TAG
#oauth
Stories connected through a shared idea, actor, technology or theme.
WeKan 12.25 improves OAuth and SAML sign-in flowsWeKan 12.25 changes Google, OAuth/OIDC and SAML authentication so sign-in returns to the same browser window by default. Its hosting documentation also improves real-client-address forwarding for Caddy and Sandstorm deployments.→Codex CLI 0.158 hardens MCP, sandboxing and terminal approvalsThe release adds support for pre-registered MCP OAuth clients and bearer-token authentication for exec-server WebSocket connections. It also strengthens approval behaviour and fixes Windows, Linux and macOS sandbox and path-handling issues.→Docker publishes an MCP Gateway OAuth helperThe package was extracted from Docker's MCP Gateway work and provides OAuth-discovery support for gateway integrations. Its release establishes a separately versioned component for authentication plumbing around MCP services.→Letta Code 0.32.14 connects Grok subscription OAuth to cloud agentsLetta Code 0.32.14 adds a Grok OAuth login path and protocol support for subscription OAuth tokens. It also removes legacy toolsets, scopes stream cursors to individual runs, and improves headless continuation and worktree behavior.→Gemini CLI 0.60 hardens MCP OAuth, sandboxing and extension boundariesGemini CLI 0.60 enforces RFC 9207 issuer identification in MCP OAuth and improves web-fetch destination validation and connection routing. It also isolates macOS sandbox directories, validates extension paths and workspace boundaries, checks configuration ownership, sanitises environment changes and preserves provenance metadata for untrusted tool output.→LiteLLM 1.103 dev release tightens MCP admission, guardrails and spend controlsLiteLLM 1.103.0-dev.1 requires admission for delegated MCP OAuth and adds post-call guardrail support for background Responses and streaming flows. It also bounds tool and guardrail index operations against spend-log budgets, improves timeout logging, fixes reasoning translation and documents signed-container verification.→Gemini CLI preview strengthens MCP OAuth, sandboxing and path boundariesThe preview adds destination validation for web-fetch utilities and enforces RFC 9207 issuer identification in MCP OAuth flows. It also isolates temporary directories, tightens extension and symlink boundary checks, requires consent for environment changes and removes a hard-coded CrUX API key.→MCP Python SDK 2.2.0 tightens Streamable HTTP and OAuth defaultsMCP Python SDK 2.2.0 limits HTTP redirects to the endpoint origin, expires idle stateful sessions after 30 minutes and caps concurrent sessions at 10,000. It also validates OAuth issuer and token-resource settings more strictly.→Better Auth 1.7.3 restores schema compatibility and tightens authentication defaultsThe release restores compatibility with 1.6 account schemas and enables initialisation-time schema validation by default, rejecting authentication requests when detected mismatches remain. It also adds Cloudflare as a social provider, Have I Been Pwned password checks and fixes for OAuth callbacks, session handling and TOTP re-enrolment.→LiteLLM 1.100.0 expands gateway integrations and security controlsThe release adds per-team New Relic trace routing, Grounding with Bing Search, native Vertex AI Interactions API support and Entra ID/OAuth authentication across Azure AI Foundry routes. It also introduces vector-store upload security controls and updates MCP, A2A, routing, cost and provider handling.→Okta makes Agent SSO generally available for AI-agent identityThe service is designed to replace static API keys and repeated user consent with central policy, short-lived tokens and delegated access. Okta says Agent SSO can govern agents as they call applications and MCP servers, giving administrators a control point for identity, permissions and revocation.→