v2026.9.0

What's Changed

• ci: bump actions/checkout from 4 to 7 in the github-actions group by @dependabot[bot] in #1
• deps: take all six Dependabot major bumps in one pass by @vpetersson-bot in #8
• feat: mint short-lived tokens from a service-account key (RFC 7523) by @vpetersson-bot in #9
• fix: close the ACL bypass and the rest of the review findings by @vpetersson-bot in #10
• feat: mcp-iap init writes a policy file that is ready to run by @vpetersson-bot in #11
• chore: adopt CalVer by @vpetersson-bot in #12
• docs: state the N:1 agent model, and make the audit log readable at N by @vpetersson-bot in #13
• fix: stop blaming 1Password for every failed secret reference by @vpetersson-bot in #15
• feat: override the listen addresses without editing the policy file by @vpetersson-bot in #14
• feat: mcp-iap list shows every service the proxy exposes by @vpetersson-bot in #16
• fix: authenticate the control plane before parsing anything by @vpetersson-bot in #19
• feat: build a policy file from the CLI instead of guessing at one by @vpetersson-bot in #18
• docs: say why this exists before saying what it does by @vpetersson-bot in #22
• Helper profiles, and the four things that blocked the common workflows by @vpetersson-bot in #21
• feat: short-lived, scope-bound workload identity by @vpetersson-bot in #20
• feat: TLS on the proxy and the control-plane listeners by @vpetersson-bot in #17
• chore: keep every policy file and audit log out of git by @vpetersson-bot in #23
• fix(audit): default the log path to the one the policy file names by @vpetersson-bot in #24
• feat: run is the approval console, not a log stream by @vpetersson-bot in #26
• SIRI-88: make audit tail -f an actual stream by @vpetersson-bot in #27
• feat(tls): name the CA to verify against, and document the providers by @vpetersson-bot in #25
• feat: make a tag produce something installable by @vpetersson-bot in #33
• feat(mcp): serve the proxy itself as an MCP server by @vpetersson-bot in #32
• docs: give the project a logo by @vpetersson-bot in #30
• chore: rename the project to agent-iap (SIRI-94) by @vpetersson-bot in #29
• docs: add SECURITY.md by @vpetersson-bot in #28
• feat(enroll): revoke and remove without an editor by @vpetersson-bot in #31
• docs: draw the logo as an SVG by @vpetersson-bot in #34
• Make the console the place the policy is kept by @vpetersson-bot in #35
• Give each profile variable its own field in the add form by @vpetersson-bot in #38
• Put a minted token on the clipboard, over the terminal by @vpetersson-bot in #36
• Let the console edit an upstream, not just add and remove one by @vpetersson-bot in #37
• Offer a profile when adding an upstream by @vpetersson-bot in #39
• Re-read credentials on reload, not just TLS by @vpetersson-bot in #40
• Add Semrush profiles: v3, v4 and the MCP server by @vpetersson-bot in #41
• Tell the upstream which proxy is forwarding by @vpetersson-bot in #44
• Let the console walk to a credential file, rather than typing its path by @vpetersson-bot in #43
• Keep config and state out of the working directory (a relative [audit].path now resolves from the state dir) by @vpetersson-bot in #45
• Add a 'verify' step for upstreams and MCP servers by @vpetersson-bot in #46
• Add a semrush-trends profile by @vpetersson-bot in #42
• Ask Cloudflare for the account, not just the token by @vpetersson-bot in #48
• Name the key that opens the file picker, where an error cannot cover it by @vpetersson-bot in #47
• A probe of the root is a pass, not a warning by @vpetersson-bot in #49
• Make the VERIFIED column a status, not a paragraph by @vpetersson-bot in #51
• Take the picker's offer off the field the moment there is a value in it by @vpetersson-bot in #50
• Keep the spaces a human put in an op:// reference by @vpetersson-bot in #52
• Stop the console losing the token it only shows once by @vpetersson-bot in #53
• Answer an agent that has only a token and an address by @vpetersson-bot in #54
• Stop acl add on its defaults from granting everything by @vpetersson-bot in #55
• Say which Sentry, before a token finds out for you by @vpetersson-bot in #57
• deps: Bump the cargo-minor-and-patch group with 2 updates by @dependabot[bot] in #56
• Add Homebrew support by @vpetersson-bot in #58
• Two ways to say stop: acl reset, run --lockdown, and the approval bell by @vpetersson-bot in #59
• A reset should leave it asking by @vpetersson-bot in #60
• Write down what a change here has to do by @vpetersson-bot in #61
• An empty policy asks, and one that cannot say so by @vpetersson-bot in #62
• Add the one this issue was reported against by @vpetersson-bot in #63
• Take the vault off the thread that draws by @vpetersson-bot in #65
• An ACL rule should be written from the names the file already holds by @vpetersson-bot in #64
• A 403 is the API refusing the caller, not the token by @vpetersson-bot in #66
• Enrolling a service is not the same as granting access to it by @vpetersson-bot in #67
• Answering a request should not send you to 1Password by @vpetersson-bot in #68
• A PostHog key is checked against the API, not the login page by @vpetersson-bot in #69
• One trip to 1Password, however many credentials the file names by @vpetersson-bot in #70
• A credential with nowhere else to live can be kept here by @vpetersson-bot in #71
• Fifty presses of the right arrow is not a way to pick a profile by @vpetersson-bot in #75
• A grant is about a service, not the ones enrolled later by @vpetersson-bot in #74
• deps: bump clap from 4.6.6 to 4.6.7 in the cargo-minor-and-patch group by @dependabot[bot] in #72
• A way to stop 1Password being asked at all by @vpetersson-bot in #77
• Enrolling x.ai should not mean finding out what one key covers by @vpetersson-bot in #79
• A binary that says what it was built from by @vpetersson-bot in #78

New Contributors

• @dependabot[bot] made their first contribution in #1
• @vpetersson-bot made their first contribution in #8

Full Changelog: https://github.com/vpetersson/agent-iap/commits/v2026.9.0