v0.5.0

Added

• Backend findings and snapshot API (ADR 0011). Agent state is now
  projected into typed AgentSnapshot values and served from the backend,
  alongside prioritized findings for unreachable, stale, drifting, unowned,
  heuristic, idle, and unattributed-usage conditions. The fleet page and
  per-agent Agent card consume this neutral API instead of deriving state from
  catalog annotations in the browser.
• Backend package rename and expanded role. The backend package is now
  @showcall/backstage-plugin-agent-catalog-backend; it continues to ingest
  catalog entities and now also exposes the agent-catalog HTTP plugin used by
  the fleet UI and external integrations.

v0.4.0

Added

• Fleet page polish + click-to-filter. The /agents page leads with
  summary tiles (agents, shadow, unreachable, unowned, runtimes) that are
  clickable to filter the table; the "Needs attention" panel is collapsible and
  each entity-backed finding filters the fleet to exactly the affected agents;
  probe-discovered "shadow" agents get a ghost mark and a subtle row tint; and
  the column chooser is now a clearly-labelled Columns menu. All current-state
  and read-only — filtering the live view, not saved views or dashboards.
• Audit sweep — find agents nobody registered (ADR 0007). A new
  SweepDiscoveryProvider lists every Service on a cluster, skips the ones
  that are already someone else's job (labeled agentcatalog.io/a2a=true →
  Tier A; owned by a runtime CR; suppressed a2a=false), and probes the rest
  for a live A2A card — GET-only, well-known paths, each Service's declared
  ports (capped), through the kube-apiserver proxy. A card-serving Service is
  cataloged with agentcatalog.io/discovery: probe (and a shadow tag); an
  unlabeled Service with no card is ignored, not flagged. Off by default
  (agentCatalog.sweep.enabled) — it is a port-probing workload, so tell your
  security team before enabling; there is no default schedule (one supervised
  run on enable, recurring only via sweep.scheduleMinutes). Its own
  locationKey, so it never clobbers labeled discovery. Doubles as a Tier B
  scout: agents on runtimes with no CRD provider yet still show up if they
  serve a card.
• Fleet health summary — "Needs attention". The /agents page now leads
  with a prioritized, severity-ranked list of findings an owner can act on,
  derived entirely from signals already collected: unreachable agents (their
  card couldn't be fetched), stale entries from a currently-unobservable source,
  interface drift, unowned agents, heuristic "unverified LLM workloads",
  deployed-but-idle agents, and gateway consumers matching no catalog entity.
  Purely derived — no new collectors or stored state — and shows an explicit
  "nothing needs attention" state when the fleet is clean.

Security

• Dependency advisory. Pinned prismjs to ^1.30.0 via a workspace
  resolution to clear GHSA-x7hr-w5r2-h6wg (DOM clobbering) in the transitive
  dev/build tree (pulled in as ~1.27.0 via refractor); a
  backward-compatible minor bump. The resolution affects this repo's install
  tree only — it is not part of the published packages, so consumers are
  unaffected either way.

v0.3.0 — observation lifecycle

agent-catalog v0.3.0 — technical preview

An observation-lifecycle release: the catalog now tells you not just what agents exist, but whether what it's showing you is current. Published via npm trusted publishing (OIDC) with provenance.

Added

• Cluster visibility in the UI. A Cluster column on the fleet page and a cluster: <name> chip on the agent card — in a multi-cluster setup you can see which cluster an agent runs on.
• Observation lifecycle v0 — an outage no longer reads as a deletion. Each scan stamps last-observed-at + source-status: available; a failed cluster list keeps the last good snapshot but marks it source-status: unavailable with source-last-success-at. Surfaced as a Source column (online/offline) and a card chip/hint.
• Interface drift — declared vs. served skills. For kagent agents with a live A2A card, declarative a2aConfig skill IDs are compared against the card's served skills; mismatches set interface-status (in-sync|drift) + an interface-drift detail, also under spec.agent.interface. Shown as an Interface column and card chip.
• Fleet column chooser. Lower-signal columns hidden by default, toggleable per view.

Docs

• First release where both packages render a README on npm; plus demo screenshots and the agent-operations roadmap.

Full notes: CHANGELOG.md.

v0.2.0 — security hardening

agent-catalog v0.2.0 — technical preview

A security-hardening release. Published via npm trusted publishing (OIDC) with provenance.

Security

• Card-fetch path/port hardening. The agentcatalog.io/a2a-path Service annotation is untrusted (anyone who can label a discoverable Service) and flowed into a privileged kube-apiserver service-proxy request. It's now sanitized — schemes, queries, fragments, %-encoding, and .. traversal are rejected and fall back to the well-known card paths; agentcatalog.io/a2a-port is clamped to 1–65535.
• Response size caps. Card bodies over 1 MiB and oversized LiteLLM usage responses are rejected before parsing — bounding parse cost and stored-entity size against a hostile or broken endpoint.
• Gateway key protection. The LiteLLM spend key is never sent over a non-HTTPS, non-loopback baseUrl (fail closed); HTTP remains allowed only for loopback.

Internal

• Mocked-kube-client tests for the four entity providers and the first frontend tests (toRow + AgentInfoCard). 52 → 92 tests.
• Demo: DEMO_CLUSTER_CONTEXTS to scan multiple clusters (demo tooling only).

Full notes: CHANGELOG.md.

v0.1.1 — technical preview

agent-catalog v0.1.1 — technical preview

First release published via npm trusted publishing (OIDC, no token) with
provenance.

Fixed

• The Agents sidebar item now appears under Backstage's new frontend
  system. The fleet page registered no routeRef, so the app's nav module
  (AppNav) filtered it out — the page was reachable at /agents but never
  surfaced in the sidebar. It now creates and passes a routeRef.
  Classic/custom sidebars using AgentCatalogSidebarItem were unaffected.

Internal

• Mocked-kube-client tests for the four entity providers (52 → 72 tests).

Full notes: see CHANGELOG.md.

v0.1.0 — technical preview

agent-catalog v0.1.0 — technical preview

First public release. Catalogs AI agents across runtimes in Backstage, with live A2A-card enrichment and LLM-gateway usage — the same questions your catalog already answers for services, now for agents.

📦 Published to npm:

• @showcall/backstage-plugin-agent-catalog (frontend)
• @showcall/backstage-plugin-catalog-backend-module-agent-catalog (backend module)

Highlights

• Discovery across kagent (v1alpha2), ARK (v1alpha1), labeled A2A Services, and heuristic detection of unlabeled LLM workloads.
• Live A2A agent-card enrichment via the kube-apiserver service proxy.
• LLM-gateway (LiteLLM) usage/traction: per-agent annotations + gateway rollups and unattributed-consumer surfacing.
• /agents fleet view and a per-agent Agent info card.

Compatibility

Backstage new frontend system only (the backend module works on any new-backend-system app); Node 20/22.

Known limitations

• Audit sweep designed, not implemented (ADR 0007).
• Provider classes lack mocked-client tests (transforms: 52 tests).
• No legacy-frontend UI.

Full notes: see CHANGELOG.md.