Skip to content
Latest (currently 2026.7.0) has the newest features, bug fixes, and CVE patches of Solo Enterprise for agentregistry.

For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Changelogs

Page as Markdown
Solo Enterprise for agentregistry changelogs
v2026.7

v2026.7.1

Published on: 2026-07-24
Release v2026.7.1
Container Images
us-docker.pkg.dev/solo-public/agentregistry-enterprise/server:v2026.7.1
Helm Chart
helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --version v2026.7.1
CLI (arctl)
curl -sSL https://storage.googleapis.com/agentregistry-enterprise/install.sh | ARCTL_VERSION=v2026.7.1 sh
export PATH=$HOME/.arctl/bin:$PATH
OpenAPI Spec
https://storage.googleapis.com/agentregistry-enterprise/v2026.7.1/openapi.yaml
agw-sync
curl -fsSL -o agw-sync https://storage.googleapis.com/agentregistry-enterprise/v2026.7.1/agw-sync
chmod +x agw-sync
agentregistry-sts
curl -fsSL -o agentregistry-sts https://storage.googleapis.com/agentregistry-enterprise/v2026.7.1/agentregistry-sts
chmod +x agentregistry-sts
agentgateway
curl -fsSL -o agentgateway https://storage.googleapis.com/agentregistry-enterprise/v2026.7.1/agentgateway
chmod +x agentgateway
Changes
Breaking Changes
  • [Upstream] Make Models tagged catalog artifacts and allow Deployments to select an optional Model tag. (#584)
Features
  • AgentCore harness deployments can now use the openclaw harness type in addition to claude-code. (#1058)
  • Users can now configure which runtime connection types appear in the bundled UI via config.enabledRuntimes. (#1090)
  • AgentCore harness runners now use runtime session IDs to preserve Claude Code conversation continuity and isolate OpenClaw transcripts across sessions. (#1059)
  • Added per-runtime OIDC authentication with configurable scopes and AWS EKS Pod Identity Association support for kagent runtimes. (#1111)
  • Enterprise AccessPolicy can grant name-scoped read and mutation permissions for tagged Models, and enterprise clients now expose the Model and Deployment modelRef APIs. (#1123)
  • Add the RuntimeAccessPolicy API for governing runtime Agent-to-MCP traffic. (#1133)
  • [Upstream] Add support for GitLab and self-hosted GitLab URLs when pulling Git-backed skill sources. (#549)
  • [Upstream] Add /healthz endpoint to the registry MCP server. (#582)
  • [Upstream] feat(cli): arctl configure now supports adding MCP configuration for Kiro agentic IDE (#580)
  • [Upstream] Add the mutable Model resource and CRUD API. (#581)
  • [Upstream] Deployment apply fingerprints now include changes to referenced Models. (#585)
Fixes
  • AgentCore harness runner containers now accept only plain JSON invocations while the registry continues translating A2A requests. (#1076)
  • Update optional MCP compatibility API to return MCP details for public/anonymous users. (#1077)
  • Fixes harness agent chat functionality in the UI (#1085)
  • The Runtimes page now uses generic header copy instead of naming every supported runtime provider. (#1088)
  • The create/update agent form now lets you select both a prebuilt container image and build from source at the same time instead of treating them as mutually exclusive. The MCP server source step now uses the same artifact cards (Prebuilt package / Build from source) and drops the platform pills. The skill update form now renders correctly when the mock UI is enabled. (#1112)
  • Replaced components with those migrated to components library (#1113)
  • Fixes AgentCore agent deployments failing during dependency installation. (#1147)
  • [Upstream] support configurable StorageClass for bundled PostgreSQL (#571)
  • [Upstream] Add new PublicSession implementation and publicPaths middleware to allow API extensions to define public user authorization (e.g. allow anonymous users to view all servers via the MCP compatibility servers.) (#576)
  • [Upstream] arctl get all no longer shows discovered deployments by default, matching arctl get deployments. (#578)
  • [Upstream] Fixes arctl init ADK Python agents failing to build due to a dependency resolution error. (#588)
v2026.7.0

Published on: 2026-07-13
Release v2026.7.0
Container Images
us-docker.pkg.dev/solo-public/agentregistry-enterprise/server:v2026.7.0
Helm Chart
helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --version v2026.7.0
CLI (arctl)
curl -sSL https://storage.googleapis.com/agentregistry-enterprise/install.sh | ARCTL_VERSION=v2026.7.0 sh
export PATH=$HOME/.arctl/bin:$PATH
OpenAPI Spec
https://storage.googleapis.com/agentregistry-enterprise/v2026.7.0/openapi.yaml
agw-sync
curl -fsSL -o agw-sync https://storage.googleapis.com/agentregistry-enterprise/v2026.7.0/agw-sync
chmod +x agw-sync
agentregistry-sts
curl -fsSL -o agentregistry-sts https://storage.googleapis.com/agentregistry-enterprise/v2026.7.0/agentregistry-sts
chmod +x agentregistry-sts
agentgateway
curl -fsSL -o agentgateway https://storage.googleapis.com/agentregistry-enterprise/v2026.7.0/agentgateway
chmod +x agentgateway
Changes
Features
  • AgentRegistry Enterprise can now export structured control-plane audit events over OTLP, including registry resource changes, approval workflow events, selected authorization decisions, and applied-resource activity. (#1000)
  • Adds UI support for Prompt catalog items in the Agent Registry, including a detail view, create/update wizards, batch delete, and a Prompt count on the dashboard. (#1027)
  • Added Microsoft Copilot Studio support for discovering and viewing agents from connected Power Platform environments. (#1031)
  • AgentCore deployments can run Claude Code harness agents from Ready Plugin source pointers using a configured harness image. (#966)
  • Added support for deploying container-based agents to AWS Bedrock AgentCore. (#1048)
  • [Upstream] Add an experimental Plugin kind and harness-based agent source using source-pointer storage. (#554)
  • [Upstream] arctl get deployments now supports an –origin flag to filter by managed, discovered, or all deployments. (#570)
Fixes
  • Fix issue where enterprise CLI commands where missing the user API token. (#1026)
  • The Kubernetes runtime connection form now labels its name field “Connection Name” with help text explaining it is the unique connection identifier, instead of the misleading “Cluster Name” label that suggested it had to match the Kubernetes cluster name. (#1043)
  • Fixes runtime sync status to correctly show for all runtimes, including those that were previously shown with a blank sync state. (#1045)
  • Fixes leaked EnterpriseAgentgatewayBackends and mirrored secrets for deployments (#1037)
  • Fixes: gracefully handle logout + clear localStorage when /api/oidc/discovery or /v0/user/whoami endpoint calls fail (#1051)
  • Fixes: use shared ui-components UserIconCircle component (#1062)
  • Fixes: improves validation/error UX by displaying error contents on UI (#1068)
  • [Upstream] helm: inherit release namespace configuration for helm chart (#568)
v2026.6

v2026.6.2

Published on: 2026-06-26
Release v2026.6.2
Container Images
us-docker.pkg.dev/solo-public/agentregistry-enterprise/server:v2026.6.2
Helm Chart
helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --version v2026.6.2
CLI (arctl)
curl -sSL https://storage.googleapis.com/agentregistry-enterprise/install.sh | ARCTL_VERSION=v2026.6.2 sh
export PATH=$HOME/.arctl/bin:$PATH
OpenAPI Spec
https://storage.googleapis.com/agentregistry-enterprise/v2026.6.2/openapi.yaml
agw-sync
curl -fsSL -o agw-sync https://storage.googleapis.com/agentregistry-enterprise/v2026.6.2/agw-sync
chmod +x agw-sync
agentregistry-sts
curl -fsSL -o agentregistry-sts https://storage.googleapis.com/agentregistry-enterprise/v2026.6.2/agentregistry-sts
chmod +x agentregistry-sts
agentgateway
curl -fsSL -o agentgateway https://storage.googleapis.com/agentregistry-enterprise/v2026.6.2/agentgateway
chmod +x agentgateway
Changes
Features
  • arctl on hosts without an OS keychain now falls back to a file-based token store (~/.arctl/token.json, override with ARCTL_TOKEN_FILE). (#866)
  • Adds code-mode MCP support for Agentgateway-backed virtual deployments (#882)
  • Report managed deployment drift from provider inventory refreshes and surface drifted instances in the UI. (#859)
  • Helm installs now require licensing configuration: set licensing.createSecret=false with licensing.secretName for an existing Secret, or licensing.createSecret=true with licensing.licenseKey to create one. (#930)
  • Enterprise now supports the read-only MCP Registry v0.1 compatibility API (GET /v0.1/servers and related read endpoints), scoped to each caller’s RBAC permissions. It is disabled by default; enable it by setting AGENT_REGISTRY_MCP_REGISTRY_COMPAT_ENABLED=true. (#926)
  • Added more details to the UI for discovered agents (#945)
  • Adds secret support to the UI. (#983)
  • Remote MCP servers now deploy through a streamlined Virtual-runtime form with a new agentgateway Policies section for Backend TLS, Backend Authentication, and MCP Authorization, attached to the route on deploy and shown on instance details. The catalog wizard step “MCP Server Source” is renamed “MCP Server Origin”. The create-agent form gains Kubernetes/Cloud runtime choices and can attach catalog MCP servers, and deployment env vars now appear masked in the Configuration section. (#971)
  • Managed Gateways now accept a user-defined spec.labels map that is applied as tags to all backing AWS resources (instances, IAM roles, security groups, and the STS secret), validated against the target platform’s tag rules. Keys using the reserved agentregistry-solo-io- prefix are rejected. (#990)
  • Added Microsoft Foundry support for discovering and viewing agents from connected Azure projects. (#922)
  • Added runtime sync status visibility for runtime connections. (#960)
  • [Upstream] The Deployment controller now records dependency evidence (kind, namespace, name, tag, UID, generation, and a material hash of each resolved dependency) in the Deployment’s controller status details after each successful apply, making it possible to see which dependency versions an applied deployment was built from. (#546)
  • [Upstream] Add a read-only MCP Registry v0.1 compatibility API (GET /v0.1/servers …) that re-exposes MCP servers in the official server.json format so registry-aware clients (e.g. VS Code) can discover them. Off by default; enable with AGENT_REGISTRY_MCP_REGISTRY_COMPAT_ENABLED=true. (#550)
  • [Upstream] Added AGENT_REGISTRY_CONTROLLER_DISCOVERY_INTERVAL, AGENT_REGISTRY_CONTROLLER_DISCOVERY_STALE_AFTER_MISSES, and AGENT_REGISTRY_CONTROLLER_DISCOVERY_DELETE_AFTER_MISSES to tune discovered deployment refresh and removal timing. (#565)
Fixes
  • Added agent deployment validation for mcp server references to prevent misconfigurations (#847)
  • Fixes missing arctl secret get and delete commands (#958)
  • Fixed stale agent chat sessions after rebuilds, lost transcripts, echoed user messages, and hidden agent failures in the UI chat modal; added a New Session button. Improved the tracing page diagram layout. (#877)
  • Runtime apply now rejects invalid enterprise Runtime config before persisting the Runtime object. (#959)
  • Bump multiple dependencies to resolve CVEs. (#976)
  • [Upstream] Discovered (unmanaged) Deployment rows are now garbage-collected: rows missing from 5 consecutive discovery polls, or whose Runtime has been deleted, are removed, and their Discovered/Ready conditions flip to False after 3 consecutive misses instead of the first one. (#545)
  • [Upstream] Fixed arctl deployment YAML output dropping canonical metadata and deploymentRefs fields. (#551)
  • [Upstream] Bumps dependencies to resolve CVEs (#559)
Documentation
  • The generated OpenAPI document now describes the AgentRegistry Enterprise control-plane API without stale upstream MCP or provider references. (#975)
v2026.6.1

Published on: 2026-06-12
Release v2026.6.1
Container Images
us-docker.pkg.dev/solo-public/agentregistry-enterprise/server:v2026.6.1
Helm Chart
helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --version v2026.6.1
CLI (arctl)
curl -sSL https://storage.googleapis.com/agentregistry-enterprise/install.sh | ARCTL_VERSION=v2026.6.1 sh
export PATH=$HOME/.arctl/bin:$PATH
OpenAPI Spec
https://storage.googleapis.com/agentregistry-enterprise/v2026.6.1/openapi.yaml
agw-sync
curl -fsSL -o agw-sync https://storage.googleapis.com/agentregistry-enterprise/v2026.6.1/agw-sync
chmod +x agw-sync
agentregistry-sts
curl -fsSL -o agentregistry-sts https://storage.googleapis.com/agentregistry-enterprise/v2026.6.1/agentregistry-sts
chmod +x agentregistry-sts
agentgateway
curl -fsSL -o agentgateway https://storage.googleapis.com/agentregistry-enterprise/v2026.6.1/agentgateway
chmod +x agentgateway
Changes
Breaking Changes
  • Removed the unsupported built-in demo auth/autoauth path. You must configure an external OIDC identity provider via the oidc.issuer, oidc.clientId, and oidc.publicClientId chart values (#862)
Features
  • Outbound kagent management API calls now use an OIDC client-credentials service identity instead of forwarding the end user’s bearer token. This fixes kagent-backed deploy, undeploy, reconcile, retry, and AccessPolicy propagation failures caused by missing or expired user sessions. Operators should ensure the outbound OIDC client allows the client_credentials grant and is authorized by kagent RBAC; set kagent.outboundAuth.oidc.{issuer,clientId,clientSecret} when the existing oidc.* client cannot be reused. (#868)
Fixes
  • The UI version badge in the bottom-right of the page and the browser-console UI_VERSION log now always show the server’s build version, even when the UI_VERSION environment variable is not set. (#861)
  • The Helm chart now validates required OIDC settings and rejects malformed OIDC issuer URLs before deploying the server. These values are required by the server at startup, so this fails invalid installs earlier instead of allowing a successful Helm install or upgrade that leaves the server pod in CrashLoopBackOff. (#863)
  • AWS unmanaged discovery now reads BedrockAgentCore runtime connection credentials from background discovery loops. (#869)
  • fix: Deployments whose async deploy job fails (kagent/AWS/GCP runtimes) are now retried automatically on the next controller resync, instead of staying failed until manually re-triggered via the reconcile.agentregistry.dev/force annotation. (#880)
  • Runtime deletion no longer fails when a runtime only has discovered/unmanaged deployments. (#885)
  • [Upstream] Deployments discovered out-of-band by runtime adapters are now included in deployment list responses and can be filtered with origin=discovered. (#535)
v2026.6.0

Published on: 2026-06-09
Release v2026.6.0
Container Images
us-docker.pkg.dev/solo-public/agentregistry-enterprise/server:v2026.6.0
Helm Chart
helm upgrade --install agentregistry \
  oci://us-docker.pkg.dev/solo-public/agentregistry-enterprise/helm/agentregistry-enterprise \
  --version v2026.6.0
CLI (arctl)
curl -sSL https://storage.googleapis.com/agentregistry-enterprise/install.sh | ARCTL_VERSION=v2026.6.0 sh
export PATH=$HOME/.arctl/bin:$PATH
OpenAPI Spec
https://storage.googleapis.com/agentregistry-enterprise/v2026.6.0/openapi.yaml
agw-sync
curl -fsSL -o agw-sync https://storage.googleapis.com/agentregistry-enterprise/v2026.6.0/agw-sync
chmod +x agw-sync
agentregistry-sts
curl -fsSL -o agentregistry-sts https://storage.googleapis.com/agentregistry-enterprise/v2026.6.0/agentregistry-sts
chmod +x agentregistry-sts
agentgateway
curl -fsSL -o agentgateway https://storage.googleapis.com/agentregistry-enterprise/v2026.6.0/agentgateway
chmod +x agentgateway
Changes
Breaking Changes
  • Removed the unsupported arctl daemon command from the enterprise CLI. Enterprise installations should be managed with Helm. (#738)
  • Fix the MCP name validation in the CLI + UI for MCP server creation. (#714)
Decoupled an MCP resource name metadata.name and added an underlying package name used for validation spec.source.package.serverName.
🚨 Breaking Change: Resource names must now be DNS-1123 subdomain compliant (lowercase alphanumeric, hyphens, periods, <= 253 chars). MCP Server package name for validation has been moved to spec.source.package.serverName and is required for source type MCP Servers that are not mcpb types.
  • feat(helm)!: Adds database.postgres.external.secretRef to source the PostgreSQL connection string (URL or keyword/value form) from an existing Kubernetes Secret. (#744)
    BREAKING CHANGE: database.postgres.url moves to database.postgres.external.url; database.postgres.bundled.enabled is removed and replaced by database.postgres.type: bundled|external. Legacy keys fail loud with migration guidance.
  • BREAKING: fixes kagent stdio MCP deploys dropping Launch.Command/Launch.Args metadata. Consumes OSS MCPPackage v1alpha1 redesign — translation layer now reads MCPPackageOrigin and derives per-origin Cmd/Args; (#777)
  • [Upstream] AgentRegistry resource names must now use DNS-1123 subdomain format (lowercase letters, numbers, hyphens, and periods). MCP package manifests now use spec.source.package.serverName for the upstream MCP server name, so manifests that used slash-delimited resource names such as namespace/name must rename those resources and set serverName when package validation needs the upstream name. (#511)
  • [Upstream] Breaking change — restructured database.postgres values: new type: bundled|external discriminator; url and secretRef moved under external. Defaults unchanged; legacy keys fail loud with migration guidance. (#525)
  • [Upstream] BREAKING: MCPPackage v1alpha1 redesigned (Origin + Launch + Transport); New: arctl init mcp --transport {http,stdio} and per-server tool_name_prefix in scaffolded mcp_tools.py (#530)
Features
  • Adds Secret API with Database and k8s Secret as stores. (#747)
  • Adds backend TLS, Auth, MCP authorization policies for remote MCPs deployed to Agentgateway. (#757)
  • Add arctl db migrate for Postgres schema management independent of server startup. OSS and enterprise migrations run as independent tracks, each owning its own Postgres schema (agentregistry, agentregistry_enterprise) selected on the connection; upgraded databases are bridged into the new schemas automatically with no operator cleanup required. Note: the Postgres LISTEN/NOTIFY status channels are renamed — the v1alpha1_ prefix is dropped (e.g. v1alpha1_agents_status → agents_status); any external process that LISTENs on these channels must update. (#671)
  • UI updates for: adding the approval feature; allowing batch catalog item and instance actions; adding charts to the dashboard; improving UI agent creation messaging; renaming Tool Server to MCP Server. (#728)
  • kagent Agent and MCP deployments now honor pod scheduling fields (nodeSelector, tolerations, affinity) for pinning pods to specific nodes. (#790)
  • Registry MCPServers may declare an OpenAPI 3.0 REST API (spec.openapi), (#823)
which is exposed as an MCP server through Agentgateway.
  • Added platform information to the Trace Details panel (#826)
  • Helm: the telemetry-collector and bundled PostgreSQL Deployments now honor optional nodeSelector, affinity, and tolerations values, allowing them to be scheduled independently of the registry server pod. (#824)
  • [Upstream] feat(helm): support sourcing the Postgres connection URL from an existing Kubernetes Secret via database.postgres.secretRef.{name,key} (#523)
  • [Upstream] Added arctl db migrate (up, down N, status, version, goto V, force V) for applying, rolling back, and inspecting Postgres migrations independently of server startup. The OSS migrator now uses golang-migrate/migrate v4 with the schema name parameterized; tables live in the agentregistry schema (was v1alpha1). Existing deployments are bridged transparently: data copies from v1alpha1.* into agentregistry.* on first contact and public.schema_migrations is renamed to public.schema_migrations_v0_legacy. Downgrading to a pre-engine-swap binary is not supported once bridged. Adds AppOptions.SkipMigrations / the SKIP_MIGRATIONS env var to boot the server against a pre-migrated schema. (#503)
  • [Upstream] Adds durable Deployment controller foundations for v1alpha1 reconciliation. (#517)
  • [Upstream] Added namespace/name support for arctl get, delete, and wait resource lookups (#542)
Fixes
  • Fixed password-credentials OIDC login so arctl stores refresh tokens and can refresh short-lived sessions. (#750)
  • Virtual runtime Deployments no longer advertise a non-routable exposedAt URL for a labeled parent HTTPRoute that delegates to a different namespace. (#768)
  • Fix kagent tool server recreation bug where deletion times out (#774)
  • Managed agentgateway AppConfig resources are now isolated per gateway and per install, preventing gateways or installs that share an AWS account from overwriting each other’s configuration. (#799)
  • Hides tracing sections for non-admins users (#808)
  • Fix unsupported principles generating invalid authorization rules. (#812)
APICLI