Changelog
Bifrost Enterprise v1.4.5 is a release ontransports/v1.5.6 centered on identity lifecycle and MCP per-user authentication. Headline items: new onboarding and IdP deprovisioning flows that sync user activeness on login, token refresh, and a periodic 15-minute reconcile (with Okta scoped to app-associated groups and users), end-to-end MCP per-user header auth with credential storage, lazy submission, TLS configuration, and sessions filtering, and a large governance UI overhaul that moves users, teams, business units, RBAC, and access profiles off dialogs onto keyboard-navigable sheets. The release also brings OSS additions like a direct API-key request header, dimension rankings dashboards, key rotation on auth failures, model pricing attributes, Opus 4.8 support, and OTel spec-compatible metrics.✨ Features
Access & Identity
- Onboarding and IdP deprovisioning flows : new user onboarding and extension flows, with deprovisioning wired into login, token refresh, and a periodic sync so accounts removed at the IdP are reconciled automatically.
- User activeness sync : user active state is checked on each session refresh and synced with the IdP every 15 minutes, so disabled users lose access promptly.
- Okta app-scoped sync : Okta now syncs only the groups and users associated with the app, rather than the entire directory.
- App removal deletes the user : removing an app now deletes the associated user even on app disassociation, keeping membership consistent.
MCP
- MCP per-user authentication : new per-user header auth type with credential storage, lazy-auth submission, and reconciliation of per-user credentials on virtual-key and MCP-client changes (OSS + enterprise).
- MCP TLS configuration : configurable TLS (
insecureSkipVerify,caCertPem) for HTTP/SSE MCP client connections (OSS). - MCP sessions filtering : filter, search, and pagination on the MCP sessions list API and table, plus a
can_reauthidentity gate (OSS + enterprise).
Governance UI
- Governance UI moved to sheets : users, teams, business units, RBAC, and access profiles moved off dialogs onto sheets, with full prev/next keyboard navigation and URL state across each sheet (OSS + enterprise).
- Attach business units from teams : teams can attach to a business unit directly from the teams sheet, with a warning surfaced for teams already attached.
- SearchSelect adoption : governance pages start using the
SearchSelectcomponent for faster filtering, alongside assorted governance view fixes.
OSS Base (transports/v1.5.6)
- Direct API key header : pass a provider API key directly via a request header.
- Dimension rankings dashboard : new dashboard tabs for team, customer, business-unit, and user rankings, backed by a
GetDimensionRankingsAPI. - Tool-call execution UI : inline tool-call execution, stop streaming, bulk execute and submit, and a redesigned tool-call UI.
- Model pricing attributes :
additional_attributeson model pricing rows, with a management API and UI editor. - Key rotation on auth failures : rotate keys on 401/402/403 and return a 502
upstream_credentials_exhaustedwhen all keys are permanently dead. - Opus 4.8 support : system-message handling and compatibility for Opus 4.8.
- OTel spec-compatible metrics : OTel-spec metrics with provider and semantic-cache attributes in the metrics export, backward compatible with existing dashboards.
- Prompt cache retention : prompt cache retention parameter on responses requests.
- Go 1.26.3 : toolchain upgraded to Go 1.26.3.
🐞 Fixed
Guardrails
- Grayswan full conversation history : the outbound side of the Grayswan guardrail provider now receives the full conversation history rather than a truncated view.
MCP & Access
- MCP per-user OAuth deferred flow : removed the deferred user-id flow in MCP per-user OAuth and the deferred-fill user-mode OAuth flow, gating user-mode flows on the caller
user_idand skipping temp-token mint where it does not apply. - MCP header temp-token toggle : the MCP header temp-token flow now follows the UI toggle.
- Models endpoint allowlist :
/v1/modelsis allowed through the access-profile model allowlist check. - PKCE code challenge : code-challenge generation moved to the backend.
Cluster & Config
- URL query escaping : escaped characters in URL query parameters are now supported.
- Broadcast model attribute updates : model attribute updates are broadcast across the cluster.
- Tool attribute data : tool attribute data is no longer sent.
OSS Base (transports/v1.5.6)
- Virtual-key associations : removed
created_byas a user association for virtual keys; optional fields are no longer overridden during virtual-key update. - Matview sync interval : materialized-view sync interval increased to 1 minute.
- Bedrock tool names and guardrails : Bedrock function/tool names are truncated to the provider length limit, and guardrail config is set in Bedrock requests built from responses.
- Anthropic tool use : Anthropic
tool_useinput defaults to{}when arguments are absent. - Responses streaming : fixed responses stream events.
- Compat flow parsing : fixed missing parameter parsing on the compat flow.
- Passthrough API version : a default API version is set in passthrough requests as a fallback.
- Partial tool calls : partial tool-call execution failures are handled and successful results returned.
- MCP auth errors : inline banner and retry support for MCP auth-required errors.
- UI nitpicks : assorted UI fixes and build fixes.
📀 Base OSS version
transports/v1.5.6This release pins clean tagged OSS modules: