Skip to content

v0.27.0

Latest
Latest

Choose a tag to compare

View all tags
@cjellick cjellick released this 20 Oct 00:28
v0.27.0
a607011
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

We're excited to announce the v0.27.0 release of the Obot Platform. This release adds experimental Claude Environments for running Claude sessions on your own Kubernetes infrastructure, OpenAPI-backed MCP servers, Okta SCIM provisioning, a localized UI, and tool search for vMCPs.

Big Updates

Claude Environments

Organizations can now run Claude cloud sessions on their own Kubernetes infrastructure. Users keep working in Claude, while Obot decides who can start a session, which vMCPs the session can use, where it can send network traffic, and how much CPU and memory it gets. Obot uses Agent Substrate to run isolated sessions and suspend idle workspaces. Claude Environments replaces the former Hosted Agents feature.

Administrators create an environment from a Claude environment key, then grant access through profiles that map users and groups to vMCPs, resource limits, and egress rules. Session traffic is limited to allowed hosts, and destination-specific secrets are injected at the egress gateway, so the session never sees them. Obot vMCP credentials are scoped to the mapped Obot user, and every egress request is recorded in Audit Logs. Administrators map Claude organization members to Obot users, and Claude Tag sessions started from Slack or GitHub run under a dedicated service identity. See the docs for cluster requirements and setup.

Important

Claude Environments is experimental and disabled by default. It uses new technology, requires Obot to run in Kubernetes, and needs additional cluster resources and configuration. It also requires a Claude Team or Enterprise organization with self-hosted environments enabled. See #8276 for details.

OpenAPI-Backed MCP Servers

Obot can now host an MCP server for any HTTP API that has an OpenAPI schema, without anyone writing a separate MCP server. Administrators import a schema from a URL or a file, and Obot pre-fills the name, description, API destination, and credential headers for review before saving. Each API operation becomes an MCP tool.

OpenAPI servers run on Docker or Kubernetes from a saved snapshot of the schema, and MCP egress policies apply to them. API keys and bearer tokens are forwarded on each request. OpenAPI entries are also supported in Git-backed catalogs, and existing servers keep their schema snapshot until they are explicitly upgraded. See the docs for details.

Note

OpenAPI-backed MCP servers support header API keys and pre-issued bearer tokens, but do not perform OAuth flows against the upstream API. OAuth declarations in a schema are imported but do not configure authentication. Schemas are limited to 1 MiB. See #8253 and #8250 for details.

Okta SCIM Provisioning

Okta can now provision users, groups, and group memberships into Obot through SCIM. Administrators decide in Okta which users and groups Obot can see, and Obot no longer needs read access to the Okta directory. Users still sign in through the existing Okta OIDC app.

Removing a user's assignment in Okta now deactivates them in Obot. They are signed out, and their API keys and other credentials stop working. When configuring the Okta auth provider, administrators choose between SCIM and the Okta API for group data. See the docs for setup.

Japanese, Korean, and Simplified Chinese UI

The Obot UI is now available in Japanese, Korean, and Simplified Chinese in addition to English. The language defaults to the browser's language and can be changed from the profile menu. Auth and model provider configuration text returned by the API is localized as well.

Tool Search for vMCPs

vMCPs have a new opt-in Tool search setting. When it is enabled, clients see two tools, search_tools and call_tool, instead of the full tool list, which keeps tool definitions out of the model's context when a vMCP has many tools. Obot recommends enabling it for vMCPs with more than 50 tools.

Tool search does not grant additional access. The same component, profile, and user selections determine which tools can be found and called, and each call is validated, authorized, and audited as the underlying tool. The setting is also supported in catalog YAML. See the docs for details.

Improvements

  • Remote catalog entries can require a localhost OAuth callback, and users connect to them with obot mcp login <url>.
  • Users can reauthenticate a single vMCP component without signing out of the others.
  • The same MCP server can be added to a vMCP more than once, each with its own component name.
  • The built-in credential filter can be configured from the UI.
  • Catalog entries support minObotVersion and maxObotVersion to limit which Obot versions offer them.
  • Obot Sentry supports Kiro as a client.
  • When the license service can't be reached, Obot keeps the last accepted license entitlements until the license expires instead of degrading.

Upgrade Notes

Obot Agent has been removed. Obot Agent has been disabled by default since v0.23.0 and is removed in this release. Claude Environments is the planned replacement. The OBOT_ENABLE_AGENTS setting and the User Impersonation role are removed with it, and containerized MCP servers redeploy once after the upgrade. See #8274 for details.

Hosted Agents has been removed. Hosted Agents was off by default and never left experimental status. It has been removed and replaced by Claude Environments, and its resources are cleaned up on upgrade. See #8275 for details.

MCP clients must connect through vMCPs. Direct connections to catalog entries, MCP servers, and server instances are now rejected. Connections that were migrated to vMCPs keep their existing URLs. See #8178 for details.

Several default catalog entries are deprecated. Legacy Slack is scheduled for removal on October 30, 2026. AntV Charts, Brave Search, Browserbase, Chroma Cloud, MarkItDown, Playwright, and MongoDB Atlas Management will also be removed, on dates not yet announced. Upgrade to at least v0.26.2 before these entries are removed so existing deployments are preserved. See #8269 for recommended replacements.

What's Changed

New Contributors

Full Changelog: v0.26.2...v0.27.0

Contributors

cloudnautique, cjellick, and 8 other contributors
Assets 9
Loading