context-constraints-scc) for details.
  * The default security context for NATS has been removed. If your cluster requires a security context for NATS, you must now pass it explicitly via your Helm values:

  ```yaml theme={"dark"}
  tfyNats:
    container:
      merge:
        securityContext:
          capabilities:
            drop:
              - ALL
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
    podTemplate:
      merge:
        spec:
          securityContext:
            fsGroup: 1000
            runAsUser: 1000
            runAsNonRoot: true
  ```

  <Warning>
    **Breaking Change**: We have non-compatible migrations in this version which
    requires an upgrade to v0.141.0 before proceeding to upgrade to higher
    versions. Please upgrade in 2 steps: Upgrade truefoundry to v0.141.0, then,
    upgrade truefoundry to any higher version of your will.
  </Warning>
</Update>

<Update label="v0.139.4" description="April 27, 2026">
  ## Updates

  ### AI Gateway

  * Google Vertex provider accounts now support Workload Identity Federation (WIF) as an alternative to service-account key files.
  * Bedrock Nova embeddings are now supported, including text and base64 image inputs with a dedicated response transformer.
  * Structured output handling for Azure OpenAI models is fixed by resolving the effective foundation model name before checking `json_schema` response format support.
  * Computer-use tool definitions are now translated to Gemini's native format for both Google AI Studio and Vertex AI chat completions.
  * Guardrail policies can now target individual MCP tools using `server:tool` identifiers in the `mcpServers` field, enabling fine-grained guardrail scoping.
  * End-to-end request tracing now covers all provider operation endpoints including batches, files, fine-tuning, image generation, and moderation.
  * For Claude Code Max, TrueFoundry Anthropic provider accounts must omit the API key entirely instead of using a dummy key.[You can learn more about it here](https://www.truefoundry.com/docs/ai-gateway/claude-code-max#claude-code-max)
  * OpenTelemetry metrics export is now enabled by default for the gateway. Operators who do not want OTLP metrics emission should explicitly disable `ENABLE_OTEL_METRICS_EXPORTER`.
  * MCP elicitation is now supported for remote MCP servers — the gateway can forward JSON-RPC response payloads (not just requests) upstream.
  * The OpenAI Responses API is now supported as a new inference type, with routing, model validation, and code snippet generation available for both streaming and non-streaming modes.
  * Virtual Model `model_types` are now restricted to `chat`, `completion`, `embedding`, `rerank`, and `moderation`. Existing configs using other types (e.g. `realtime`) will need to be updated.
  * Added support for automatically deploying stdio-based MCP servers. \[Only available for SaaS customers, for on-prem, please contact truefoundry support team]

  ### AI Engineering

  * SCIM provisioning is now supported for OIDC identity providers via a new `enable_scim` toggle in SSO settings, with improved RFC compliance across all SCIM v2 API responses.
  * The Kubecost addon has been removed from cluster infrastructure configuration across all cloud providers.
  * GCP Workload Identity Federation is now supported for trace and log storage backends, enabling keyless authentication for GCS-backed Delta tables.
  * Slack webhook is now supported as a notification target for alert rules, alongside existing Email, Slack Bot, and PagerDuty options.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.139.4`.
  * Update the `tfy-llm-gateway` chart to version `0.139.2`.
</Update>

<Update label="v0.136.6" description="April 9, 2026">
  ## Updates

  ### AI Gateway

  * Guardrails now support targeting individual MCP tools per server, allowing fine-grained control.
  * Gateway provider responses now include a `provider` field indicating which upstream provider served the request.

  <Warning>
    **Breaking Change**: All metric names in AI Gateway are being renamed from the
    llm\_gateway\_\* prefix to ai\_gateway\_\*, so please update your dashboards and
    alerts to use the new metric names. [Read
    more](/docs/change-announcements/refactoring-of-ai-gateway-metrics)
  </Warning>

  ### AI Engineering

  * Spark jobs no longer set an explicit `memoryOverhead: 0M`, allowing Spark operator defaults to apply for driver and executor memory sizing.
  * External identity authentication now supports nested/dotted JWT claim paths for extracting `unique_id_claim` and `email_claim` from token payloads.
  * Trace search has been optimized and made more efficient and faster.
  * Dry-run apply requests now skip activity logging.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.136.6`.
  * Update the `tfy-llm-gateway` chart to version `0.136.1`.
  * If you're using `tfy-logs` for Logging, remove `retentionMaxDiskUsagePercent` from Values.
    Go to **Deployment > Helm > Tfy-logs > Edit Values** and delete the `retentionMaxDiskUsagePercent` field.
</Update>

<Update label="v0.135.4" description="April 7, 2026">
  ## Updates

  ### AI Gateway

  * Added TrojAI DEFEND as a new guardrail integration, supporting both blocking (validate) and content-sanitizing (mutate) modes via the TrojAI firewall API.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/HzcYnSlPR7DkS8bF/images/docs/trojai_integration.png?fit=max&auto=format&n=HzcYnSlPR7DkS8bF&q=85&s=de60624d984d86416bcce393787c83fc" width="2672" height="1570" data-path="images/docs/trojai_integration.png" />
      </Frame>
  * Azure AI Foundry now supports audio endpoints for text-to-speech and speech-to-text operations.
  * DeepInfra embeddings are now supported through the gateway.
  * PagerDuty is now available as a notification target for gateway budget alerts.
  * Google Gemini and Vertex AI token accounting now correctly includes thinking/reasoning tokens in completion token counts for accurate cost calculations.

  <Warning>
    **Deprecation warning**: Built in common tools are now deprecated from
    Playground and Settings and will be fully removed after 15 May 2026. [Read
    more](/docs/change-announcements/deprecation-of-common-tools-v0-135-0)
  </Warning>

  ### AI Engineering

  * Added an Access Control drawer throughout the platform, providing visibility into who has what permissions on any resource.
  * Team names now allow uppercase letters and underscores.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.135.4`.

  <Warning>
    We have renamed following fields in the values. Please replace them before upgrading.
    Changes in helm values:

    1. Replace `tfy-configs` with `tfyConfigs` field in values.
    2. Replace `tfy-buildkitd-service` with `tfyBuildkitdService` field in values.
  </Warning>

  * Update the `tfy-llm-gateway` chart to version `0.135.0`.
</Update>

<Update label="v0.134.7" description="March 31, 2026">
  ## Updates

  ### AI Gateway

  * MCP auth overrides now support virtual accounts in addition to users, allowing programmatic service identities to authenticate to MCP servers.

  ### AI Engineering

  * HashiCorp Vault integrations now support AppRole authentication in addition to token-based auth, and `root_path` validation accepts nested slash-delimited paths.
  * Custom S3-compatible blob storage integrations are now supported for tracing and data routing, including plain HTTP endpoints.
  * Virtual account permissions now accept role names (not just IDs) for account-scoped roles.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.134.7`.
  * Update the `tfy-llm-gateway` chart to version `0.134.3`.
</Update>

<Update label="v0.133.3" description="March 27, 2026">
  ## Updates

  ### AI Gateway

  * Baseten is now available as a first-class inference provider, supporting chat completions and embeddings.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/yR_clVDeJDlQkXKY/images/docs/baseten.png?fit=max&auto=format&n=yR_clVDeJDlQkXKY&q=85&s=a8a420fdb7f594a08461bcbb5e428fff" width="2028" height="1464" data-path="images/docs/baseten.png" />
      </Frame>
  * MCP servers now support per-user header-based auth overrides, allowing individual users to supply their own API tokens for MCP servers that require per-user credentials. MCP auth overrides are enabled by default.
  * OpenAPI-backed MCP servers are now processed through the full gateway hook pipeline, ensuring guardrails, auth, and tool settings apply consistently with remote MCP servers.
  * Virtual model routing targets can now include `metadata_match` conditions, so only targets whose key/value constraints match the incoming request metadata headers are eligible for routing.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/KHFOdhbHkz-Buyvl/images/docs/metadata_filter.png?fit=max&auto=format&n=KHFOdhbHkz-Buyvl&q=85&s=16b6aae66e3ef568066369021014f3b3" width="2898" height="1320" data-path="images/docs/metadata_filter.png" />
      </Frame>
  * TLS and proxy support is now available for remote MCP server connections, configurable via manifest `tls_settings`.
  * Azure OpenAI deployment configuration has been reworked — the previous region and data-zone fields are replaced by a `deployment_type` selector (`global`, `datazone_us`, `datazone_eu`, `standard`), and pricing lookup is updated accordingly.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/qFsIrTci7_FnaRIi/images/docs/deployment_type_azure_openai.png?fit=max&auto=format&n=qFsIrTci7_FnaRIi&q=85&s=b5e71e493e8be341fe5d2691034af762" width="2110" height="1456" data-path="images/docs/deployment_type_azure_openai.png" />
      </Frame>
  * The `x-tfy-routing-config` request header is no longer accepted for routing overrides. Routing configuration is now resolved exclusively from virtual model config, prompt config, or tenant-level load-balance settings. Clients that relied on this header must migrate to one of those mechanisms.
      <Warning>
        **Breaking Change**: We are retiring the `x-tfy-routing-config` request
        header. Use Virtual Models instead. [Read more about Virtual
        Models](/docs/ai-gateway/virtual-model#routing-strategies) and [Read more
        about x-tfy-routing-config header
        removal](/docs/change-announcements/routing-config-header-removal-v0.133)
      </Warning>

  ### AI Engineering

  * GCR (`gcr.io`) container registries are now supported alongside Artifact Registry for GCP Docker registry integrations.
  * The OpenTelemetry collector now accepts traces and metrics over gRPC (port 4317) in addition to HTTP.
  * Platform policies can now be applied to `volume` manifests, extending enforcement and mutation support to volume deployments.

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.133.3`.
  * Update the `tfy-llm-gateway` chart to version `0.133.0`.
</Update>

<Update label="v0.132.5" description="March 24, 2026">
  ## Updates

  ### AI Gateway

  * Google Model Armor guardrails now support a `mutate` operation mode that can redact or transform request and response content via sensitive data protection, in addition to the existing `validate` mode.
  * MCP tool-call guardrails are now enforced on SSE streaming responses in addition to JSON responses, with consistent blocking and error handling across both transports.
  * Speech-to-text proxy support has been added for Vertex, with a corresponding code snippet available in the playground.
  * Added support for sticky routing for virtual models.
  * Guardrail requests to Palo Alto can now include custom metadata fields (e.g. AI model name, app user, app name) via a configurable `metadata_key_mapping`
  * Fixed structured output (`response_format: json_schema`) handling for Anthropic models on Vertex.
  * Added support for disabling individual tools on an MCP Server
  * New code snippet integrations have been added for the playground, including Pydantic, Agno, CrewAI, Instructor, Langroid, OpenAI Agents, OpenAI Swarm, Strands Agents, and Codex.
  * New format for MCP Gateway endpoint.
      <Warning>
        **Breaking Change**: We are updating the format of MCP Gateway endpoints.
        [Read more](/docs/change-announcements/mcp-gateway-url-transport-v0.130)
      </Warning>

  ### AI Engineering

  * HashiCorp Vault integrations now require `kv_mount_path` and support an optional `root_path`.

  <Accordion title="Breaking Change: Hashicorp Integration">
    1. `kv_mount_path` is required parameter
    2. Key path used in Secret FQN should be updated to following path: `<root_path>/<secretPath>/<secretKeyInJSON>`.

    |                             | Existing                                                                                   | New                                                                                     |
    | --------------------------- | ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
    | Model Integration Auth Data | `tenant1:hashicorp:secret-store:vault::kv1/data/my-root-path/my-secret-path/my-secret-key` | `tenant1:hashicorp:secret-store:vault::my-root-path/my-secret-path/my-secret-key/value` |
    | Virtual Account Sync Secret | `kv1/data/my-root-path/my-secret-path/my-secret-key`                                       | `my-root-path/my-secret-path/my-secret-key/value`                                       |
  </Accordion>

  * SCIM provisioning is now supported for SAML-based external OAuth identity providers.
  * Additional AWS instance families are now available for EKS cluster provisioning, including Graviton-based (T4g, M6g/M7g, C6g/C7g, R6g/R7g), ML accelerator (Trn1, Inf2), and newer GPU families (P5e, P6-B200, G6e, G7e).
  * A generic custom secret store integration is now available as an alternative to the built-in TrueFoundry DB or HashiCorp Vault secret backends.
  * Added Support for Databricks Job Task in Flyte workflows to trigger Databricks jobs from Flyte workflows.
  * The YAML spec/apply workflow has been removed from platform settings configuration drawers; settings are now edited exclusively through the form UI.
  * Simplified GitOps CI/CD — `tfy apply` now supports directory-level `--diffs-only` with automatic dependency resolution, replacing complex per-file CI/CD scripts with a single command. Dry runs now succeed even when a PR adds interdependent resources.
    [Read more](/docs/change-announcements/simplified-gitops-cicd-v0.132)

  ### Release instructions

  * Update the `truefoundry` Helm chart to version `0.132.5`.
  * Update the `tfy-llm-gateway` chart to version `0.132.2`.
</Update>

<Update label="v0.127.3" description="2026-03-10">
  ## Updates

  * Added support for time-to-first-token(TTFT) based timeout using header `x-tfy-ttft-timeout-ms`. [Read more](https://www.truefoundry.com/docs/ai-gateway/headers#request-headers)
  * Added support for finetuned model integration in Google Vertex AI.
  * Added support to configure custom KMS Key ARN in AWS Secret Manager/AWS Parameter Store for Secret Store integration.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.127.3`.
  * Update `tfy-llm-gateway` helm chart version to `0.127.0`.
</Update>

<Update label="v0.126.2" description="2026-03-09">
  ## New: Enhanced Model integration flow allowing to verify the models before enabling

  Get easy option to verify if the models are working before adding them to your Integration. This helps resolve any authentication or infra issue before showing the models to your end users.

  <Frame>
    <img src="https://mintcdn.com/truefoundry/sPVRqtD7_DUiJUnA/images/changelogs-model-test-flow.png?fit=max&auto=format&n=sPVRqtD7_DUiJUnA&q=85&s=a0e8d4d1cea957dcb87a7a232625aec7" width="1346" height="854" data-path="images/changelogs-model-test-flow.png" />
  </Frame>

  ## Overview dashboard for AI Gateway

  Get a high-level summary of your AI Gateway’s health, cost, errors, and top usage patterns [Read more](https://www.truefoundry.com/docs/ai-gateway/analytics-overview#overview-dashboard)

  <Frame>
    <img src="https://mintcdn.com/truefoundry/3tKgDS5056Vb7-nZ/images/docs/ai-gateway/analytics-overview-metrics.png?fit=max&auto=format&n=3tKgDS5056Vb7-nZ&q=85&s=51850c82938f961d317e2382370c5611" width="3016" height="1600" data-path="images/docs/ai-gateway/analytics-overview-metrics.png" />
  </Frame>

  ## Updates

  * Separate our configs for Google Gemini and Vertex in Gemini CLI ([https://www.truefoundry.com/docs/ai-gateway/gemini-cli#migrating-from-gemini-config-to-vertex-ai-config](https://www.truefoundry.com/docs/ai-gateway/gemini-cli#migrating-from-gemini-config-to-vertex-ai-config))
  * Added support for Google Model Armor Guardrails ([https://www.truefoundry.com/docs/ai-gateway/google-model-armor#google-model-armor-guardrail-integration](https://www.truefoundry.com/docs/ai-gateway/google-model-armor#google-model-armor-guardrail-integration))
  * Added Rate limit, Budget limit support for Gemini CLI
  * Added support for live/realtime API in Gemini, OpenAI, Azure. [Read more](https://www.truefoundry.com/docs/ai-gateway/live-api)
  * Bugfix: flow Gemini thinking tokens in response.
  * Added support for custom `base_url` in GraySwan Cygnal Guardrail.
  * Improved performance of AI Gateway Tracing to show live logs without delay.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.126.2`.
  * Update `tfy-llm-gateway` helm chart version to `0.126.2`.
</Update>

<Update label="v0.125.10" description="2026-03-02">
  ## Updates

  * Added new role `Secret Group Access` for Secret Group to allow users to only read secret value but not update.

  <Frame>
    <img src="https://mintcdn.com/truefoundry/C74Rv8GAOLwZQLyu/images/changelogs-secret-group-access-role-2.png?fit=max&auto=format&n=C74Rv8GAOLwZQLyu&q=85&s=fb285ff319501c84b2f53361cb804055" width="1528" height="778" data-path="images/changelogs-secret-group-access-role-2.png" />
  </Frame>

  * Added support for Validation in PII Guardrails.

  * Added support for TTS (`Text-to-Speech`) & STT (`Speech-to-Text`) Models for Groq. [TTS](https://www.truefoundry.com/docs/ai-gateway/text-to-speech) [STT](https://www.truefoundry.com/docs/ai-gateway/audio-transcription)

  * Added support for Realtime models in Google Gemini model. [Read
    more](https://www.truefoundry.com/docs/ai-gateway/live-api)

  * Added support for
    `compaction` API for OpenAI. [Read
    more](https://www.truefoundry.com/docs/ai-gateway/compaction)

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.125.10`.
  * Update `tfy-llm-gateway` helm chart version to `0.125.2`. Requires following update in the values file if being installed as standalone application:
    1. Set `global.tenantName` as the name of tenant
    2. Set `global.controlPlaneURL` as the Control Plane URL
    3. Remove any URL set under `env`

  ```yaml theme={"dark"}
  global:
    # This is the reference to the secrets we created in the previous step
    imagePullSecrets:
      - name: "truefoundry-image-pull-secret"

    # Choose the resource tier as per your needs
    resourceTier: medium # or small or large
    controlPlaneURL: <CONTROL_PLANE_URL> # eg. https://example-company.truefoundry.cloud
    tenantName: <TENANT_NAME>

  # Optional: Istio configuration (if using Istio instead of standard ingress)
  # istio:
  #   virtualservice:
  #     hosts:
  #       - <GATEWAY_ENDPOINT_HOST>
  #     enabled: true
  #     retries:
  #       enabled: true
  #       retryOn: gateway-error
  #     gateways:
  #       - istio-system/tfy-wildcard
  #     annotations: {}
  ```
</Update>

<Update label="v0.122.3" description="2026-02-24">
  ## Updates

  * Added support for TTS (`Text-to-Speech`) & STT (`Speech-to-Text`) Models for ElevenLabs, Cartesia, Deepgram, Vertex AI, Gemini. [TTS](https://www.truefoundry.com/docs/ai-gateway/text-to-speech) [STT](https://www.truefoundry.com/docs/ai-gateway/audio-transcription)
  * Added support for Deepgram Model Integration. [Read more](https://www.truefoundry.com/docs/ai-gateway/deepgram)
  * Added support for Cartesia Model Integration. [Read more](https://www.truefoundry.com/docs/ai-gateway/cartesia)
  * Added support for ElevanLabs Model Integration. [Read more](https://www.truefoundry.com/docs/ai-gateway/elevenlabs)
  * Enable `tfy apply` for MCP Server integrations.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.122.3`.
  * Update `tfy-llm-gateway` helm chart version to `0.122.0`.
</Update>

<Update label="v0.121.0" description="2026-02-17">
  ## New: Added support for Build Secret in Dockerfile Deployment

  Docker build secrets allow you to securely pass sensitive information like private repository credentials, API keys, or authentication tokens during the Docker image build process. [Read more](https://www.truefoundry.com/docs/docker-build-secrets#docker-build-secrets)

  <Frame>
    <img src="https://mintcdn.com/truefoundry/48CabQFe1efH4KMg/images/docs/docker-build-secrets.png?fit=max&auto=format&n=48CabQFe1efH4KMg&q=85&s=56c98393faaa407d0d435bdcbb615c27" width="1762" height="960" data-path="images/docs/docker-build-secrets.png" />
  </Frame>

  ### More Updates

  * Improvements in Hashicorp Vault integration:
    * Added support for custom KV mount path
    * Added support for custom Namespace
        <Frame>
          <img src="https://mintcdn.com/truefoundry/tMcv2s6jJV9ureTw/images/changelogs-integration-hashicorp-custom-kv.png?fit=max&auto=format&n=tMcv2s6jJV9ureTw&q=85&s=6c901db23e72e16f93099578e25231b7" width="848" height="844" data-path="images/changelogs-integration-hashicorp-custom-kv.png" />
        </Frame>

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.121.0`.
  * Update `tfy-llm-gateway` helm chart version to `0.121.0`.
</Update>

<Update label="v0.120.2" description="2026-02-13">
  ### Updates

  * Expanded TrueFoundry managed Guardrail integration with Prompt Injection Guardrail. [Read more](https://www.truefoundry.com/docs/ai-gateway/tfy-prompt-injection)
  * Added support for custom CORS and Security Headers in TrueFoundry Helm Chart. [Read more](https://artifacthub.io/packages/helm/truefoundry/truefoundry?modal=values\&path=global.proxy.cors)

  ```yaml theme={"dark"}
  global:
    proxy:
      cors:
        enabled: true|false
        allowedOrigins: string[] // Provide a list of allowed origins to restrict CORS. Defaults to '*'.
      enforceSecurityHeaders: true|false // Enforces security headers like X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security
  ```

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.120.2`.
</Update>

<Update label="v0.119.4" description="2026-02-11">
  ### Updates

  * Added support for Image Edit API in Google Vertex AI & Gemini Models.
  * Expanded TrueFoundry managed Guardrail integration with Cedar Guardrail for MCP tools. [Read more](https://www.truefoundry.com/docs/ai-gateway/cedar-guardrails)

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.119.4`.
</Update>

<Update label="v0.118.2" description="2026-02-06">
  ## New: More TrueFoundry managed Guardrails

  We are expanding our TrueFoundry managed Guardrails with addition of [Regex Pattern Match](https://www.truefoundry.com/docs/ai-gateway/regex-pattern-matching), [TrueFoundry PII](https://www.truefoundry.com/docs/ai-gateway/tfy-pii), & [Content Moderation Guardrails](https://www.truefoundry.com/docs/ai-gateway/tfy-content-moderation). (**Only available in SaaS AI Gateway**)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/AZRy_Nfw8fI7jPyv/images/changelogs-guardrail-tfy-pii-and-content-moderation.png?fit=max&auto=format&n=AZRy_Nfw8fI7jPyv&q=85&s=b00604020bd0a433157dc11e4000ff6a" alt="" width="1480" height="384" data-path="images/changelogs-guardrail-tfy-pii-and-content-moderation.png" />
  </Frame>

  ### More Updates

  * Improved: Cost Attribution for Gemini CLI

      <Warning>
        **Breaking Change**: We are making it compulsory to register the model in
        TrueFoundry with exact Model name as Model ID if using Gemini CLI. [Read
        more](/docs/change-announcements/gemini-cli-model-registration-v0.118)
      </Warning>

  * Improved: Google GCP Integrations now support giving Key File Content as TrueFoundry Secret FQN.
      <Frame caption="">
        <img src="https://mintcdn.com/truefoundry/AZRy_Nfw8fI7jPyv/images/changelogs-gcp-key-file-as-secret.png?fit=max&auto=format&n=AZRy_Nfw8fI7jPyv&q=85&s=71fd76e4dfb302df9768b1d2c3274945" alt="" width="2076" height="450" data-path="images/changelogs-gcp-key-file-as-secret.png" />
      </Frame>

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.118.2`.
</Update>

<Update label="v0.117.2" description="2026-02-04">
  ## New: TrueFoundry managed Guardrails

  We are releasing TrueFoundry managed Guardrails such as [Secret Detection](https://www.truefoundry.com/docs/ai-gateway/secrets-detection), [Code Safety Linter](https://www.truefoundry.com/docs/ai-gateway/code-safety-linter) & [SQL Sanitizer](https://www.truefoundry.com/docs/ai-gateway/sql-sanitizer) and will be adding more soon.

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/w6Mvh0tcmi-0CBln/images/changelogs-tfy-managed-guardrails.png?fit=max&auto=format&n=w6Mvh0tcmi-0CBln&q=85&s=fa913009b975c45ce366b0b192822e35" alt="" width="1510" height="854" data-path="images/changelogs-tfy-managed-guardrails.png" />
  </Frame>

  ### More Updates

  * New: Added support for configuring Embedding Model for Semantic Caching in AI Gateway Requests. [Read more](https://www.truefoundry.com/docs/ai-gateway/caching#embedding-model)
  * New: Added support for Audio Transcript, Audio Translation & Text to Speech HTTP APIs in Google Vertex models.
      <Frame caption="">
        <img src="https://mintcdn.com/truefoundry/w6Mvh0tcmi-0CBln/images/changelogs-vertex-model-audio-mode-types.png?fit=max&auto=format&n=w6Mvh0tcmi-0CBln&q=85&s=4f1cc185482ebae3b493e9e609e4372a" alt="" width="2030" height="698" data-path="images/changelogs-vertex-model-audio-mode-types.png" />
      </Frame>

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.117.2`.
</Update>

<Update label="v0.116.3" description="2026-02-01">
  ## Improvement: MCP Guardrails and Guardrail Config Schema Change

  We have launched a feature to enable MCP Guardrails. This allows us to configure policies at the Gateway layer to apply certain guardrails to specific MCP servers and models.

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/TqDAYlM79a48xQUK/images/changelogs-guardrail-config-schema-change.png?fit=max&auto=format&n=TqDAYlM79a48xQUK&q=85&s=4898e5a08cf1937214f8c48d3baac811" alt="" width="3022" height="1722" data-path="images/changelogs-guardrail-config-schema-change.png" />
  </Frame>

  <Warning>
    **Breaking Change**: We are changing schema for Guardrail Config. [Read
    more](/docs/change-announcements/guardrails-yaml-schema-change-v0.116)
  </Warning>

  ## New: Data Access Rules for AI Gateway Request Logs and Metrics

  Data Access Rules allow you to control who can access which request logs and metrics in the AI Gateway. Gateway Datasets provide access to subsets of traces and metrics by applying filters, enabling fine-grained access control based on users, teams, roles, and data scopes.

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/6G-b9aBDFXAe3SbK/images/docs/ai-gateway/data-access-rules.png?fit=max&auto=format&n=6G-b9aBDFXAe3SbK&q=85&s=27e0a49cdce0414a3ff2a163e5b73b69" width="3010" height="1600" data-path="images/docs/ai-gateway/data-access-rules.png" />
  </Frame>

  ## Improvement: Data Routing Rules to Configure Storage For AI Gateway Request Logs and Metrics

  Data Routing Rules allows you to configure where your request logs (traces) and metrics are stored. You can choose between control plane managed storage or bring your own customer-managed storage. [Read more](https://www.truefoundry.com/docs/ai-gateway/data-routing)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/6G-b9aBDFXAe3SbK/images/docs/ai-gateway/data-routing-destinations.png?fit=max&auto=format&n=6G-b9aBDFXAe3SbK&q=85&s=d7f701901d2c2c2a45e53eff128bce7e" width="3012" height="1592" data-path="images/docs/ai-gateway/data-routing-destinations.png" />
  </Frame>

  ### More Updates

  * **Change**: Revamp of `External Identity` by introducing `Identity Provider`. [Read more](https://www.truefoundry.com/docs/external-identity)
  * New: Added support to `Shutdown` cluster connected to TrueFoundry.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/WzQCWthfeEqr1LQG/images/changelogs-cluster-shutdown.png?fit=max&auto=format&n=WzQCWthfeEqr1LQG&q=85&s=ae55ce38553e8d2509835dbd6cbf880e" width="2664" height="674" data-path="images/changelogs-cluster-shutdown.png" />
      </Frame>
  * **Behavior Change**: Team Managers can now view all the `Virtual Accounts` owned by their Team.
  * Allow assigning `Custom Roles` to `Virtual Account`.
      <Frame>
        <img src="https://mintcdn.com/truefoundry/WzQCWthfeEqr1LQG/images/changelogs-va-assign-custom-role.png?fit=max&auto=format&n=WzQCWthfeEqr1LQG&q=85&s=4b3884b858c14b5f664fed98c9d63b5d" width="3024" height="1712" data-path="images/changelogs-va-assign-custom-role.png" />
      </Frame>
  * Added support for image model in Google Gemini.
  * Allow updating default roles to allow Team Managers manage their Virtual Accounts without making them Admin. [Read more](https://www.truefoundry.com/docs/platform/manage-user-roles-and-permissions#how-to-allow-teams-create-and-manage-their-virtual-accounts-without-making-them-admin)
  * New: Create MCP Servers using OpenAPI spec. [Read more](https://www.truefoundry.com/docs/ai-gateway/mcp/openapi-mcp-server)
      <Frame>
        <img src="https://mintcdn.com/truefoundry/w6Mvh0tcmi-0CBln/images/changelogs-mcp-server-from-openapi.png?fit=max&auto=format&n=w6Mvh0tcmi-0CBln&q=85&s=006caf7a555d3fb1d399af663134eccd" width="2702" height="1720" data-path="images/changelogs-mcp-server-from-openapi.png" />
      </Frame>

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.116.3`.
</Update>

<Update label="v0.115.2" description="2026-01-23">
  ## New: Allow query with multiple sub-agents

  You can now use multiple sub-agents along with mcp-servers in AI Gateway and create useful super-agents. [Read more](https://www.truefoundry.com/docs/ai-gateway/agents/agent-hub#using-sub-agents-beta)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/VUDCUBCPUrp9U-FU/images/changelogs-ai-gateway-playground-sub-agents.png?fit=max&auto=format&n=VUDCUBCPUrp9U-FU&q=85&s=ee1550bbbcc8821977cc11fecbb1ac22" width="1834" height="1372" data-path="images/changelogs-ai-gateway-playground-sub-agents.png" />
  </Frame>

  ### More Updates

  * Added support for using MCP Server `name` in MCP Gateway URL.
  * Added support for `Certificate` based auth in Azure Model Integrations.
      <img src="https://mintcdn.com/truefoundry/mOMD_C2IVFPwLUPU/images/changelogs-ai-gateway-model-azure-cert-based-auth.png?fit=max&auto=format&n=mOMD_C2IVFPwLUPU&q=85&s=a2f6dc72764e3b1854b3ffc2eb0e38ea" width="2102" height="848" data-path="images/changelogs-ai-gateway-model-azure-cert-based-auth.png" />
  * Added support for `thinkingLevel` in Gemini-3 series Models.
  * Added support `reasoning` in Azure Anthropic Models.
  * Added support for customisation of base URL in Palo Alto Prisma AIRS Guardrails.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.115.2`.
</Update>

<Update label="v0.114.1" description="2026-01-19">
  ## New: AI Gateway Settings

  You can now configure Global AI Gateway related settings from Control. These settings Retry, Logging Mode, Additional OTEL Config.

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/3o6JzFxXmh2lG4ve/images/changelogs-ai-gateway-settings.png?fit=max&auto=format&n=3o6JzFxXmh2lG4ve&q=85&s=db53621aced4a8e705e1699d0d7ab723" width="3024" height="918" data-path="images/changelogs-ai-gateway-settings.png" />
  </Frame>

  ### More Updates

  * Added support for Files API in Anthropic.
  * **Bugfix**: fixed Prompt tokens calculation for Google Vertex Anthropic models.
  * Added cached tokens info in Groq response.
  * Added support for Anthropic models in Azure Foundry.
  * **Change:** `AI Gateway > Controls > OTEL Config` tab is merged to `AI Gateway > Controls > Settings`
  * **Change:** `Settings > Default Data Location` section is moved to `AI Gateway > Controls > Data Routing` tab.
      <Frame caption="">
        <img src="https://mintcdn.com/truefoundry/3o6JzFxXmh2lG4ve/images/changelogs-ai-gateway-controls-data-routing.png?fit=max&auto=format&n=3o6JzFxXmh2lG4ve&q=85&s=f13d6b0c60985aacb044bc6c944f02c7" width="3018" height="788" data-path="images/changelogs-ai-gateway-controls-data-routing.png" />
      </Frame>
  * **Behavior Change**: For workloads with Auto-Shutdown enabled along with On-Demand nodes, truefoundry now automatically adds pod disruption budget for max availbility of 25%. This reduces disruption of these workloads in case of node consolidation.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.114.1`.
</Update>

<Update label="v0.113.2" description="2026-01-16">
  ## New: TrueFoundry Agent Hub

  Centralized platform for building, registering, discovering, and orchestrating AI agents within an organization. This will support building complex agents as well as registering and using pre-existing agents. [Read more](https://truefoundry.com/docs/ai-gateway/agent-hub)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/2mB7LxU2jFpiKykM/images/docs/ai-gateway/new_agent_page.png?fit=max&auto=format&n=2mB7LxU2jFpiKykM&q=85&s=25e5f8ac1c1adf7ed46e004311ce8568" width="3024" height="1038" data-path="images/docs/ai-gateway/new_agent_page.png" />
  </Frame>

  ### More Updates

  * Added support of Real-time SSE streaming for `streamable-http` transport in MCP Gateway.
  * Update: username and password fields are now optional for SMTP integration.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.113.2`.
</Update>

<Update label="v0.112.1" description="2026-01-14">
  ## Improvement: Simplified management for MCP Servers

  MCP Server integrations are now standalone, top-level resources with their own permissions and simplified management.

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/Mzl7_gVlARosS-Be/images/changelogs-mcp-server-group-removal.png?fit=max&auto=format&n=Mzl7_gVlARosS-Be&q=85&s=daa1f3d779aadeeb39eae86d6bc7797e" alt="" width="3024" height="1372" data-path="images/changelogs-mcp-server-group-removal.png" />
  </Frame>

  <Warning>
    **Breaking Change**: We are removing MCP Server Groups. MCP Servers will no
    longer be nested under groups. [Read
    more](/docs/change-announcements/mcp-server-groups-removal-v0.112)
  </Warning>

  ### More Updates

  * Added support for Google Gemini image models
  * Tiered pricing in Google Vertex AI models
  * **Behavior Change** Guardrails would now run in parallel to reduce latency in AI Gateway. [Read more](https://truefoundry.com/docs/ai-gateway/guardrails-overview#guardrail-execution-flow)
  * Added support for certificate based auth in Azure OpenAI Integration
  * Added suport for External identity in MCP Gateway

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.112.1`.
</Update>

<Update label="v0.111.2" description="2026-01-12">
  ## Create your own custom roles and assign to User

  You can now create your custom tenant level roles and assign to users. [Read more](https://truefoundry.com/docs/collaboration-and-access-control#custom-roles)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/PrnwQvivUIDNSBT-/images/platform-access-roles-list.png?fit=max&auto=format&n=PrnwQvivUIDNSBT-&q=85&s=373df288b5b7df7dc5d4a6d508b4b786" alt="" width="3024" height="820" data-path="images/platform-access-roles-list.png" />
  </Frame>

  ### More Updates

  * Bugfix - fixed SLA cutoff in priority based routing config
  * Added support for xAI model provider in AI Gateway
  * Added Request Failure metrics for tools in MCP metrics
  * **Behavior Change**: For production GPU workloads, truefoundry now automatically adds pod disruption budget for max availbility of 25%. This reduces disruption of GPU workloads in case of node consolidation.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.111.2`.
</Update>

<Update label="v0.110.3" description="2026-01-05">
  ## New: Oauth Inbound Auth for MCP Gateway

  When using MCP Servers in Cursor/VSCode, you can now use OAuth for authentication without need to hardcode the token in mcp.json. [Read more](https://www.truefoundry.com/docs/ai-gateway/mcp/mcp-gateway-auth-security#truefoundry-oauth)

  ### More Updates

  * **Behavior Change** In AWS Paramter store, we now store the secrets as `SecureString` instead of `String` parameter type. [Read more](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
  * A request body size limit added in AI Gateway requests (default: 50 MB)
  * Bugfix - Fixed Assumed Role based auth for AWS Bedrock Guardrails
  * Bugfix - Removed default request timeout of 5 min within AI Gateway

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.110.3`.
</Update>

<Update label="v0.109.3" description="2025-12-22">
  ## New: Support for SCIM

  TrueFoundry now supports SCIM for SAML based SSO. SCIM enabled automatic user/team management using IdP users/groups. [Read more](https://truefoundry.com/docs/sso#enable-scim-provisioning)

  {" "}

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/nPY6hmSlBVBPJNoL/images/enable_scim.png?fit=max&auto=format&n=nPY6hmSlBVBPJNoL&q=85&s=3e3e73b466f7bc1f1f69cfc2e128d3f8" alt="Enable SCIM checkbox in SAML SSO configuration" width="1526" height="812" data-path="images/enable_scim.png" />
  </Frame>

  ## **Improved Rate Limit Config**

  * Rule IDs must be **static** (no `{}` placeholders). Use `rate_limit_applies_per` to create per-entity rate limit instead of dynamic rule IDs. [**Read more**](https://docs.truefoundry.com/docs/ai-gateway/budgetlimiting#migration-from-dynamic-rule-ids-breaking-changes)

  ### More Updates

  * Added support for API key based auth in AWS Bedrock model integration.
  * **Behavior Change**: Tenant Admin can now access all entities(Models, MCP Server, Guardrail, Agent) in AI Gateway.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.109.3`.

  <Warning>
    **Breaking Change**: Removed support for Dynamic Rule ID in Rate Limit config. [**Read more**](https://truefoundry.com/docs/ai-gateway/ratelimiting#migration-from-dynamic-rule-ids-breaking-changes)
  </Warning>
</Update>

<Update label="v0.108.2" description="2025-12-17">
  ## New: Use git tags to deploy your code

  You can now use `tags` to deploy your code to have better version control of your releases.

  {" "}

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/Mzl7_gVlARosS-Be/images/changelogs-deployment-git-source-tag.png?fit=max&auto=format&n=Mzl7_gVlARosS-Be&q=85&s=5f1171e0ab87e13719c89e410ec69857" alt="" width="1758" height="776" data-path="images/changelogs-deployment-git-source-tag.png" />
  </Frame>

  ### More Updates

  * Bug fixes and improvements

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.108.2`.
</Update>

<Update label="v0.107.1" description="2025-12-15">
  ## New: Request Caching

  You can now support both Exact match and Semantic caching in AI Gateway requests. [Read more](https://truefoundry.com/docs/ai-gateway/caching)

  ### More Updates

  * Error message improvement in Self-Hosted models response via AI Gateway.
  * Added Embedding model support in Cloudera.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.107.1`.
</Update>

<Update label="v0.106.2" description="2025-12-10">
  ## New: Support for External Identity

  You can now use externally vended JWT tokens to authenticate to TrueFoundry. [Read more](https://truefoundry.com/docs/external-identity#external-identity)

  ### More Updates

  * Fixed Gemini 3 Pro Model usage in Agent Response.

  * Added support for custom Slug in Model integrations.

      <Frame caption="">
        <img src="https://mintcdn.com/truefoundry/wWQY6m-ExNahLePV/images/changelogs-ai-gateway-virtual-model-slug.png?fit=max&auto=format&n=wWQY6m-ExNahLePV&q=85&s=c5f6ba868052789e09b6adf562d282eb" alt="" width="1338" height="852" data-path="images/changelogs-ai-gateway-virtual-model-slug.png" />
      </Frame>

  * Added TrueFoundry integration with Goose. [Read more](https://truefoundry.com/docs/ai-gateway/goose#goose)

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.106.2`.
</Update>

<Update label="v0.105.2" description="2025-12-08">
  ## New: Budget Usage

  You can now monitor the usage metrics for each Budget rule added. [Read more](https://truefoundry.com/docs/ai-gateway/budgetlimiting#viewing-budget-usage)

  {" "}

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/acKb5p55patKgIwU/images/Screenshot2025-11-24at9.08.42PM.png?fit=max&auto=format&n=acKb5p55patKgIwU&q=85&s=5d06716c030b3eba47d844489556e489" alt="" width="3280" height="2008" data-path="images/Screenshot2025-11-24at9.08.42PM.png" />
  </Frame>

  ### More Updates

  * Added support for Deepseek model in Vertex AI.

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.105.2`.
</Update>

<Update label="v0.104.2" description="2025-12-02">
  ## New: Configure location to store your AI Gateway Request and Metrics

  We have added support to configure location on which AI Gateway Request and Metrics would be stored. This helps in complying with local Data Residency laws and privacy policies..

  {" "}

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/FPTwGWPyTxg0vQ78/images/changelog-settings-trace-region.png?fit=max&auto=format&n=FPTwGWPyTxg0vQ78&q=85&s=22fa5bf7e1a2bfdfeee5715929f9f374" alt="" width="3024" height="1336" data-path="images/changelog-settings-trace-region.png" />
  </Frame>

  <Note>This feature is only available in SaaS TrueFoundry AI Gateway</Note>

  ### Updates and Bug Fixes

  * Added support for Finetune API in Vertex Model as well. [Read more](https://docs.truefoundry.com/docs/ai-gateway/finetune)
  * Added support for `thought_singnature` in Google Gemini and Vertex model response

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.104.2`.
</Update>

<Update label="v0.103.1" description="2025-11-28">
  ### Updates and Bug Fixes

  * Added `404` in status codes used for default Fallback.
  * Added support for GCP workload identify authentication for Vertex models. [Read more](https://docs.truefoundry.com/docs/ai-gateway/google-vertex#get-google-vertex-authentication-details)
  * Added support for Media resolution in Vertex Models. [Read more](https://docs.truefoundry.com/docs/ai-gateway/chat-completions-multimodal#media-resolution)
  * Added support for `none` as value in `reasoning_effort`. [Read more](https://docs.truefoundry.com/docs/ai-gateway/chat-completions-advanced#gemini)

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.103.1`.
</Update>

<Update label="v0.102.5" description="2025-11-26">
  ## New: we now support Virtual Models

  Create reusable virtual models with intelligent routing configurations to distribute requests across multiple model providers. [Read more](https://docs.truefoundry.com/docs/ai-gateway/virtual-model)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/Kqb3OaMABt2qow2m/images/ai-gateway-virtual-model-1.png?fit=max&auto=format&n=Kqb3OaMABt2qow2m&q=85&s=009901178c0edf1db8a515b1e1199993" alt="" width="3024" height="1716" data-path="images/ai-gateway-virtual-model-1.png" />
  </Frame>

  ### More Updates

  * Updates on Prisma Guardrail:
    * We now pass `tfy.request.conversation_id` and `traceId` to all the request allowing to group messages.
    * We slice the payload to max size of 1.5 MB when sending to Prisma.

  * New Routing Metrics: visualize effect of different AI Gateway configs like Rate limit, Budget limit, Routing, Load Balancing or Fallback.

      <Frame caption="">
        <img src="https://mintcdn.com/truefoundry/xpzG_R2mWlqPVclT/images/changelog-ai-gateway-monitor-routing-metrics.png?fit=max&auto=format&n=xpzG_R2mWlqPVclT&q=85&s=f0e28e1e546755ece2f2a96e73d1b7b7" alt="" width="2806" height="1586" data-path="images/changelog-ai-gateway-monitor-routing-metrics.png" />
      </Frame>

  * New Metrics introduced:
    * Latency per output token
    * Model usage per user and per model

        <Frame caption="">
          <img src="https://mintcdn.com/truefoundry/xpzG_R2mWlqPVclT/images/changelog-ai-gateway-monitor-request-usage-per-user-per-model.png?fit=max&auto=format&n=xpzG_R2mWlqPVclT&q=85&s=6498750315cf798bbe38cafaad978701" alt="" width="1346" height="932" data-path="images/changelog-ai-gateway-monitor-request-usage-per-user-per-model.png" />
        </Frame>

  * Added basic tracing support for requests via Gemini CLI.

  * Added support for AWS IAM role based auth in AWS SQS based async service. [Read more](https://docs.truefoundry.com/docs/aws-sqs#aws-iam-role-with-web-identity)

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.102.5`.
</Update>

<Update label="v0.101.2" description="2025-11-21">
  ## Improved Budget Limit Config

  * Added support for Budget per week.
  * Windows for budget usage will now be a fixed. (Day starts with 00:00 UTC, Week starts with Mon, Month starts with 1st) [Read more](https://docs.truefoundry.com/docs/ai-gateway/budgetlimiting#3-budget-limit-limit-to-+-unit)
  * Added support for setting Alerts to get warned before limit reaches. [Read more](https://docs.truefoundry.com/docs/ai-gateway/budgetlimiting#budget-alerts)

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/PXgCHzcP8mc3Kxi8/images/changelog-budget-limit-new-improvements.png?fit=max&auto=format&n=PXgCHzcP8mc3Kxi8&q=85&s=f271cc1d40f35f103b90f2dfe36bcc30" alt="" width="2176" height="782" data-path="images/changelog-budget-limit-new-improvements.png" />
  </Frame>

  ### More Updates

  * **Behavior Change**: Rate limit and Budget limit rules will now be evaluated for all matching rules and the first one in order will be applied. This enables user to set priority of rules by adjusting the order in config.
  * We now support AWS IAM role based auth when adding AWS bedrock integrations in TrueFoundry SaaS Gateway. [Read more](https://docs.truefoundry.com/docs/ai-gateway/aws-bedrock#get-aws-authentication-details)
  * **Bug fix**: fixed Patronus AI guardrail validation.
  * Added support for configuring multiple AI Gateways based on BU, region, etc. [Read more](https://docs.truefoundry.com/docs/ai-gateway/globally-distributed-saas)

      <Frame caption="">
        <img src="https://mintcdn.com/truefoundry/xpzG_R2mWlqPVclT/images/changelog-settings-gateway-installation.png?fit=max&auto=format&n=xpzG_R2mWlqPVclT&q=85&s=f1b25ba22c1bc71c1dbd79527e23dd08" alt="" width="2176" height="660" data-path="images/changelog-settings-gateway-installation.png" />
      </Frame>

      <Warning>
        **Breaking Change**: Removed support for Dynamic Rule ID in Budget config.
        [Read
        more](https://docs.truefoundry.com/docs/ai-gateway/budgetlimiting#migration-from-dynamic-rule-ids-breaking-changes)
      </Warning>

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.101.2`.
</Update>

<Update label="v0.100.2" description="2025-11-18">
  ## Override prompts when re-routing/falling back to different model

  <Frame caption="">
    <img src="https://mintcdn.com/truefoundry/MURDL03vOwj7cxIx/images/changelog-prompt-override-when-routing.png?fit=max&auto=format&n=MURDL03vOwj7cxIx&q=85&s=1341a7c9e6368538184b3ac9357f17b6" alt="" width="2698" height="1056" data-path="images/changelog-prompt-override-when-routing.png" />
  </Frame>

  ### More Updates

  * Added support for MiniMax model in Vertex.
  * Bug fix: resolved issue of index number handling in case of parallel tool calls with Anthropic models

  ### Release instructions

  * Update `truefoundry` helm chart version to `0.100.2`.
</Update>