v0.18.1

Forge v0.18.1 brings delegated per-user MCP authentication with full OAuth 2.1 discovery and dynamic client registration, a one-command forge try onboarding flow, skill-folder→agent import, a config-selectable OpenAI Responses API provider, and hardened egress control and audit attribution — for teams building secure, governed AI agents.

Forge is an open-source runtime for building and shipping AI agents that speak the A2A (Agent2Agent) protocol, call Model Context Protocol (MCP) tools, and run under first-class egress control, policy governance, and tamper-evident audit. This release centers on making MCP tool access safe for real multi-user deployments, and on getting new users to a running agent in seconds.

Upgrade note: additive and backward-compatible. New MCP auth.type values (platform, user) and the openai-responses provider are opt-in. Full diff: v0.17.1...v0.18.1

Highlights

• Delegated per-user MCP auth — MCP servers can now authenticate as the requesting user (auth.type: user), with a per-user connection pool, lazy consent, and an auth-required gate that parks a call until the user connects. Works standalone or platform-managed. (#317, #327, #329, #330/#331, #332/#344)
• MCP OAuth 2.1 discovery + Dynamic Client Registration — zero-config OAuth against any compliant MCP server: RFC 9728 → RFC 8414 metadata discovery and RFC 7591 dynamic client registration at first forge mcp login. (#316/#320)
• forge try — instant onboarding: scaffold a keyless demo agent and chat in-process, no server or build, credentials auto-resolved. (#350/#353)
• Skill folder → agent — forge skills import <dir> and forge init --from-skill-dir convert a SKILL.md + scripts + reference files into a runnable agent; Python skills are first-class (## Tool: .py/.js), and a skill requirements.txt is pip-installed at build. (#405/#406)
• OpenAI Responses API provider — point an agent at /v1/responses (or a Responses-first gateway) via config with provider: openai-responses. (#383/#385)

Model Context Protocol (MCP)

Multi-user MCP is the theme of this release: a single agent can now broker each user's own credentials to remote MCP tools, with consent, tenancy, and audit.

• Per-user connection lifecycle — pooled per-subject MCP connections + routing seam + materialized type=user servers. (#317 → #327, #329)
• Auth-required consent gate — a grantless delegated call parks and resumes when consent lands; POST /mcp/consent signals completion. (#330/#331)
• Standalone delegated consent — type:user works without a platform, via a loopback resolver. (#332/#344)
• Slack-delivered MCP consent prompts — Forge DMs the user a "Connect" link over Socket Mode; no inbound exposure. (#343/#345)
• Agent-principal OAuth (2LO) — client_credentials grant so an agent authenticates as itself, no user/browser. (#324/#325)
• Platform + user auth resolvers — read via platform identity, write via delegated user identity. (#326)
• OAuth discovery + DCR — RFC 9728/8414/7591. (#316/#320)
• Tenancy headers — Org-Id/Workspace-Id on all platform token requests. (#328/#334)
• ${VAR} expansion in MCP config fields at load. (#321/#323)
• Delegated token TTL cap so a disconnect is promptly enforced; call-time ErrNoToken routed through the auth gate. (#376/#377, #380/#381)

CLI & onboarding

• forge try — zero-to-chat demo agent in one command. (#350/#353)
• Skill-folder import — forge skills import + forge init --from-skill-dir, with reference-file vendoring, egress/env wiring, build-time Python dependency install, and first-class .py/.js tools. (#405/#406)
• Startup version banner — the running forge binary/runtime version is printed on start. (#335/#336)
• Windows OAuth launch fix — the login URL opens without cmd's & truncation. (#312)

Security, governance & egress

• SOCKS5 raw-TCP egress with a port-aware allowlist — governed non-HTTP egress. (#337/#355)
• allowed_private_cidrs — narrow the default private-IP block instead of all-or-nothing. (#337/#348)
• Per-tool DEFER approver allowlist — email-based, fail-closed human-in-the-loop approvals. (#313/#315)
• Native Slack interactive DEFER approvals — Approve/Reject buttons over Socket Mode (R4c). (#310/#311)
• Org-wide command denylist (denied_command_patterns) enforcement + emitted approver allowlist in task_deferred. (#403)

LLM providers

• openai-responses provider — config-selectable OpenAI Responses API with API-key/gateway auth and a disable_store privacy opt-out. (#383/#385)
• apikey_header_only auth scheme + the invoked LLM URL recorded on llm_call audit events (Kong/gateway support). (#358)

Runtime, PDP & audit attribution

• Managed PDP decision resolver at BeforeToolExec — the platform can allow/deny/modify each governed tool call. (#399)
• Per-operation API tool type from admitted OpenAPI entries (<server>__<op>). (#400)
• Deferrals survive the request — task execution detaches so long human approvals don't time out with the HTTP connection. (#402)
• Per-invocation audit attribution — egress-proxy + MCP-consent + subprocess-proxy events attribute to the right task/invocation; channel-originated tasks attribute to the human sender. (#338/#339, #341/#366/#367, #356)

Channels & A2A

• A2A data parts reach the prompt — a data-part-only message (e.g. a workflow step's output) no longer executes as an empty prompt; the same projection feeds the guardrail/intent scanners so nothing bypasses them. (#410/#411)
• Slack long-response fix — stop dumping raw tool JSON; keep chunked replies in-thread. (#384)

Fixes & maintenance

• Session-recovery dedup only trims a trailing identical user turn. (#378/#379)
• Remote session store builds independently of the memory-persistence gate. (#372/#373)
• validate accepts hyphenated MCP tool names in allow/deny lists. (#370)
• Skill tool schemas parse the platform Input format and validate property keys at registration. (#362)
• Embedded weather skill switched to the keyless wttr.in endpoint. (#354)
• Dependency bumps: google.golang.org/grpc 1.81.1 → 1.82.1 (core + cli). (#368, #369)

Full changelog: v0.17.1...v0.18.1