September 2026

The current release notes are DeepIntShield Server and Python SDK 2.8.3. Earlier September changes and their original SDK release notes remain below.

Version 2.8.0 — 9 September 2026

• Native OpenAI sync and async clients are the primary inference surface across the gateway’s 29 provider identities. shield.openai_config() also supplies connection settings to application-owned clients; the OpenAI dependency is now included in SDK core.
• Framework binders retain native orchestration while routing model and embedding calls through the gateway. OpenAI Agents and PydanticAI can select Responses or Chat Completions explicitly; Strands and Google ADK gain native model binders.
• Added provider-prefixed multimodal examples and coverage for native Responses streams, including text, reasoning, refusal, tool calls, incomplete output, and failure events. Provider/model capabilities still determine which operations are available.
• Updated provider parameter handling and model-specific Playground controls. Prompt sessions retain native Responses continuation items, and unsupported controls are removed when the selected model changes.
• Added Astra Responses guidance, automatic MCP attachment documentation, and the per-request x-deepintshield-mcp-include-clients: "" opt-out.
• Responses conversion preserves completed output snapshots and reasoning/tool item lifecycles. Failed, incomplete and interrupted streams remain explicit outcomes for native final-response helpers.
• Inline PDF/image policy handling documents supported text extraction, binary redaction limits and uninspected references. Structured cache requests use exact matching without semantic embedding/search.
• Provider/model capability metadata drives available Playground operations and input controls, including Runway image generation/editing and video jobs.
• Documentation, website pricing fragments, and the WordPress quick-start package now identify the same 2.8.0 product and SDK release.

See OpenAI across providers, Providers and frameworks, and Astra with Responses.

Upgrade checks

Install deepintshield==2.8.0 and only the extras your application needs. Review the supported dependency combinations, handle terminal outcomes in streaming responses, and check multimodal inspection boundaries before sending attachments. Native OpenAI is included in SDK core. The 29-provider routing contract does not imply that every model implements every operation. Check the version of your gateway deployment separately from your installed SDK.

Provider coverage

• Playground parameter controls now follow the selected model’s catalog profile. Switching models removes unsupported sampling values and token limits; models with a Responses profile use native Responses execution and preserve their continuation items in prompt sessions. Explicit non-chat models cannot run in the chat Playground.
• Added independent provider integrations for DeepSeek, Amazon Bedrock Mantle, Sarvam AI, and Wafer, including authentication, discovery, streaming where supported, normalized errors, pricing metadata, UI configuration, and provider-level tests.
• The catalog now exposes 29 built-in provider identities. Live provider discovery remains authoritative for models and capabilities that can change.

Protocol and enterprise surfaces

• Added stored Responses retrieval, retrieval streaming, deletion, cancellation, compaction, and input-item access. OpenAI supports every listed operation; Bedrock Mantle does not support input-item access. Resource calls require the same workspace and provider key affinity as creation.
• Added named cached-content CRUD for Gemini and Vertex AI, and OCR for Mistral.
• Added realtime WebSocket frame relay plus WebRTC SDP/control passthrough. Provider-native call-control proxy routes are not a SIP or telephony orchestrator, and there is no SIP/WebRTC sideband call_id attachment.
• Added one canonical server-side Agentic enforcement point for JSON-RPC /mcp, POST /v1/mcp/tool/execute, Agent Mode, and nested Code Mode execution. The legacy direct MCP result cache is disabled on these governed paths until a decision-bound post-Agentic authorization cache exists.
• Refactored the Python MCP surface around the official MCP client and maintained OpenAI Agents, Anthropic, and LangChain integrations. New code uses shield.mcp.connect() or connection() with native upstream types; MCP/Agentic authorization failures use one DeepintShieldError.code boundary. The former custom models and provider loops remain deprecated compatibility shims for the 2.x line and are planned for removal in 3.0.
• Added strict OAuth 2.1 (MCP 2026-07-28) with pre-registered client first, deployment-owned Client ID Metadata Document second, and deprecated RFC 7591 registration as the final fallback, plus encrypted replica-safe pending state, refresh, reauthorization, and local-deny-first revocation.
• Added configured delegated MCP OAuth token exchange and identity-isolated, process-local Streamable HTTP sessions. The pool is bounded at 1,024 sessions per process. This delegated exchange path expects an explicitly configured endpoint; unlike the shared strict OAuth flow, it does not implement automatic protected-resource discovery or step-up/claims challenges.
• Added SQL-backed webhook subscriptions and an at-least-once outbox with signed delivery, retries, leases, replay, idempotent enqueue, retention, and payload offload. The filesystem object store is intended for one replica; multi-replica deployments should use S3-compatible storage.

See Protocol operations, MCP OAuth 2.1, Delegated MCP authentication, and Durable webhooks and payload storage for routes, limits, and deployment guidance.

Agent identity, enrolment and evidence

• Added enrolment policies at Agentic → Enrolment. One rule enrols a class of workloads an identity provider has verified, with a mandatory accountable owner, a blueprint-severity ceiling, and tool access granted through a role userset. Non-matching workloads still go to the review queue.
• Added control-plane tokens so enrolment policies, providers, grants, and agents can be applied from CI. The secret is shown once, an expiry is mandatory, tokens are scoped to one workspace, and a token cannot manage tokens.
• Added a claim predicate on identity providers (agent_identity_match_mode: exact, list, prefix, any), so one provider row can vouch for a class of agents instead of exactly one. Per-agent binding is unchanged: the subject is still pinned to the identity the token carries.
• Added DPoP proof-of-possession (RFC 9449) behind a per-provider require_proof_of_possession switch, a jti replay cache, and an accepted-token lifetime ceiling (accepted_token_max_ttl_sec, default one hour) so an issuer no longer decides alone how long a stolen credential stays useful. A token with no cnf.jkt behaves exactly as before.
• Added SPIFFE JWT-SVID acceptance as its own identity provider type, including private in-cluster SPIRE OIDC discovery endpoints and non-default ports. Cloud metadata endpoints remain refused.
• Attestation downgrades are blocked: an approved agent’s identity_provider_id cannot be cleared without an explicit re-review.
• Denied registrations are superseded, not edited. A new registration references and overrides the denial so the audit trail grows.
• Blueprint re-scans are compared against the approved baseline. A change introducing no new or escalated finding is admitted without another review; anything new or worse quarantines and returns to review.
• Added GET /api/agentic-new/decisions/verify and GET /api/agentic-security/decisions/verify to re-verify a decision chain independently.
• Production deployments must key their evidence. With DEEPINTSHIELD_ENV=production, startup fails without DEEPINTSHIELD_AUDIT_HMAC_KEY; AIBOM documents without DEEPINTSHIELD_AIBOM_SIGNING_SEED are returned explicitly marked unsigned rather than signed with a built-in key. SIEM export is HMAC-signed when DEEPINTSHIELD_SIEM_SIGNING_KEY is set, and evidence retention is bounded by DEEPINTSHIELD_AGENTIC_RETENTION_DAYS (default 730).
• Approvals enforce separation of duties. Designated approvers are enforced, and neither the requester nor the agent’s accountable owner may approve. Advisory mode no longer lets a Require-approval verdict through.
• Canonical decisions are now tagged against the OWASP Agentic Top 10 and exported to the trace sink, so the compliance crosswalks resolve on the enforced path.
• BREAKING - POST/DELETE on /api/agentic-security/authorization/* no longer accept Virtual Key authentication. Writing a relationship is a control-plane operation.
• POST /api/agentic-security/decide is deprecated in favour of POST /api/agentic-new/decide, which now carries the same context operands. Responses carry RFC 8594 deprecation headers; DEEPINTSHIELD_LEGACY_DECIDE_DISABLED=true turns it into a 410.
• Added an Analytics → Agentic dashboard for agent decisions, governed tools, and MCP tool-call telemetry.

MCP boundary hardening

• Added tool surface pinning. An approval binds the tool’s name, description, and argument schema. A first sighting is adopted; any later change is recorded as pending, raises a drift signal, and denies calls until an operator re-approves with the digest they were shown. A description change counts - it is model-visible text that steers when a tool gets called.
• MCP is refused rather than served ungoverned once a deployment has any Agentic governance profile. GET /api/mcp/governance-status reports installed, enforced, a reason, and a remedy; MCP Connections shows the same banner.
• The MCP catalog is scoped to the calling Virtual Key. GET /api/mcp/clients no longer enumerates servers the key is not bound to.
• Outbound MCP endpoints are validated before any dial: no non-http(s) scheme, no credentials in the URL, and cloud metadata addresses are refused unconditionally. Private addresses and STDIO clients are refused when DEEPINTSHIELD_ENV=production unless DEEPINTSHIELD_MCP_ALLOW_PRIVATE_ENDPOINTS / DEEPINTSHIELD_MCP_ALLOW_STDIO are set deliberately.

Agentic operator console

• The registration review form pre-fills each tool’s class and risk from the agent’s declaration (marked agent-declared); the reviewer confirms rather than re-types, and the server keeps enforcing the conservative write/high classification until the review is saved.
• The approval dialog gained an “Also grant allowed_caller on all approved tools” checkbox (on by default) that writes the caller grants for every approved tool and action in the same step as the approval.
• Added Import from MCP on Assets → Tools: pick a connected MCP server, and its live tools are registered under canonical versioned keys with the chosen class/risk, the derived <canonical>:read permissions are minted and attached to the selected agent principal, and allowed_caller grants are written — one action instead of three manual passes.
• Added Renew expiring to the Temporary-delegation section of Guided access (POST /api/agentic-new/delegations/renew): extends every delegation expiring within 24 hours — and any that lapsed in the last 7 days — to the workspace TTL ceiling as a replace-in-place extension that preserves ids and revocability.
• Delegation and approval windows are now operator-tunable: DEEPINTSHIELD_AGENTICNEW_OBO_MAX_TTL_SECONDS (default 24 h, hard cap 30 days; requests above the ceiling get a 400 naming the limit) and DEEPINTSHIELD_AGENTICNEW_APPROVAL_TTL_SECONDS (default 5 min, hard cap 24 h). Empty or invalid values keep the secure defaults.
• Added the identity resolution layer: an expected identity per friendly agent key (PUT /api/agentic-new/registry/identity-aliases) declares which provider-issued identity a name is expected to prove. A verified token for exactly that identity attests a first sighting under the friendly name; a later token on an approved VK-trusted agent records an attestation upgrade proposal that an operator confirms (POST …/registrations/{id}/attest), binding the provider while the agent keeps its subject and every grant. The review dialog gained the Expected identity card with an explicit Approve as VK-trusted opt-in - the first UI path to a provider-less approval, offered only once an exit is declared. Declarations are unique in both directions per workspace, a bound declaration is immutable, and the resolved identity is stored on the agent profile so the data plane adds no lookup.

Billing: monthly extras and payment recovery

• Team and Business now charge the subscription base and monthly extras separately. Extras are request overage (Team $19 and Business $15 per additional 100,000 governed requests) plus prorated extra seats ($20 per seat per month), plus tax where it applies. The retired logging surcharge and token markup are gone: logged requests remain a usage metric and routed provider spend carries no markup. See Billing and monthly extras.
• Account → Billing shows the month’s requests against the included allowance, the current seat count, unit rates, and an estimate of extras including tax. After the month closes the service issues a separate Monthly extras invoice, collected through a Razorpay payment link or, for INR accounts that opt in, a separate UPI AutoPay mandate (default maximum ₹15,000 per invoice, one-year mandate). Zero-value invoices are marked paid without a payment request.
• Added payment recovery. Reminders go out on days 0, 1, 3, 7, and 14 after an unpaid invoice’s due date. From day 7 new seats, invitations, and resource creation are paused; from day 14 gateway requests and MCP execution are suspended until settlement. An unpaid-extras credit limit of twice the monthly base suspends earlier when at least one invoice is overdue. Restrictions clear on verified payment, and account data is never deleted as a collection action.
• PUT /api/billing/subscription accepts only a plan downgrade or cancellation. Upgrades and every tariff, allowance, or currency field go through checkout.
• SCIM active now maps to the billing seat: a deactivated user stops counting as a seat and cannot sign in through SSO until reactivated.

Cost Optimization

• Overview, Cost Opt, and log tables display available numeric cost and savings amounts even when some records have no price. Savings rate remains numeric and uses the same filtered gateway cost series. Agentic-cache event savings stay separate, and negative optimization savings remain visible.
• Provider prompt-cache hints, request coalescing, TTFT prefix ordering, the guardrail evaluation cache, and parallel-tool safety are configurable and run on every plan without a vector store. Semantic caching, cascade routing, reasoning throttling, prompt compression, RAG optimization, summarization, and batch eligibility analysis require Team or above. The page shows the required plan per control and honours per-organization feature overrides.
• Semantic Caching has its own switch (semantic_cache_enabled) instead of toggling the whole optimization plugin. Turning it off no longer disables compression, summarization, or any other technique.
• Saves send only the fields you changed. The API validates ranges, TTLs, and dependent settings before writing, keeps sibling settings intact, and restores the previous stored configuration when the runtime reload fails. The default similarity threshold is 0.88 for new workspaces, the UI, the schema, and the runtime; explicitly saved thresholds are unchanged.
• Embedding, classifier, cascade, and summarizer calls authorize the selected workspace virtual key, including its provider and model grants and expiry. Cascade routing checks the plan and its virtual-key scope before rewriting a model. Virtual-key pickers load every page, and unrestricted keys resolve their model list from the catalog.
• RAG optimization detects retrieval context in system messages and applies Max chunks to the forwarded prompt, including cold-cache, asynchronous, and reranker-failure paths.
• MCP per-tool TTLs, client cache policy, and guardrail cache settings resolve per workspace, and parallel-tool safety is bound to the executing request.
• Batch API routing is labelled eligibility analysis. Provider batch submission is not implemented, so its dispatch-only controls are hidden. Managed RAG rerankers and unused provider-cache tuning fields are unavailable rather than silently ignored.

Accuracy: Hallucination Control and Consistency

• All three Hallucination Control tabs (Configuration, Control, Ground Truth) and all three Consistency tabs (Policy & Modes, Golden Registry, Request Trace) require the Business plan through one accuracy.consistency entitlement, enforced in the UI, the management API, and the runtime. The Team semantic_cache plugin no longer grants access to hallucination settings. Turning controls off and clearing ground truth remain available after a downgrade.
• Hallucination evaluation scores completed streaming Chat and Responses output once at completion; failed, cancelled, incomplete, or oversized streams are discarded. Valid zero scores count toward the composite, and an explicitly empty detector list runs no detectors. The temperature cap applies to both Chat and Responses requests. Judge requests run through the ordinary gateway governance pipeline on the selected virtual key. Ground Truth CSV gains an optional vk_id column, scope-preserving uploads, and a clear-all action.
• Consistency: exact matching fingerprints the complete eligible conversation and parameters, so numbers, dates, and case are preserved. Semantic entries honour their TTL and are namespaced by workspace, scope, model and provider, system prompt, policy, corpus, tools, and conversation context. Strict mode sets temperature 0, seed 42, and top-p 1 on eligible misses. The verifier must explicitly approve when policy requires it, and final admission happens after all post-hooks with a digest matching the released text. ttl_hours is the canonical TTL field (default 72 hours; default threshold 0.93).
• Golden Registry versions are monotonic, uploads fail closed when scanning is unavailable, a fully rejected upload never replaces the active version, and concurrent edits return 409 CONFIG_CONFLICT. Registry changes require workspace management permission.
• Reuse covers non-streaming text Chat Completions. Responses API, streaming, multimodal, and tool workflows bypass the engine, and Request Trace shows the bypass reason.

Plan alignment: Agentic, MCP quotas, and Playground

• Team keeps Guided access checks and basic relationship grants, external context-policy authoring, Activity, run incidents in the Work Queue, and a restored Activity → Audit tab that reads the relationship-change ledger. Temporary delegation, action approvals (direct page and embedded panel), enforcement-mode and blueprint settings, model publication (canonical and compatibility routes), and Advanced relationships require Business on the API as well as in the console.
• Agentic pages wait for entitlements before mounting protected panels, and switching organizations clears the previous plan’s access immediately. Work Queue rows for Business-only actions show the required plan instead of navigating to a locked page.
• MCP server quotas (Developer 1, Team 25, Business 50, Enterprise unlimited) count the whole organization across workspaces regardless of search or paging. New OAuth connections re-check capacity on completion, an unknown quota disables creation, and standalone installations report an explicit unmetered state.
• The unsaved Playground works on every plan, including Developer. Saving, renaming, committing, and deleting prompts, sessions, and versions require Team or above, and the controls and keyboard shortcuts reflect that. Session mutation endpoints enforce the same plan and workspace checks as the list API, and tenant-wide folder changes require tenant administration. A runtime virtual key can be supplied for governed configurations without being stored in sessions or versions.

Guardrail redaction

• Findings from the deepintshield_models detectors with a redact action now rewrite the content using the detector’s character spans, merged across detectors and with regex or PII redactions from other cards. A redact finding without usable spans, or one that cannot be combined safely with another rewrite, becomes a block. Shadow and async policies record findings without changing the payload.
• Input redaction preserves conversation roles, tool-call metadata, and content blocks, and fails closed when the rewrite cannot be mapped back to the original message boundaries.
• Policies saved by the policy builder (definition version 2) are authoritative: unticked presets are not re-enabled by the legacy compiler, custom cards apply to every stage, OWASP Agentic ASI cards keep their declared stages, and list restrictions (blocked domains, allowed and denied action classes) take the owning card’s action and severity.

Python SDK 2.7.2

The Python package and server were aligned at release 2.7.2.

• guard_retriever() now covers synchronous and asynchronous retrieval entry points. Nested framework delegation is evaluated once, while independent concurrent calls retain their own evaluation boundary.
• The Anthropic builder uses the installed SDK’s transport class, preserving prompt-cache rewriting and agent selector headers across httpx and httpx2.
• Legacy Anthropic MCP converters use stable aliases for long or unsupported tool names and resolve them through the same client’s original tool mapping.

Python SDK 2.7.1

• BREAKING - agent_name no longer defaults to deepintshield-agent. An agent name is an identity, so every governed workload must choose one; an unnamed client stops with agent_name_required instead of resolving to a shared default name (see the registration-capture note below). The x-deepintshield-agent header is omitted rather than sent empty.
• Added shield.agentic.status(), returning live, pending, denied, quarantined, not_registered, or unknown so a workload can refuse to serve traffic it knows will be denied. Discovery also logs the enrolment lifecycle state once per process.
• Added discover(..., framework="...") to override the auto-detected framework label.
• MASK obligations now cover positional arguments. Previously only keyword arguments were redacted, which made the obligation optional in practice, since the caller picks the calling convention.
• Added redact:secrets, redact:phi, redact:card-numbers, and redact:bank-accounts obligation handlers. Secret detection matches credential-shaped values as well as field names; card redaction is Luhn-checked so ordinary long numbers survive.
• Added the dpop extra (pip install "deepintshield[dpop]") for proof-of-possession proofs. The key is ephemeral and per-process.
• Added agent_quarantined and agent_name_conflict to ErrorCode and ERROR_CATALOG. Both were already emitted by the gateway but resolvable only as raw strings, so get_error_definition() returned None and the documented handling pattern re-raised. agent_name_conflict is also reported by discovery, since its whole purpose is to say change the agent name.
• Added a redact:value handler, matching the obligation the secrets tool template ships. It redacts value-carrying argument fields; the paired return:fingerprint-only constrains the result and stays the gateway’s to enforce.
• The legacy-PDP fallback now treats 410 Gone as a retired route alongside 404/405/501, so a deployment that has set DEEPINTSHIELD_LEGACY_DECIDE_DISABLED is recognised rather than surfaced as a transport error.
• Automatic enforcement no longer inspects a framework while one of its submodules is still importing. The enclosing import finishes first and the guard is installed afterwards, which removes circular-import failures and false “unsupported version” reports for frameworks such as LiteLLM that import their own helpers during package initialization. An unsupported version still stops with governance_configuration_error instead of importing ungoverned.
• RAG redaction is applied by the SDK. shield.rag.filter() returns a chunk the gateway redacts as a copy carrying the gateway’s sanitized_content, and guard_retriever() deep-copies a framework document before writing sanitized text into it, so the retriever’s cached original is unchanged. A request-level block empties the result even when a chunk was individually allowed, a redacted chunk that arrives without sanitized content is dropped rather than passed through unredacted, and a chunk ID that repeats in the request or the response is dropped because its verdict cannot be bound to one chunk.
• Native OpenAI, Anthropic, and Google GenAI clients merge gateway, default, and caller headers case-insensitively and collapse duplicate agent selector headers (x-deepintshield-agent, X-Agent-Subject) to the final explicit override before a request is sent. This covers streaming requests and caller-supplied http_client or http_options transports.
• Brokered MCP calls through shield.mcp now send X-Agent-Subject derived from the client’s agent_name, matching the PDP decide path. A Virtual Key bound to more than one active agent previously passed /decide but failed tool execution with mcp_tool_authorization_unavailable. An explicit caller header wins, and nothing is added for a client without an agent_name.
• Registration capture for a client without agent_name now registers under the agent subject the gateway’s credential-info reports for its Virtual Key, instead of stopping at agent_name_required. That subject is server-issued and bound to the key, so it cannot collide with another key’s agent. A key whose credential-info carries no subject still stops with agent_name_required.

Compatibility and performance

Existing inference routes keep their prior behavior. The new lifecycle, realtime, cached-content, OCR, delegation, and delivery paths activate only when their routes or configuration are used. Ordinary inference does not gain an additional database lookup or provider-discovery request from these changes; end-to-end latency still depends on the selected provider and enabled policies.

Paid Accuracy and Cost Optimization writes now fail closed (HTTP 503) when the organization’s entitlements cannot be resolved, and Agentic pages hold protected panels until entitlements load. Existing saved configuration keeps running.

Three changes need action before upgrading: name every governed workload (agent_name has no default), move any relationship writes off Virtual Key authentication onto an operator session or a control-plane token, and set DEEPINTSHIELD_AUDIT_HMAC_KEY before declaring DEEPINTSHIELD_ENV=production. Tool surface pinning adopts each tool’s current definition on first sight, so an existing MCP workspace is not taken offline by the upgrade; only a change after that point requires re-approval.