> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt > Use this file to discover all available pages before exploring further. # v2.1.46 > Helm v2.1.46 changelog - 2026-10-27 **Bifrost Helm** v2.1.46 ## Changelog * Removed GitHub App authentication from GitHub Copilot provider keys: Bifrost now ignores `github_copilot_key_config` (`app_id`, `installation_id`, `repository_id`, `private_key`, `github_domain`). **Migrate before upgrading:** put a fine-grained personal access token (`github_pat_…`, with the **Copilot Requests** account permission, from an account with an active Copilot plan or assigned Copilot seat) or a GitHub OAuth token (`ghu_…` / `gho_…`) in the key's `value`; a key that relied on the App fields no longer authenticates. * Added `bifrost.mcp.maxProtocolVersion` (`mcp.max_protocol_version`), one of `auto`, `2026-07-28`, `2025-11-25` or `2025-06-18`: the newest MCP protocol version offered to MCP servers. `bifrost.mcp.clientConfigs[].maxProtocolVersion` (`mcp.client_configs[].max_protocol_version`) overrides it for one server. Upgrading a deployment that already has MCP servers caps them at `2025-06-18`, the version they used before; set `auto` to offer the newest version. * `bifrost.mcp.clientConfigs[].tokenExchange` (`mcp.client_configs[].token_exchange`) without `clientId` is now refused unless `useIdpCredentials: true` or `profile: id_jag`. Such a config never worked: Bifrost's own config validation rejected what the chart rendered. * Added `profile: id_jag` to `bifrost.mcp.clientConfigs[].tokenExchange` (`mcp.client_configs[].token_exchange.profile`) for Cross App Access to MCP servers (Enterprise): Bifrost gets an ID-JAG for the user from the identity provider and redeems it at the MCP server's authorization server. Set `audience` to that authorization server's issuer and `resourceClientId` (`resource_client_id`) to Bifrost's client there. `resourceTokenEndpoint` is discovered from the issuer when left empty. Add `resourceClientSecret` or `resourcePrivateKey` unless Bifrost is a public client. * Added `bifrost.mcp.clientConfigs[].promptsToExpose` and `.resourcesToExpose` (`mcp.client_configs[].prompts_to_expose` / `resources_to_expose`): which of an MCP server's prompts and resources the MCP gateway serves, `["*"]` for all and `[]` for none. A new server serves everything when the field is omitted; on an existing server, omitting it keeps the stored list. * Added `openapi` as a `bifrost.mcp.clientConfigs[].connectionType`, configured by `openapiConfig.spec`, `.specFile`, `.specUrl`, `.baseUrl`, `.securityCredentials`, `.includeDeprecated` and `.maxResponseBytes`. Renders into `mcp.client_configs[].openapi_config.spec` / `spec_file` / `spec_url` / `base_url` / `security_credentials` / `include_deprecated` / `max_response_bytes`. Bifrost builds an MCP server from an OpenAPI or Swagger document, with each API operation as a tool; operations the document marks deprecated are skipped unless `includeDeprecated: true`. `specFile` is read relative to `bifrost.appDir`, so mount it with `volumes`/`volumeMounts`. `authType` can only be `none`, `headers` or `per_user_headers`. The connection type existed in Bifrost but had no Helm path, so it could only be added from the dashboard. * Added `storage.logsStore.objectStorage.format` and `.compression` (`logs_store.object_storage.format` / `compression`) to write offloaded log payloads as Parquet instead of JSON. `format` is `json` or `parquet`; `compression` is `none` or `gzip` for JSON, and `none`, `gzip`, `snappy` or `zstd` for Parquet. Parquet works on S3 and Azure; GCS stays JSON-only. * Added `azure` as a `type` for `storage.logsStore.objectStorage` and `bifrost.auditLogs.objectStorage` (`logs_store.object_storage` / `audit_logs.object_storage`): `bucket` is the Azure Blob container, with either `endpoint` (Azure identity) or `connectionString`. For logs, `existingSecret` with `connectionStringKey` reads the connection string from a Kubernetes Secret. * Added `storage.logsStore.matviewRefreshTempFileLimit` (`logs_store.config.matview_refresh_temp_file_limit`), for example `"10GB"`: Postgres `temp_file_limit` for materialized-view refreshes. The cap applies to each Postgres process, and parallel workers each get it, so keep cap × (workers + 1) well under free disk. It needs superuser or `GRANT SET ON PARAMETER temp_file_limit`. * Added `postgresql.primary.extraArgs` (server settings such as `["-c", "max_connections=200"]`; changing them restarts the PostgreSQL pod), `postgresql.primary.persistence.annotations` and `postgresql.primary.persistence.volumeAttributesClassName` to the bundled PostgreSQL. Pod-spec only, no config.json change. * Added `bifrost.relays` (top-level `relays`): raw HTTP relays to non-LLM APIs such as Tavily, Exa or AWS Textract, served at `/relay/{name}/...`. Bifrost adds the relay's credential, prices each counted call and charges it to the caller's budgets. Entries render as written. With `sourceOfTruth: config.json`, an explicit list (including `[]`) removes stored relays it doesn't name, and their grants with them; leave the key out to keep stored relays. A repeated name fails the render. Grants are checked for identified callers only: with `bifrost.client.enforceAuthOnInference: false`, a request that carries no credential is relayed without any grant check. * Added `relay_grants: [{relay_name: ...}]` to `bifrost.governance.virtualKeys[]`, `bifrost.governance.projects[]` and `bifrost.accessProfiles[]` (`relay_grants`), the relays a caller can reach. Like the rest of the entry, the list in your values is the whole list whenever that key, project or profile syncs from config.json: when its entry changes, or on every start with `sourceOfTruth: config.json`. Leaving `relay_grants` out then means no grants, so list any grant made in the dashboard that should stay. A grant naming a relay that doesn't exist is skipped with a warning on a virtual key; a project or access profile naming one is skipped as a whole. A virtual key whose team, customer or user is governed by an access profile (Enterprise) takes its relays from that profile, and its own `relay_grants` are not applied; grant the relay on the profile. * Added `podDisruptionBudget` (top-level value): `enabled: true` keeps at least `minAvailable` (default `1`) Bifrost pods running through node drains and cluster upgrades. Setting `maxUnavailable` replaces `minAvailable`, so `maxUnavailable: "100%"` lets every replica be evicted. Rendered only in cluster mode, and needs at least 2 replicas. No config.json change. * Added `bifrost.scim.config.crossAppAccess` (`scim_config.config.crossAppAccess`, every identity provider; Enterprise): lets AI clients your identity provider admits sign in to Bifrost as the user, by exchanging the provider's ID-JAG for a Bifrost token. Takes `enabled`, `accessTokenTtl` (60-86400 seconds, default one day) and `provisionUsers`. It needs `bifrost.client.oauth2ServerConfig.issuerUrl`, the governance plugin, and an identity provider that issues ID-JAGs (such as Okta). Previously both the values schema and config.schema.json rejected it, so it could only be set from the dashboard. * Added `bifrost.scim.config.tokenExchangeHosts` (`scim_config.config.tokenExchangeHosts`, Enterprise): the hosts, besides the identity provider's own, that an MCP server's token exchange may be sent to. Previously both the values schema and config.schema.json rejected it, so it could only be set from the dashboard. * Added `bifrost.scim.config.accessProfileResolutionStrategy` (`scim_config.config.accessProfileResolutionStrategy`, Enterprise): `order` grants only the profiles of the first attribute rule a user matches; the default, `all`, grants every match. Previously both the values schema and config.schema.json rejected it, so it could only be set from the dashboard. * Added `bifrost.scim.config.syncAllUsers` (`scim_config.config.syncAllUsers`, Okta, default `true`): which users Okta directory sync keeps. `true` keeps every user assigned to the Okta app except suspended and deactivated ones; `false` keeps active users only. Directory sync runs only when `apiToken` is set. Previously the values schema rejected it, so it could only be set from the dashboard. * Added `bifrost.client.skipAccessProfileUserVirtualKeyCreation` and `.skipAccessProfileUserVirtualKeyDeletion` (`client.skip_access_profile_user_virtual_key_creation` / `skip_access_profile_user_virtual_key_deletion`, Enterprise): `true` stops giving users a virtual key with their first access profile, and keeps their virtual keys when their last profile is removed. * Added `disable_content_logging` to `bifrost.governance.projects[]` (`governance.projects[].disable_content_logging`): turns request and response content logging on or off for a project's traffic, overriding the virtual key. Omit it to inherit. * Added the `sagemaker` provider (Amazon SageMaker real-time endpoints) to `bifrost.providers` (`providers.sagemaker`). Set `sagemaker_key_config.region`; leave out `access_key` and `secret_key` to use the default AWS credentials (for example IRSA). Models are endpoint names. * Added `use_speech_endpoints` and `use_voice_live_endpoints` to `azure_key_config` (`providers.azure.keys[].azure_key_config`): `true` sends speech and transcription to Azure AI Speech, and realtime sessions to Azure Voice Live. An alias can override either. * Added `bifrost.providers..passthrough.allowed_routes` (`providers..passthrough.allowed_routes`): limits which HTTP passthrough routes reach a provider, by `path` (`*` and `/**` globs) and optional `methods`. An empty list forwards nothing. * Added `bifrost.warp` (top-level `warp`): configures the dashboard's Warp assistant (model and provider, limits, embeddings, log search and topics). Warp also needs `bifrost.featureFlags.warp.enabled: true` and a vector store. * Added `bifrost.disableOnboarding` (`disable_onboarding`): `true` hides the dashboard's setup checklist for every user. It is read from config.json on every start, so it holds on stateless deployments. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.