[release] Release Highlights: v0.3.27

[github-actions]

🌟 Release Highlights

This release advances MCP Gateway's security posture with a new refusal-labels guard policy, brings compatibility with GitHub MCP Server v1.3.0, and sharpens the developer experience through CLI improvements and more robust jq filtering.

✨ What's New

• refusal-labels guard policy — MCP Gateway now fully implements the refusal-labels guard policy as specified in the gateway protocol. This allows operators to attach custom refusal labels to denied tool calls, giving downstream consumers richer context about why a request was blocked. The /health endpoint now also reports the updated specVersion: 1.14.0. (Guard documentation) (Implement refusal-labels guard policy and align health specVersion with MCP Gateway v1.14.0 #7700)

• GitHub MCP Server v1.3.0 support — The proxy router now routes the new get_commits sub-method for pull_request_read, added in GitHub MCP Server v1.3.0 (GET /repos/{owner}/{repo}/pulls/{pull_number}/commits). The get_file_blame tool specification and related guard documentation are also updated to align with the new server version. (Support GitHub MCP Server v1.3.0: PR commits routing, get_file_blame spec, and guard docs #7641)

• CLI improvements — TLS flags (--tls-cert / --tls-key) are now declared as co-required via cobra, so missing one produces a clear error at parse time rather than a cryptic runtime failure. Shell completion accuracy and command ordering are also improved. (feat(cmd): cobra improvements from go-fan module review #7630)

• Enhanced jq filter handling — The jq middleware now catches gojq.ValueError for cleaner diagnostics on intentional error() calls, caches compiled filters at startup for efficiency, and uses injection-safe variable binding (WithVariables) instead of string interpolation. (Improve gojq usage: ValueError handling, WithVariables, filter cache, inferSchema decoupling, any alias #7680)

🐛 Bug Fixes & Improvements

• Host-networked containers: Port mapping validation (validate_port_mapping) no longer fails for containers started with --network host. Docker discards published port mappings in host-network mode; the gateway now detects this case and skips the check rather than exiting with a false-positive error. ([Repo Assist] fix(run_containerized): skip port mapping validation for host-networked containers #7684)

📚 Documentation

• MCP_GATEWAY_SHUTDOWN_TIMEOUT is now documented in the Environment Variables reference. This variable (and its --shutdown-timeout flag counterpart) controls the maximum time the gateway waits for in-flight requests to drain during graceful shutdown (default: 5s). Operators running long-running tool calls should tune this value accordingly. (docs: document MCP_GATEWAY_SHUTDOWN_TIMEOUT environment variable #7683)

🐳 Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.3.27
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

---

For complete details, see the full release notes.

Generated by Release · 97.5 AIC · ⊞ 33.8K · ◷