All pull requests

Pull requests

• [BUG]: Preserve gateway catalogs during deferred OAuth discovery

  #7173·jstar0 opened Oct 7, 2026Contributor·

  ·
  1

  1

• fix: mask A2A/gateway credentials on read and reject ambiguous auth updates

  #7172·marekdano opened Oct 7, 2026Collaborator·

  ·
  1

• fix: paginate downstream MCP catalog responses

  #7171·vishu-bh opened Oct 7, 2026Collaborator·9 of 15 tasks·

  ·
  1

  1

  

• Feat/tool error translation

  #7169·madhu-mohan-jaishankar opened Oct 7, 2026Collaborator·

  ·
  1

• feat(token-exchange): accept X-Upstream-Authorization as subject_token for RFC 8693 exchange

  #7168·Tissandier opened Oct 7, 2026Contributor·11 of 15 tasks·

  ·
  1

• fix(oauth): respect SSRF_ALLOW_LOCALHOST for HTTP localhost IdPs in three guards

  #7166·Tissandier opened Oct 7, 2026Contributor·10 of 15 tasks·

  ·
  1

• fix(health-check): follow 3xx redirects in gateway health checker

  #7164·Tissandier opened Oct 7, 2026Contributor·10 of 15 tasks·

  ·
  1

• chore: Replace stylelint with biome

  #7162·gcgoncalves opened Oct 7, 2026Collaborator·

  ·
  2

• fix: gate per-user Vault credentials by gateway policy (#6799)

  #7161·rakdutta opened Oct 7, 2026Collaborator·

  ·
  1

• fix: trust A2A plugin headers

  #7157·msureshkumar88 opened Oct 6, 2026Collaborator·

  ·
  1

  

• feat(mcp): complete inbound MCP era negotiation

  #7156·Lang-Akshay opened Oct 6, 2026Collaborator·

  ·
  1

  1

• fix(otel): suppress tenantless background spans

  #7155·vishu-bh opened Oct 6, 2026Collaborator·10 of 15 tasks·

  ·
  1

  3

  

• chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2

  dependenciesjavascript
  #7154·dependabot[bot] opened Oct 6, 2026Bot·

  ·

• fix: restore conftest fixtures for duplicate Directory nodes under pytest 9.1.x

  #7149·ManasSakthivel opened Oct 6, 2026·9 of 15 tasks·

  ·
  1

• fix(oauth): serve RFC 9728 metadata for OAuth-enabled non-public servers

  #7148·kimjunil opened Oct 6, 2026·8 of 9 tasks·

  ·
  1

• feat(auth): add MAX_TOKEN_EXPIRY_DAYS cap for API token lifetime

  #7147·ankit2235 opened Oct 5, 2026·5 of 6 tasks·

  ·
  1

• feat: per-request _meta protocol validation and serverInfo stamping (…

  #7145·prakhar-singh1928 opened Oct 5, 2026Collaborator·9 of 15 tasks·

  ·
  1

• chore(deps): bump opentelemetry_sdk from 0.31.0 to 0.32.1

  dependenciesrust
  #7142·dependabot[bot] opened Oct 5, 2026Bot·

  ·

• chore(deps): bump dompurify from 3.4.15 to 3.4.16

  dependenciesjavascript
  #7140·dependabot[bot] opened Oct 5, 2026Bot·

  ·

• feat(observability): return success and error counts from metrics timeseries

  #7138·byrnec30 opened Oct 5, 2026Contributor·

  ·
  1

  3

  

• fix: anchor refresh throttle to cycle_started_at to prevent skipping refresh

  #7130·prakhar-singh1928 opened Oct 5, 2026Collaborator·9 of 10 tasks·

  ·
  1

  1

  

• fix(oauth): raise /oauth/callback code max_length 2048 -> 4096

  #7129·ToniAdreal opened Oct 5, 2026·

  ·
  1

• feat(catalog): add Parlor.sh MCP server

  #7127·LubabaKhalid opened Oct 4, 2026·

  ·
  1

  1

• fix(llmchat): load MCP tools with the MCP SDK v2 client

  #7126·kosesena opened Oct 4, 2026·9 tasks done·

  ·
  1

• fix(a2a): emit hyphenated v0.3 task states for input/auth required

  #7125·kosesena opened Oct 4, 2026·8 tasks done·

  ·
  1