Skip to main content

Version 1.18.7.11

Release Date: November 12, 2026 Release Type: Stable

Automatically generated change list for this version.

Backend Server​

New Features​

  • mcp: Answer a server's shutdown notice beside its tool catalog
  • simulation: A Live Test runs with what its deployed flow runs with
  • mcp: Mutual TLS from a keystore and a trusted server certificate for MCP servers
  • mcp: Keep every pod's MCP server registry in step with the database
  • mcp: Record the MCP node's connector-log steps in production
  • oauth2: Renew Authorization Code (PKCE) credentials from their stored refresh token

Bug Fixes​

  • mcp: Record the request the MCP node builds as text in Connector Logs
  • mcp: Record the MCP server address (secrets masked) in Connector Logs
  • mcp: Restart the MCP server and global configuration listeners when PostgreSQL drops them
  • simulation: A quiet stream stays open behind a proxy
  • simulation: Any pod answers for a run, so a balanced address does not fail it
  • monitoring: A continued message's success clears the failed attempt's text
  • alerts: No alert leaves for a Dry Run or a Mock
  • simulation: A Live Test leaves its monitoring row, and the panel lists each node once
  • simulation: A mock that stands in for a failed call fails the node
  • simulation: A SOAP Dry Run reaches the End, and a mock marks only its own node
  • simulation: A failure the flow handled itself ends the run as FAILED
  • credential: Send username and password with a password grant whose client goes as Basic
  • mcp: No retry unless the node's Max Retries asks for it
  • mcp: Say a host name DNS does not know, not "connection refused"
  • mcp: Read a REST Start's byte body as text for the tool arguments
  • mcp: A corrected Bearer, Basic or API key credential reaches the running client
  • mcp: Say when a server did not answer, and let its config set how long to wait
  • connector-log: A readable MCP send failure, and no steps for MIP's own database writes
  • mcp: Read the MCP server registry through the default DataSource
  • oauth2: Keep the renewed access token and its expiry in the credential's token row
  • oauth2: Cache a short-lived token for half its life
  • mcp: Drop the SDK's stack-trace warning for a server that offers no event stream
  • mcp: A Basic credential without a password sends "user:", and failures name the credential
  • mcp: A mocked tool error fails the node; nulls in the tool's data reach the caller
  • mcp: Say why a call to an MCP server failed, and do not retry what cannot change
  • mcp: Refuse tool arguments that are not a JSON object
  • credentials: A credential name that is not a Basic credential resolves as not found (B2)
  • credentials: A Basic credential without a password sends an empty one; an escape a stored value already holds is kept (B7, B4)
  • oauth2: Credential values with %, & or + reach the token endpoint as stored (B4)
  • mcp: Say so when an MCP server URL is not http:// or https:// (B1)
  • mcp: Forget an OAuth2 token the MCP server refused (B8)
  • oauth2: Take the refresh lock only for refresh-token grants; lazy token-source wiring
  • mcp: Fail the flow when an MCP tool reports an error (G6)
  • oauth2: Run one refresh grant per credential across threads and nodes
  • mcp: Name the token endpoint's OAuth2 error when a grant fails
  • mcp: Authenticate OAuth2 MCP servers with the granted token; keep rotated refresh tokens
  • mcp: Let a replaced MCP client finish its running calls before closing
  • mcp: Keep an MCP server's credential across a backend restart
  • mcp: Name the HTTP status and the server's reason of a refused refresh
  • mcp: Use a corrected credential without re-saving the MCP server
  • mcp: Name the reason when refreshing an MCP server's tools fails
  • mcp: Call a streamable-HTTP server on its configured path (BUG-MCP-STREAMABLE-PATH-001)

Other Changes​

  • Revert(oauth2): send Send As Body credential values unescaped again (B4 out, known bug 123)

Frontend Server​

New Features​

  • mcp: Store a server's shutdown notice and list it with the server
  • mcp: A client certificate keystore and a TLS server certificate on an MCP server
  • mcp: Broadcast an MCP server's change to every backend pod
  • oauth2: Authorization Code (PKCE) sign-in for MCP servers (H4, H5, H7, H8)

Bug Fixes​

  • simulation: Keep a run's stream open past the container's 30 seconds
  • simulation: Read a run's answer as text, so a missing Content-Type is not a 502
  • oauth2: Make the Refresh Token screen's backend answer what the screen needs
  • mcp: Install the MCP server trigger through the primary DataSource
  • simulation: Check an idle backend connection before reusing it
  • global-config: Refuse configuration keys MIP uses itself
  • security: OAuth2 credential token endpoints are DEVELOPER/ADMIN
  • oauth2: The refused-callback page names both ways to start the login again
  • oauth2: Readable OAuth callback page; token requests as a form by default (H6, H9)
  • oauth2: Keep every token a token response carries (H10, H11)
  • mcp: Answer a created MCP server with its id
  • mcp: Answer a failed tool refresh as an error with its reason

Frontend Web​

New Features​

  • mcp: Warn on the MCP Servers list before a server stops working
  • mcp: Fetch a server's tools from its window, so Default Tool lists them
  • credentials: Create and edit API Key credentials
  • mcp: Choose a client certificate keystore and a TLS server certificate on the MCP server form
  • mcp: Open the Connector Logs tab of the MCP node
  • oauth2: Authorization Code (PKCE) sign-in in the credential form and row menu (H4, H5, H7, H8)

Bug Fixes​

  • flow-configuration: Keep Add disabled until the row's flow has loaded
  • mcp: A refreshed server row drops the shutdown notice and error it no longer has
  • credentials: Refresh Token Settings shows the stored settings when reopened
  • mcp: Put the Default Tool help, its fetch error and Enabled on their own lines
  • credentials: Store POST, not GET, when the Refresh Token method is left empty
  • mcp: Name the server default in the tool fields; type a default tool before the first connection
  • simulation: Show the reason a stream was refused
  • simulation: Say in the Live Test dialog that it runs like the deployed flow
  • simulation: A failed step opens by itself on the results
  • simulation: A dropped stream no longer leaves the panel on "running"
  • credentials: Save the Auth Code settings and label the token type on Refresh Token Settings
  • credentials: Clear "Add as Basic Authentication" when Send As leaves Body
  • credentials: Spell the OAuth2 field "Token URL"
  • global-config: Say before saving that a key is a name MIP uses itself
  • mcp: Keep a tool the server's catalog no longer lists, and say so
  • oauth2: An absolute callback when the screens and the API share one origin
  • service-users: The e-mail is required on create, as the server requires it (G1)
  • oauth2: Mint the Authorization Code state when Get Auth Code is pressed (H6)
  • mcp: Show an MCP node's server and tool in Show Full Log
  • mcp: Connect to a new MCP server right after it is created
  • mcp: Show why an MCP server is FAILED

1.18.7.11 is a stable release. Previous: 1.18.7.10