> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt > Use this file to discover all available pages before exploring further. # v2.5.0 > v2.5.0 changelog - 2026-11-06 **Bifrost Enterprise** v2.5.0 ## Changelog v2.5.0 moves the enterprise gateway onto OSS transports v2.5.0. Service accounts can now authenticate with workload identity: a workload sends a token from Entra, AWS or a trusted OIDC issuer instead of a stored key. Guardrails now apply to passthrough requests and responses, including streams, and input checks can run in parallel with the LLM call. Noma Security AI-DR is a new guardrail provider. The OSS release adds per-user MCP tool discovery, MCP Apps, serving under a base path, and Anthropic workload identity federation. ## ✨ Features * **Workload Identity for Service Accounts** - A workload can call inference endpoints with a token from its own platform and run as the Bifrost service account an admin connected it to. Supported sources are Entra managed identities and apps, AWS outbound identity federation (IAM role or IAM user ARN), and trusted OIDC issuers with presets for Okta, Auth0 and Keycloak. Tokens are verified on every request and never stored. [Docs](https://docs.getbifrost.ai/enterprise/workload-identity/overview.md) * The service account sheet has a Workload identities tab to connect, enable, disable and remove workloads, with an optional required app role per connection. * Admin API under `/api/workload-identity`, with Entra directory search through Microsoft Graph. An Entra object ID is checked against the directory before it is saved, and a client ID is refused with the matching object ID to use. * `workload_identity.connections` in config.json is reconciled on startup. * Mapping needs the new `UserProvisioning:UpdateWorkloadIdentities` permission, granted only to Admin. Changes write `workload_identity.created`, `updated` and `deleted` audit events and apply on every cluster node. * Issuer signing keys are fetched in advance on reload, so the first request does not wait for them. * **Several Audiences for SSO and the Auth Proxy** - Every SSO provider takes an `allowedAudiences` list next to the single `audience`, and a token for any of them is accepted. The auth proxy accepts the union of both fields. The UI edits all audiences as one list. Existing single-audience configs keep working. * **Guardrails on Passthrough Routes** - Input and output guardrails now apply to passthrough requests and responses, streamed and non-streamed. Redactions and transforms are written back into the raw body. A typed route whose body cannot be read is refused when a rule could block it. Routes with no typed form, such as `/v1/files`, pass through with a warning. [Docs](https://docs.getbifrost.ai/enterprise/guardrails.md) * **Parallel Input Checks** - Guardrail rules take `inputTiming`. `pre_call` (default) finishes the input check before the request is sent. `parallel` runs the check while the LLM responds and holds the response until the verdict, so only a block is enforced. `parallel` works for chat, text completion and Responses, and is refused for MCP rules. [Docs](https://docs.getbifrost.ai/enterprise/guardrails.md) * **Noma Security AI-DR Guardrail Provider** - New `noma-security` provider, authenticated with a client ID and secret. Noma `block` and `ask` decisions intervene, `mask` becomes redactions on message text, tool-call arguments and tool results, and streamed responses are scanned progressively. `application_id` is optional and defaults to the virtual key name. The client secret is encrypted at rest. [Docs](https://docs.getbifrost.ai/enterprise/guardrails.md) * **Enterprise Under a Base Path** - `server.base_path` (or `-base-path` / `BIFROST_BASE_PATH`) now works for enterprise builds. Login redirects, the SSO PKCE cookie, the Edge gateway URL, deprecation `Link` headers and the license-only bootstrap carry the prefix. The SSO and SCIM setup wizard shows the exact redirect URI to paste into the identity provider. * **Access Profiles on the MCP Server Access Tab** - The MCP server view sheet lists the access profiles that grant the server, with their user counts. Results follow DAC. Backed by `GET /api/mcp/client/{id}/access-profiles`. * **Per-User MCP Discovery in Clusters** - Per-user discovery cache evictions are broadcast to every node. A user's discoveries are deleted with the user and kept when the user ID is remapped. The per-user OAuth and MCP headers sweep workers run only on the cluster leader. * **Enterprise UI Translations** - Enterprise views use the dashboard's i18n catalogs, so they follow the selected language. A `create` action URL param opens the create sheet on enterprise views, which the command palette uses. ## 🌎 Open Source Features * **MCP Per-User Tool Discovery** - Per-user OAuth and per-user headers clients can set `per_user_discovery`, so each caller sees the tools, prompts and resources their own credential unlocks on the MCP gateway. Discovery is stored at sign-in, shared across callers with identical results, and removed with the credential. A per-caller connect tool, caller counts in the sessions table and registry, and a Refresh tools action on the sessions page come with it. Turning it off sends a per-user OAuth server back to pending verification. * **MCP Apps on the Gateway** - `/mcp/` serves MCP Apps tools and `ui://` resources as the server sent them, to callers that declared MCP Apps. Aggregate `/mcp` never lists app-only tools and namespaces `ui://` URIs per client. App-only tools never reach models, tools are accepted by the names their own server gave them, and MCP logs record Apps use. * **MCP Multi Round-Trip** - Bifrost passes an upstream server's `input_required` result through to a gateway caller that can answer it, and forwards callers' declared capabilities upstream. MCP logs record each round and link a call's rounds by `round_trip_id`. * **Faster Boot with MCP Clients** - MCP clients from config.json connect in the background, so an unreachable client no longer delays the HTTP listener. * **Serve Under a Base Path** - `server.base_path` (or `-base-path` / `BIFROST_BASE_PATH`) serves the API and UI under a URL prefix. Redirects, OAuth bootstrap URLs, webhook `result_url`, MCP discovery and every copyable URL in the UI carry the prefix. Helm gets `basePath`. * **SOCKS5 and TLS-Inspecting Global Proxies** - The global proxy accepts `socks5`, takes a `ca_cert_pem` to trust a TLS-inspecting proxy, and always verifies targets through the proxy. The Inference and API toggles now take effect. * **Anthropic Workload Identity Federation** - Anthropic keys (and custom providers with an Anthropic base) can carry `anthropic_key_config.workload_identity` instead of a static key. Bifrost exchanges the workload's OIDC token for a short-lived access token and refreshes it before expiry. The key form gets an API Key / Workload Identity tab. [Docs](https://docs.getbifrost.ai/providers/supported-providers/anthropic.md) * **Caller Identity on Logs** - LLM, MCP and relay logs record the caller's user email and, with `logs_store.capture_client_ip` on, their client IP. Both show on log pages and in CSV exports, and export to object storage. * **Relay Logs Match LLM Logs** - The relay log store, API and UI reach parity with LLM logs: session and correlation ids, large payload previews, filters and capture behaviour. The relay detail header is redesigned and OpenAPI import moves to a side sheet. * **Multi-Value Metadata Filters** - Log metadata filters accept several values per key. * **Gemini Interactions Billing** - On `/genai_passthrough`, the Interactions agent is recorded as the model, poll records name it, and each run is billed and counted as one request. * **Container and Image Tool Billing** - Containers started through OpenAI and Azure code interpreter and hosted shell, and Anthropic code execution, are counted on `usage.tool_usage.container_sessions` and billed at the `container` rate, including under `previous_response_id` and `conversation`. OpenAI image generation tool tokens are billed at the image model's rates and show as `image_cost`. * **OpenAI 12h Prompt Cache** - Prompt cache breakpoints accept a TTL, and 12h cache writes are priced from new datasheet columns. * **Complexity Router Confidence Thresholds** - Decision model routers take confidence thresholds before they act on a classification. * **Optional Routing Rule IDs** - config.json routing rules no longer need an `id`. A rule without one matches the stored rule by name and scope, and a priority collision with an undeclared stored rule logs a warning instead of stopping startup. * **Dashboard Languages** - The dashboard is fully translated with i18next across 11 locales. Numbers and dates follow the selected language, non-English catalogs lazy-load, and the language toggle lives in client settings. * **Command Palette** - Press ⌘K to jump anywhere in the workspace. * **MCP Server UI** - The MCP server sheet splits into a read-only view and a settings editor, tool parameters toggle between table and JSON, extra access grants have their own registry, and code mode settings collapse into an accordion. * **Sticky Log Message Filter** - The log detail messages filter persists across reloads. * **Duration Strings for `tool_sync_interval`** - Accepts values like `30m` alongside bare minutes. ## ⚙️ Upgrade Notes * **Bearer access tokens must match the configured audience** - When an SSO provider has `audience` set, access and ID tokens must be addressed to that audience or the client ID (and, for Entra, the App ID URI). Deployments that already set an audience start rejecting bearer tokens issued for other apps. With no audience set, behaviour is unchanged. * **MCP OAuth config routes need `MCPGateway` permissions** - `/api/oauth/config/*` is no longer skipped by RBAC. Callers without `MCPGateway` permissions can no longer read an MCP OAuth config's status or revoke its token. Sign-in routes stay open. * **Workload identity mapping is Admin-only on upgrade** - `UserProvisioning:UpdateWorkloadIdentities` is granted only to Admin. Grant it to custom roles yourself if they need it. ## 🐞 Fixed * **Budget Requests After Propagation** - Pending budget requests stay attached when access profile propagation re-creates budgets, so they stay listed, can be approved and still block duplicates. * **Budget Requests for Removed Budgets** - Requests whose budget no longer exists are listed as `target_missing` so an approver can deny them, instead of being hidden. * **Home Budget Card** - The pooled "Closest to limit" figure sums only budgeted profiles, and a tooltip shows each profile's usage and limit. * **Broker Cluster Peer Count** - Broker transport heartbeats no longer erase a peer's stored membership, which showed `Peers 0/2` while all nodes were connected. * **SSO Token Without `exp`** - A signed SSO token with no `exp` claim is refused instead of crashing the process. * **Workload Identity Service Accounts Without a Role** - Requests for a service account with no role are no longer refused as if the account were deleted. * **Guardrail Output Blocks Skip Fallbacks** - An output-phase guardrail block is final and no longer triggers fallbacks. * **Guardrail Transforms on Raw Bodies** - Provider transforms (for example Bedrock email masking) reach raw request and response bodies, and text Bifrost added (MCP server instructions) is not transformed. * **Guardrail Tool-Call Arguments** - Local detectors scan decoded tool-call arguments, so escapes cannot hide a value, and an argument-only redaction that a raw body cannot carry fails open with a warning. * **Guardrail Streamed Raw Payloads** - Raw provider payloads in held Chat and Responses streams match the redacted text. * **Log Store Redaction** - Passthrough model parameters such as Responses `instructions` are redacted, and values split across streamed raw response frames are redacted. * **Relay Log DAC** - Relay latency histograms and relay log deletion are scoped by `RelayLogs` DAC. * **Relay Log Exports** - Splunk keeps fractional relay upstream latency, and relay spans report `error.type` with the same failure classes as LLM calls (for example `policy_access_denied` instead of `403`). * **Virtual MCP Filter Under DAC** - Listing Virtual MCPs filtered by `mcp_client_id` works under DAC and returns an exact total. * **Scoped MCP Client Refetch** - `RequirePublicTarget`, `OpenAPIConfig`, `PerUserDiscovery` and `PendingVerification` are kept when an MCP client config is read back under DAC. * **Edge Inspect Session IDs** - Edge inspect logs store the conversation ID in `session_id` instead of `parent_request_id`, so fallback chains and root listings are no longer confused. * **Enterprise Boot with MCP Clients** - Enterprise startup no longer waits for unreachable MCP clients. * **Users Table Role Badge** - Every role badge shows the shield icon. * **Singulr AI Icon** - The Singulr AI guardrail provider has a dark-mode icon. * **Anthropic Prompt Caching on Chat Messages** - Message-level `cache_control` is kept on chat completion messages, and OpenAI-style `prompt_cache_breakpoint` markers become `cache_control` for Claude on Anthropic and Bedrock. * **Zero Token Usage** - Explicitly reported zero token counts from OpenAI-compatible providers are preserved instead of dropped. * **Anthropic Web Tool Versions** - Explicit web search and web fetch versions are kept instead of upgraded, and web search and code execution are dropped for Claude on Bedrock. * **Anthropic Empty Content** - Responses requests drop empty text blocks instead of failing with a 400, and text documents with empty `data` keep their source type. * **Claude Haiku 5.x Parameters** - Haiku 5.x takes reasoning effort like Sonnet 5.x, sampling params are dropped, and custom Anthropic-based providers read their base provider's capabilities. * **Codex on Claude** - Codex's client-side tool search runs as the caller's own, a tool re-declared mid-session no longer fails as a duplicate after namespace flattening, and invalid tool arguments in history replay as `{}` instead of a 500. * **Codex on OpenAI Responses** - Assistant messages carrying `encrypted_content` keep their content, and a `function_call_output` with a name and no `call_id` keeps its name. * **Gemini Item IDs** - Non-streamed Gemini item ids stay under 64 characters, reasoning items get ids, and Bedrock Mantle replay keeps them. * **vLLM and SGLang Reasoning** - Unsigned thinking blocks and replayed reasoning content are kept, and raw `reasoning_text` stream events emit Anthropic thinking deltas. * **Streamed Web Search Query** - Streamed Anthropic `web_search` blocks always carry the search query. * **DeepSeek V3.2 on Bedrock** - Leaked DSML tags are stripped, and `stopSequences` is omitted for Converse models that reject it. * **Databricks Safeguards** - The Anthropic-only `safeguards` param is stripped from Databricks chat and Responses requests. * **GitHub Copilot Tool Search** - Tool search works without the beta header Copilot rejects. * **Chat to Responses Conversion** - Assistant text next to tool calls is kept. * **Runware Async Output** - Bifrost polls the task when a sync request turns async. * **Multi-Key Stored Objects** - Follow-up calls on a stored response, container or video find the key that created it instead of returning 404. * **Routing Rule Fallbacks on 4xx** - Routing-rule fallbacks run when the primary target returns a 4xx. * **Pricing Model Names** - Pricing lookups match model names case-insensitively, and Azure Model Router deployments bill the served model's tokens. * **Dropped Requests Skipped Post-Hooks** - Requests rejected before reaching a provider worker (full queue, shutdown, cancelled wait) run their post-hooks, and telemetry no longer counts them as upstream traffic. * **ClickHouse Log Detail at Scale** - Opening a single log no longer scans the whole logs table. * **Log Retention Lag** - Postgres retention runs hourly, keeps draining past a short batch, and lets one replica drain each table. ClickHouse dedupes deletes per cutoff. * **Fallback Chain Banner** - The banner shows only for real fallback attempts, not for session rows sharing a parent id. * **Realtime and Live Logging Headers** - Setup-request headers reach realtime and Live log rows. * **Config-File-Only Mode Logs** - The dashboard and MCP logs show in config-file-only mode. * **Unmatched API Paths** - Unknown `/api` paths return a JSON 404 instead of the dashboard shell. * **Config Sync** - Unchanged framework URLs skip the URL accessibility check, and a config.json MCP client keeps its stored id. * **Relay Passthrough** - Relays match passthrough for headers and streams. * **Drop-Params Key Aliases** - Supported-param lookups resolve key aliases. * **Complexity Router Subagents** - Complexity session state is scoped per subagent. * **MCP OAuth Server** - ChatGPT and other CIMD clients sign in, including documents that list grants the server does not offer. A replayed authorization code revokes its grant, an expired virtual key cannot consent or refresh, a grant bound before an issuer change cannot refresh, a trailing slash in `issuer_url` no longer produces `//`, and every `/mcp` 401 carries `WWW-Authenticate`. * **MCP Connections** - Permanent connect errors stop retrying, invalid `ca_cert_pem` is refused, a failed enable stays unstable with its checker retrying, TLS and SSE header edits apply to the live client, a per-call credential refreshes once on a 401, a tool's own 401 is no longer treated as an upstream auth failure, and `tls_config` is kept on per-user headers clients. * **MCP Tool Calls** - Upstream tools are called by their exact name, a tool's error flag survives on `/mcp` and in Responses, every code mode call inside agent mode is logged, code mode meta tools go through governance, `tool_execution_timeout` applies to code mode and in-process clients, and timeout errors report the caller's deadline. * **MCP Admin API** - Client create, rename, reconnect, OAuth and virtual key mistakes return 400, 404 or 409 instead of 500. Unknown auth types and per-user auth on SSE and STDIO are refused, `vk_configs` are checked before an update applies, deleting a client reloads its virtual keys and drops its prices, and `max_instructions_length` is returned in the client list. * **MCP Per-User Auth** - A revoke is not undone by a sign-in finishing during it, pending OAuth flows can be revoked from the sessions list, per-user headers keep their sample values as the admin credential, a stored OpenAPI credential cannot fill a caller-supplied header, and sign-in prompts no longer create MCP log rows. * **MCP Library** - Invalid catalog entries are skipped, permanent fetch errors stop retrying, and a custom entry can reuse a deleted entry's name. ## 🗄️ Database Migrations ### Enterprise * **ent\_add\_guardrail\_rule\_input\_timing\_column** - Adds `enterprise_guardrail_rules.input_timing` (default `pre_call`), so existing rules keep finishing their input check before the LLM call. Reversible: rollback drops the column. * **ent\_add\_service\_account\_workload\_identities\_table** - Creates `enterprise_service_account_workload_identities`, which maps a workload identity to the service account its requests run as. Reversible: rollback drops the table. > [!WARNING] > > Rolling back `ent_add_service_account_workload_identities_table` drops the table and deletes every workload identity mapping. * **ent\_add\_user\_provisioning\_update\_workload\_identities\_permission** - Adds the `UserProvisioning:UpdateWorkloadIdentities` permission and grants it to Admin only. Rollback is a no-op, so grants on customized roles are kept. ### Open Source * **add\_anthropic\_workload\_identity\_column** - Adds `config_keys.anthropic_workload_identity_json`. Non-reversible: dropping it would delete every Anthropic key's workload identity config. Additive, so older binaries ignore it * **add\_mcp\_per\_user\_discoveries** - Adds `config_mcp_clients.per_user_discovery` and the `mcp_per_user_discoveries` table with its indexes. Reversible: drops the indexes, table and column * **add\_mcp\_client\_pending\_verification\_column** - Adds `config_mcp_clients.pending_verification` and backfills it to true for OAuth and per-user clients still awaiting verification. Reversible: drops the column * **add\_cache\_creation\_above\_12hr\_pricing\_columns** - Adds eight 12h cache write pricing columns. Reversible: drops them * **mcp\_tool\_logs\_add\_round\_trip\_id\_column**, **logs\_add\_client\_ip\_column**, **logs\_add\_user\_email\_column** - Add `round_trip_id`, `client_ip` and `user_email` to the log tables. Reversible only while the columns are empty: rollback is refused once any row holds a value * **relay\_logs\_add\_session\_id**, **relay\_logs\_add\_correlation\_columns**, **relay\_logs\_add\_large\_payload\_response** - Add session, correlation and preview columns to relay logs. Non-reversible: dropping them would lose recorded relay data > [!NOTE] > > ClickHouse log stores add bloom-filter skip indexes on `id` and `parent_request_id` and backfill them once with a background `MATERIALIZE INDEX`. Startup does not wait for it. ## 🐙 Closed OSS Issues * [#3261](https://github.com/maximhq/bifrost/issues/3261) - Routing-rule fallbacks not invoked when primary target returns 4xx (chat completions) * [#6764](https://github.com/maximhq/bifrost/issues/6764) - Dashboard UI full multi-language i18n (i18next, 11 locales) * [#8037](https://github.com/maximhq/bifrost/issues/8037) - OpenAPI spec omits the 100-row clamp and default of 25 on paginated list endpoints * [#8712](https://github.com/maximhq/bifrost/issues/8712) - Message-level cache\_control on chat messages is dropped, so Anthropic prompt caching never triggers * [#8749](https://github.com/maximhq/bifrost/issues/8749) - Custom OpenAI-compatible provider responses drop prompt\_tokens/completion\_tokens - only total\_tokens survives * [#8849](https://github.com/maximhq/bifrost/issues/8849) - Anthropic route: a text document with empty `data` loses `source.type`, upstream 400 * [#9150](https://github.com/maximhq/bifrost/issues/9150) - Anthropic /v1/messages overrides the client's explicit web\_search version, implicitly enabling code\_execution * [#9316](https://github.com/maximhq/bifrost/issues/9316) - ClickHouse logs store: single-log detail scans the whole logs table, so the log drawer never loads * [#9318](https://github.com/maximhq/bifrost/issues/9318) - Anthropic Responses converter forwards empty text blocks, upstream rejects with 400 * [#9324](https://github.com/maximhq/bifrost/issues/9324) - Persist message-type filter selection in the chat UI * [#9490](https://github.com/maximhq/bifrost/issues/9490) - Claude Haiku 5.5 behind a custom Anthropic-base provider: reasoning effort is dropped and temperature is forwarded ## 📀 Base OSS version `transports/v2.5.0` ## 🔌 If you are compiling plugin against this release - use following deps ```go theme={null} module github.com/maximhq/bifrost-enterprise/transports go 1.27.3 require ( github.com/bytedance/sonic v1.15.3-0.20260730064818-2a36d6da63e2 github.com/coreos/go-oidc/v3 v3.18.0 github.com/fasthttp/router v1.5.4 github.com/google/cel-go v0.30.0 github.com/google/uuid v1.6.0 github.com/mark3labs/mcp-go v1.5.0 github.com/maximhq/bifrost-enterprise/core v0.0.0 github.com/maximhq/bifrost-enterprise/framework v0.0.0 github.com/maximhq/bifrost-enterprise/plugins v0.0.0 github.com/maximhq/bifrost/core v1.15.1 github.com/maximhq/bifrost/framework v1.12.1 github.com/maximhq/bifrost/plugins/governance v1.12.1 github.com/maximhq/bifrost/plugins/logging v1.12.1 github.com/maximhq/bifrost/plugins/routing v1.3.1 github.com/maximhq/bifrost/plugins/semanticcache v1.7.6 github.com/maximhq/bifrost/plugins/telemetry v1.9.6 github.com/maximhq/bifrost/transports/v2 v2.5.0 github.com/stretchr/testify v1.12.1 github.com/valyala/fasthttp v1.74.0 golang.org/x/sync v0.24.0 gorm.io/driver/postgres v1.6.0 gorm.io/driver/sqlite v1.6.0 gorm.io/gorm v1.31.1 ) require ( cel.dev/expr v0.25.2 // indirect cloud.google.com/go v0.123.0 // indirect cloud.google.com/go/auth v0.20.0 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/bigquery v1.74.0 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.7.0 // indirect cloud.google.com/go/monitoring v1.24.3 // indirect cloud.google.com/go/pubsub/v2 v2.4.0 // indirect cloud.google.com/go/secretmanager v1.16.0 // indirect cloud.google.com/go/storage v1.62.1 // indirect dario.cat/mergo v1.0.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.4 // indirect github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/BobuSumisu/aho-corasick v1.0.3 // indirect github.com/ClickHouse/ch-go v0.65.0 // indirect github.com/ClickHouse/clickhouse-go/v2 v2.32.0 // indirect github.com/DataDog/datadog-agent/comp/core/tagger/origindetection v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/obfuscate v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/opentelemetry-mapping-go/otlp/attributes v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/proto v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/trace v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/log v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/stats v0.82.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/traceutil v0.82.0 // indirect github.com/DataDog/datadog-go/v5 v5.9.0 // indirect github.com/DataDog/dd-trace-go/v2 v2.11.1 // indirect github.com/DataDog/go-libddwaf/v5 v5.0.0 // indirect github.com/DataDog/go-runtime-metrics-internal v0.0.4-0.20260217080614-b0f4edc38a6d // indirect github.com/DataDog/go-sqllexer v0.2.3 // indirect github.com/DataDog/go-tuf v1.1.1-0.5.2 // indirect github.com/DataDog/sketches-go v1.4.8 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect github.com/Masterminds/goutils v1.1.1 // indirect github.com/Masterminds/semver/v3 v3.4.0 // indirect github.com/Masterminds/sprig/v3 v3.3.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect github.com/STARRY-S/zip v0.2.1 // indirect github.com/a2aproject/a2a-go/v2 v2.5.0 // indirect github.com/andybalholm/brotli v1.2.2 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/apache/arrow/go/v15 v15.0.2 // indirect github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect github.com/armon/go-metrics v0.4.1 // indirect github.com/aws/aws-sdk-go-v2 v1.42.0 // indirect github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect github.com/aws/aws-sdk-go-v2/config v1.32.14 // indirect github.com/aws/aws-sdk-go-v2/credentials v1.19.14 // indirect github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.50.6 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 // indirect github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.42.3 // indirect github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 // indirect github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 // indirect github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect github.com/aws/smithy-go v1.27.1 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blevesearch/go-porterstemmer v1.0.3 // indirect github.com/bodgit/plumbing v1.3.0 // indirect github.com/bodgit/sevenzip v1.6.0 // indirect github.com/bodgit/windows v1.0.1 // indirect github.com/bytedance/gopkg v0.1.3 // indirect github.com/bytedance/sonic/loader v0.5.2 // indirect github.com/canonical/starlark v0.0.0-20260428155828-9a81051fac39 // indirect github.com/cenkalti/backoff v2.2.1+incompatible // indirect github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/charmbracelet/colorprofile v0.3.1 // indirect github.com/charmbracelet/lipgloss v1.1.0 // indirect github.com/charmbracelet/x/ansi v0.10.1 // indirect github.com/charmbracelet/x/cellbuf v0.0.13 // indirect github.com/charmbracelet/x/term v0.2.1 // indirect github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575 // indirect github.com/cloudflare/circl v1.6.3 // indirect github.com/cloudwego/base64x v0.1.6 // indirect github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect github.com/coreos/go-semver v0.3.1 // indirect github.com/coreos/go-systemd/v22 v22.6.0 // indirect github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect github.com/dustin/go-humanize v1.0.1 // indirect github.com/ebitengine/purego v0.10.0 // indirect github.com/emicklei/go-restful/v3 v3.13.0 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect github.com/fasthttp/websocket v1.5.12 // indirect github.com/fatih/color v1.18.0 // indirect github.com/fatih/semgroup v1.2.0 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/gitleaks/go-gitdiff v0.9.1 // indirect github.com/go-faster/city v1.0.1 // indirect github.com/go-faster/errors v0.7.1 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.9.0 // indirect github.com/go-git/go-git/v5 v5.19.2 // indirect github.com/go-jose/go-jose/v4 v4.1.6 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/go-openapi/analysis v0.26.2 // indirect github.com/go-openapi/errors v0.22.8 // indirect github.com/go-openapi/jsonpointer v1.0.0 // indirect github.com/go-openapi/jsonreference v1.0.1 // indirect github.com/go-openapi/loads v0.25.2 // indirect github.com/go-openapi/runtime v0.29.2 // indirect github.com/go-openapi/spec v0.22.11 // indirect github.com/go-openapi/strfmt v0.27.0 // indirect github.com/go-openapi/swag v0.29.1 // indirect github.com/go-openapi/swag/cmdutils v0.29.1 // indirect github.com/go-openapi/swag/conv v0.29.1 // indirect github.com/go-openapi/swag/fileutils v0.29.1 // indirect github.com/go-openapi/swag/jsonutils v0.29.1 // indirect github.com/go-openapi/swag/loading v0.29.1 // indirect github.com/go-openapi/swag/mangling v0.29.1 // indirect github.com/go-openapi/swag/netutils v0.29.1 // indirect github.com/go-openapi/swag/pools v0.29.1 // indirect github.com/go-openapi/swag/stringutils v0.29.1 // indirect github.com/go-openapi/swag/typeutils v0.29.1 // indirect github.com/go-openapi/swag/yamlutils v0.29.1 // indirect github.com/go-openapi/validate v0.26.5 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/goccy/go-json v0.10.5 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/btree v1.1.3 // indirect github.com/google/flatbuffers v23.5.26+incompatible // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/jsonschema-go v0.4.2 // indirect github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect github.com/googleapis/gax-go/v2 v2.22.0 // indirect github.com/grandcat/zeroconf v1.0.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect github.com/h2non/filetype v1.1.3 // indirect github.com/hashicorp/consul/api v1.34.3 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-hclog v1.6.3 // indirect github.com/hashicorp/go-immutable-radix v1.3.1 // indirect github.com/hashicorp/go-metrics v0.5.4 // indirect github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-retryablehttp v0.7.8 // indirect github.com/hashicorp/go-rootcerts v1.0.2 // indirect github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect github.com/hashicorp/go-sockaddr v1.0.7 // indirect github.com/hashicorp/go-version v1.9.0 // indirect github.com/hashicorp/golang-lru v1.0.2 // indirect github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect github.com/hashicorp/hcl v1.0.1-vault-7 // indirect github.com/hashicorp/memberlist v0.5.4 // indirect github.com/hashicorp/serf v0.10.1 // indirect github.com/hashicorp/vault/api v1.23.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/pgx/v5 v5.9.2 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect github.com/jaswdr/faker/v2 v2.8.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/jinzhu/inflection v1.0.0 // indirect github.com/jinzhu/now v1.1.5 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.20.0 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/klauspost/pgzip v1.2.6 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/linkdata/deadlock v0.5.5 // indirect github.com/lucasb-eyer/go-colorful v1.2.0 // indirect github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect github.com/magiconair/properties v1.8.10 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.24 // indirect github.com/mattn/go-runewidth v0.0.17 // indirect github.com/mattn/go-sqlite3 v1.14.32 // indirect github.com/maximhq/bifrost/plugins/compat v0.5.5 // indirect github.com/maximhq/bifrost/plugins/maxim v1.7.16 // indirect github.com/maximhq/bifrost/plugins/mocker v1.6.16 // indirect github.com/maximhq/bifrost/plugins/modelcatalogresolver v1.1.16 // indirect github.com/maximhq/bifrost/plugins/otel v1.6.6 // indirect github.com/maximhq/bifrost/plugins/prompts v1.1.16 // indirect github.com/maximhq/maxim-go v0.2.1 // indirect github.com/mholt/archives v0.1.2 // indirect github.com/miekg/dns v1.1.68 // indirect github.com/minio/minlz v1.0.0 // indirect github.com/minio/simdjson-go v0.4.5 // indirect github.com/mitchellh/copystructure v1.2.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/mapstructure v1.5.0 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/molecule-man/go-brrr v1.0.1 // indirect github.com/muesli/termenv v0.16.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/nwaples/rardecode/v2 v2.2.2 // indirect github.com/oapi-codegen/runtime v1.1.1 // indirect github.com/oklog/ulid/v2 v2.1.2 // indirect github.com/outcaste-io/ristretto v0.2.3 // indirect github.com/parquet-go/bitpack v1.0.0 // indirect github.com/parquet-go/jsonlite v1.0.0 // indirect github.com/parquet-go/parquet-go v0.32.0 // indirect github.com/paulmach/orb v0.11.1 // indirect github.com/pelletier/go-toml/v2 v2.4.3 // indirect github.com/petermattis/goid v0.0.0-20260226131333-17d1149c6ac6 // indirect github.com/philhofer/fwd v1.2.0 // indirect github.com/philippgille/chromem-go v0.7.0 // indirect github.com/pierrec/lz4/v4 v4.1.22 // indirect github.com/pinecone-io/go-pinecone/v5 v5.3.0 // indirect github.com/pion/datachannel v1.6.3 // indirect github.com/pion/dtls/v3 v3.1.9 // indirect github.com/pion/ice/v4 v4.4.4 // indirect github.com/pion/interceptor v0.1.49 // indirect github.com/pion/logging v0.2.4 // indirect github.com/pion/mdns/v2 v2.2.1 // indirect github.com/pion/randutil v0.1.0 // indirect github.com/pion/rtcp v1.2.18 // indirect github.com/pion/rtp v1.10.5 // indirect github.com/pion/sctp v1.11.3 // indirect github.com/pion/sdp/v3 v3.0.20 // indirect github.com/pion/srtp/v3 v3.1.0 // indirect github.com/pion/stun/v4 v4.0.1 // indirect github.com/pion/transport/v5 v5.1.1 // indirect github.com/pion/turn/v5 v5.1.2 // indirect github.com/pion/webrtc/v4 v4.2.22 // indirect github.com/pjbgf/sha1cd v0.6.0 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/prometheus/client_golang v1.23.3-0.20251103151724-a5ae20370e5e // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.69.0 // indirect github.com/prometheus/procfs v0.21.1 // indirect github.com/puzpuzpuz/xsync/v4 v4.5.0 // indirect github.com/qdrant/go-client v1.16.2 // indirect github.com/redis/go-redis/v9 v9.17.2 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/rs/zerolog v1.34.0 // indirect github.com/ryanuber/go-glob v1.0.0 // indirect github.com/sagikazarmark/locafero v0.7.0 // indirect github.com/sagikazarmark/slog-shim v0.1.0 // indirect github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect github.com/savsgio/gotils v0.0.0-20250408102913-196191ec6287 // indirect github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect github.com/segmentio/asm v1.2.0 // indirect github.com/segmentio/kafka-go v0.4.51 // indirect github.com/sergi/go-diff v1.4.0 // indirect github.com/shirou/gopsutil/v4 v4.26.6 // indirect github.com/shopspring/decimal v1.4.0 // indirect github.com/skeema/knownhosts v1.3.1 // indirect github.com/sorairolake/lzip-go v0.3.5 // indirect github.com/sourcegraph/conc v0.3.0 // indirect github.com/spf13/afero v1.15.0 // indirect github.com/spf13/cast v1.10.0 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/spf13/viper v1.19.0 // indirect github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect github.com/stretchr/objx v0.5.3 // indirect github.com/subosito/gotenv v1.6.0 // indirect github.com/tetratelabs/wazero v1.11.0 // indirect github.com/therootcompany/xz v1.0.1 // indirect github.com/tidwall/gjson v1.18.0 // indirect github.com/tidwall/match v1.1.1 // indirect github.com/tidwall/pretty v1.2.1 // indirect github.com/tidwall/sjson v1.2.5 // indirect github.com/tinylib/msgp v1.6.4 // indirect github.com/tklauser/go-sysconf v0.3.16 // indirect github.com/tklauser/numcpus v0.11.0 // indirect github.com/trailofbits/go-mutexasserts v0.0.0-20250514102930-c1f3d2e37561 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/twpayne/go-geom v1.6.1 // indirect github.com/ulikunitz/xz v0.5.15 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect github.com/wasilibs/go-re2 v1.9.0 // indirect github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect github.com/weaviate/weaviate v1.38.0 // indirect github.com/weaviate/weaviate-go-client/v5 v5.7.1 // indirect github.com/wlynxg/anet v0.0.5 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/xdg-go/pbkdf2 v1.0.0 // indirect github.com/xdg-go/scram v1.1.2 // indirect github.com/xdg-go/stringprep v1.0.4 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/yosida95/uritemplate/v3 v3.0.2 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect github.com/zeebo/xxh3 v1.1.0 // indirect github.com/zricethezav/gitleaks/v8 v8.30.1 // indirect go.etcd.io/etcd/api/v3 v3.6.11 // indirect go.etcd.io/etcd/client/pkg/v3 v3.6.11 // indirect go.etcd.io/etcd/client/v3 v3.6.11 // indirect go.opencensus.io v0.24.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/collector/component v1.61.0 // indirect go.opentelemetry.io/collector/featuregate v1.61.0 // indirect go.opentelemetry.io/collector/pdata v1.61.0 // indirect go.opentelemetry.io/collector/pdata/pprofile v0.155.0 // indirect go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect go.opentelemetry.io/otel v1.45.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 // indirect go.opentelemetry.io/otel/metric v1.45.0 // indirect go.opentelemetry.io/otel/sdk v1.45.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect go.opentelemetry.io/otel/trace v1.45.0 // indirect go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/mock v0.6.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/arch v0.23.0 // indirect golang.org/x/crypto v0.58.0 // indirect golang.org/x/exp v0.0.0-20260529124908-c761662dc8c9 // indirect golang.org/x/mod v0.41.0 // indirect golang.org/x/net v0.61.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/telemetry v0.0.0-20260924152758-ed294f943157 // indirect golang.org/x/term v0.47.0 // indirect golang.org/x/text v0.43.0 // indirect golang.org/x/time v0.15.0 // indirect golang.org/x/tools v0.51.0 // indirect golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect google.golang.org/api v0.282.0 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.1 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect gorm.io/driver/clickhouse v0.7.0 // indirect k8s.io/api v0.36.1 // indirect k8s.io/apimachinery v0.36.1 // indirect k8s.io/client-go v0.36.1 // indirect k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect sigs.k8s.io/yaml v1.6.0 // indirect ) replace github.com/maximhq/bifrost-enterprise/core => ../core replace github.com/maximhq/bifrost-enterprise/framework => ../framework replace github.com/maximhq/bifrost-enterprise/plugins => ../plugins replace github.com/mark3labs/mcp-go => github.com/maximhq/mcp-go v0.0.0-20261102181017-b7da3bc145a1 ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.