v1.5.0

🎉 Welcome to the 1.5.0 release of the agentgateway project!

This release expands agentgateway across LLM, agent, and general-purpose traffic. Highlights include API-key-scoped LLM budgets, native Gemini inbound APIs, Anthropic Messages to OpenAI Responses conversion, deeper Agent Substrate integration, SPIFFE Workload API identities, and richer dynamic forward proxy and TCP support. Guardrails can now cover tool calls and use OpenAI inline moderation, while the UI, traces, logs, metrics, and `agctl` provide a much clearer view of multi-turn agent activity and policy callouts.

## Artifacts

Docker images are available:

* `cr.agentgateway.dev/agentgateway:v1.5.0`
* `cr.agentgateway.dev/controller:v1.5.0`

Helm charts are available:

* `cr.agentgateway.dev/charts/agentgateway:v1.5.0`
* `cr.agentgateway.dev/charts/agentgateway-crds:v1.5.0`
* `cr.agentgateway.dev/charts/agentgateway-standalone:v1.5.0`

Binaries are available below.

## Quick Start

Follow the [Kubernetes](https://agentgateway.dev/docs/kubernetes/latest/quickstart/) or [Standalone](https://agentgateway.dev/docs/standalone/latest/quickstart/) quick start guide to get started.

## 🔥 Breaking changes

### LLM token counts now include prompt-cache tokens

Agentgateway now normalizes LLM usage across providers: `llm.inputTokens` includes cache-read and cache-creation tokens, and `llm.totalTokens` is that normalized input count plus output tokens. The new `llm.providerInputTokens` and `llm.providerTotalTokens` fields preserve the provider's original values. This changes access logs, spans, metrics, token-based rate limits, and CEL expressions for Anthropic, Bedrock, and other providers that exclude cached tokens from their reported input count; cost calculation is unchanged.

Review token-based limits and dashboards before upgrading. As a temporary migration aid, set `AGENTGATEWAY_LEGACY_LLM_USAGE_TOKEN_SEMANTICS=true` to restore the previous behavior. This compatibility setting is planned for removal after 1.5.

### JWT issuer and audience claims are now required when configured

JWT authentication now requires an `iss` claim that matches the configured issuer. When a non-empty audience list is configured, the token must also contain a matching `aud` claim. Setting `requiredClaims` to an empty list no longer disables these requirements; it only removes additional claim requirements beyond those implied by the issuer and audiences.

Review JWTs issued to clients before upgrading, especially tokens that previously omitted `iss` or `aud`. For more information, see the [Kubernetes JWT authentication](https://agentgateway.dev/docs/kubernetes/main/security/jwt/) and [Standalone JWT authentication](https://agentgateway.dev/docs/standalone/main/configuration/security/jwt-authn/) docs.

### Backend and attached LLM policies now merge field by field

An AI policy defined directly on an `AgentgatewayBackend` now merges field by field with an attached `AgentgatewayPolicy`. Previously, the backend policy replaced the complete attached AI policy block. This fixes attached prompt guards, defaults, transformations, model aliases, and prompt caching being silently dropped, but configurations that relied on full replacement must be updated.

### Cross-namespace route delegation requires a ReferenceGrant

Cross-namespace Route-to-Route delegation now requires a `ReferenceGrant` from the child route's namespace. Add the grant before upgrading or the delegation will no longer be accepted. For more information, see [route delegation](https://agentgateway.dev/docs/kubernetes/latest/traffic-management/route-delegation/) and [TODO]().

### Managed API key metadata uses the `agentgateway.dev/` prefix

For standalone API keys created through the admin UI or API, the key ID moved from `metadata.id` to `metadata["agentgateway.dev/id"]`, and a new `metadata["agentgateway.dev/createdAt"]` field records creation time. User-supplied metadata under the reserved `agentgateway.dev/` prefix is now rejected. Update integrations that read or write these fields.

### Legacy Istio identity TLV support has been removed

Agentgateway no longer emits the special Istio identity TLV that was intended for a ztunnel "sidecar". Use agentgateway's native mTLS support for workload identity. Deployments that still require the sandwich topology can continue to pass traffic, but no longer receive identity through this TLV.

## 🌟 New features

### API-key-scoped budgets and model access

Standalone deployments can assign rolling token or dollar budgets to individual API keys. A budget can block requests or audit an overage, and its state is persisted to SQLite or PostgreSQL and can be viewed and managed in the UI. API keys can also restrict which models a caller is authorized to use. Budgets require hybrid storage mode.

<img width="1487" height="1608" alt="2026-08-27_10-50-48" src="https://github.com/user-attachments/assets/ea207d6c-5ff5-4ae4-95c4-cd664ea19e65" />
<img width="3146" height="696" alt="2026-08-27_10-50-31" src="https://github.com/user-attachments/assets/ee69793c-efa2-4842-903f-dd9c845fcec6" />


### Better LLM log views

LLM request logs now include in-depth request and response details, such as tool calls, reasoning, token usage, and request trajectory.

<img width="3282" height="1482" alt="2026-08-27_10-51-18" src="https://github.com/user-attachments/assets/5074fc65-22a4-411e-ac84-96a7d2302c23" />


### Native Gemini APIs and broader format conversion

Clients using Gemini and Vertex SDKs can now call agentgateway through the native `generateContent`, streaming `streamGenerateContent`, and `countTokens` APIs.

Agentgateway can also translate Anthropic Messages requests to OpenAI Responses backends, including buffered and streaming text, images, function tools, structured output, usage, finish reasons, and error mapping. This makes Responses-only providers available to clients that speak the Anthropic Messages API. For provider configuration, see the [Kubernetes](https://agentgateway.dev/docs/kubernetes/main/llm/providers/) and [Standalone](https://agentgateway.dev/docs/standalone/main/llm/providers/) LLM provider docs.

Additional LLM improvements include:

* Amazon Nova multimodal embeddings on Bedrock and Cohere v4 embeddings on Bedrock.
* OpenAI Responses routing for GitHub Copilot Grok models.
* Translation of OpenAI prompt-cache markers to Anthropic and Bedrock formats.
* Vertex AI `gemini-embedding-2` and later models routed through `:embedContent`.
* Final transformations that run after provider format conversion.

### Guardrails for tool calls and OpenAI inline moderation

Regex prompt guards can opt in to scanning system prompts, messages, tool inputs, and tool outputs independently. This allows sensitive data and policy violations inside tool arguments or results to be detected without indiscriminately scanning every part of a request.

OpenAI providers can also inject OpenAI inline moderation into Chat Completions and Responses requests. Gateway configuration takes precedence over client-supplied moderation settings so clients cannot weaken the policy. For more information, see the [Kubernetes](https://agentgateway.dev/docs/kubernetes/main/llm/guardrails/) and [Standalone](https://agentgateway.dev/docs/standalone/main/llm/prompt-guards/) guardrail docs.

### Dynamic forwarding, TCP, and policy backend URLs

Dynamic backends now support TCP traffic, CONNECT tunneling through another proxy, and an optional CEL target expression. Forward proxy authentication supports `Proxy-Authorization` and returns the expected `407 Proxy Authentication Required` response on authentication failures. Backend connect timeout policy is now implemented end to end in both the proxy and controller.

Kubernetes policy callouts can use an inline URL instead of requiring an intermediate Service or `AgentgatewayBackend`. This applies to remote JWKS, tracing, OTLP access logs, external authorization, external processing, remote rate limiting, and backend tunnel proxies. HTTPS URLs automatically receive the corresponding inline backend TLS configuration.

Network-level external authorization is also available for connection-oriented traffic. For more information, see [dynamic forward proxy](https://agentgateway.dev/docs/kubernetes/main/traffic-management/dfp/) and the [Kubernetes API reference](https://agentgateway.dev/docs/kubernetes/main/reference/api/).

### SPIFFE identities and backend authentication

Agentgateway can source its mTLS identity and trust bundle directly from the SPIFFE Workload API. The same rotating SVID can terminate frontend mTLS and authenticate outbound backend connections, while `source.spiffeId` exposes the authenticated identity to CEL policies. Startup fails closed if SPIFFE is enabled but an identity cannot be obtained.

Backend authentication can now mint a fresh short-lived JWT for each request, supporting key-pair JWT upstreams such as the Snowflake SQL API. JWT passthrough can optionally preserve the original token, backend authentication secrets reload when their files change, and `AgentgatewayPolicy` backend TLS can reference CA bundles in Secrets as well as ConfigMaps.

Cross App Access and OAuth token exchange can now configure scopes independently for each exchange leg, accept a configurable subject token type, and omit `requested_token_type` when an authorization server requires the RFC 8693 default behavior.

Other security and identity improvements include:

* Configurable sensitive request headers are redacted from trace and debug output, including headers created by CEL transformations.
* The controller Helm chart can optionally reduce cluster-wide permissions to read-only for most workload resources and scope write access to configured gateway namespaces. Existing cluster-wide write access remains the default.

### Routing, rate limiting, and policy enhancements

This release expands routing and policy controls:

* Session affinity: A CEL expression can derive a session key from request data and consistently route requests with the same key to the same endpoint. Selection is deterministic across gateway replicas and does not require shared session state.
* Rate limiting: Kubernetes local rate limiting can apply multiple limits to a request. Remote rate limit descriptors can use a CEL-based `limitOverride` to calculate a different limit for each request.
* Dynamic backend selection: A CEL expression can select the destination of a dynamic backend from request attributes or external-processing metadata, avoiding the need to rewrite the request authority.
* Backend connection timeouts: Backend connect timeouts can now be configured per backend.

### Observability and operations

Distributed traces now include outbound spans for the upstream request and each policy callout, including external authorization, external processing, rate limiting, guardrails, and token exchange.

Metrics endpoints support Prometheus protobuf negotiation, and an opt-in native histogram mode is available. Standalone database access logging can explicitly store either LLM metadata or full prompt and completion content. LLM access logs include token timing and the matched prompt-guard pattern. `agctl proxy profile` can collect CPU and heap pprof profiles from a proxy.

The UI includes a rebuilt logs view, clearer multi-turn conversation rendering, tool call and result details, trajectory visualization, and a read-only storage mode that disables UI and API writes. Standalone can also reload file-backed backend authentication secrets without a restart.

## 🪲 Notable fixes

* Fixed dynamic listener port swaps without requiring a restart.
* Fixed AgentgatewayModel authorization on failover routes and InferencePool policy resolution for AI provider backends.
* Fixed Bedrock virtual models using the untransformed model in the upstream path.
* Fixed Bedrock streaming indexes, `top_k` translation, invalid function inputs, image URL handling, and preservation of guardrail request structure.
* Fixed Gemini usage extraction from Cloud Code response envelopes and preserved parallel tool calls across Gemini and Chat Completions conversions.
* Fixed Anthropic streaming input usage, first-delta roles, thinking budget bounds, and server-tool error handling.
* Fixed OpenAI file content conversion on the Vertex Gemini path and empty tool arguments in multi-turn requests.
* Fixed MCP discovery failures being hidden by `failOpen`, authorization issuer metadata rewriting, upstream trace context, and routing of client responses to server-initiated requests.
* Fixed A2A path and interface URL rewrites and added response telemetry for A2A v1.0 nested payloads.
* Fixed local API-key policy updates when file-mode keys are omitted.
* Fixed policy status when a target reference names a missing `sectionName`.
* Fixed rate-limited responses so they consistently include `x-ratelimit` headers.
* Fixed upstream connection duration precision and retained full LLM proxy error phase information.
* Fixed the UI analytics summary request loop and CEL playground routing when the UI is exposed through a gateway.

## Contributors

Thank you to everyone who contributed code, reviews, documentation, bug reports, and CI improvements for this release!

See the full contributor list below.

## What's Changed
* auth: add jwtSign backend auth for keypair-JWT upstreams by @yordis in https://github.com/agentgateway/agentgateway/pull/2515
* feat(copilot): route Grok models through the Responses API by @iandvt in https://github.com/agentgateway/agentgateway/pull/2766
* chore: add max length to ttl policy field by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2782
* llm: return the original golden tests by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2783
* listener/tls: add authority key ID to dynamic CA certificates by @shashankram in https://github.com/agentgateway/agentgateway/pull/2786
* bump rmcp to 3.1.0 by @filintod in https://github.com/agentgateway/agentgateway/pull/2788
* llm: parse requests in golden tests by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2787
* bedrock: Consistently image URLs across input types by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2791
* vertex gemini: proper xhigh budget by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2792
* Add AgentgatewayModel status reconciliation by @danehans in https://github.com/agentgateway/agentgateway/pull/2794
* Fix invalid header modifications by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2775
* bedrock: handle invalid function inputs by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2771
* config: drop MODEL_CATALOG_PATHS env var by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2772
* docs: fix prompt guard webhook target examples by @nnennandukwe in https://github.com/agentgateway/agentgateway/pull/2796
* llm: make responses instructions golden actually use instructions by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2795
* Stop bind if it transitions to internal bind by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2735
* llm: preserve truncated tool calls by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2776
* auth: fix examples for explicit OAuth subject tokens by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2777
* api: remove deadcode type by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2800
* llm: capture tool calls for all provider paths by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2793
* llm: fix invalid max_token req case by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2802
* llm: retain parallel tool calls for gemini<-->completions by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2801
* llm: support cohere v4 embedding on bedrock by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2820
* feat(loadbalancer): CEL-based stateless session persistence by @fengxsong in https://github.com/agentgateway/agentgateway/pull/2779
* build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /ui in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/agentgateway/agentgateway/pull/2824
* llm: move more tests to goldens; recommend agents do the same by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2822
* merge ai policy from AI backends with attached policies by @stevenctl in https://github.com/agentgateway/agentgateway/pull/2821
* Add support for listenerset postrouting policies by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2739
* config: respect XDG_CONFIG_HOME by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2823
* Fix initial model catalog refresh by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2830
* llm: don't 503 the whole request when an Anthropic server tool is pre… by @sj-louw in https://github.com/agentgateway/agentgateway/pull/2804
* fix(llm): preserve buffered responses metadata by @iandvt in https://github.com/agentgateway/agentgateway/pull/2828
* Test `Programmed` defaults for rejected Gateways by @johananl in https://github.com/agentgateway/agentgateway/pull/2527
* chore:Fix incorrect code comment by @keithmattix in https://github.com/agentgateway/agentgateway/pull/2829
* feat(cel): allow error types to be serialized to strings without potentially-private details by @charles-dyfis-net in https://github.com/agentgateway/agentgateway/pull/2836
* llm: misc responses conversion correctness fixes by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2842
* gemini: avoid filler text on tool call turns by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2832
* perf(cel): avoid unnecessary materialize for Dynamic objects during has() by @charles-dyfis-net in https://github.com/agentgateway/agentgateway/pull/2835
* Add pod labels to standalone Helm chart by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2844
* Register all request policies for CEL by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2845
* chore(api): convert PolicyConditionType/Reason to string type aliases by @dongjiang1989 in https://github.com/agentgateway/agentgateway/pull/2815
* examples: add tier-aware semantic routing by @danehans in https://github.com/agentgateway/agentgateway/pull/2789
* auth: consolidate duplicated jwtSign / oauth token exchange code by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2763
* proxy: make route policy application more consistent by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2846
* crypto: add crypto module by @jgreeer in https://github.com/agentgateway/agentgateway/pull/2737
* llm: append [DONE] on chat -> anthropic flow by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2843
* build(deps): bump cryptography from 49.0.0 to 50.0.0 in /examples/traffic-a2a/strands-agents in the uv group across 1 directory by @dependabot[bot] in https://github.com/agentgateway/agentgateway/pull/2847
* Import LiteLLM centralized credentials by @danehans in https://github.com/agentgateway/agentgateway/pull/2797
* llm: refactor guardrails by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2848
* ui: fix placeholder example by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2852
* fix(config): fail startup when a static local bind cannot be opened by @piyushbag in https://github.com/agentgateway/agentgateway/pull/2588
* llm: retain better HTTP error code for errors by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2850
* 🤖  Fix :authority mutation no-op for CONNECT requests by @keithmattix in https://github.com/agentgateway/agentgateway/pull/2851
* fix: send x-ratelimit headers on all rate limited responses by @jgreeer in https://github.com/agentgateway/agentgateway/pull/2661
* Add h2c inference routing tests by @danehans in https://github.com/agentgateway/agentgateway/pull/2315
* jwt sign: misc followups from review by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2849
* llm: support OpenAI inline moderation by @GuruduGanesh in https://github.com/agentgateway/agentgateway/pull/2519
* feat(cli): add agctl pprof profile command by @abhinavgautam01 in https://github.com/agentgateway/agentgateway/pull/2110
* feat(cel): Allow function call signature access for static checking by @charles-dyfis-net in https://github.com/agentgateway/agentgateway/pull/2855
* llm: skip encoding model id by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2857
* cel: add LLM cost class helper by @mukeshbaphna in https://github.com/agentgateway/agentgateway/pull/1975
* Move off deprecated fetch_update by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2859
* llm: route count tokens endpoint by default by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2858
* llm: cap anthropic thinking budget by max tokens by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2856
* controller: properly handle conflicts on internal GW/ListenerSet by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2699
* Initial fuzzing by @howardjohn in https://github.com/agentgateway/agentgateway/pull/1853
* bedrock: correct top_k translation by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2860
* fix(llm): extract Gemini usage from Cloud Code's `response` envelope by @liorbenita2 in https://github.com/agentgateway/agentgateway/pull/2813
* build(deps): bump the cargo group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/agentgateway/agentgateway/pull/2862
* AgentgatewayModel: properly configure authorization for failover by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2861
* feat: use system theme as default by @guenhter in https://github.com/agentgateway/agentgateway/pull/2683
* Followups to session affinity by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2825
* controller: expose remote rate-limit limitOverride by @FenjuFu in https://github.com/agentgateway/agentgateway/pull/2839
* support inline URL policy backends by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2125
* examples: fix mcp-multiplex time target failing to start by @kristin-kronstain-brown in https://github.com/agentgateway/agentgateway/pull/2873
* controller: CEL validate that ports are numbers by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2872
* Attempt to make copilot review less annoying by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2869
* e2e: fix slow frontendtls test by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2874
* e2e: add verbose logging of Istio libraries by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2875
* ci: speed up e2e test builds by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2878
* ci: include source in key by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2882
* Split conformance job by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2884
* bug: bedrock virtual models bypass transformed model for upstream path by @vascoccorreia in https://github.com/agentgateway/agentgateway/pull/2885
* ci: fully cache go by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2893
* ci: pull mtime script remotely instead of vendoring by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2895
* examples: add Redis semantic cache by @danehans in https://github.com/agentgateway/agentgateway/pull/2883
* api: remove redundant CEL uniqueness check on MCPBackend.targets by @GregCKrause in https://github.com/agentgateway/agentgateway/pull/2831
* ci: attempt windows build optimizations by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2899
* deps: move off gcp git dep by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2903
* e2e: avoid repeated create+delete Gateways by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2897
* build(deps): bump js-yaml from 4.3.0 to 4.3.1 in /ui in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/agentgateway/agentgateway/pull/2911
* Bump go dependencies by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2900
* ci: attempt full rust cache for windows builds too by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2898
* proxy: avoid blocking on otel drop by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2876
* ci: run e2e ui tests by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2901
* llm: expose normalized input tokens count in CEL by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2880
* Add AgentgatewayModel into config dump by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2907
* Revert "ci: run e2e ui tests" by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2913
* readd conditional validation for ext services by @nfuden in https://github.com/agentgateway/agentgateway/pull/2896
* mcp: bump backend target `MaxItems` 32 -> 128 by @GregCKrause in https://github.com/agentgateway/agentgateway/pull/2916
* feat: import LiteLLM wildcard models by @FenjuFu in https://github.com/agentgateway/agentgateway/pull/2915
* bump cel-go for scanners by @nfuden in https://github.com/agentgateway/agentgateway/pull/2902
* fix: allow requested_token_type optional for Token Exchange (RFC 8693) by @sushisnow in https://github.com/agentgateway/agentgateway/pull/2892
* feat(controller): support Secret CA refs in AgentgatewayPolicy by @jvlxz in https://github.com/agentgateway/agentgateway/pull/2868
* ci: use full cache setup for all Go jobs by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2917
* Log LLM token timing in access logs by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2920
* standalone: more explicit LLM payload logging by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2925
* ci: run ui e2e again by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2923
* ci: invalidate stale Rust workspace cache artifacts by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2928
* Fix flake in ui e2e by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2929
* backend: support a CEL target expression on dynamic backends by @keithmattix in https://github.com/agentgateway/agentgateway/pull/2908
* llm: also parse custom tool calls by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2930
* ui: better logs view by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2888
* fix(ui): support macOS hybrid save override by @iandvt in https://github.com/agentgateway/agentgateway/pull/2938
* feat(transformations): post provider conversion transformation policies by @yanir75 in https://github.com/agentgateway/agentgateway/pull/2912
* deps(ui): pin Node to 24.17.0 across CI and Docker by @iandvt in https://github.com/agentgateway/agentgateway/pull/2940
* crypto: add symcrypt provider by @jgreeer in https://github.com/agentgateway/agentgateway/pull/2909
* chore(ui): replace prettier with biome by @iandvt in https://github.com/agentgateway/agentgateway/pull/2935
* llm: support Amazon Nova multimodal embeddings on Bedrock by @sankks11 in https://github.com/agentgateway/agentgateway/pull/2934
* proxy: drop special Istio TLV by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2951
* build(ui): migrate from npm to pnpm by @iandvt in https://github.com/agentgateway/agentgateway/pull/2941
* ci: use fake keycloak for validation by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2953
* [docs] update comments for mask streaming prompt guard by @artberger in https://github.com/agentgateway/agentgateway/pull/2954
* local rate limit: support multiple limits in k8s by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2952
* fix: record upstream connect duration at full precision by @krisztianfekete in https://github.com/agentgateway/agentgateway/pull/2964
* feat: add shared Duration type to simplify CRD rules by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2950
* build(ui): make UI builds consistent across workflows by @iandvt in https://github.com/agentgateway/agentgateway/pull/2961
* deps(ui): refresh pinned dependencies by @iandvt in https://github.com/agentgateway/agentgateway/pull/2960
* Add revisionHistoryLimit and dnsConfig to the controller Helm charts by @DrFaust92 in https://github.com/agentgateway/agentgateway/pull/2972
* sec: CVE bump go 1.26.5 by @iandvt in https://github.com/agentgateway/agentgateway/pull/2974
* cel: port parser bug fix by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2970
* Scope ModelRouter to HTTPRoute by @keithmattix in https://github.com/agentgateway/agentgateway/pull/2973
* fix(mcp): route client JSON-RPC responses for server-initiated requests by @piyushbag in https://github.com/agentgateway/agentgateway/pull/2207
* fix(llm): honor final Anthropic stream input usage by @fengxsong in https://github.com/agentgateway/agentgateway/pull/2977
* fix(ui): forward LLM playground API key to MCP requests by @harukz in https://github.com/agentgateway/agentgateway/pull/2986
* fix(proxy): resolve InferenceRouting policy for AI provider_backend t… by @gaogaoSpark in https://github.com/agentgateway/agentgateway/pull/2976
* auth: configure Cross App Access subject token type by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2750
* ui: clarify Client Setup description by @danehans in https://github.com/agentgateway/agentgateway/pull/2990
* agctl trace: handle oversized copy payloads by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2997
* fix(status): surface policy targetRef sectionName missing on targets by @stevenctl in https://github.com/agentgateway/agentgateway/pull/2998
* llm: fix index on bedrock streaming by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2971
* build: mark generated Go and schema files as generated by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2999
* fix(a2a): correct interface URL rewriting when path rewrite policy is active by @dongjiang1989 in https://github.com/agentgateway/agentgateway/pull/2983
* Add ReadOnly storage mode to lock down UI/API writes by @jbohanon in https://github.com/agentgateway/agentgateway/pull/2988
* llm: set role on the first Anthropic streaming delta by @mautini in https://github.com/agentgateway/agentgateway/pull/3005
* fix: nightly builds by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3010
* report errors on invalid inline jwks by @nfuden in https://github.com/agentgateway/agentgateway/pull/2991
* Bump to go 1.26.6 by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3011
* serde: better errors for invalid JWT by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3007
* controller: lock down valid JWKS targets a bit by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3008
* policies: add network (connection) ext authz by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3016
* llm: fix "Input should be a valid dictionary" when previous turn returned empty args by @mautini in https://github.com/agentgateway/agentgateway/pull/3002
* fix(llm): classify proxy errors by phase by @shubhamojha1 in https://github.com/agentgateway/agentgateway/pull/3015
* mcp: do not mask discovery failures on failOpen mode by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3009
* jwt: require aud and iss claims by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2993
* style(ui): expand Biome formatting and enable linting by @iandvt in https://github.com/agentgateway/agentgateway/pull/2957
* Feat protobuf metrics by @SajalBharadwaj in https://github.com/agentgateway/agentgateway/pull/3027
* bedrock: guardrail mutates in place preserving original structure by @stevenctl in https://github.com/agentgateway/agentgateway/pull/3021
* proxy: allow TCP traffic to use dynamic backend by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3013
* docs: add egress proxy documentation by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3014
* controller: write InferencePool status for pools referenced via AgentgatewayModel by @Geun-Oh in https://github.com/agentgateway/agentgateway/pull/3034
* fix: reconcile listener port swaps dynamically by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3017
* feat(llm): native Gemini inbound API (generateContent, streamGenerateContent, countTokens) by @hjsauce in https://github.com/agentgateway/agentgateway/pull/2963
* feat(mcp): opt-in DNS rebinding protection for localhost Host/Origin by @piyushbag in https://github.com/agentgateway/agentgateway/pull/3022
* refactor(llm): expose stream termination to converters by @iandvt in https://github.com/agentgateway/agentgateway/pull/2994
* feat(xds): add custom request headers by @shubhamojha1 in https://github.com/agentgateway/agentgateway/pull/3052
* fix(mcp): derive upstream trace context from the gateway's active span by @stevenctl in https://github.com/agentgateway/agentgateway/pull/3059
* fix(llm): advertise the Responses format for the DeepSeek preset by @rajatvig in https://github.com/agentgateway/agentgateway/pull/3058
* fix: default file-mode apiKey policy keys to empty array on upsert by @Altamimi-Dev in https://github.com/agentgateway/agentgateway/pull/3048
* mesh: retain identity with nested TLS in HBONE by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3069
* test(e2e): make test hooks and resources configurable by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3070
* llm: defer re-encoding body by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3071
* move catalog to not just be costs by @nfuden in https://github.com/agentgateway/agentgateway/pull/2927
* Add Anthropic Messages to OpenAI Responses conversion by @haowu1234 in https://github.com/agentgateway/agentgateway/pull/2689
* fix(a2a): populate response telemetry for A2A v1.0 nested payloads and record contextId by @Jpatel86 in https://github.com/agentgateway/agentgateway/pull/3073
* cel: port 310 limit recovery by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3067
* feat: configure sensitive request headers by @shubhamojha1 in https://github.com/agentgateway/agentgateway/pull/3078
* auth: configure Cross App Access redemption scopes by @markuskobler in https://github.com/agentgateway/agentgateway/pull/2770
* fix(azure): support system-assigned managed identity by @iandvt in https://github.com/agentgateway/agentgateway/pull/3044
* deps: go 1.27 by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3086
* fix(mcp): rewrite authorization server issuer metadata by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3089
* Fix a2a path rewriting by @keithmattix in https://github.com/agentgateway/agentgateway/pull/3087
* fix(azure/managed-identity): reject multiple identity selectors by @iandvt in https://github.com/agentgateway/agentgateway/pull/3088
* release: drop unused caches by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3043
* promptGuard: opt-in tool call coverage with scope by @stevenctl in https://github.com/agentgateway/agentgateway/pull/3000
* build(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in /tools in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/agentgateway/agentgateway/pull/3090
* ui: dep bump by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3096
* tracing: add outbound span for all policy calls by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3068
* metrics: add mode to enable native histograms by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3079
* feat(llm): log which promptGuard pattern matched by @rajatvig in https://github.com/agentgateway/agentgateway/pull/3097
* dtrace: scope all outbound calls, not just ext authz by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3100
* install: limit helm roles, allow namespaced write roles by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3102
* [docs] update standalone Helm values by @artberger in https://github.com/agentgateway/agentgateway/pull/3104
* fix(util) modify convert_duration to clamp negative values to 0 by @jmcguire98 in https://github.com/agentgateway/agentgateway/pull/3103
* refactor: use simpler body logic for e2e test by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3105
* dtrace: do not exit TUI if we get truncated by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3099
* deploy: emit status on failures to write deployed objects by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3101
* controller: implement backend TCP by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3118
* delegation: require reference grant for Route<-->Route by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3110
* llm: allow limiting authorized models on an API key by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3107
* feat(auth): support forward proxy authentication via the `Proxy_Authorization` header by @ericdbishop in https://github.com/agentgateway/agentgateway/pull/3098
* fix: cache InferencePool status to suppress redundant writes by @henrichter-sap in https://github.com/agentgateway/agentgateway/pull/3116
* Bump rust to 1.98 by @nfuden in https://github.com/agentgateway/agentgateway/pull/3122
* feat: source mTLS identity from the SPIFFE Workload API by @gcosgrave in https://github.com/agentgateway/agentgateway/pull/2640
* Bump golangci lint by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3120
* Support CONNECT tunneling through dynamic proxy backends by @EItanya in https://github.com/agentgateway/agentgateway/pull/3095
* Full implement backend connect timeout policy by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3124
* ui: fix cel playground when exposed over gateway by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3138
* fix(llm): convert OpenAI file content parts on the Vertex Gemini path by @rajatvig in https://github.com/agentgateway/agentgateway/pull/3123
* feat(api): expose custom provider override by @shubhamojha1 in https://github.com/agentgateway/agentgateway/pull/3128
* Deeper Agent Substrate Integration by @keithmattix in https://github.com/agentgateway/agentgateway/pull/3051
* feat: reload backendAuth secrets when the file changes by @cbascom in https://github.com/agentgateway/agentgateway/pull/3132
* fix(ui): stop analytics summary request loop by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3140
* api keys: reserve agentgateway.dev/ metadata prefix by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3139
* schema: auto-generate metrics info by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3141
* inference routing: do not trust client header by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3144
* security: refine security policy a bit by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3072
* test: cover multiple controller installations by @danehans in https://github.com/agentgateway/agentgateway/pull/2826
* examples: add Intune client verification and compliance by @danehans in https://github.com/agentgateway/agentgateway/pull/3012
* Keep substrate in sync by @keithmattix in https://github.com/agentgateway/agentgateway/pull/3145
* ui: better conversation view by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3148
* ui: add new trajectory component by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3149
* jwt: implement preserveToken by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3106
* llm: route gemini-embedding-2 models to Vertex embedContent by @mautini in https://github.com/agentgateway/agentgateway/pull/2968
* docs: ban using examples for self-promotional content by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3151
* dtace: correlate original body snapshot time by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3150
* llm: translate openai cache markers to anthropic/bedrock by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3109
* Add API-key scoped budgets for LLM traffic by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3143
* cleanup controller Makefile by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3171
* xds: reject non-FIPS RSA key parameters when running in FIPS mode by @ymesika in https://github.com/agentgateway/agentgateway/pull/3183
* preserve latest cache control when guardrails rewrites messages by @stevenctl in https://github.com/agentgateway/agentgateway/pull/3147
* chore: update golangci-lint plugins and enable unconvert linter by @dongjiang1989 in https://github.com/agentgateway/agentgateway/pull/3160
* mcp: handle recursive schemas in openapi translation by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3154
* fix(tls/tcp over hbone): preserve hbone identity by @zac-nixon in https://github.com/agentgateway/agentgateway/pull/3156
* feat(helm): support controller topology spread constraints by @HasonoCell in https://github.com/agentgateway/agentgateway/pull/3159
* fix(pii): keep phone matches within one line by @jstar0 in https://github.com/agentgateway/agentgateway/pull/3162
* feat: support following proxy debug traces by @fengxsong in https://github.com/agentgateway/agentgateway/pull/3134
* metrics: minimal fix to return prometheus compat by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3186
* feat(llm): add detect-only mode to Bedrock Guardrails by @theagenticguy in https://github.com/agentgateway/agentgateway/pull/2349
* Improve metrics endpoint handling by @markuskobler in https://github.com/agentgateway/agentgateway/pull/3185
* controller: allow cross-namespace InferencePool backendRefs by @koba1t in https://github.com/agentgateway/agentgateway/pull/3169
* fix postgres request log schema startup locking by @howardjohn in https://github.com/agentgateway/agentgateway/pull/2931
* hbone: improve error handling by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3153
* guardrails: expose guardrails mask/rejection to cel access log by @stevenctl in https://github.com/agentgateway/agentgateway/pull/3189
* fix(ui): flag conflicting runtime listeners by @Math1987 in https://github.com/agentgateway/agentgateway/pull/2914
* fix split and nondeterministic frontend accessLog selection by @ymesika in https://github.com/agentgateway/agentgateway/pull/3199
* models: avoid naming collisions in keys by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3205
* mcp: rate limit as JSON-RPC error by @stevenctl in https://github.com/agentgateway/agentgateway/pull/3146
* Add maxConcurrentRequests and maxConnections by @howardjohn in https://github.com/agentgateway/agentgateway/pull/3201
* Substrate Refinements by @keithmattix in https://github.com/agentgateway/agentgateway/pull/3174

## New Contributors
* @nnennandukwe made their first contribution in https://github.com/agentgateway/agentgateway/pull/2796
* @charles-dyfis-net made their first contribution in https://github.com/agentgateway/agentgateway/pull/2836
* @mukeshbaphna made their first contribution in https://github.com/agentgateway/agentgateway/pull/1975
* @liorbenita2 made their first contribution in https://github.com/agentgateway/agentgateway/pull/2813
* @guenhter made their first contribution in https://github.com/agentgateway/agentgateway/pull/2683
* @FenjuFu made their first contribution in https://github.com/agentgateway/agentgateway/pull/2839
* @vascoccorreia made their first contribution in https://github.com/agentgateway/agentgateway/pull/2885
* @GregCKrause made their first contribution in https://github.com/agentgateway/agentgateway/pull/2831
* @sushisnow made their first contribution in https://github.com/agentgateway/agentgateway/pull/2892
* @jvlxz made their first contribution in https://github.com/agentgateway/agentgateway/pull/2868
* @sankks11 made their first contribution in https://github.com/agentgateway/agentgateway/pull/2934
* @DrFaust92 made their first contribution in https://github.com/agentgateway/agentgateway/pull/2972
* @harukz made their first contribution in https://github.com/agentgateway/agentgateway/pull/2986
* @gaogaoSpark made their first contribution in https://github.com/agentgateway/agentgateway/pull/2976
* @shubhamojha1 made their first contribution in https://github.com/agentgateway/agentgateway/pull/3015
* @SajalBharadwaj made their first contribution in https://github.com/agentgateway/agentgateway/pull/3027
* @Geun-Oh made their first contribution in https://github.com/agentgateway/agentgateway/pull/3034
* @hjsauce made their first contribution in https://github.com/agentgateway/agentgateway/pull/2963
* @Altamimi-Dev made their first contribution in https://github.com/agentgateway/agentgateway/pull/3048
* @Jpatel86 made their first contribution in https://github.com/agentgateway/agentgateway/pull/3073
* @ericdbishop made their first contribution in https://github.com/agentgateway/agentgateway/pull/3098
* @henrichter-sap made their first contribution in https://github.com/agentgateway/agentgateway/pull/3116
* @gcosgrave made their first contribution in https://github.com/agentgateway/agentgateway/pull/2640
* @cbascom made their first contribution in https://github.com/agentgateway/agentgateway/pull/3132
* @zac-nixon made their first contribution in https://github.com/agentgateway/agentgateway/pull/3156
* @HasonoCell made their first contribution in https://github.com/agentgateway/agentgateway/pull/3159
* @theagenticguy made their first contribution in https://github.com/agentgateway/agentgateway/pull/2349
* @koba1t made their first contribution in https://github.com/agentgateway/agentgateway/pull/3169
* @Math1987 made their first contribution in https://github.com/agentgateway/agentgateway/pull/2914

**Full Changelog**: https://github.com/agentgateway/agentgateway/compare/v1.4.1...v1.5.0