AISIX 0.3.0

This release introduces the MCP Gateway and Agent Gateway, expands the proxy API and guardrail catalog, and adds metric-based routing.

Release date: July 9, 2026

This release introduces the MCP Gateway and Agent Gateway, expands the proxy API and guardrail catalog, and adds metric-based routing.

New Features

The new aggregating /mcp endpoint fronts multiple upstream MCP servers behind one AISIX caller API key.
Upstream MCP servers are first-class resources with registration and full CRUD in the control plane and dashboard, along with enable and disable controls and a configurable upstream timeout.
Tool access control limits each caller API key to specific MCP tools.
Upstream authentication supports API keys and OAuth 2.0 client credentials.
MCP tool calls use the same rate limits, budgets, and input and output guardrails as model traffic. Calls also emit usage events and access logs.

The new Agent Gateway fronts organization-scoped Agent-to-Agent (A2A) agents managed through the control plane and dashboard.
The allowed_agents field limits each caller API key to specific agents.

The /v1/realtime WebSocket relay supports OpenAI-family and Azure providers, browser subprotocol authentication, and per-session usage accounting.
The new /v1/files, /v1/batches, and /v1/fine_tuning endpoints support OpenAI-family and Azure providers, with cost attribution for batch jobs.
Embeddings support native Vertex AI, Gemini, and Bedrock Titan and Cohere requests.
Anthropic Messages supports cross-provider image, tool-use, tool-result, and document content blocks.

New guardrail integrations support Lakera Guard, Presidio, and OpenAI Moderation.
PII detection and redaction can mask or block sensitive data in request and response bodies, including streamed responses and non-chat endpoints.
Monitor-mode guardrail matches appear in usage events and the dashboard Logs view.

Multi-target models support least-cost, least-latency, and least-busy target selection.
Conditional routing can select targets by tags or metadata, and wildcard aliases can route model names such as provider/*.
Sticky weighted routing supports A/B testing and canary releases.

Caller API key lifecycle controls can set an expiration, disable a key, or rotate it in one operation.
Cluster rate limiting can use shared Redis storage and adds per-second (rps) and per-hour (rph) request limits to the existing per-minute (rpm) and per-day (rpd) limits.

Request and response content capture now covers embeddings, rerank, images, and audio.

MCP servers can be managed from the dashboard, with MCP governance available in the rate-limit, budget, and guardrail views.
Usage-log retention can be configured by organization.

The container image runs as a non-root user and can bind ports 80 and 443 through the CAP_NET_BIND_SERVICE file capability.
The dashboard provides a unified, filterable models view and a single model-kind picker when creating a model.
Routing targets can be reordered by dragging, and least-cost targets display per-target cost badges.
Member and team lists are paginated.

Cache and rate-limit keys are scoped by environment so shared Redis storage cannot mix state between environments.
Passthrough endpoints now emit usage events for successful and failed requests, with caller API key attribution.