Popular starting points. Use Tab or arrow keys to browse results.

Skip to content
Aten SecurityThoth docs

Changelog

Release notes for Thoth SDKs, the Thoth binary line (proxy + thothctl), and IaC providers.

View as MarkdownOpen in ClaudeOpen in ChatGPT

Historical release notes

Entries describe behavior at the time of each release. Use Install an SDK and Your first governed agent for current package names, runtime requirements, connection details, and failure behavior.

Release notes for every published Thoth package, newest first. Latest releases come straight from each package's changelog, so they match what is published; pre-releases are not listed. See the release-channel guide when selecting an upgrade. Releases follow Semantic Versioning.

Subscribe

  • Direct feed URL: https://docs.atensecurity.com/docs/changelog/rss.xml
  • One-click Feedly subscribe: Feedly
  • One-click Inoreader subscribe: Inoreader

Latest releases

Generated from each package's CHANGELOG.md, newest first.

Pulumi provider 0.1.16September 18, 2026Added, Changed, Upgrade note

Added

  • Bridged the Terraform provider's 0.1.16 surface. GovernanceSettings gains the executable compliance declaration (declaredRegulatoryRegimes, complianceEnforcementMode) with computed canonical regimes, coverage, revision and propagation bound, and McpVendor gains manifest signature, capability, runtime identity and egress attributes. See the terraform-provider-thoth 0.1.16 changelog for the full surface and its upgrade note.

Changed

  • Updated Terraform provider bridge dependency pin to github.com/atensecurity/terraform-provider-thoth v0.1.16.
  • Bumped Pulumi release defaults/docs to 0.1.16:
    • Makefile default VERSION
    • plugin install command in docs/installation-configuration.md

Upgrade note

Applying a compliance declaration requires a running enforcer that reports the same catalogue and evaluator identity the bridged provider pins and reports transactional declaration support. Otherwise the update fails with Compliance capability mismatch and changes nothing. A service with tenant declarations disabled refuses these fields by design; every other resource is unaffected.

Python SDK 0.5.23September 18, 2026Fixed, Security, Added, Unchanged

Fixed

  • The tracer discarded the final enforcement decision after computing effective tool arguments, so POST telemetry hardcoded ALLOW and omitted server-issued reason codes and structured decision evidence. The real outcome is now retained and reported.
  • A resolved STEP_UP no longer loses the initial policy evidence or the canonical terminal receipt. Final authorization semantics are merged with the initial reason, policy and receipt evidence, and the terminal receipt is preserved separately.
  • A sparse server response no longer erases locally established correlation. Sparse decisions bind to the local trace and action IDs.

Security

  • A server response whose action or trace ID contradicts the locally established one now fails closed before the tool executes, rather than proceeding with ambiguous correlation.

Added

  • EnforcementDecision and the policy exceptions gain an optional terminal_receipt field. Existing callers are unaffected.
  • Claude Agent SDK post-success and post-failure hooks now carry decision context, correlated through a bounded single-use map keyed on the provider tool-use ID. The map holds at most 1024 pending entries; a reused, missing, unseen or evicted ID yields empty context rather than another action's, so evidence correlation fails closed without changing the authorization result.

Unchanged

  • Tool execution, blocking, deferral, step-up and argument-modification semantics, final MODIFY outcomes, and current OBSERVE behaviour. The enforcement return shape remains private to the SDK implementation.
Terraform provider 0.1.16September 18, 2026Added, Changed, Security, Upgrade note

Added

  • thoth_governance_settings gains an executable compliance declaration: declared_regulatory_regimes and compliance_enforcement_mode, with computed canonical_regimes, compliance_coverage, compliance_revision and propagation_max_ms. A declaration governs all current and future tenant agents, including agents with no policy record. observe records advisory findings and preserves independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Removing a managed declaration or setting [] clears it, and legacy profile defaults never activate the binding.
  • Per-regime coverage counts are known at plan time from a catalogue pinned into the provider, so terraform plan previews which controls a declared regime would evaluate before any apply. These are Aten's own author classifications and are not a regulatory conformance assessment.
  • thoth_mcp_vendor gains manifest signature attributes (manifest_signature_status, _signer, _bundle_ref, _verified_at), plus capabilities, runtime_identity, egress_policy_mode and egress_allowed_host_patterns.
  • thoth_governance_settings gains regulatory_regimes for onboarding baseline auto-pack loading. This selects legacy packs only and does not activate executable compliance; the declaration fields above are separate.

Changed

  • The governance executive summary and reports overview data sources return additional fields.

Security

  • Updated indirect dependencies, including golang.org/x/text 0.37.0 to 0.41.0, golang.org/x/net 0.55.0 to 0.58.0 and golang.org/x/crypto 0.52.0 to 0.55.0.

Upgrade note

Applying a compliance declaration requires a running enforcer that reports the same catalogue and evaluator identity this provider pins and reports transactional_declarations_supported. If it does not, the apply fails with Compliance capability mismatch and changes nothing rather than writing a declaration the service cannot honour.

A service with tenant declarations disabled will therefore refuse these fields by design. Every other resource and data source in this release is unaffected. Verify the three-way agreement before rollout with:

python3 scripts/reliability/compliance_release_preflight.py \
  --base-url https://grid.<tenant>.<apex> --tenant-id <tenant>
Thoth CLI and MCP proxy 0.3.7September 12, 2026Security, Added, Fixed, Known limitations, Changed

Stable release of the macOS runtime (thoth and thothctl) for Apple Silicon and Intel. This is the global latest release; Linux and Windows artifacts are not included and remain at v0.3.6. This client release does not change the platform readiness status.

Security

  • Updated the HTTP/2 stack from h2 0.4.13 in v0.3.6 to 0.4.19, fixing RUSTSEC-2026-0258 (unbounded queuing of empty DATA frames through hyper). The advisory is patched in h2 0.4.16 and later.

Added

  • Carried an action attestation ID through every governed tool call. The proxy reuses action_attestation_id from the request when supplied and otherwise generates one, sends it to the enforcer, and reports it on decision responses and on both the request and terminal telemetry events, so an attempt can be correlated end to end.
  • Reported decision evidence on ALLOW and BLOCK responses, which previously carried none. BLOCK, DEFER and STEP_UP responses now include the enforcement trace ID, action attestation ID, authorization decision, reason, reason code, action classification and risk score when the enforcer supplies them.

Fixed

  • Stopped writing enforcer error response bodies and selected response headers into proxy logs when a call fails. A failure is now recorded as a reason code (enforcer_transport_error, enforcer_http_error, enforcer_invalid_response) with the HTTP status only, so response content cannot reach logs.
  • Distinguished an enforcer response with no recognized decision from a genuine BLOCK. Both still fail closed, but the former is now recorded as enforcer_invalid_response rather than being indistinguishable from a policy denial in evidence.
  • Preserved request-side correlation IDs on the terminal event when the enforcer is unreachable, returns an error status, or returns an undecodable body, so a failed call is still traceable to the attempt that caused it.
  • Kept a locally escalated STEP_UP from exporting a receipt that the underlying ALLOW never carried.
  • Distinguished an absent model risk score from one the enforcer explicitly reported as null, and stopped copying non-numeric risk payloads into decision evidence.
  • Cleared stale request-side reason fields from terminal telemetry so a decision reason always describes that decision.

Known limitations

  • On Windows the proxy API key file (~/.thoth/proxy_api_key.json) is written with inherited ACLs. The owner-only permission handling that thothctl applies on macOS and Linux has no Windows equivalent yet, so treat that file as readable by any account with access to the user profile until it does.

Changed

  • Serialized the decision-evidence integration fixtures. Each spawns a proxy subprocess and a mock enforcer, and running them concurrently exhausted the proxy's bounded 5s HTTP timeout, so the proxy failed closed and the suite reported six failures unrelated to proxy behavior.
Go SDK 0.1.19September 11, 2026Added, Changed

Added

  • Added a per-action attestation ID, generated for each tool call unless the caller supplies one, and propagated it through enforcement decisions, behavioral events, logs, and policy errors for deterministic correlation.
  • Added model name/provider/artifact context, authentication and delegation context, MCP runtime identity, and caller metadata to authorization requests.
  • Added public process-local delivery status and bounded shutdown APIs.

Changed

  • Minimized retained HTTP and SQS telemetry with an explicit allowlist. Tool arguments, free-text context, results, errors, explanations, full receipts, and unknown metadata remain available to authorization but are not retained by default.
  • Added bounded HTTP and SQS delivery retries with stable event and FIFO deduplication identifiers. Retrying telemetry never re-executes a governed tool or repeats its authorization decision.
  • Added SQS partial-batch failure handling, process-local delivery counters, bounded shutdown through CloseWithTimeout, and a five-second overall HTTP request timeout.
  • Expanded the public decision-envelope compatibility contract and standalone module tests for the new authorization and evidence fields.
  • Documented the telemetry privacy boundary and the limits of process-local delivery status.
Python SDK 0.5.22September 11, 2026Added, Fixed, Changed

Added

  • Added first-class LangGraph support through instrument_langgraph(), instrument_tool_node(), and @thoth_graph, including synchronous and asynchronous tool execution, concurrent call history, mock mode, and explicit ThothDeferredError handling.
  • Added per-action attestation IDs across authorization, Claude Agent SDK hooks, lifecycle events, policy errors, and decision evidence. Provider tool-use IDs are used for correlation only and are never represented as authenticated workload identity.
  • Added model name/provider/artifact context, authentication and delegation context, MCP runtime identity, and caller metadata to authorization requests.
  • Added human-explanation retrieval for blocked and step-up decisions with optional bounded webhook delivery.
  • Added wheel-content validation and clean installed-package tests for the base package and the Anthropic, AutoGen, Claude, LangChain, LangGraph, and OpenAI extras.

Fixed

  • Return a fresh approval-timeout decision for every sync and async call, so blocked-event evidence cannot inherit an earlier action's attestation ID.
  • Reject unresolved or malformed step-up results without executing the tool, and keep synchronous and asynchronous fallback enforcement to one decision per action.
  • Reject Claude callback results that identify a different action, and avoid correlating concurrent callbacks by tool name when no trusted action ID is available.
  • Govern callable-only tool collections and LangChain-style duck-typed _run/run tools even when their framework classes are unavailable.
  • Correct optional dependency declarations and restore SDK type-check coverage.

Changed

  • Minimized retained HTTP and SQS telemetry with an explicit allowlist. Tool arguments, free-text context, results, errors, explanations, full receipts, and unknown metadata remain available to authorization but are not retained by default.
  • Added bounded HTTP and SQS delivery retries with stable event and FIFO deduplication identifiers. Retrying telemetry never re-executes a governed tool or repeats its authorization decision.
  • Added SQS partial-batch failure handling, process-local delivery counters, and bounded shutdown through close(timeout=...).
  • Documented the telemetry privacy boundary and the limits of process-local delivery status.
TypeScript SDK 0.1.21September 11, 2026Fixed

Fixed

  • Continue polling canonical unresolved STEP_UP hold responses until resolution or the configured deadline instead of treating a missing decision field as a terminal fallback block. Timeout and malformed-response handling remain fail-closed.
TypeScript SDK 0.1.20September 11, 2026Added, Changed

Added

  • Added a per-action attestation ID, generated for each tool call unless the caller supplies one, and propagated it through authorization, lifecycle telemetry, decisions, and policy errors.
  • Added bounded human-explanation requests for blocked and step-up decisions and exposed the explanation on decisions and ThothPolicyViolation.
  • Exported behavioral-event emission and per-event delivery status types for applications that need process-local telemetry health signals.

Changed

  • Minimize default telemetry with an explicit field allowlist; omit tool arguments and free-text context, reasons, explanations and full receipts. Authorization inputs and enforcement behavior are unchanged. See PRIVACY.md for wire data and migration limits.
  • Remove payload-bearing diagnostic logs and verify the installed npm artifact against a local HTTP collector.
  • Make telemetry delivery resilient: bounded retries with stable event IDs, so a retried delivery is de-duplicable server-side and never replays a governed tool call or re-requests authorization.
  • Use native Node ESM imports throughout the published package.
  • Restrict the published package to built output, source and user-facing docs via an explicit files allowlist. Development-only files (tests, CI workflows, tsconfig.json, fixtures and internal notes) are no longer published, and a packing artifact can no longer be swept into the tarball.
Pulumi provider 0.1.15July 23, 2026Changed, Fixed

Changed

  • Updated Terraform provider bridge dependency pin to github.com/atensecurity/terraform-provider-thoth v0.1.15.
  • Bumped Pulumi release defaults/docs to 0.1.15:
    • Makefile default VERSION
    • plugin install command in docs/installation-configuration.md

Fixed

  • Updated docs for Pulumi Registry lint compatibility:
    • extensionless internal cross-link in docs/_index.md
    • markdown SDK links (no bare URLs) in docs/installation-configuration.md
Terraform provider 0.1.15July 23, 2026Fixed

Fixed

  • Updated provider docs for Pulumi Registry compatibility by converting markdown cross-links to extensionless paths and replacing bare SDK URLs with explicit markdown links.
Pulumi provider 0.1.14July 10, 2026Fixed

Fixed

  • Added required YAML front-matter blocks to:
    • docs/_index.md
    • docs/installation-configuration.md
  • This unblocks Pulumi registry metadata generation (resourcedocsgen metadata from-github) and future nightly community-package refreshes.
Terraform provider 0.1.14July 10, 2026Changed

Changed

  • Release alignment patch to unblock downstream Pulumi provider v0.1.14 publishing and registry metadata refresh.
Pulumi provider 0.1.13July 9, 2026Changed, Added

Changed

  • Updated Terraform provider bridge dependency pin to github.com/atensecurity/terraform-provider-thoth v0.1.13.
  • Bumped Pulumi release defaults/examples to 0.1.13:
    • Makefile default VERSION
    • README release line and manual plugin-install command docs
    • Node.js and .NET example package references
  • Updated Pulumi bridge language metadata so Node.js SDK publishing is declared as @atensec/pulumi-thoth (matching npm publication and registry install instructions).
  • Corrected .NET namespace configuration to avoid doubled NuGet identity rendering in generated metadata/docs.
  • Added explicit plugin download URL + bridge metadata wiring in provider metadata for release consistency.

Added

  • Added complete cross-language examples under examples/ for Node.js, Python, and .NET with matching stack config templates.
  • Added code examples to docs/_index.md for Node.js, Python, and .NET quick starts.
Terraform provider 0.1.13July 9, 2026Added, Changed

Added

  • Added policy-exception workflow resources:
    • thoth_policy_exception
    • thoth_policy_exception_review
    • thoth_policy_change_artifact_apply
  • Added policy-exception workflow data sources:
    • thoth_policy_exception
    • thoth_policy_exceptions
    • thoth_policy_change_artifact
    • thoth_policy_change_artifacts
  • Added governance + MCP summary data sources:
    • thoth_governance_executive_summary
    • thoth_governance_board_incident_summary
    • thoth_mcp_inventory_digest
  • Added policy-exception workflow example under examples/policy-exception-workflow.

Changed

  • Expanded governance cost report coverage to include pricing-catalog metadata, fallback counters, and unresolved-model visibility fields.
  • Refreshed provider docs/README for the new policy exception and governance summary surfaces.
Thoth CLI and MCP proxy 0.3.6July 9, 2026Fixed

Fixed

  • Emitted behavioral telemetry events from the Rust thoth proxy for local preflight outcomes (BLOCK, DEFER, STEP_UP) and forwarded execution outcomes so Claude Desktop/runtime decisions are ingested through /v1/events/batch and appear in governance feeds.
Go SDK 0.1.18June 20, 2026Changed

Changed

  • Added configurable resilience mode via Config.FailOpen / THOTH_FAIL_OPEN. When enabled, enforcer transport failures and retryable statuses (429, 5xx) return ALLOW so tool execution can continue.
  • Auth failures (401/403) remain fail-closed and continue returning BLOCK.
  • Added regression coverage in internal and public SDK tests for fail-open/fail-closed behavior.
  • Added vendor-runtime observability coexistence tests for Datadog, LangSmith, OpenTelemetry, and Sentry in an isolated compat test module (sdk/thoth/compat).
  • Added compatibility matrix CI coverage for Go runtime-stack coexistence verification.
Python SDK 0.5.21June 20, 2026Changed

Changed

  • Added configurable resilience mode via ThothConfig.fail_open / THOTH_FAIL_OPEN. When enabled, enforcer transport failures and retryable statuses (429, 5xx) return ALLOW so agent execution can continue.
  • Auth failures (401/403) remain fail-closed and continue returning BLOCK.
  • Added regression tests for fail-open timeout, retryable status, and auth-failure handling.
  • Added LangSmith coexistence integration coverage (tests/integrations/test_langsmith_compat.py) to ensure traceable tools continue to execute under Thoth governance wrappers.
  • Added observability-wrapper coexistence integration coverage for Datadog-like, OpenTelemetry-like, and Sentry-like instrumentation patterns (tests/integrations/test_observability_compat.py).
  • Hardened instrument() wrapping for LangChain-style duck-typed tools so _run and run are both governed even when LangChain classes are not importable at runtime.
  • Fixed generic .tools wrapping for callable-only tool entries (plain functions/callables), which are now replaced with governed callables instead of bypassing enforcement.
  • Added regression tests for callable-only tool entries and LangChain duck-typed _run/run wrapping in tests/test_instrumentor.py.
  • Added first-class LangGraph instrumentation APIs: instrument_langgraph(), instrument_tool_node(), and @thoth_graph.
  • Added mock-mode LangGraph decision simulation (THOTH_MOCK_MODE=true) for local end-to-end development without a live enforcer.
  • Added ThothDeferredError and LangGraph DEFER handling that raises without executing the tool and emits defer metadata in tool telemetry.
  • Added a thread-safe session call-history path for concurrent LangGraph branches via SessionContext.pending_tool_calls(...).
TypeScript SDK 0.1.19June 20, 2026Changed

Changed

  • Added configurable resilience mode via failOpen / THOTH_FAIL_OPEN. When enabled, enforcer transport failures and retryable statuses (429, 5xx) return ALLOW so tool execution can continue.
  • Auth failures (401/403) remain fail-closed and continue returning BLOCK.
  • Added regression tests for fail-open timeout/status behavior and auth-failure handling.
  • Added vendor-runtime compatibility regression tests for Datadog, LangSmith, OpenTelemetry, and Sentry coexistence with Thoth tool interception.
  • Added compatibility matrix CI coverage with per-stack TypeScript runtime test runs.
Python SDK 0.5.20June 15, 2026Added

Added

  • Added a LangGraph runtime enforcement example at examples/langchain/langgraph_runtime_enforcement.py that demonstrates observe and progressive enforcement flows using instrument_toolchain().
  • Added a companion policy example at examples/langchain/policies/research_agent.rego covering allow, step-up, block, and flag outcomes for a research-agent toolchain.
  • Added a cookbook notebook at examples/langchain/cookbook_agent_governance.ipynb with end-to-end shadow and enforce walkthroughs.
  • Added a reusable composite GitHub Action at .github/actions/thoth-policy-check/ for static policy checks against Python agent tool-call patterns.
  • Added a static analysis helper script at scripts/langchain/thoth_policy_check.py used by the action.
  • Added a vendor-neutral RFC issue draft for LangGraph tool interception hooks at docs/contributions/langchain_rfc_tool_hooks.md.
  • Added an engineering blog draft at docs/blog/langchain-runtime-enforcement.md.
Pulumi provider 0.1.12June 10, 2026Changed, Added, Fixed

Changed

  • Updated Terraform provider bridge dependency pin to github.com/atensecurity/terraform-provider-thoth v0.1.12.
  • Bumped Pulumi release defaults/examples to 0.1.12:
    • Makefile default VERSION
    • Node.js example package dependency (@atensec/pulumi-thoth)

Added

  • Pulumi bridge now exposes Terraform 0.1.12 MCP vendor registry and catalog verification surfaces:
    • McpVendor resource
    • getMcpVendors data source
    • McpCatalogVerify resource
    • getMcpInventoryReport data source

Fixed

  • Inherited Terraform 0.1.12 stabilization for MCP vendor hostPatterns ordering so Pulumi up/refresh operations converge deterministically when API response ordering differs.
Thoth CLI and MCP proxy 0.3.5June 10, 2026Added, Changed

Added

  • Added MCP vendor registry and catalog verification command surfaces in thothctl to align CLI capability with current control-plane governance APIs.

Changed

  • Updated release automation and public distribution flow for thoth and thothctl so production release tags drive Homebrew package publication from signed assets.
Terraform provider 0.1.12June 9, 2026Added, Fixed

Added

  • Added MCP vendor registry support:
    • thoth_mcp_vendor resource
    • thoth_mcp_vendors data source
  • Added MCP inventory and verification surfaces:
    • thoth_mcp_inventory_report data source
    • thoth_mcp_catalog_verify resource

Fixed

  • Stabilized thoth_mcp_vendor.host_patterns state behavior to avoid apply/read inconsistencies caused by server-side ordering differences.

Earlier releases

Combined release-line notes up to June 8, 2026.

v0.1.18 / v0.3.4June 8, 2026

Enterprise release pathway: Homebrew tap + notarized PKG + supply-chain trust metadata

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.17
  • Python SDK: unchanged at sdk/python/v0.1.16
  • TypeScript SDK: unchanged at sdk/npm/v0.1.18
  • Thoth proxy + thothctl binary line: thoth/v0.3.4
  • Terraform provider: unchanged at v0.1.11
  • Pulumi provider: unchanged at v0.1.11
⚡
Improvements

Enterprise distribution and verification

  • Added Homebrew tap publication flow for atensecurity/homebrew-tap.
  • Added notarized macOS PKG release pathway for MDM deployments (Jamf/Intune/Kandji).
  • Published Santa trust metadata (santa-metadata.json) and signing metadata for endpoint allowlisting.
  • Expanded release metadata set: SBOMs (CycloneDX + SPDX), provenance, immutable manifest, checksums, and Sigstore keyless signatures.
  • Added documentation runbooks for release channels, Santa trust policy, Kandji deployment, and deployment validation matrix.
v0.1.18 / v0.3.3May 14, 2026

MODIFY, DEFER, and complete MOSES decision envelope across Python, Go, and TypeScript

This release line publishes:

  • Go SDK: sdk/go/v0.1.17
  • Python SDK: unchanged at sdk/python/v0.1.16
  • TypeScript SDK: sdk/npm/v0.1.18
  • Thoth proxy + thothctl binary line: unchanged at thoth/v0.3.3
  • Terraform provider: unchanged at v0.1.11
  • Pulumi provider: unchanged at v0.1.11
✦
New Features

Two new decision outcomes

  • MODIFY — the enforcer rewrites tool arguments before execution. The governed wrapper calls the tool with the modified args. PolicyViolationError / ThothPolicyViolation is not raised — execution proceeds with policy-applied arguments. The audit trail carries both the original request and the modification reason.
  • DEFER — the enforcer signals the caller to retry after a specified timeout. Different from STEP_UP: no human approval required, time-bounded, and recoverable by design. The error surfaces deferTimeoutSeconds / DeferTimeoutSeconds for caller-side retry logic.

Legacy enforcer aliases normalize automatically: TRANSFORM→MODIFY, HOLD/DEFERRED→DEFER, DENY→BLOCK, CHALLENGE/ESCALATE→STEP_UP.

Full MOSES ML decision envelope in SDK error types

PolicyViolationError (Go) and ThothPolicyViolation (Python and TypeScript) now carry six new fields from the MOSES two-tier enforcement path:

FieldDescription
decision_envelope_version / DecisionEnvelopeVersionSchema version of the enforcer response — for forward-compatibility checks
enforcement_trace_id / EnforcementTraceIDCorrelation ID following the request through enforcer → fast-ML → deep-LLM
fastml_features / FastMLFeaturesONNX fast-ML feature vector used to score the request
score_components / ScoreComponentsComposite risk score breakdown by component (scope, velocity, identity binding, etc.)
top_contributors / TopContributorsRanked list of highest-weight features that drove the decision
decision_evidence / DecisionEvidenceRaw evidence fields from the enforcer response envelope

These fields are available directly on the caught exception — no additional API calls needed for incident reporting or audit trail reconstruction.

⚡
Improvements

Canonical observe mode

shadow is no longer part of the public SDK surface. The canonical enforcement mode is observe. The enforcer and all three SDKs continue to accept shadow as an alias — no config changes required in running deployments.

Expanded policy context propagation

ThothConfig / Config now accepts environment, enforcement_trace_id, session_intent, purpose, data_classification, and task_context. All fields are forwarded on every enforcement call.

HTTP diagnostics

Improved error messages for 401/403 enforcer responses with actionable hints about API key scope and ingest token configuration.

v0.1.17 / v0.3.3May 10, 2026

Proxy 0.3.3 and provider 0.1.7 release alignment

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.15
  • Python SDK: sdk/python/v0.1.16
  • TypeScript SDK: sdk/npm/v0.1.17
  • Thoth proxy + thothctl binary line: thoth/v0.3.3
  • Terraform provider: v0.1.7
  • Pulumi provider: v0.1.7
⚡
Improvements

Docs and release consistency

  • Promoted Thoth CLI/proxy docs to the thoth/v0.3.3 binary line.
  • Standardized provider references on v0.1.7 across Terraform and Pulumi docs.
v0.1.16 / v0.3.0May 5, 2026

Org API key auth for IaC + Thoth 0.3.0 release line

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.15
  • Python SDK: unchanged at sdk/python/v0.1.15
  • TypeScript SDK: unchanged at sdk/npm/v0.1.16
  • Thoth proxy + thothctl binary line: thoth/v0.3.0
  • Terraform provider: v0.1.3
  • Pulumi provider: v0.1.2
⚡
Improvements

Infrastructure-as-code provider releases

  • Added org-level API key auth for provider workflows and preserved bearer-token compatibility.
  • Standardized CI/CD auth through THOTH_API_KEY for Terraform and Pulumi provider usage.
  • Updated provider release notes and docs for dual-auth guidance.

Thoth binary line release

  • Published thoth/v0.3.0 and aligned customer-facing install/version references.
  • Updated release docs to reflect the current stable binary line for thoth and thothctl.
v0.1.15 / v0.2.23April 30, 2026

Canonical release lines, Secrets Broker GA docs, and ingest resilience

This release line publishes:

  • Go SDK: sdk/go/v0.1.14
  • Python SDK: sdk/python/v0.1.14
  • TypeScript SDK: sdk/npm/v0.1.15
  • Thoth endpoint runtime: thoth/v0.2.23
⚡
Improvements

Release and upgrade clarity

  • Standardized customer docs on canonical release channels (thoth/v* for endpoint runtime, sdk/* for SDKs).
  • Updated install and quick-reference pages to reflect current stable versions and package constraints.

Operator workflows

  • Added customer-ready strict-mode Secrets Broker examples for MCP tools (for example Figma, Notion, and Stitch host bindings).
  • Documented fail-closed token handling patterns for endpoint runtime use without storing long-lived tokens in local tool config.

Runtime resilience

  • Hardened telemetry ingest behavior for intermittent 403/edge enforcement failures to reduce dropped event noise and improve operator troubleshooting.
v0.1.14 / v0.2.22April 28, 2026

SDK log-level controls + governance envelope hardening

This release line publishes:

  • Go SDK: sdk/go/v0.1.13
  • Python SDK: sdk/python/v0.1.13
  • TypeScript SDK: sdk/npm/v0.1.14
  • Thoth endpoint runtime: thoth/v0.2.22
⚡
Improvements

SDK diagnostics and enforcement traceability

  • Added SDK log-level controls across Go, Python, and TypeScript for cleaner operator debugging.
  • Improved STEP_UP token and enforcement trace diagnostics to make approval-path troubleshooting faster.

Thoth control-plane hardening

  • Unified auth/delegation envelope fields across control-plane and runtime services.
  • Added stricter default purpose-class enforcement and promotion lifecycle guardrails.
  • Hardened model-router policy behavior and admin settings integration for safer runtime rollout control.
  • Clarified API key redaction output and governance feed query UX.
v0.5.5 / v0.2.20April 27, 2026

Tenant-scoped telemetry and API-key hardening

This release line publishes:

  • Go SDK: sdk/go/v0.1.11
  • Python SDK: sdk/python/v0.5.4
  • TypeScript SDK: sdk/npm/v0.5.5
  • Thoth endpoint runtime: thoth/v0.2.20
⚡
Improvements

SDK telemetry isolation

  • Go, Python, and TypeScript SDK ingestion paths now align to tenant-scoped telemetry/event IDs to avoid cross-tenant event collisions.
  • Instrumentation payload models were updated to preserve scoped event identity throughout ingest and normalization.

Endpoint runtime management

  • Improved API key management UX and guidance for scope-aware authorization.
  • Set a secure 90-day default API key expiry with proactive warnings for near-expiry keys.
  • Fixed shadow mode STEP_UP visibility so review-to-agent-registry flows surface approval state consistently.
v0.5.4 / v0.2.19April 26, 2026

In-place runtime update experience

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.10
  • Python SDK: unchanged at sdk/python/v0.5.3
  • TypeScript SDK: unchanged at sdk/npm/v0.5.4
  • Thoth endpoint runtime: thoth/v0.2.19
⚡
Improvements

Lifecycle management

  • Added in-place update workflows for endpoint runtime and admin tooling.
  • Each command checks GitHub Releases, verifies asset checksums (checksums.sha256), and installs only verified binaries.
  • --force is supported for explicit reinstallation of the latest release.

Customer docs

  • Updated external docs to reflect current Thoth binary line v0.2.19.
  • Added update workflow guidance so operators can keep binaries current without reinstall scripts.
v0.5.4 / v0.2.18April 26, 2026

Scoped key reliability + SDK ingest auth parity

This release line publishes:

  • Go SDK: sdk/go/v0.1.10
  • Python SDK: unchanged at sdk/python/v0.5.3
  • TypeScript SDK: sdk/npm/v0.5.4
  • Thoth endpoint runtime: thoth/v0.2.18
⚡
Improvements

SDK ingest reliability

  • Go and TypeScript SDK emitters now send both Authorization: Bearer ... and X-Api-Key headers on ingest calls to match enforcer/runtime expectations.
  • Non-2xx ingest failures now log the HTTP status, target URL, and a safe response-body snippet to speed up debugging.

API key management

  • API key creation and authorization flows now support explicit scope selectors:
    • --organization
    • --fleet-id
    • --endpoint-id
    • --agent-id
  • Command help now explains key scope vs runtime context matching in plain language.
  • Authorization output now includes clear hints when validation fails due to expiry, permission mismatch, or scope mismatch.

Operator docs

  • Public runbooks now use explicit scope flags in API key command examples so customer operators can copy/paste known-good commands.
v0.1.6 / v0.2.8April 24, 2026

Python SDK ThothClient Backward-Compatibility Export

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.5
  • Python SDK: unchanged at sdk/python/v0.1.6
  • TypeScript SDK: unchanged at sdk/npm/v0.1.6
  • Thoth binary line: unchanged at thoth/v0.2.8
⚡
Improvements

Python SDK (atensec-thoth)

  • Restored from thoth import ThothClient compatibility export.
  • Added legacy method aliases (wrap, wrap_openai_tools, wrap_anthropic_tools) that delegate to current instrument* APIs.

Documentation

  • Python SDK README now includes a legacy compatibility section for ThothClient.
  • Docs-site Python SDK reference now calls out preferred module-level APIs and legacy ThothClient support.
v0.1.6 / v0.2.8April 22, 2026

Headless operations improvements

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.5
  • Python SDK: unchanged at sdk/python/v0.1.6
  • TypeScript SDK: unchanged at sdk/npm/v0.1.6
  • Thoth endpoint runtime: thoth/v0.2.8
⚡
Improvements

Fleet management + MDM providers

  • Added tenant-scoped MDM provider configuration and sync workflows for Jamf and Intune.
  • Fleet management now supports on-demand provider inventory synchronization to upsert endpoint records.
  • Provider sync now supports default fleet and environment mapping for imported endpoints.

Headless control plane

  • Admin tooling is now documented as the default path for no-dashboard bootstrap and updates.
  • New headless operations section covers API-driven and automation-driven orchestration patterns.
  • Documentation now emphasizes customer-run automation workflows without dashboard dependency.
  • SIEM/PAM integration guidance is now aligned to API-first and CI-driven operations.
  • Added browser control-plane workflows for provider, policy, and enrollment management across supported browsers.
  • Added browser sync workflows for endpoint-side policy resolution and managed artifact application (applied/rendered/dry_run) to support mixed browser fleets.

Manual endpoint enrollment

  • Fleet management now provides generated re-enrollment scripts for endpoints not associated with a fleet.
  • Direct endpoint enrollment supports optional fleet assignment through THOTH_FLEET_ID.
  • Endpoint health state remains current through periodic proxy check-ins.

Documentation

  • Added external-facing docs for MDM provider sync and manual endpoint enrollment flow.
  • Proxy install docs now default to thoth/v0.2.8.
  • Added public-platform delivery workflows: Terraform-based public repo bootstrap and CI mirroring for provider/runbook content.
v0.1.6 / v0.2.7April 21, 2026

Proxy Identity Defaults + Enforcer Context-Diff Warnings

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.5
  • Python SDK: unchanged at sdk/python/v0.1.6
  • TypeScript SDK: unchanged at sdk/npm/v0.1.6
  • MCP Proxy: thoth/v0.2.7
⚡
Improvements

MCP Proxy (thoth binary)

  • Endpoint identity resolution now defaults to immutable machine identity (Intune/Jamf managed ID override, then OS machine ID), with hostname only as last-resort fallback.
  • THOTH_USER_ID remains required and must be a valid email address.
  • enforcer_url and govapi_url are inferred from tenant_id + apex_domain.
  • --enforcer-url / THOTH_ENFORCER_URL are now deprecated and ignored.

Enforcer

  • Requests with valid keys now proceed even when endpoint/fleet scope context does not match exactly; enforcer emits warnings for follow-up.
  • Tenant user-domain mismatches are now warn-only when key validation succeeds.

Documentation

  • Customer docs now reflect thoth/v0.2.7 defaults for identity, URL inference, and runtime env expectations.
v0.1.6 / v0.2.3April 20, 2026

Wrap-Config Env Injection + Simpler Endpoint Routing

This release line publishes:

  • Go SDK: unchanged at sdk/go/v0.1.5
  • Python SDK: unchanged at sdk/python/v0.1.6
  • TypeScript SDK: unchanged at sdk/npm/v0.1.6
  • MCP Proxy: thoth/v0.2.3
⚡
Improvements

MCP Proxy (thoth binary)

  • thoth wrap-config now supports repeatable --env KEY=VALUE to inject runtime environment values directly into selected MCP server entries.
  • Wrap output remains idempotent and now reports environment changes when values are updated.
  • Fleet registration URL handling is simplified:
    • govapi_url is derived automatically from tenant_id + apex_domain as https://grid.<tenant>.<apex-domain>.
    • enforcer_url is derived automatically as https://enforce.<tenant>.<apex-domain> when not explicitly set.
    • legacy gov_api_url compatibility paths are removed.
  • Runtime identity hardening:
    • THOTH_USER_ID must be a valid email address.
    • customer domain policy is enforced centrally by enforcer tenant metadata (admin-managed), with automatic request blocking for non-matching user domains.

Documentation

  • Customer-facing docs are updated for v0.2.3.
  • Proxy setup examples now use supported wrap-config flags and document inline environment injection via --env.
v0.1.6 / v0.2.2April 19, 2026

Fail-Closed Enforcement + Canonical Contract Parity

This release line publishes:

  • Go SDK: sdk/go/v0.1.5
  • Python SDK: sdk/python/v0.1.6
  • TypeScript SDK: sdk/npm/v0.1.6
  • MCP Proxy: thoth/v0.2.2
⚡
Improvements

Proxy + SDK enforcement behavior

  • Go and proxy paths now enforce fail-closed posture on enforcer/runtime failures.
  • Enforcement payload contract is normalized to canonical fields:
    • tool_args
    • enforcement_trace_id
    • user_id, approved_scope, session_intent, session_tool_calls
  • Session tool-call history is bounded to the latest 128 calls for parity across Go and proxy paths.

Documentation

  • Docs now reflect fail-closed behavior in SDK guidance and security posture sections.
  • Version banners and docs-site changelog are updated for the latest SDK/proxy releases.
v0.1.3 / v0.2.0April 15, 2026

Telemetry Metadata + Policy Context Propagation

This release publishes:

  • Go SDK: unchanged at sdk/go/v0.1.2
  • Python SDK: sdk/python/v0.1.3
  • TypeScript SDK: sdk/npm/v0.1.3
  • MCP Proxy: thoth/v0.2.0 (public release: atensecurity/thoth v0.2.0)
⚡
Improvements

Python SDK (atensec-thoth)

  • BehavioralEvent now includes endpoint context fields:
    • endpoint_id
    • hostname
  • BehavioralEvent now includes WORM chain evidence fields:
    • chain_index
    • hash
    • previous_hash
    • signature
  • Dependency lock/metadata refreshed as part of the SDK patch line.

TypeScript SDK (@atensec/thoth)

  • Enforcer payload now propagates:
    • tool_args
    • user_id
    • metadata.policy_context
    • enforcement_trace_id
  • ThothConfig adds:
    • policyContext
    • enforcementTraceId
  • Instrumentation now serializes tool call arguments safely before enforcement checks.

MCP Proxy (thoth binary)

  • Emitted events now include normalized top-level endpoint metadata:
    • endpoint_id
    • hostname
  • Event metadata includes hostname consistently for downstream pipelines.
  • MCP proxy distribution now uses the cross-platform thoth binary release line.
  • Docs + install path standardized to:
    • curl -fsSL https://install.atensecurity.com/thoth | sh
    • GitHub release assets from atensecurity/thoth
v0.1.2April 10, 2026

Tenant API URL Contract + Session Intent Enforcement

This release publishes v0.1.2 for all Thoth SDKs:

  • Go: sdk/go/v0.1.2
  • Python: sdk/python/v0.1.2
  • TypeScript: sdk/npm/v0.1.2
⚡
Improvements

Unified SDK API URL contract

  • Go, Python, and TypeScript SDKs now use a single tenant API URL for both:
    • policy enforcement (POST /v1/enforce)
    • behavioral event ingestion (POST /v1/events/batch)
  • SDK startup now requires tenant API URL configuration via:
    • explicit config (APIURL / api_url / apiUrl)
    • or THOTH_API_URL
  • Removed SDK fallbacks to hosted global defaults and split endpoint semantics.

Go SDK

  • NewClient now fails fast when APIURL is missing.
  • Examples and tests updated to pass THOTH_API_URL explicitly.
  • SDK docs now include required env setup and quickstart examples.

Python SDK

  • ThothConfig now requires tenant API URL resolution (api_url or THOTH_API_URL) and enforces a single URL contract.
  • resolved_enforcer_url now follows the single-URL contract and mirrors resolved_api_url.
  • session_intent is now accepted in config and passed to enforcement payloads.
  • Step-up polling now sends auth headers when api_key is present.

TypeScript SDK

  • Removed HOSTED_API_URL fallback and split enforcer semantics.
  • instrument() now throws at startup when apiUrl/THOTH_API_URL is missing.
  • Enforcement and event emission now route through the same tenant API URL.
  • sessionIntent is now supported in config and forwarded to enforcement payloads.
  • Runtime/test baseline updated and validated for Node.js 18+ compatibility.
v0.1.1March 31, 2026API Contract Fixes

This patch release fixes critical mismatches between the Go and TypeScript SDKs and the enforcement API. All SDK consumers on v0.1.0 should upgrade.

⚠
Bug Fixes

Go SDK (github.com/atensecurity/thoth-go)

  • Critical enforcement compatibility and decision-handling fixes across request/response mapping.
  • Endpoint and schema alignment updates for stable enforcement and step-up behavior.
  • Improved client metadata propagation and response observability fields.

TypeScript SDK (@atensec/thoth)

  • emitBehavioralEvent was not exported from the package root. It is now accessible via import { emitBehavioralEvent } from "@atensec/thoth".

REST API documentation

  • All endpoint paths, request field names (corrected to snake_case), response schemas, and HTTP status codes in the API reference now match the actual backend.
v0.1.0March 30, 2026

First General Availability Release

This is the first general-availability release of the Thoth SDK. All three language SDKs (Python, Go, TypeScript) are stable and production-ready.

✦
New Features

Hosted API — single API key, zero infrastructure

The Thoth enforcement and event ingestion API is now hosted at https://api.atensecurity.com. Authentication requires a single THOTH_API_KEY — no AWS credentials, no infrastructure setup. All three SDKs pick it up automatically from the environment.

export THOTH_API_KEY="thoth_live_your_key_here"

Python SDK (thoth-sdk)

  • instrument(agent, ...) — Instrument any AI agent with a .tools attribute. Auto-detects LangChain AgentExecutor and CrewAI Agent via duck-typing.
  • instrument_anthropic(tool_fns, ...) — Wrap tool execution functions for Anthropic Claude agentic loops. Returns a governed dict[str, Callable].
  • instrument_openai(tool_fns, ...) — Wrap tool execution functions for OpenAI tool-calling loops.
  • ThothPolicyViolation exception — raised when the enforcer blocks a tool call. Fields: tool_name, reason, violation_id.
  • get_current_session() — Access the active session context from within a governed tool call.
  • ThothConfig — Pydantic model with full field validation.
  • EnforcementMode enum — observe | progressive | step_up | block.
  • LangGraph and CrewAI integrations — auto-detected via duck-typing.

Go SDK (github.com/atensecurity/thoth-go)

  • NewClient(Config) — Initialize the Thoth client with env-var fallback.
  • Client.WrapTool / Client.WrapToolFunc — wrap string and map tool functions.
  • Client.StartSession(ctx, agentID, sessionID) — per-request session isolation.
  • PolicyViolationError, StepUpRequiredError — typed error values.
  • Fail-open guarantee — enforcer unreachable never blocks tool execution.

TypeScript SDK (@atensec/thoth)

  • instrument<T>(agent, config) — generic agent instrumentation; preserves TypeScript types.
  • wrapAnthropicTools / wrapOpenAITools — sub-path imports for framework-specific wrappers.
  • ThothPolicyViolation — extends Error. Fields: toolName, reason, violationId.
  • EnforcementMode enum, ThothConfig interface, BehavioralEvent interface.
  • Async generator support and strict: true compilation.

REST API (https://api.atensecurity.com)

  • POST /v1/events/batch — up to 100 events per batch; idempotent via event_id; 90-day retention.
  • POST /v1/enforce — returns ALLOW | BLOCK | STEP_UP with progressive anomaly scoring.
  • GET /v1/enforce/hold/{hold_token} — returns pending | approved | denied | expired.
  • Rate limits: 1,000 req/min (events), 500 req/min (enforce), 200 req/min (hold) per tenant.
⚡
Enforcement Modes
ModeBehavior
observeLog and emit events only. Never block.
progressiveEscalating enforcement based on session anomaly scoring. Default.
step_upAlways require human approval for out-of-scope tools.
blockImmediately reject with ThothPolicyViolation.

Previous

CRD Reference

Next

Changelog

On this page