https://cybertoolchain.io/tools/aembit New releases and features in Aembit, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 17:40:17 GMT https://aembit.io/blog/introducing-the-ai-agent-kill-switch-instant-single-user-revocation/ https://aembit.io/blog/introducing-the-ai-agent-kill-switch-instant-single-user-revocation/ Thu, 29 Oct 2026 17:40:17 GMT Aembit adds an AI agent kill switch to revoke a single user's MCP client session without affecting other agents or users⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Revoke a specific MCP user session by navigating to `Administration` > `Identity Providers` > `Sessions` tab and selecting `Revoke session`, scoped to one user and one MCP client without affecting other sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Filter and bulk-revoke sessions in the `Sessions` view by user email, MCP client, or both using `Revoke filtered`, covering all sessions for one user or all sessions for one MCP client. • Automate session revocation in incident-response workflows via the Aembit Cloud API. • Sessions appear for MCP clients that connect through a `Client-to-Gateway Access Policy` using an `OIDC ID Token Credential Provider` with refresh token support enabled; admins need `Read/Write` permission on `Identity Providers` to revoke. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog https://docs.aembit.io/changelog Thu, 29 Oct 2026 07:55:12 GMT Aembit adds `AEMBIT_NETWORK_ACCESS_POLICY` to control which MCP servers a self-hosted MCP Identity Gateway can reach, and exposes gateway version in protected resource metada⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Read the MCP Identity Gateway version without an access token via the `aembit_gateway_version` field now present in the protected resource metadata document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Agent Controller now bypasses an HTTP proxy when calling the AWS instance metadata service for AWS Metadata Service Trust Provider attestation, matching its existing Azure behavior. • Agent Controller authentication errors now name the Agent Controller ID that failed, prompting you to confirm it is valid and active in your Aembit Tenant. • MCP Identity Gateway now applies a new credential on the user's very next request after an MCP User-Based Access Token Credential Provider authorization, instead of returning errors until the cached credential expired. • MCP clients now receive MCP server errors directly when MCP Tool Access Control is filtering a tool list and the upstream MCP server returns an error. • MCP Identity Gateway now sends tool-argument request headers to MCP clients on earlier specification revisions when connecting to MCP servers on the 2026-07-28 MCP specification. • Workload events now record credential injection as failed when MCP Identity Gateway cannot add a credential to a request as a header or query parameter. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/aembit-now-supports-spiffe-x-509-svid-and-jwt-svid-without-spire/ https://aembit.io/blog/aembit-now-supports-spiffe-x-509-svid-and-jwt-svid-without-spire/ Tue, 27 Oct 2026 15:24:29 GMT Aembit now issues SPIFFE X.509-SVID certificates and JWT-SVID tokens directly from its control plane, eliminating the need for SPIRE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Issues SPIFFE-compliant X.509-SVID certificates for end-to-end mTLS between workloads via Agent Proxy, CLI, or Aembit Secrets Operator (Kubernetes), with certificates auto-rotating at 80% of their lifetime (15-minute default, configurable) and private keys never persisted to disk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Issues SPIFFE JWT-SVID tokens for bearer-token authentication behind service meshes such as Istio and Envoy, automatically handling standard claims (`sub`, `iss`, `aud`, `exp`, `iat`, `jti`) and supporting custom claims built from literal values or dynamic workload attributes (Kubernetes namespace, AWS account ID, environment). • Handles SPIFFE identity attestation, credential issuance, and policy evaluation directly from the Aembit control plane, requiring no SPIRE server, agent, or supporting infrastructure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog https://docs.aembit.io/changelog Tue, 20 Oct 2026 07:55:26 GMT Aembit adds MCP session management, change-notification relay, tool-output validation, named-header credentials, and parity across Edge SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `access.registration` event type to Access Authorization Events, recording each Dynamic Client Registration (DCR) request an MCP client sends — successful registrations log client ID, client name, redirect URIs, grant types, and response types at severity `Info`; failed registrations log at severity `Error` with a `reason` and the failing `attribute` (and its supplied value when present).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `subscriptions_workload_refresh_interval` timeout setting (default: 30 seconds) to MCP Identity Gateway, controlling how often it checks for assignment and rule changes, and extends it to relay `subscriptions/listen` change notifications to MCP clients using the 2026-07-28 MCP specification revision, including notifications triggered by Server Workload assignment or MCP Tool Access Control rule changes and on reconnection. • Adds tool-output validation to MCP Identity Gateway: when a tool publishes an output schema, completed results are checked against it and the MCP client receives an error in place of any result that does not match. • Adds `Header` authentication scheme support to MCP Identity Gateway, sending credentials to MCP servers in a named header so MCP servers that accept an API key via a custom header now receive it correctly. • Adds `Sessions` tab to each Identity Provider in the Aembit Tenant UI, listing active MCP user sessions with the ability to filter, revoke individual sessions, or revoke all sessions for a user or MCP client at once. • Adds AWS Metadata Service, Azure Instance Metadata Service, GCP Identity Token, Kubernetes Service Account, and OIDC ID Token Trust Provider support to the Python Edge SDK (`pip install aembit-edge-sdk`, requires Python 3.10+). • Adds GitLab, Kubernetes Service Account, and Terraform Cloud Trust Provider support to the TypeScript Edge SDK, bringing both SDKs to parity across the same nine Trust Providers. • Adds new integration guides for Azure Functions, Azure virtual machines, GitHub Actions, GitLab CI/CD, Kubernetes, and Terraform Cloud, each covering both TypeScript and Python, and adds an Edge SDK logging reference documenting events the SDKs log, how to route them to a logger, and which hosts the SDKs contact. • Adds per-MCP-server workload events for `tools/list` and `resources/list` fan-out requests in MCP Identity Gateway, including events for servers that fail or are skipped because they do not support the method, naming the Server Workload and recording the server's host and HTTP status when known. • Extends MCP Server Workloads to support any authentication method available to HTTP Server Workloads, including API Key, HTTP Authentication with the Basic scheme, and Static HTTP Headers. Breaking changes: • The `status` field in MCP client error `data` (sent when MCP Identity Gateway cannot connect to an MCP server) is replaced by `upstreamHttpStatus` — update any client code that reads `status`. • MCP Identity Gateway now accepts an access token for up to 3 seconds after expiry, down from 60 seconds — MCP clients must refresh access tokens before they expire. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/introducing-mcp-tool-filtering-fine-grained-least-privilege-authorization-for-ai-agents/ https://aembit.io/blog/introducing-mcp-tool-filtering-fine-grained-least-privilege-authorization-for-ai-agents/ Thu, 15 Oct 2026 17:49:33 GMT Aembit adds MCP Tool Access Control — per-tool allow/block policies with glob patterns and fail-closed audit logging for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `application.mcp.contentSecurity.toolFilter` audit event that records which rule matched and why for every filtered `tools/list` response or blocked `tools/call` request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces MCP Tool Access Control in the Aembit MCP Identity Gateway, enabling per-tool allow/block rules inside an access policy — controlling both `tools/list` discovery visibility and `tools/call` invocation independently. • Supports exact tool names and glob patterns (e.g., `get_user*`, `admin_*`, `list_*`, `delete_*`) in tool-filtering policies so new tools inherit rules automatically without manual allow-list updates. • Enforces tool-filtering rules in 'Allow' mode (deny unmatched by default) or 'Block' mode (permit unmatched by default), selectable per policy to match least-privilege or low-maintenance postures. • Scopes tool-access rules by blended identity — user identity, group membership, and workload/agent identity — so different principals sharing the same MCP server receive different tool sets. • Evaluates tool-filtering policy before deeper inspection layers (e.g., CrowdStrike AIDR), resolving coarse-grained discovery and invocation decisions first in the enforcement chain. • Fails closed by default: a missing or malformed tool-filtering policy causes the gateway to return an empty `tools/list` and block `tools/call`, never failing open. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/introducing-mcp-tool-filtering-fine-grained-least-privilege-authorization-for-ai-agents/ https://aembit.io/blog/introducing-mcp-tool-filtering-fine-grained-least-privilege-authorization-for-ai-agents/ Thu, 15 Oct 2026 17:49:33 GMT Aembit adds MCP Tool Access Control — per-tool allow/block policies with glob patterns and fail-closed audit logging for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `application.mcp.contentSecurity.toolFilter` audit event that records which rule matched and why for every filtered `tools/list` response or blocked `tools/call` request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces MCP Tool Access Control in the Aembit MCP Identity Gateway, enabling per-tool allow/block rules inside an access policy — controlling both `tools/list` discovery visibility and `tools/call` invocation independently. • Supports exact tool names and glob patterns (e.g., `get_user*`, `admin_*`, `list_*`, `delete_*`) in tool-filtering policies so new tools inherit rules automatically without manual allow-list updates. • Enforces tool-filtering rules in 'Allow' mode (deny unmatched by default) or 'Block' mode (permit unmatched by default), selectable per policy to match least-privilege or low-maintenance postures. • Scopes tool-access rules by blended identity — user identity, group membership, and workload/agent identity — so different principals sharing the same MCP server receive different tool sets. • Evaluates tool-filtering policy before deeper inspection layers (e.g., CrowdStrike AIDR), resolving coarse-grained discovery and invocation decisions first in the enforcement chain. • Fails closed by default: a missing or malformed tool-filtering policy causes the gateway to return an empty `tools/list` and block `tools/call`, never failing open. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/personal-ai-agents-are-here-and-aembit-customers-can-secure-them-today/ https://aembit.io/blog/personal-ai-agents-are-here-and-aembit-customers-can-secure-them-today/ Mon, 05 Oct 2026 17:13:57 GMT Aembit now secures personal AI agents (Meta Muse, etc.) with distinct identities, just-in-time credentials, and a per-agent kill switch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports the Aembit MCP Identity Gateway for enforcing identity and policy on personal AI agents such as Meta Muse, with integration into other gateways already in use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Assigns each personal AI agent its own distinct agentic identity — separate from the sponsoring employee's login — so credentials can be issued, scoped, and revoked independently. • Provides a per-agent kill switch that revokes all access for a specific agent instantly across Microsoft 365, GitHub, and custom services without disrupting the employee. • Centralizes audit logging for every agent access decision, capturing which agent acted, on whose behalf, what it touched, and which policy permitted the request. • Extends existing Aembit policy coverage to personal AI agents across Microsoft 365, GitHub, and custom in-house services under one unified policy model, at no extra cost. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/aembit-launches-identity-and-access-security-controls-for-meta-muse/ https://aembit.io/blog/aembit-launches-identity-and-access-security-controls-for-meta-muse/ Mon, 05 Oct 2026 14:34:13 GMT Aembit adds Meta Muse support, brokering short-lived credentials through its MCP Identity Gateway and MCP Authorization Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Meta Muse as a supported client workload in Aembit's IAM for Agentic AI Platform, routing Muse's enterprise resource requests through the `MCP Identity Gateway` and `MCP Authorization Server` for policy-evaluated, short-lived credential issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports Meta Muse Dynamic Client Registration against the Aembit authorization server — no manual app creation, client ID, or secret required. • Enables Muse to connect to the `MCP Identity Gateway` by requesting the gateway URL as an OAuth scope, matching the gateway's protected-resource metadata advertisement. • Generates a reusable Muse skill file (e.g. `~/workspace/skills/aembit-mcp-gateway/bin/mcp.py`) using `CREDENTIAL_NAME`, `MCP_URL`, and `ALLOWED_HOSTS` constants, enabling persistent `tools/list` and `tools/call` invocations through the gateway. • Provides MCP Authorization Tracing to diagnose authorization flow issues during Muse-to-gateway setup. • Extends centralized access policy management to cover Meta Muse alongside Microsoft Copilot Studio, Claude, ChatGPT, Gemini, and custom LLM-based agents under a single policy model. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog https://docs.aembit.io/changelog Sat, 26 Sep 2026 07:48:57 GMT Aembit: Adds `${saml.response.subject.nameId}`, `${saml.response.issuer}`, and `${saml.response.attributes['<name>']}` expressions so OAuth 2.0 Authorization Code Credential Provider dynamic claims can read values from a SAML 2.0 response, binding each issued credential to the individual SAML user's identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `credentialType: X509Svid` to `AembitSecretRefreshSchedule` so Aembit Secrets Operator generates a private key in-cluster, obtains a signed certificate from Aembit, and writes both to a `kubernetes.io/tls` Secret (`tls.crt` and `tls.key`) for mutual TLS; the private key never leaves the cluster and certificates renew automatically. • Enables the MCP Enterprise Managed Access Token Credential Provider in the Aembit Tenant UI, obtaining per-user MCP server access tokens through a corporate identity provider so users reach MCP servers behind the MCP Identity Gateway without a per-user consent prompt. • Records MCP tool filtering decisions — which control decided the outcome, which rules matched, which tools were removed, and the return count — under `application.mcp.contentSecurity` in MCP workload authorization events. • Allows a Kubernetes Service Account Trust Provider to accept multiple OIDC endpoints (one per cluster issuer URL, added via `Add an Endpoint`), enabling attestation of a single Client Workload running active-active across two or more clusters. Breaking changes: • Switching an `AembitSecretRefreshSchedule` to or from `credentialType: X509Svid` deletes and recreates the target Kubernetes Secret, because `X509Svid` writes a `kubernetes.io/tls` Secret while every other credential type writes a generic Secret. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog https://docs.aembit.io/changelog Fri, 25 Sep 2026 13:13:51 GMT Breaking changes: • Switching an `AembitSecretRefreshSchedule` to or from `credentialType: X509Svid` deletes and recreates the target Kubernetes Secret (X509Svid writes a `kubernetes.io/tls` Secret; all other credential types write a generic Secret). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog https://docs.aembit.io/changelog Thu, 24 Sep 2026 13:08:11 GMT Aembit adds SAML-bound dynamic claims, X.509-SVID delivery, multi-cluster Kubernetes attestation, MCP Tool Access Control, and AWS STS provider selection in GitHub Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `aws-access-key-id` input to the Aembit GitHub Action (minimum version 1.3.0) so a workflow on a GitHub-hosted runner can select among multiple AWS STS Federation Credential Providers in a single Access Policy by Access Key ID selector. • Extends the Edge API credentials endpoint and Edge SDKs for TypeScript and Python (minimum Edge SDK 1.34.0) to pass an AWS STS Credential Provider selector as connection metadata alongside existing JWT Credential Provider selectors. • Adds MCP Tool Access Control enforcement to the MCP Identity Gateway (version 1.34.5794): Tool Visibility controls which MCP tools an AI agent discovers, Tool Invocation controls which it can call, and both accept exact tool names or case-sensitive glob patterns. • Adds `application.mcp.contentSecurity` fields to MCP workload authorization events, recording which control decided a tool's fate, which rules matched, which tools a listing removed, and how many it returned. • Adds Agent Controller support for Kerberos Trust Provider attestation requests from Agent Proxy when running on AWS EC2 instances (version 1.34.3725). • Adds Windows certificate chain validation to Agent Controller: intermediate CA certificates from its TLS certificate chain are now installed into the LocalMachine certificate store so Windows TLS clients can validate the full chain. • Populates user first and last names from OIDC profile claims (`given_name`, `family_name`, falling back to `name`) when Aembit creates a user through single sign-on. Breaking changes: • Switching an `AembitSecretRefreshSchedule` to or from `credentialType: X509Svid` deletes and recreates the target Kubernetes Secret (X509Svid writes a `kubernetes.io/tls` Secret; all other types write a generic Secret). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/how-aembit-makes-cross-app-access-usable-before-the-rest-of-the-stack-catches-up/ https://aembit.io/blog/how-aembit-makes-cross-app-access-usable-before-the-rest-of-the-stack-catches-up/ Tue, 22 Sep 2026 13:00:37 GMT Aembit launches Enterprise-Managed Authorization Credential Provider to broker XAA/EMA for AI agents against SaaS MCP servers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new Enterprise-Managed Authorization (EMA) Credential Provider that captures a user's SSO ID token and refresh token (requiring the `offline_access` scope) at login, refreshes them in the background, and performs a dual token exchange at request time so AI agents can access downstream MCP servers without per-app OAuth consent screens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Aembit's Edge Controller brokers XAA between identity providers and upstream MCP servers that don't yet support XAA natively — generating and signing assertions using the tenant's own keys when the IdP cannot perform the exchange directly. • Automatically falls back to the standard OAuth Authorization Code flow for any upstream MCP server or identity provider that doesn't support XAA, requiring no separate configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/crowdstrike-aidr-tells-you-whats-risky-aembit-tells-you-who-gets-access/ https://aembit.io/blog/crowdstrike-aidr-tells-you-whats-risky-aembit-tells-you-who-gets-access/ Tue, 15 Sep 2026 16:16:53 GMT Aembit adds CrowdStrike AIDR as a Content Security capability attached to Access Policies, covering MCP tool listings, inputs, and outputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Content Security` as a new capability type on Aembit `Access Policy` objects, enabling administrators to attach a CrowdStrike AIDR content-security configuration to the same enforcement path that governs MCP access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Covers three MCP inspection checkpoints per policy — tool listings, tool inputs, and tool outputs — with AIDR returning an allow, block, or transform verdict that Aembit enforces inline. • Correlates every CrowdStrike AIDR finding with Aembit's identity and policy context (agent, target MCP server, applicable policy, Content Security decision) in a single workload event. • Makes the integration configurable through the Aembit UI, API, or Terraform with no changes required to existing AIDR console configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/aembit-crowdstrike-more-judgment-behind-every-ai-agent-yes/ https://aembit.io/blog/aembit-crowdstrike-more-judgment-behind-every-ai-agent-yes/ Tue, 01 Sep 2026 12:41:49 GMT Aembit integrates CrowdStrike AIDR into MCP access policies to inspect tool listings, inputs, and outputs for AI agents. • Adds a CrowdStrike AIDR content security configuration attachment to Aembit access policies, enabling MCP traffic inspection (tool listings, tool inputs, tool outputs) from the same control plane that handles identity and credential issuance. • Supports configurable fail-open or fail-closed behavior per access policy when CrowdStrike AIDR is unreachable, with every failure recorded as a workload event. • Inspection is opt-in per access policy — only the policies you explicitly configure with a CrowdStrike AIDR content security configuration trigger MCP content checks; all others continue to work unchanged. • Based on AIDR's decision, Aembit allows, blocks, or forwards a transformed version of MCP content (e.g., sensitive data redacted or defanged), with the outcome logged as a workload event tied to the agent identity, target MCP server, and access policy. • New integration is configurable through the Aembit UI, API, or Terraform; requires a CrowdStrike AIDR for Agents subscription. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog https://docs.aembit.io/changelog Mon, 31 Aug 2026 07:41:00 GMT Aembit adds Edge SDK (TypeScript & Python), glibc amd64 CLI build, and `authorizationChain` field in Agent Proxy workload events. • Adds `authorizationChain` field to Agent Proxy workload events — an ordered list of context IDs for the authorization events behind a request, enabling full trace-back to the directive and credential retrievals. • Adds `severity`, `outcome.result`, and `outcome.reason` fields to response events when Aembit answers in place of the Server Workload, so the outcome is no longer cleared between request and response. • Windows MSI installer now applies `AEMBIT_TENANT_GRPC_PING_INTERVAL_SECS` and `AEMBIT_TENANT_GRPC_PING_TIMEOUT_SECS` when passed as install-time properties. • Linux installer script now validates Agent Proxy arguments — including numeric environment variables such as `AEMBIT_HTTP_IDLE_TIMEOUT_SECS` — before installation proceeds. • Introduces the Aembit Edge SDK (TypeScript and Python): in-process libraries that handle workload attestation, token lifecycle, and credential retrieval with no proxy required, suited for serverless functions, ephemeral CI containers, and restricted runtimes. • Edge SDK supports seven Trust Providers: AWS Metadata Service, AWS Role, Azure Instance Metadata Service, GCP Identity Token, GitHub, GitLab, and OIDC ID Token. • Provides Edge SDK integration guides for four platforms: AWS EC2, AWS Lambda, GCP Cloud Run, and Vercel OIDC. • Adds `aembit_agent_cli_linux_amd64_glibc_<version>.tar.gz` as a second Linux amd64 archive in Aembit CLI 1.34.5772, dynamically linking against glibc 2.28 or newer, for organizations whose policy requires glibc or to work around DNS resolution issues caused by musl's stricter handling of resolver responses. • Consolidates API Guide, CLI Guide, and Edge SDK documentation into a single Developer Guide under `/dev-guide/`, with a side-by-side credential-path comparison of Agent Proxy, Edge SDK, Aembit CLI, and Edge API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/openai-workload-identity-federation-aembit-brings-secretless-access-to-the-openai-api/ https://aembit.io/blog/openai-workload-identity-federation-aembit-brings-secretless-access-to-the-openai-api/ Mon, 17 Aug 2026 19:20:34 GMT Aembit Cloud v1.33 adds an OpenAI WIF credential provider for secretless, keyless ChatGPT API access via federated OIDC tokens. • Adds the OpenAI WIF credential provider in Aembit Cloud v1.33, enabling workloads to authenticate to the OpenAI ChatGPT API with short-lived, scoped access tokens instead of static `sk-proj-...` API keys. • Extends Aembit's WIF credential provider ecosystem to now cover AWS STS, Azure Entra, GCP, Anthropic Claude, and OpenAI ChatGPT under a single secretless access policy model. • The EdgeController intercepts outbound OpenAI API requests at runtime, exchanges an Aembit-issued federation token at OpenAI's token endpoint, and injects the resulting short-lived access token — requiring no application code changes, SDK modifications, or credential management logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://aembit.io/blog/aembit-adds-workload-identity-federation-support-for-the-claude-api/ https://aembit.io/blog/aembit-adds-workload-identity-federation-support-for-the-claude-api/ Wed, 05 Aug 2026 14:54:52 GMT Aembit extends its WIF Credential Provider ecosystem to the Claude API, replacing static `sk-ant-…` keys with short-lived, automatically exchanged tokens. • Adds a new 'Claude Workload Identity Federation' `Credential Type` option in the Aembit Credential Provider UI, with required fields `federation_rule_id`, `organization_id`, and `service_account_id`, and optional fields `audience`, `scope` (defaults to `workspace:developer`), `workspace_id`, and `lifetime` (defaults to `3600` seconds, range `300`–`43200`). • Adds a `claude_wif` block to the Aembit Terraform Provider, with required arguments `federation_rule_id`, `organization_id`, and `service_account_id`, and optional arguments `audience`, `scope`, `workspace_id`, and `lifetime`. • Aembit's `EdgeController` now transparently performs the federation token exchange against Claude's `POST /v1/oauth/token` OAuth endpoint and injects the resulting short-lived bearer token into outbound requests — no application code changes required. • Extends Aembit's existing Workload Identity Federation Credential Provider pattern (previously covering AWS STS, Azure Entra, and GCP) to include Anthropic's Claude API, allowing any OIDC-compliant identity source (AWS IAM, Google Cloud, Microsoft Entra ID, GitHub Actions, Kubernetes service accounts, SPIFFE, Okta) to authenticate to Claude under the same Access Policy model. • Aembit auto-generates a dedicated OIDC Issuer URL (serving `/.well-known/openid-configuration` and JWKS) that Claude Console uses for OIDC discovery when registering Aembit as a federation issuer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-26-mcp-user-based-access-token-callback-url-format https://docs.aembit.io/changelog/entry/2026-06-26-mcp-user-based-access-token-callback-url-format Fri, 26 Jun 2026 00:00:00 GMT New credential providers use a new callback URL format for MCP user-based access tokens. • Existing Credential Providers retain their original URL format and require no re-registration • New Credential Providers generate the updated callback URL upon save Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-23-resource-set-deletion-now-available https://docs.aembit.io/changelog/entry/2026-06-23-resource-set-deletion-now-available Tue, 23 Jun 2026 00:00:00 GMT Aembit now supports cascading deletion of Resource Sets via UI and Terraform. • Adds the ability to delete a custom `Resource Set` and all its contained entities (Access Policies, Workloads, Trust Providers, etc.) in a single cascading operation through the console • Introduces Terraform support for Resource Set lifecycle management via the `aembit_resource_set` resource type • Exposes the `resource_set_id` argument in Terraform to assign or filter entities by Resource Set Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-12-edge-components-release-with-aembit-cli-and-secrets-operator-updates https://docs.aembit.io/changelog/entry/2026-06-12-edge-components-release-with-aembit-cli-and-secrets-operator-updates Fri, 12 Jun 2026 00:00:00 GMT Aembit CLI gains AWS/K8s Trust Provider attestation and deployment model flags; Secrets Operator expands credential types. • Adds `aembit credentials get` support for AWS Metadata Service, AWS Role, and Kubernetes Service Account Trust Providers with automatic local attestation • The --deployment-model option now accepts vm, kubernetes, ecs_fargate, and lambda_container; the AWS Role Trust Provider requires it. • Expands Aembit Secrets Operator 1.32.322 credential retrieval to any type issued by an Access Policy, beyond previous HashiCorp Vault token limitation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-12-claude-api-wif-credential-provider-now-available https://docs.aembit.io/changelog/entry/2026-06-12-claude-api-wif-credential-provider-now-available Fri, 12 Jun 2026 00:00:00 GMT Aembit adds a Claude WIF Credential Provider with Terraform support and built-in verification • Adds the Claude WIF Credential Provider type to exchange assertions for short-lived Claude API tokens through Workload Identity Federation. • Adds a `Verify` action to confirm trust between Aembit and the Claude federation rule before applying to an Access Policy • Adds Terraform provider support to manage the `Claude WIF` Credential Provider resource Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-04-mcp-identity-gateway-1-32-5006-release https://docs.aembit.io/changelog/entry/2026-06-04-mcp-identity-gateway-1-32-5006-release Thu, 04 Jun 2026 00:00:00 GMT MCP Identity Gateway adds MCP ping support, authorization chain in workload events, and accurate health endpoint status • Adds MCP `ping` method support for client connection-health checks per the MCP specification. • Workload events now include an ordered authorization chain of context IDs to trace requests end-to-end across agent, gateway, and server sides. • Health endpoint returns HTTP 503 status when the Gateway is unhealthy, enabling accurate detection by orchestrators and load balancers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-04-aembit-secrets-operator-now-supports-more-credential-types https://docs.aembit.io/changelog/entry/2026-06-04-aembit-secrets-operator-now-supports-more-credential-types Thu, 04 Jun 2026 00:00:00 GMT Aembit Secrets Operator 1.32.322 adds credentialType field for OAuth, API keys, AWS STS, and Workload Identity federation • Adds `credentialType` field to `AembitSecretRefreshSchedule` resource to select the Credential Provider type (default: `OAuthToken`). • Supports `ApiKey`, `UsernamePassword`, `AwsStsFederation`, and `GoogleWorkloadIdentityFederation` credential types, each producing specific Secret data keys. • Redacts AWS access key, secret access key, and session token values from debug logs in Secrets Operator. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-04-edge-components-release-with-reliability-cli-and-mcp-enhancements https://docs.aembit.io/changelog/entry/2026-06-04-edge-components-release-with-reliability-cli-and-mcp-enhancements Thu, 04 Jun 2026 00:00:00 GMT Adds CLI X.509-SVID retrieval, configurable gRPC keep-alives and Windows HTTP idle timeout, and restores custom CA configuration. • `aembit credentials get --client-tls-private-key` retrieves X.509-SVID certificates using a local PEM private key without sending the key to the server. • `AEMBIT_TENANT_GRPC_PING_INTERVAL_SECS` and `AEMBIT_TENANT_GRPC_PING_TIMEOUT_SECS` environment variables configure gRPC keep-alives for Agent Proxy reconnects. Keep-alives are off by default. • AGENT_TRUST_PATH again supports supplying a custom CA certificate for Agent Proxy connections to Aembit Cloud. • `AEMBIT_HTTP_IDLE_TIMEOUT_SECS` configures the HTTP idle timeout on Windows in the Agent Proxy. • Improved upstream proxy diagnostics now show the full error source chain in logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-06-03-aembit-cli-now-retrieves-x509-svid-certificates https://docs.aembit.io/changelog/entry/2026-06-03-aembit-cli-now-retrieves-x509-svid-certificates Wed, 03 Jun 2026 00:00:00 GMT Aembit CLI `aembit credentials get` now accepts `--client-tls-private-key` to retrieve X.509-SVID certificates. • `aembit credentials get` command gains `--client-tls-private-key` flag for retrieving SPIFFE-compliant X.509-SVID certificates • X.509-SVID retrieval generates the CSR locally and returns the signed certificate chain in CLIENT_CERT_CHAIN. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-21-end-to-end-mtls-with-spiffe-x509-svid-certificates https://docs.aembit.io/changelog/entry/2026-05-21-end-to-end-mtls-with-spiffe-x509-svid-certificates Thu, 21 May 2026 00:00:00 GMT New end-to-end mTLS between Client and Server Workloads using SPIFFE X.509-SVID certificates • Adds `X.509-SVID Credential Provider` type that issues SPIFFE-compliant X.509 certificates with URI SANs and configurable lifetime. • Adds `mTLS Authentication` method with the `x509 Certificate` scheme to Server Workloads for validating client certificates. • Enables Agent Proxy to establish outbound mTLS connections to Server Workloads using SPIFFE-compliant X.509-SVID certificates generated in memory. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-19-mcp-identity-gateway-1-31-4955-release https://docs.aembit.io/changelog/entry/2026-05-19-mcp-identity-gateway-1-31-4955-release Tue, 19 May 2026 00:00:00 GMT MCP sessions can now be explicitly deleted via API; MCP protocol and app-level Prometheus metrics added. • Adds session deletion capability to enable clients to explicitly end MCP Identity Gateway sessions when finished. • Adds Prometheus metrics for MCP protocol-level errors and request failures. • Exposes application-scoped Prometheus metrics for MCP Identity Gateway observability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-19-expanded-mcp-and-ai-iam-event-coverage https://docs.aembit.io/changelog/entry/2026-05-19-expanded-mcp-and-ai-iam-event-coverage Tue, 19 May 2026 00:00:00 GMT Adds MCP discovery events, user identity fields, clearer failure reporting, and live authorization tracing. • Adds `access.discovery` event type to list Client and Server Workloads considered during access evaluation • Adds `application.mcp.userId` field to MCP Workload Events and corresponding 'User (MCP App Protocol only)' filter in the Workload Events view • Changes Trust Provider attestation failure severity from Warning to Error • Improves `access.credential` event reason to identify which token expired and at which step • Adds live MCP Authorization Tracing view in the Reporting dashboard for real-time inbound authorization request diagnostics Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-15-aembit-secrets-operator-crds-graduate-to-v1 https://docs.aembit.io/changelog/entry/2026-05-15-aembit-secrets-operator-crds-graduate-to-v1 Fri, 15 May 2026 00:00:00 GMT Aembit Secrets Operator 1.31.314 updates its CRDs to v1 API. • Aembit Secrets Operator 1.31.314 updates its CRDs to v1 API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-12-aembit-secrets-operator-now-available https://docs.aembit.io/changelog/entry/2026-05-12-aembit-secrets-operator-now-available Tue, 12 May 2026 00:00:00 GMT Aembit Secrets Operator 1.31.298 adds Service Account and OIDC auth, proactive renewal, and multi-namespace Helm installs. • Adds `Kubernetes Service Account authentication` using the operator’s in-cluster ServiceAccount token validated against the cluster’s OIDC endpoint • Adds `OIDC symmetric key authentication` (HS256) for custom claims and non-Kubernetes identity scenarios • Enables proactive credential renewal where credentials refresh at 80% of their TTL, or sooner when you configure a shorter `refreshInterval` • Allows multi-namespace install by supporting the same Helm release name across multiple namespaces on the same cluster without resource name conflicts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-12-mcp-identity-gateway-1-31-release https://docs.aembit.io/changelog/entry/2026-05-12-mcp-identity-gateway-1-31-release Tue, 12 May 2026 00:00:00 GMT MCP Identity Gateway 1.31 adds userId to workload events and client-initiated session termination via DELETE /mcp • Adds `userId` field to `mcp.request` and `mcp.response` workload events for authenticated clients, enabling user attribution in audit reports • Enables MCP clients to terminate sessions by sending an HTTP `DELETE` request to the `/mcp` endpoint Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-02-dynamic-claims-now-support-custom-environment-variables https://docs.aembit.io/changelog/entry/2026-05-02-dynamic-claims-now-support-custom-environment-variables Sat, 02 May 2026 00:00:00 GMT Aembit OIDC and JWT-SVID dynamic claims now read custom env vars via `AEMBIT_ENV_VAR_ALLOWLIST`. • Adds `AEMBIT_ENV_VAR_ALLOWLIST` environment variable to Agent Proxy and Aembit CLI to explicitly allowlist which custom environment variables may be captured for OIDC and JWT-SVID dynamic claims • Always-available Kubernetes variables (`K8S_POD_NAME`, `K8S_NAMESPACE`, `KUBERNETES_PROVIDER_ID`) are now usable in dynamic claims regardless of the allowlist Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-02-edge-components-release-with-oracle-ga-and-http-proxy-support https://docs.aembit.io/changelog/entry/2026-05-02-edge-components-release-with-oracle-ga-and-http-proxy-support Sat, 02 May 2026 00:00:00 GMT Oracle GA, HTTP proxy, dynamic env-var claims, and streaming S3 uploads in Aembit edge components • `AEMBIT_ENV_VAR_ALLOWLIST` environment variable enables Agent Proxy and Aembit CLI to gather dynamic claims from environment variables. • Oracle Database protocol support is now generally available, including mid-connection TLS and Prometheus metrics for credential injection events. • Agent Proxy and Aembit CLI add upstream HTTP proxy configuration with `NO_PROXY` support for gRPC and Server-Workload-bound HTTP/HTTPS traffic. • Large file uploads to AWS S3 Log Streams are now supported via streaming AWS chunked signing, removing the previous upload size limit. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-05-02-oracle-database-now-generally-available https://docs.aembit.io/changelog/entry/2026-05-02-oracle-database-now-generally-available Sat, 02 May 2026 00:00:00 GMT Aembit adds general availability for Oracle Database support with TLS and enhanced monitoring. • Adds production-ready Oracle Database protocol support (19c and 21c) to eliminate static database passwords via credential injection. • Enables independent TLS configuration on client-to-proxy and proxy-to-database connections for Oracle Server Workloads. • Provides Prometheus metrics (`aembit_agent_proxy_credential_injections_total` with `application_protocol="oracleDatabase"`) for monitoring Oracle credential injection events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-04-17-agent-proxy-now-honors-http-proxy-environment-variables https://docs.aembit.io/changelog/entry/2026-04-17-agent-proxy-now-honors-http-proxy-environment-variables Fri, 17 Apr 2026 00:00:00 GMT Agent Proxy now honors HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables for outbound traffic routing. • Agent Proxy now honors `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables to route outbound connections through an HTTP proxy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-04-15-agent-controller-now-honors-http-proxy-environment-variables https://docs.aembit.io/changelog/entry/2026-04-15-agent-controller-now-honors-http-proxy-environment-variables Wed, 15 Apr 2026 00:00:00 GMT Agent Controller now respects HTTP_PROXY, HTTPS_PROXY, and NO_PROXY env vars for outbound traffic routing • Adds `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variable support to Agent Controller for configuring outbound proxy routes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-04-07-refresh-token-support-for-mcp-authorization-flows https://docs.aembit.io/changelog/entry/2026-04-07-refresh-token-support-for-mcp-authorization-flows Tue, 07 Apr 2026 00:00:00 GMT MCP Authorization Server flows gain optional single-use refresh tokens and configurable absolute token lifetime. • Adds Enable Refresh Token Support to OIDC ID Token and Aembit Access Token Credential Providers exclusively for MCP Authorization Server flows. • Adds `Absolute Token Lifetime` setting to control how long refresh tokens remain valid for exchanging for new access tokens after initial issuance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-04-03-mcp-identity-gateway-1-30-release https://docs.aembit.io/changelog/entry/2026-04-03-mcp-identity-gateway-1-30-release Fri, 03 Apr 2026 00:00:00 GMT MCP Identity Gateway 1.30 adds pre-proxy auth, tool annotations, and a metrics endpoint. • Authenticates requests before proxying them to upstream MCP servers (new default behavior) • Includes tool annotations in MCP responses • Returns HTTP 405 for GET requests to the MCP endpoint • Adds additional metadata to Unauthorized (401) responses • Honors the `AEMBIT_TRUSTED_ISSUER_DOMAINS` environment variable for trusted issuer configuration • Provides a new metrics endpoint for Gateway operational metrics on a configurable port Breaking changes: • The Gateway now authenticates requests before proxying them to upstream MCP servers as its new default behavior. • GET requests to the MCP endpoint now return HTTP 405. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-03-31-mcp-authorization-server-now-supports-unauthenticated-flows https://docs.aembit.io/changelog/entry/2026-03-31-mcp-authorization-server-now-supports-unauthenticated-flows Tue, 31 Mar 2026 00:00:00 GMT Aembit MCP Authorization Server adds unauthenticated OAuth flows via 'Enforce SSO' toggle • Allows MCP Authorization Server to issue access tokens without identity provider redirection when `Enforce SSO` is off Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-03-17-mcp-identity-gateway-now-supports-mcp-resources https://docs.aembit.io/changelog/entry/2026-03-17-mcp-identity-gateway-now-supports-mcp-resources Tue, 17 Mar 2026 00:00:00 GMT MCP Identity Gateway v1.29.4419 adds MCP resource support for identity-aware proxying • `resources/list` endpoint discovers available resources across all assigned MCP servers • `resources/read` endpoint retrieves a specific resource by URI from the appropriate MCP server Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-02-26-oracle-database-support-enters-beta-with-process-based-identifiers https://docs.aembit.io/changelog/entry/2026-02-26-oracle-database-support-enters-beta-with-process-based-identifiers Thu, 26 Feb 2026 00:00:00 GMT Aembit adds Oracle Database support in Limited Beta and process-based Client Workload identifiers for Linux VM deployments. • Adds `Oracle Database` application protocol support (Limited Beta) to Agent Proxy, enabling transparent credential injection for client workloads connecting via the TNS wire protocol. • Adds Process Command Line and Process Path Client Workload identifiers for Linux VM deployments, with wildcard matching for command lines and exact executable-path matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-02-24-mcp-identity-gateway-enters-beta-with-mcp-server-and-component-copying https://docs.aembit.io/changelog/entry/2026-02-24-mcp-identity-gateway-enters-beta-with-mcp-server-and-component-copying Tue, 24 Feb 2026 00:00:00 GMT Aembit adds MCP Identity Gateway beta, MCP Server for log querying, per-user OAuth Credential Provider, and component copying. • Adds MCP Identity Gateway (Beta) for proxying MCP traffic with identity-aware policy enforcement and fail-closed behavior • Adds MCP Server to enable AI agents and users to query Aembit event logs using structured commands via the Model Context Protocol • Adds 'MCP User-Based Access Token' Credential Provider type supporting OAuth 2.0 Authorization Code flow with PKCE support for per-user credential scoping • Adds component copying capability between Resource Sets, allowing replication of Access Policy components and entire Access Policies Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-01-16-edge-components-release-with-s3-streaming-and-secrets-manager-improvements https://docs.aembit.io/changelog/entry/2026-01-16-edge-components-release-with-s3-streaming-and-secrets-manager-improvements Fri, 16 Jan 2026 00:00:00 GMT Agent Proxy 1.28 adds S3 chunked upload signing and Secrets Manager PNA for username/password • `private network access` support for `HTTP Basic Auth Credential Providers using AWS Secrets Manager` • `process name` and `process username` added as Client Workload Identifiers • Extended AWS S3 support to include all `SigV4` headers, enabling required signing type specification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2026-01-13-github-action-mcp-authorization-server-beta-and-access-policy-builder-now-available https://docs.aembit.io/changelog/entry/2026-01-13-github-action-mcp-authorization-server-beta-and-access-policy-builder-now-available Tue, 13 Jan 2026 00:00:00 GMT New GitHub Action for CI/CD credential injection, MCP Authorization Server beta, PNA support, and Access Policy Builder UI. • Adds official GitHub Action to inject credentials into CI/CD workflows using workload identity federation • Introduces MCP Authorization Server (beta) securing Model Context Protocol workloads with OAuth 2.1 authorization code flow • Enables Private Network Access (PNA) for AWS Secrets Manager Credential Provider to retrieve secrets from private VPCs • Adds an opt-in Access Policy Builder with card-based navigation and inline component creation; enable Use new access policy in user profile preferences. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2025-12-04-edge-components-release-with-aws-s3-uploads-and-multiple-aws-sts-support https://docs.aembit.io/changelog/entry/2025-12-04-edge-components-release-with-aws-s3-uploads-and-multiple-aws-sts-support Thu, 04 Dec 2025 00:00:00 GMT Aembit adds S3 upload support and multiple AWS STS providers in a single Access Policy • `Agent Proxy` now supports transparent `AWS S3` file uploads with automatic detection of signing methods via the `x-amz-content-sha256` header. • Streaming signed payload uploads default to a 50 MiB limit, configurable with AEMBIT_AWS_MAX_BUFFERED_PAYLOAD_BYTES. • `Access Policy` now supports multiple `AWS STS Credential Providers` matched automatically using Access Key ID selectors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2025-10-21-azure-key-vault-credential-provider-and-oidc-sso-now-available https://docs.aembit.io/changelog/entry/2025-10-21-azure-key-vault-credential-provider-and-oidc-sso-now-available Tue, 21 Oct 2025 00:00:00 GMT Aembit adds Azure Key Vault private network access, Azure Entra Federation credential provider, and OIDC SSO for admin console. • Adds support for Azure Key Vault private network endpoints through the Azure Key Vault Credential Provider. • Introduces the `Azure Entra Federation Credential Provider` integration to authenticate with Azure Entra using Workload Identity Federation and OIDC • Enables configuration of OIDC 1.0 Identity Providers for administrator Single Sign-On (SSO) authentication in the Aembit admin console Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2025-08-26-spiffe-jwt-svid-credential-provider-now-available https://docs.aembit.io/changelog/entry/2025-08-26-spiffe-jwt-svid-credential-provider-now-available Tue, 26 Aug 2025 00:00:00 GMT Aembit adds SPIFFE JWT-SVID Credential Provider for workload authentication. • Adds the `SPIFFE JWT-SVID Credential Provider` to generate JWT-SVID tokens for SPIFFE-compliant workloads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2025-08-22-edge-components-release-with-openshift-and-aws-secrets-manager-pna https://docs.aembit.io/changelog/entry/2025-08-22-edge-components-release-with-openshift-and-aws-secrets-manager-pna Fri, 22 Aug 2025 00:00:00 GMT Adds AWS Secrets Manager private network access and OpenShift support for Edge components • Adds Private Network Access to the AWS Secrets Manager Credential Provider for Aembit CLI and Agent Proxy • Adds Official Red Hat OpenShift and ROSA support for Agent Proxy and Sidecar Init, including SecurityContextConstraint configurations • Adds custom annotation support on Kubernetes resources in the Helm chart Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2025-08-19-gitlab-cicd-component-oidc-dynamic-claims-and-crowdstrike-conditions-now-available https://docs.aembit.io/changelog/entry/2025-08-19-gitlab-cicd-component-oidc-dynamic-claims-and-crowdstrike-conditions-now-available Tue, 19 Aug 2025 00:00:00 GMT Aembit adds GitLab CI/CD Component, OIDC dynamic claims for credential data, and CrowdStrike MAC/IP access conditions • Aembit Edge GitLab CI/CD Component available in the GitLab CI/CD Catalog to simplify pipeline integration. • OIDC ID Token Credential Provider now supports dynamic claims to extract values from OIDC tokens for personalized credential data. • New Access Conditions for CrowdStrike: 'MAC Address' and 'Local IP Address' ensure Host MAC and Local IP match Agent Proxy retrieval. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit https://docs.aembit.io/changelog/entry/2025-07-29-aembit-cli-aws-secrets-manager-and-jenkins-pipelines-now-available https://docs.aembit.io/changelog/entry/2025-07-29-aembit-cli-aws-secrets-manager-and-jenkins-pipelines-now-available Tue, 29 Jul 2025 00:00:00 GMT New Aembit CLI for CI/CD injection, AWS Secrets Manager/IAM providers, Jenkins support, and Agent Controller TLS port hardening • Releases the `Aembit CLI`, a command-line interface that allows you to inject credentials into your CI/CD pipelines. • Introduces the AWS IAM Role Credential Provider Integration, used with the Secrets Manager Credential Provider to retrieve AWS Secrets Manager secrets. • Introduces the `AWS Secrets Manager Credential Provider` for direct secret retrieval from AWS Secrets Manager. • Adds support for `Jenkins Pipelines` as a compatible CI/CD target for Aembit-managed credentials. • Enables wildcard hostname support for Server Workloads in Agent Controller. • Agent Controller automatically closes insecure HTTP ports when TLS is enabled and opens port 443 (5443 on VMs) plus secure Prometheus port 9091. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aembit