Changelog

What's new.

Stable releases. Follow along on GitHub.

v1.4.0Hardening release2026-07-31
  • ›Every enforcement surface now fails closed when it cannot confirm a call is allowed. An enforcing policy whose expression cannot be evaluated blocks the call rather than letting it through, and the full policy set is evaluated first, so one policy's error no longer drops another policy's match on the same span.
  • ›The MCP gateway and egress proxy fail closed: the gateway validates the upstream address and ignores any caller request to turn its enforcement off, and the egress proxy blocks until it has loaded the project's policy, rather than starting open.
  • ›Every SDK adapter fails closed when the receiver is unreachable, and policies are evaluated against the full tool arguments, so a padded argument cannot slip content past a rule.
  • ›Project and member operations are confined to the caller's organization, closing cases that could read or act across tenants. Creating an API key or deleting a project now requires re-authentication.
  • ›The audit anchor chain is protected against truncation, and its full history is limited to an instance admin while project readers see per-project tamper-evidence status.
  • ›Malformed input no longer crashes a request: an out-of-range value or a stray null byte is rejected cleanly instead of surfacing as a server error.
  • ›The dashboard list tables can be sorted by column and their columns shown or hidden, and the SDK can send traces through a custom exporter.
v1.3.0Intervention visibility, fail-closed evaluation2026-07-25
  • ›Interventions are visible end to end: every span where Strathon blocked, throttled, steered, or held a call for approval is marked through the SDK, persisted by the receiver, and shown in the dashboard.
  • ›Policy evaluation now fails closed: when the CEL engine cannot evaluate a request, the egress proxy and MCP gateway block it rather than let it through.
  • ›A missing HMAC key, encryption key, or password pepper can be made a hard startup failure instead of a warning, naming the variables that are missing; cloud deployments always enforce it.
  • ›A failure-model page documents what every component does when something breaks — which surfaces fail closed, which fail open, and why.
  • ›Losing the encryption key no longer locks a user out of MFA: hashed backup codes remain usable.
  • ›The SDK now requires Python 3.11 or newer.
v1.2.3Multi-party approvals, policy-matching fixes2026-06-28
  • ›Multi-party approvals: a require_approval policy can now require a quorum of distinct approvers (N-of-M) before an action proceeds, not just a single approval.
  • ›Approval expiry notifications: when a pending approval times out and is auto-denied, an expiry notice now goes to the configured Slack and Discord channels, so a lapsed approval is no longer silent.
  • ›Policy matching: the policy templates, the plain-English generator, and the reference docs now use the exact CEL attribute keys the engine emits, so policies built from them match as intended.
  • ›Cost-based policies: per-call token cost is now recorded on spans, so log and alert policies can read it.
  • ›Per-framework enforcement guidance: the framework docs now state which surfaces each framework enforces on, so you can confirm coverage beyond the instrumented client.
v1.2.2Audit hardening, dashboard improvements2026-06-20
  • ›Tamper-evident audit log: the Merkle anchoring now follows RFC 6962 / RFC 9162. Existing anchors are unaffected, so no re-anchoring is required.
  • ›Audit integrity in the dashboard: the audit log header shows the chain-anchor state, and any entry can be inspected to recompute and check its keyed hash against the receiver.
  • ›Budget forecasting: end-of-month forecast and remaining headroom with a per-agent spend breakdown, and the overview spend trend reads the same cost data.
  • ›Compliance evidence export: download evidence mapped to the EU AI Act and OWASP from the receiver as JSON or SARIF.
  • ›Span kinds are color-coded across the trace waterfall and the spans list from a shared palette, with blocked spans highlighted; the selected span also shows token and cost detail where present.
  • ›A new overview agent-health card surfaces each agent's liveness and risk at a glance, sharing data with the Agents page so the two stay consistent.
v1.2.1Bug fixes2026-06-17
  • ›Fixed a crash on the trace detail page that prevented it from loading.
  • ›Approval cards now show the agent that triggered the call instead of "unknown agent".
  • ›Fixed dashboard search placeholders that rendered a literal escape sequence instead of an ellipsis.
v1.2.0Human approvals, broader detection, account recovery2026-06-16
  • ›Human-in-the-loop approvals now work end to end: a require_approval policy opens a pending approval the held tool call waits on, resumed or denied on the human decision, with optional Slack, Discord, webhook, or GitHub routing.
  • ›Notification channels: route approvals, incidents, policy interventions, and budget alerts to Slack, Discord, a generic webhook, or GitHub issues, with per-channel event selection from the dashboard.
  • ›Broader PII detection (crypto wallets, IBAN, IPv6, US ITIN, India Aadhaar, all checksum-validated) and credential detection across modern AI providers and SaaS platforms.
  • ›Break-glass account recovery: strathon-admin reset-password resets a locked-out owner's password and optionally clears MFA directly against the database, with no running receiver required.
  • ›The seeded development API key is now opt-in (STRATHON_SEED_DEV_KEY) and never seeded in cloud mode; local docker compose opts in so the quickstart still works out of the box.
  • ›Consent-based ownership transfer: the owner sends a request an existing admin accepts or declines before any role changes. Sensitive member actions now require the caller to outrank the target, enforced server-side.
  • ›Users can change their own password and display name from the dashboard; changing a password requires a current MFA code when MFA is enabled.
  • ›Dashboard: an enforcement-mix overview, per-agent budget spend, a usage section, and a span-derived activity log on the trace detail view.
  • ›CLI key management (strathon keys list/create/rotate/revoke), an `allow` action selectable from the CLI and dashboard, a PEP 561 py.typed marker for the SDK, and official Python 3.13 support.
  • ›Relicensed the receiver and CLI to Apache-2.0, so the whole project is now uniformly Apache-2.0. The dashboard moves to Node 24 (current LTS), with dependencies refreshed across the SDK and dashboard.
v1.1.0First pre-release2026-06-06
  • ›CEL policy engine: seven actions (block, steer, throttle, log, alert, require_approval, allow), allow-list mode, time-based rules, policy versioning, shadow mode, and OWASP-mapped templates.
  • ›Human oversight: multi-party (N-of-M) approval workflows, kill-switch halts, SDK poll-based approval.
  • ›Data plane: OTLP protobuf ingest, RANGE-partitioned spans, span search and full-text search, aggregation, trace tree, PII redaction, sampling, retention.
  • ›10 framework integrations, fail-closed mode, per-key scoped auth; RBAC, Argon2id auth, TOTP MFA, API key rotation; tamper-evident HMAC-SHA256 audit log with Merkle anchors.
  • ›CLI: create policies from OWASP templates (--template), from plain English (--from-english), or by bulk import; dry-run a policy against recent traces (policies test).
  • ›Compliance: EU AI Act evidence export (Articles 9–15, 19), agent inventory with risk scoring, agent topology map, OWASP Agentic Applications 2026 mapping (ASI01–ASI10).
  • ›Self-host with Docker Compose, including PgBouncer connection pooling; per-framework integration guides for all 10 frameworks; enterprise scaling guide.
  • ›Published to PyPI: pip install strathon.