| v3.7.1 | Six fixes, every one a first-week report against 3.7.0. Three are the same shape — something failed silently instead of saying so: an agent that registered nowhere while its probes answered 200, a provider that waited until its first LLM call to report a missing dependency, and two diagnostics that other fixes in this release removed as a side effect. All Python. No wire-protocol, registry-schema, dependency-resolution or declaration-syntax changes. ### 🐍 Python - **Annotations are resolv | High | 8/31/2026 |
| v3.7.0 | `health_check` is a routing answer, not a health taxonomy (#1539). It accepted three verdicts and had two behaviours — `healthy` and `degraded` were identical on every path, and only `unhealthy` withdrew. The contract is now binary: return true to keep the agent in dependency resolution, false to withdraw it. Returning a dict or object to populate `checks` and `errors` still works and still reaches `/health`; it just never affects routing. Alongside it, the dashboard's topology and traffic views | High | 8/22/2026 |
| v3.6.0 | ## A minor release with one breaking change, and it is the point of the release: mesh health and Kubernetes probes are now separate hooks wired to separate consumers. Mesh employs only healthy workers; Kubernetes keeps the sick and kills only the dead. A failing `health_check` pauses the heartbeat so the registry ages the agent out and consumers rewire — the process keeps running and returns on its own when the check passes, and Kubernetes never restarts it for a dependency outage. The new ` | Medium | 8/7/2026 |
| v3.4.0 | ## A minor release with breaking changes in two runtimes. Dependency injection is now positional at every injection site in every runtime — Java `@MeshRoute`/`@MeshA2A` and TypeScript `mesh.route`/`mesh.a2a.mount` change how declared dependencies reach handler parameters. Three declaration shapes that used to fail silently now fail at boot instead, so an agent that started on 3.3.2 can refuse to start on 3.4.0. The bundled tempo chart no longer requests a PVC by default, and the Python vendor- | High | 8/1/2026 |
| v3.2.2 | A patch release. Two vendor-contract fixes stop mesh sending parameters that current models reject, the meshctl scaffold Gemini default is corrected from a retired model id, and meshui gains the resolution detail the CLI already showed. Two test surfaces that had never executed in CI are now wired in — including one that was already failing. Nothing touches the wire protocol, the registry, dependency resolution, or the declaration syntax. 🤖 LLM: vendor-removed sampling parameters are no long | High | 7/20/2026 |
| v3.1.0 | ## A service-view refinement release: two RFC-1280 declaration surfaces shipped in v3.0.0 are corrected — the producer-side sugar is withdrawn and the Java view annotation is renamed for consistency — alongside a documentation buildout that gives the service-view, LLM, and HTTP-route features proper conceptual homes. Both surface changes landed in v3.0.0 roughly two days before this release with effectively no adoption, so they are corrected now, cleanly, rather than carried forward. Neither | High | 7/8/2026 |
| v2.6.0 | ## Capability-aware version resolution, and Java reaches feature parity with Python on the MeshJob and `@mesh.llm` contracts. v2.5 hardened the platform; v2.6 sharpens two contracts. The registry now resolves a dependency to the **highest version** that satisfies the consumer's constraint — turning the `version` field from an undefined tiebreaker into a real, semver-aware selector. Alongside it, the Java runtime closes its remaining gaps with Python: a `task=true` MeshJob producer can now dec | High | 6/29/2026 |
| v2.5.0 | ## Operational hardening across the whole stack — settling-window dependency grace, a coordinated five-codebase audit, and Helm chart maturity. v2.4 matured the `@mesh.llm` contract; v2.5 hardens the platform around it. The headline is the settling-window dependency grace: calls arriving during agent startup wait for topology to settle instead of failing instantly on a not-yet-resolved dependency — across all three runtimes. Around it, a coordinated audit of all five codebases (Python, TypeSc | High | 6/13/2026 |
| v2.4.0 | ## LLM contract maturity across the polyglot trilogy — `response_model`, server-enforced structured output, and Java `@mesh.llm` parity. v2.3 completed the MeshJob lifecycle surface; v2.4 turns to the `@mesh.llm` contract. The schema the model is asked to emit is now cleanly separable from a tool's own return type, structured output is enforced natively by the provider instead of a brittle re-prompt fallback, and Java's `@mesh.llm` reaches feature parity with Python and TypeScript. Spring use | High | 6/4/2026 |
| v2.3.0 | ## v2.3.0 (2026-05-23) Lifecycle facades across the polyglot trilogy + unified dependency-injection contract. v2.2 introduced the MeshJob substrate; v2.3 completes the lifecycle surface so callers that hold only a `job_id` can drive cancel / status / wait through DDDI-clean module-level facades — the same shape `post_event` and `subscribe_events` already had. The DI rules for `McpMeshTool` and `MeshJob` parameters are unified under a single positional contract, eliminating a silent wrong-proxy | High | 5/23/2026 |
| v2.2.4 | ## v2.2.4 (2026-05-21) Cross-loop affinity fix for v2.2 adopters using FastAPI lifespan patterns. Apps that create loop-bound resources (`asyncpg.Pool`, `redis.asyncio.Redis`, `aiohttp.ClientSession`) in `lifespan` startup and use them from tool bodies hit "Future attached to a different loop" errors in v2.2.0 — the documented `MCP_MESH_TOOL_WORKERS=1` "escape hatch" did not actually solve it. v2.2.4 fixes the topology so standard FastAPI patterns work as expected. ### 🪢 Loop topology fix (#1 | High | 5/21/2026 |
| v2.0.0 | ## The 2.x major release. Two new flagship surfaces — **MeshJob** (a registry-backed substrate for long-running tasks across the mesh) and **A2A v1.0** (cross-runtime Agent-to-Agent protocol bridge, both producer and consumer sides) — plus a **schema registry** that makes capability matching type-safe across Python, TypeScript, and Java with cross-runtime hash equality. The LLM provider stack moves from direct-mode SDK calls to mesh-delegated providers backed by native vendor SDKs (Anthropic, | High | 5/14/2026 |
| v1.4.1 | Reliability + provider expansion. The marquee item is a clean-cutover redesign of meshctl's process lifecycle that eliminates a class of bugs around orphaned registry/UI servers, same-name agent re-starts, and watch-mode races. Vertex AI joins the LLM provider lineup across all three runtimes with IAM-based auth instead of API keys. Python and TypeScript agents no longer have their health endpoints blocked by long-running tool calls (k8s pod-restart fix). Claude structured output goes HINT-first | High | 4/28/2026 |
| v1.3.4 | ### Hardening + Spring AI M4. - Closes an audit-derived security pass (registry agent_id validation, header-propagation allowlist tightened from prefix-by-default to exact match, TLS auto fail-fast, proxy error sanitization), error-visibility improvements across Python/Java SDKs, meshctl signal handler leak fix, and stale doc/version cleanups. Spring AI upgraded to 2.0.0-M4 — brings the Java integration suite to parity, 5 previously-disabled Java tests re-enabled. | High | 4/18/2026 |
| v1.3.3 | Release v1.3.3 | High | 4/16/2026 |
| v1.3.2 | ### Patch release. - Agent `name` and `agent_id` are now distinct fields across Python, TypeScript, and Java SDKs — previously all three collapsed `name == agent_id`, making replicas behind a K8s Service indistinguishable. The topology dashboard now groups replicas of the same base name into a single node with a ×N badge and an accordion drawer for per-replica details. meshctl `list` / `call` / `status` display and filter by full agent ID so replicas are individually addressable; registry `/pr | High | 4/15/2026 |
| v1.3.1 | ### Patch release. - Tutorial download artifacts (zips, tutorial-complete.html/txt) now generate and deploy in CI (#775). - Version bump script refactored to a handler-based design — catches 363 files per bump vs 184 previously, eliminating the manual cleanup toil from #753. | High | 4/14/2026 |
| v1.3.0 | ### Reliability and production-readiness release. meshctl stop works reliably across all scenarios, timeouts propagate through multi-hop agent chains, and the TripPlanner tutorial ships end-to-end from first agent to production deployment. ### 🔗 X-Mesh-Timeout Propagation - **Header propagation across all SDKs** (#769): Python/TypeScript/Java SDKs set and propagate `X-Mesh-Timeout` header on outgoing mesh calls. Multi-hop LLM chains (gateway → planner → specialist → provider) now respect | High | 4/14/2026 |
| v1.2.0 | Observability and dashboard reliability release. Distributed tracing now works end-to-end across all runtimes, the dashboard is faster and lighter, and SQLite stability is improved. ### Observability - **Fix parent_span linkage** (#745): Python `ExecutionTracer` was publishing all spans as root spans, breaking cross-agent edge detection. Per-Edge Traffic and Total Calls now work correctly on the dashboard - **Total Calls metric** (#745): Counts every finalized trace once (single-agent and | High | 4/9/2026 |
| v1.1.0 | The dashboard release. Real-time monitoring, parallel tool execution, per-service TLS, and production-grade Kubernetes deployment with Helm charts. ### 🖥️ Web Dashboard - **Dashboard UI** (#665, #668, #669, #673, #677, #695): Real-time agent monitoring with 5 pages — Dashboard overview (stats, traffic, events), Agents (table with capabilities), Topology (dependency graph), Traffic (per-edge metrics, token usage, latency), and Live (trace streaming) - **Docker image** (`mcpmesh/ui`) (#722 | High | 4/5/2026 |
| v1.1.0-beta.6 | Release v1.1.0-beta.6 | Medium | 4/5/2026 |
| v1.1.0-beta.5 | Release v1.1.0-beta.5 | Medium | 4/5/2026 |
| v1.1.0-beta.4 | Release v1.1.0-beta.4 | Medium | 4/4/2026 |
| v1.1.0-beta.3 | Release v1.1.0-beta.3 | Medium | 4/2/2026 |
| v1.1.0-beta.2 | Release v1.1.0-beta.2 | Medium | 4/2/2026 |
| v1.1.0-beta.1 | Release v1.1.0-beta.1 | Medium | 4/1/2026 |
| v1.0.1 | ### ✨ New Features - **download_media API** (#660): Added `mesh.download_media(uri)` / `downloadMedia(uri)` / `MeshMedia.downloadMedia(uri, store)` across all three SDKs for reading media back from MediaStore ### 🐛 Bug Fixes - **Registry proxy timeout** (#657): `meshctl call --timeout` now propagates to the registry proxy via `X-Mesh-Timeout` header (was hardcoded 60s, capped at 600s) - **Helm scaffold env/secrets override** (#660): Commented out `env: []` and `secrets: []` in scaffol | Medium | 3/29/2026 |
| v1.0.0 | The first stable release of MCP Mesh. This milestone brings production-grade security with mutual TLS everywhere, first-class multimodal/media support across all three SDKs, and provider-side tool execution for single-round-trip agentic workflows. ### 🔒 Security & Trust - **Registration Trust — Phase 1** (#599): Registry validates agent identity via X.509 certificates before allowing registration. Entity-level trust model with pluggable trust backends (LocalCA, FileStore, K8s Secrets, SPI | Medium | 3/25/2026 |
| v1.0.0-beta.3 | Release v1.0.0-beta.3 | Medium | 3/24/2026 |
| v1.0.0-beta.2 | Release v1.0.0-beta.2 | Medium | 3/23/2026 |
| v1.0.0-beta.1 | Release v1.0.0-beta.1 | Low | 3/22/2026 |
| v0.9.12 | Provider-side tool execution, Gemini support | Low | 3/15/2026 |
| v0.9.11 | multi-function LLM provider_proxy loss — additive tool updates | Low | 3/10/2026 |
| v0.9.10 | ### 🐛 Bug Fixes - **Python SDK — LLM agent injector KeyError crash for filtered agents ** | Low | 3/10/2026 |
| v0.9.9 | ### 🐛 Bug Fixes - **Java SDK — Flat trace spans in Grafana** (#595): Java agent traces appeared flat — all downstream agent spans at the same level under the handler span — while Python and TypeScript showed proper nested hierarchy. Added `proxy_call_wrapper` intermediate spans around outgoing tool/proxy calls in `McpMeshToolProxy.call()` and `ToolInvoker.invokeLocal()`, matching the span nesting behavior of Python and TypeScript SDKs. Also added `TraceContext.wrapSupplier()` for async trace | Low | 3/5/2026 |
| v0.9.8 | ### 🐛 Bug Fixes - **Java SDK — Orphan spans in trace graph** (#589): `TraceInfo.forPropagation()` generated a phantom spanId when no parent span was provided (e.g., `meshctl call --trace`), creating a span reference that was never published — downstream spans appeared as orphans with no root. Removed phantom generation so the first tool span is correctly a root span - **Java SDK — Header propagation returning empty `{}`** (#589): `MeshMcpServerConfiguration` used default `immediateExecution | Low | 2/22/2026 |
| v0.9.7 | ### ✨ New Features - **Language-agnostic Helm chart** (#580): `mcp-mesh-agent` chart now supports Python, TypeScript, and Java agents natively — added `agent.runtime` field and `isPython` helper for conditional Python env var injection; removed dead `agent.script` and `agent.python` fields; rewrote README with multi-language examples - **Arbitrary namespace support** (#579): Helm charts deploy into any namespace — replaced hardcoded FQDN hostnames with short names, added `networkPolicy.allow | Low | 2/22/2026 |
| v0.9.6 | New Features - Per-call custom headers (#575): Inject headers like x-audit-id on individual tool invocations across all three SDKs — tool(headers={"x-audit-id": "abc"}) (Python), tool({}, { headers }) (TypeScript), tool.call(args, headers) (Java). Per-call headers merge with session-propagated headers (per-call wins). Improvements - Header allowlist prefix matching (#575): MCP_MESH_PROPAGATE_HEADERS now uses case-insensitive prefix matching — x-audit matches x-audit-id, x-audit | Low | 2/19/2026 |
| v0.9.5 | ### ✨ New Features - **Java SDK — `/health` endpoint** (#561): Added `GET` and `HEAD` `/health` endpoint to Java SDK for parity with Python and TypeScript runtimes ### 🔧 Improvements - **Header propagation decoupled from distributed tracing** (#564): `MCP_MESH_PROPAGATE_HEADERS` now works across all SDKs (Python, Java, TypeScript) even when tracing is disabled — previously gated behind `MCP_MESH_DISTRIBUTED_TRACING_ENABLED`, silently dropping custom headers (auth tokens, tenant IDs) - | Low | 2/18/2026 |
| v0.9.4 | ### 🐛 Bug Fixes - **Java SDK — `List<Record>` @Param deserialization** (#548) - `@MeshTool` methods accepting `List<Record>` parameters (e.g., `List<TeamMember>`) received `List<LinkedHashMap>` at runtime due to Java type erasure — `MeshToolWrapper.ParamInfo` stored erased `Class<?>` instead of the full generic `Type` from `Method.getGenericParameterTypes()`; switched to `Type` and used Jackson `TypeFactory.constructType()` for proper parameterized type deserialization | Low | 2/11/2026 |
| v0.9.3 | ### 🐛 Bug Fixes - **Java SDK — JavaTimeModule and isError guard in McpHttpClient** (#544) - `MeshMcpServerConfiguration` lacked `JavaTimeModule` — `@MeshTool` methods returning `java.time` types (`LocalDate`, `LocalTime`, `LocalDateTime`) threw `InvalidDefinitionException`; registered `JavaTimeModule` with `WRITE_DATES_AS_TIMESTAMPS=false` so java.time types serialize as ISO-8601 strings - `McpHttpClient.deserializeResult()` didn't check the MCP `isError` flag before attempting typed d | Low | 2/10/2026 |
| v0.9.2 | ### 🐛 Bug Fixes - **meshctl start -w — Go fsnotify watch mode** (#533) - Replaced buggy bash-based watch mode with Go-native `AgentWatcher` using fsnotify, eliminating infinite restart cycles for Java agents and removing `watchfiles` pip dependency for Python - Event-driven file watching with debounce, process group termination, and automatic subdirectory watching — compiled into meshctl with zero runtime dependencies - TypeScript unchanged (`tsx --watch` works natively) - **Java | Low | 2/10/2026 |
| v0.9.1 | ### 🐛 Bug Fixes - **Release pipeline — PyPI indexing wait** (#526) - Docker builds could fail due to a race condition where `mcp-mesh-core` or `mcp-mesh` packages weren't indexed on PyPI yet when `pip install` ran - Added PyPI indexing wait steps to `publish-rust-core` and `publish-python` jobs, completing registry wait coverage for all 5 published packages (PyPI, npm, Maven Central) - **meshctl scaffold — missing Java FreeMarker template** (#528) - `meshctl scaffold --lang java | Low | 2/8/2026 |
| v0.9.0 | ### ✨ New Features - **Java SDK — Full Runtime Support** (#491) - New `mcp-mesh-spring-boot-starter` built on Spring Boot 4.0.2 + Spring AI 2.0.0-M2 - Java agents participate as tool agents, LLM consumers, and LLM providers - Full cross-runtime interoperability (Java ↔ Python ↔ TypeScript) - Spring Boot auto-configuration for mesh registration, heartbeat, and discovery - MCP protocol support (tool listing, invocation, prompt handling) - Mesh delegation with `@MeshLlmProvider | Low | 2/8/2026 |
| v0.9.0-beta.11 | Release v0.9.0-beta.11 | Low | 2/6/2026 |
| v0.9.0-beta.10 | Release v0.9.0-beta.10 | Low | 2/4/2026 |
| v0.9.0-beta.9 | Release v0.9.0-beta.9 | Low | 2/4/2026 |
| v0.9.0-beta.8 | Release v0.9.0-beta.8 | Low | 2/4/2026 |
| v0.9.0-beta.7 | Release v0.9.0-beta.7 | Low | 2/4/2026 |
| v0.9.0-beta.6 | Release v0.9.0-beta.6 | Low | 2/4/2026 |
| v0.9.0-beta.5 | Release v0.9.0-beta.5 | Low | 2/4/2026 |
| v0.9.0-beta.4 | Release v0.9.0-beta.4 | Low | 2/4/2026 |
| v0.9.0-beta.3 | Release v0.9.0-beta.3 | Low | 2/4/2026 |
| v0.9.0-beta.2 | Release v0.9.0-beta.2 | Low | 2/4/2026 |
| v0.9.0-beta.1 | v0.9.0-beta.1 | Low | 2/4/2026 |
| v0.8.1 | ### 🔧 Improvements - **TypeScript SDK - MESH*LLM*\* environment variables** (#484) - `MESH_LLM_PROVIDER`: Override LLM provider (direct mode only) - `MESH_LLM_MODEL`: Override model at runtime - `MESH_LLM_MAX_ITERATIONS`: Override max iterations - `MESH_LLM_FILTER_MODE`: Override tool filter mode - **Python 3.13/3.14 support** (#485) - Updated pyproject.toml classifiers - Release workflow now builds wheels for Python 3.14 - Added scaffold test matrix (tc04-tc07) for l | Low | 1/29/2026 |
| v0.8.0 | ### ✨ New Features - **Full TypeScript SDK** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - Express integration via `mesh.route()` for dependency injection (#396) - LLM agent support with `mesh.llm()` and provider plugin architecture (#398, #400) - Vercel AI SDK v6 compatibility (#412) - meshctl TypeScript support - start, watch, and manage TS agents (#406) - **Gemini (Google AI) support** - New LLM provider alongside Claude/OpenAI (#416) ### 🔧 Improvements
| Low | 1/28/2026 |
| v0.8.0-beta.9 | ## v0.8.0-beta.9 (2026-01-20) ### 🎯 TypeScript SDK (Major) - **Full TypeScript support** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - **Rust core runtime** for multi-language FFI support (#388, #394) - **Express integration** via `mesh.route()` for dependency injection (#396) - **LLM agent support** with `mesh.llm()` and provider plugin architecture (#398, #400) - **Vercel AI SDK v6 compatibility** (#412) - **meshctl TypeScript support** - start, watch, and manage | Low | 1/20/2026 |
| v0.8.0-beta.8 | ### 🎯 TypeScript SDK (Major) - **Full TypeScript support** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - **Rust core runtime** for multi-language FFI support (#388, #394) - **Express integration** via `mesh.route()` for dependency injection (#396) - **LLM agent support** with `mesh.llm()` and provider plugin architecture (#398, #400) - **Vercel AI SDK v6 compatibility** (#412) - **meshctl TypeScript support** - start, watch, and manage TS agents (#406) ### ✨ New Fe | Low | 1/19/2026 |
| v0.8.0-beta.7 | ### 🎯 TypeScript SDK (Major) - **Full TypeScript support** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - **Rust core runtime** for multi-language FFI support (#388, #394) - **Express integration** via `mesh.route()` for dependency injection (#396) - **LLM agent support** with `mesh.llm()` and provider plugin architecture (#398, #400) - **Vercel AI SDK v6 compatibility** (#412) - **meshctl TypeScript support** - start, watch, and manage TS agents (#406) ### ✨ New Fe | Low | 1/19/2026 |
| v0.8.0-beta.6 | ### 🎯 TypeScript SDK (Major) - **Full TypeScript support** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - **Rust core runtime** for multi-language FFI support (#388, #394) - **Express integration** via `mesh.route()` for dependency injection (#396) - **LLM agent support** with `mesh.llm()` and provider plugin architecture (#398, #400) - **Vercel AI SDK v6 compatibility** (#412) - **meshctl TypeScript support** - start, watch, and manage TS agents (#406) ### ✨ New Fe | Low | 1/17/2026 |
| v0.8.0-beta.5 | ### 🎯 TypeScript SDK (Major) - **Full TypeScript support** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - **Rust core runtime** for multi-language FFI support (#388, #394) - **Express integration** via `mesh.route()` for dependency injection (#396) - **LLM agent support** with `mesh.llm()` and provider plugin architecture (#398, #400) - **Vercel AI SDK v6 compatibility** (#412) - **meshctl TypeScript support** - start, watch, and manage TS agents (#406) ### ✨ New Fe | Low | 1/17/2026 |
| v0.8.0-beta.4 | ### 🎯 TypeScript SDK (Major) - **Full TypeScript support** with `@mcpmesh/sdk` npm package (#391, #398, #400, #403, #406) - **Rust core runtime** for multi-language FFI support (#388, #394) - **Express integration** via `mesh.route()` for dependency injection (#396) - **LLM agent support** with `mesh.llm()` and provider plugin architecture (#398, #400) - **Vercel AI SDK v6 compatibility** (#412) - **meshctl TypeScript support** - start, watch, and manage TS agents (#406) ### ✨ New Fe | Low | 1/17/2026 |