[ca] Update MCP Gateway to v0.1.5

[github-actions]

Update Summary

• Tool: MCP Gateway (ghcr.io/github/gh-aw-mcpg)
• Previous Version: v0.1.4
• Latest Version: v0.1.5
• Breaking Changes: Yes
• Update Priority: High (breaking config validation changes)

constants.go has been updated and make recompile completed successfully (158/158 workflow files).

---

Breaking Changes

The following configuration validation changes require updates to existing configs:

1. Docker required for TOML stdio servers (Enforce Docker containerization requirement for TOML stdio servers gh-aw-mcpg#1029): TOML-configured stdio servers must now use command = "docker". Direct command execution without containerization is rejected at startup.
2. Explicit mount mode required (fix(compliance): require explicit mount mode in volume mount validation gh-aw-mcpg#1231): Volume mount entries in server configs must now include an explicit mode field ("ro" or "rw"). Mounts without a declared mode are rejected.
3. mounts field rejected for HTTP servers (Reject mounts field for HTTP servers (T-CFG-019) gh-aw-mcpg#1122): HTTP-type server configurations that include a mounts field now fail validation with a clear error.

Key Features

• MCP Spec v1.8.0 compliance (Update MCPGatewaySpecVersion to 1.8.0 gh-aw-mcpg#1065): Gateway now targets spec version 1.8.0.
• Integrated MCP SDK logging (Integrate project logger with MCP SDK ClientOptions and ServerOptions gh-aw-mcpg#1067): Full SDK-level visibility via DEBUG=* flag.
• Timeout enforcement for jq middleware (Add timeout enforcement and comprehensive tests for gojq middleware gh-aw-mcpg#961): Prevents runaway jq expressions from stalling request pipelines.

View Full Changelog

Release Highlights

This release focuses on compliance enforcement, reliability improvements, and MCP spec v1.8.0 alignment — tightening configuration validation, improving observability through integrated SDK logging, and eliminating numerous duplicate code patterns.

Bug Fixes & Improvements

• Fixed SSE JSON-RPC parsing on HTTP error paths (Fix SSE JSON-RPC parsing for HTTP error paths gh-aw-mcpg#1085)
• Updated tool logging format for improved readability (Copilot/update tool logging format gh-aw-mcpg#1243)
• Consolidated duplicate variable expansion logic (Consolidate duplicate variable expansion logic gh-aw-mcpg#1014)
• Centralized PayloadPreviewSize constant (Centralize jq payload preview size configuration gh-aw-mcpg#1066)
• Added nightly workflow auto-upgrader for gh-aw releases (Add nightly workflow to upgrade workflows to latest gh-aw releases gh-aw-mcpg#986)

Documentation

• Fixed payloadSizeThreshold configuration docs (all 3 config methods) (docs: fix payloadSizeThreshold config options and DOCKER_API_VERSION description gh-aw-mcpg#1233)
• Fixed 5 documentation discrepancies from nightly docs reconciliation (docs: fix 5 discrepancies from nightly documentation reconciliation gh-aw-mcpg#1123)
• Documented session persistence for stdio backends (Document existing session persistence implementation for stdio backends gh-aw-mcpg#1042)
• Documented BurntSushi/toml v1.6.0 and TOML 1.1 (Document BurntSushi/toml v1.6.0 usage and TOML 1.1 implementation gh-aw-mcpg#982)

Selected Merged PRs

• Enforce Docker containerization requirement for TOML stdio servers gh-aw-mcpg#1029 — Enforce Docker containerization for TOML stdio servers
• fix(compliance): require explicit mount mode in volume mount validation gh-aw-mcpg#1231 — Require explicit mount mode in volume mount validation
• Reject mounts field for HTTP servers (T-CFG-019) gh-aw-mcpg#1122 — Reject mounts field for HTTP servers
• Update MCPGatewaySpecVersion to 1.8.0 gh-aw-mcpg#1065 — Update MCPGatewaySpecVersion to 1.8.0
• Integrate project logger with MCP SDK ClientOptions and ServerOptions gh-aw-mcpg#1067 — Integrate project logger with MCP SDK ClientOptions and ServerOptions
• Add timeout enforcement and comprehensive tests for gojq middleware gh-aw-mcpg#961 — Add timeout enforcement for gojq middleware
• Fix SSE JSON-RPC parsing for HTTP error paths gh-aw-mcpg#1085 — Fix SSE JSON-RPC parsing for HTTP error paths
• Consolidate duplicate variable expansion logic gh-aw-mcpg#1014 — Consolidate duplicate variable expansion logic
• Add nightly workflow to upgrade workflows to latest gh-aw releases gh-aw-mcpg#986 — Add nightly workflow to upgrade to latest gh-aw releases

Full Changelog: github/gh-aw-mcpg@v0.1.4...v0.1.5

View Migration Guide

Config Migration Steps

1. TOML stdio servers: Ensure all TOML-configured stdio servers use command = "docker" — direct command execution is now rejected.

2. Volume mounts: Add explicit mode field to all volume mount entries:

   # Before (now rejected):
   mounts = ["/host/path:/container/path"]
   
   # After (required):
   # Use "ro" for read-only or "rw" for read-write

3. HTTP servers: Remove any mounts field from HTTP-type server configurations.

Docker Image

docker pull ghcr.io/github/gh-aw-mcpg:v0.1.5

Supported platforms: linux/amd64, linux/arm64

Impact Assessment

• Risk: High (breaking validation changes to MCP Gateway config)
• Affects: All workflows using sandbox.agent container and MCP Gateway configuration
• Migration: Review TOML server configs for Docker enforcement, explicit mount modes, and HTTP server mount fields

Recommendations

1. Review all MCP Gateway configurations for the 3 breaking changes above
2. Test with updated container image before rolling out to production workflows
3. Update any TOML stdio server configs to use Docker containerization

Package Links

• Repository: https://github.com/github/gh-aw-mcpg
• Release Notes: https://github.com/github/gh-aw-mcpg/releases
• Specific Release: https://github.com/github/gh-aw-mcpg/releases/tag/v0.1.5
• Docker Image: https://github.com/github/gh-aw-mcpg/pkgs/container/gh-aw-mcpg

---

No Other Updates

The following tools are current as of 2026-02-22:

Tool	Version	Status
Claude Code	2.1.50	✅ Up to date
Copilot CLI	0.0.414	✅ Up to date
Codex	0.104.0	✅ Up to date
GitHub MCP Server	v0.31.0	✅ Up to date
Playwright MCP	0.0.68	✅ Up to date
Playwright Browser	v1.58.2	✅ Up to date

References:

• §22274799991

Generated by CLI Version Checker

• expires on Feb 24, 2026, 9:54 AM UTC