chore: release v1.0.9 — mTLS, OAuth Quick Wins, Tool Preview, Catalog Actions, and Security Hardening

[Lang-Akshay]

Release 1.0.9 consolidates 35 PRs focused on inbound mTLS client certificate auth, MCP server OAuth improvements, tool preview and schema publishing, catalog gateway actions, TLS/SSL enhancements, and security hardening:

• Security & Auth — Inbound mTLS (client certificate authentication), MCP server OAuth form quick wins (read-only redirect URI, drop password grant), session refresh and validate endpoints, default token creation to creator's personal team, and invisible Unicode stripping from stored auth credentials.
• API & Platform — MCP handshake test endpoint for Test Connection and virtual servers, new tool preview permission and preview functions, tool schema publishing to dataplane, catalog gateway actions backend support, and gateway-side TLS override for end-to-end HTTPS.
• Operations — Experimental UI added to compose, SSL/TLS exposed for gateway pods, TLS cipher suite exposure, automated catalog icon generation, and load test consolidation.
• Documentation — Dynamic env production risk documentation for translate, live black-box test requirement policy.

---

Added

Security & Auth

• Inbound mTLS (client certificate authentication) (#6352)
• MCP server OAuth form quick wins (#6315)
• Session refresh and validate endpoints (#6235)

API & Platform

• MCP handshake test endpoint for Test Connection (#5934)
• Tool preview permission (#6321)
• Tool preview functions (#6360)
• Tool schema publishing to dataplane (#6348)
• Catalog gateway actions backend (#6355)
• Gateway-side TLS override (#6422, closes #6266)

Operations & Tooling

• Experimental UI in compose (#6320)
• SSL/TLS exposed for gateway pods (#6362)
• TLS cipher suite exposure (#6483)
• Automated MCP server catalog icon generation (#6397)

Fixed

Security & Auth

• Default token creation to creator's personal team (#6354, closes #5993)
• Reject/strip invisible Unicode in stored auth credentials (#6350)
• Enforce component-aware directory confinement on admin log download (#6393)
• Harden local A2A egress handling (#6399)

Gateway & Platform

• Missing migration columns in migrate_enc_secret (#6324)
• MCP handshake test endpoint for virtual servers (#6405)
• Gateway/tool/prompt/resource audit rows in activity feed (#6351)
• Cache StatefulHTTP JWT admin lookups (#6437)
• Normalize bundled catalog icon bounds (#6441)

Deprecations & Cleanup

• Remove deprecated PUT /admin/users endpoint (#6304)

Build & CI

• CI venv recreation for broken Python symlink (#6302)
• Raise clippy large-error-threshold for mcp_runtime (#6349)
• Bump pinned UBI10 base image tags (#6413)

Changed

• Remove fast_test_server; consolidate load tests (#6192)

Documentation

• Document dynamic env production risk (#6388)
• Require live black-box tests where applicable (#6326)

Chores

PR	Description
#6301	Remove temporary min-release-age-exclude pins from .npmrc
#6312	Bump dependency-review-action from v4.9.0 to v5.0.0
#6319	.env.example cleanup
#6325	Tool invoke function refactor
#6306	Add MCP Apps live stack tests to TestRawJsonRpc
#6398	Fix Playwright gateway OAuth and team flakiness

Signed-off-by: prakhar-singh1928 prakhar.singh1928@ibm.com

[gandhipratik203]

Default token creation to creator's personal team (#6354, closes #5993) Looks a bit out of sync with the pattern for the other items. This menitons the issue as well. We can remove the issue mention if not needed to be consistent!

LGTM otherwise!

[msureshkumar88]

Thanks for putting the 1.0.9 notes together — the structure is clear, the grouping into Security & Auth / API & Platform / Operations reads well, and everything that is listed checks out. I verified each of the 35 entries against the merge commits in v1.0.8..Release/v1.0.9, and the cross-links are accurate (#6422 → closes #6266, #6354 → #5993). The version bump is already in place (pyproject.toml:36 and mcpgateway/__init__.py:12 both at 1.0.9), and the section is correctly placed above [1.0.8].

A few things worth fixing before we tag, though.

Blocking

1. Six merged PRs are missing from the section

Comparing the changelog against git log v1.0.8..Release/v1.0.9, there are 41 merged PRs in the window but 35 listed. These six don't appear anywhere in CHANGELOG.md:

PR	What it is	Suggested home
#5599	Pluggable OAuth token storage with HashiCorp Vault backend	Added → Security & Auth
#6247	Security hardening: catalog registration scope enforcement	Fixed → Security & Auth (see point 3)
#6257	Two new paths added as versioned API aliases	Added → API & Platform
#6292	Recent activity feed endpoint (audit + security union) — rebase of #5973	Added → API & Platform
#6293	Durable observability metrics endpoints for the home dashboard — rebase of #6009	Added → API & Platform
#6375	Routine python/node dependency updates	Chores table

Two of these feel like they'd be missed by users: the Vault-backed OAuth token storage is a headline feature, and #6247 is a security hardening change.

One note on #6292/#6293 — their commit subjects are just "Pr 5973 rebase" / "Pr 6009 rebase", so they're worth describing by what the underlying PRs actually did (activity feed endpoint, observability metrics endpoints) rather than by the rebase title.

2. The PR count in the Overview

Follows from the above: "consolidates 35 PRs" would become 41 PRs once the missing entries are added.

3. The [Unreleased] section still holds something that ships in 1.0.9

CHANGELOG.md lines 11-13 currently read:

## [Unreleased]

### Fixed

- **Catalog registration ownership and visibility** - ... ([#6036](https://github.com/IBM/mcp-context-forge/issues/6036)).

That entry is PR #6247 (merged 2026-08-26, commit 89a2decc2), which is inside this release window. As it stands, 1.0.9 would ship claiming this change is still unreleased. Moving the bullet down into the 1.0.9 → Fixed → Security & Auth block (keeping the #6036 issue link and adding the #6247 PR link) covers both this and point 1, and leaves [Unreleased] empty for the next cycle.

Minor / optional

• The Chores table keeps the raw conventional-commit prefixes in the Description column (chore: ..., test: ..., refactor: ...), while every other section strips them. The PR description version of this table already has them stripped — worth making the file match.
• Possibly worth a look for next time: three commit subjects in this range are literally truncated with ... in git history (#6304, #6315, #6351), so they carry no trailing PR number. If the list was generated by scraping commit subjects, that's likely related to why the six PRs above dropped out — might be worth hardening whatever generates this before v1.0.10.

Happy to re-review once the entries are added.

[Lang-Akshay]

Done. Added all 6 PRs to the v1.0.9 changelog:

PR	Section	Placement
#5599	Added → Security & Auth	Pluggable OAuth token storage with Vault
#6247	Fixed → Security & Auth	Catalog registration scope enforcement
#6257	Added → API & Platform	Versioned API aliases
#6292	Added → API & Platform	Recent activity feed endpoint
#6293	Added → API & Platform	Durable observability metrics endpoints
#6375	Chores table	Routine dependency updates

[msureshkumar88]

Thanks for the quick turnaround — re-reviewed and everything from the previous round is addressed.

Verified against the PR head:

• All six missing PRs are in — #5599 (Vault-backed OAuth token storage) and #6247 (catalog registration scope enforcement) landed in Security & Auth, #6257 / #6292 / #6293 in API & Platform with descriptions based on what the underlying work does rather than the "Pr NNNN rebase" commit subjects, and #6375 in the Chores table.
• Overview count updated to 41, and the entries tally: 17 Added + 14 Fixed + 1 Changed + 2 Documentation + 7 Chores = 41.
• [Unreleased] no longer carries 1.0.9 content — the catalog registration bullet now lives under 1.0.9 → Fixed → Security & Auth as #6247, so the release won't ship claiming that change is unreleased.
• Chores table prefixes stripped, matching the rest of the file.
• The overview bullets were also refreshed to mention the newly added items (pluggable OAuth token storage, versioned API aliases, activity feed, observability metrics), which is a nice touch.

Also consistent with @gandhipratik203's note — issue references are dropped from the entry lines now, so #6354 and #6422 match the pattern of the rest.

One entirely optional thought for next cycle, not worth holding this: the #6247 line lost the detail from the old [Unreleased] bullet (private-by-default registrations, ownership attribution, preservation through gateway transfer and user deletion) and its #6036 issue link. The one-liner is fine for the changelog's style, but that bullet had useful specifics if you ever want to expand it.

LGTM — approving.