> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# v1.6.3

> v1.6.3 changelog - 2026-07-06

<Tabs>
  <Tab title="NPX">
    ```bash theme={null}
    npx -y @maximhq/bifrost --transport-version v1.6.3
    ```
  </Tab>

  <Tab title="Docker">
    ```bash theme={null}
    docker pull maximhq/bifrost:v1.6.3
    docker run -p 8080:8080 maximhq/bifrost:v1.6.3
    ```
  </Tab>
</Tabs>

<Update label="Bifrost(HTTP)" description="1.6.3">
  ## ✨ Features

  * **DeepSeek Provider** - Added DeepSeek as a first-class provider with dedicated request handling and thinking-mode gating
  * **AWS Bedrock Mantle Provider** - Added `bedrock_mantle` as a first-class provider with SigV4 key config, native-Anthropic and OpenAI-compatible routing, DB migration, and UI support
  * **OAuth 2.1 Gateway Auth for MCP** - Added a full OAuth2 authorization server for `/mcp`: discovery endpoints, dynamic client registration, authorize/token with PKCE and refresh token rotation, consent page, JWT Bearer authentication, session listing/revocation with sweep worker, OAuth Grants UI, and `mcp_server_auth_mode` config
  * **Virtual Key Expiry** - Added an expiry field to virtual keys with governance enforcement
  * **ClickHouse Log Store (Beta)** - Added ClickHouse support for the log store, including a hybrid store mode. This feature is in beta and may have some corner cases.
  * **IPv6 Support** - Added IPv6 support to the HTTP transport
  * **Per-MCP-Server Tool Timeout** - Added per-MCP-server tool execution timeout configuration (thanks [@Purvi09](https://github.com/Purvi09)!)
  * **OpenAI Responses Lifecycle APIs** - Added missing OpenAI Responses lifecycle methods with explicit per-verb governance flags (thanks [@17jmumford](https://github.com/17jmumford)!)
  * **MCP Clients Filtering & Pagination** - Added connection\_type, auth\_type, state, virtual\_key, and server/client\_id filters with pagination and a faceted filter sidebar on the MCP clients page
  * **Deprecated Model Marking** - Models are now marked `is_deprecated` in pricing and catalog APIs instead of being filtered out of responses
  * **Log Attribution Columns** - Added user, team, customer, and business-unit name columns to the logs list with multi-value attribution cells
  * **Latency on Errors** - Error responses now carry latency information
  * **Env-Store Virtual Key Values** - Virtual key values now use `schemas.SecretVar`, enabling env-store references
  * **Connector Multi-Attribution** - Connectors can now attach multiple teams, customers, and business units
  * **Supplemental External Budgets** - Added support for externally resolved supplemental budgets not tracked against a virtual key
  * **Cost Recalculation Progress** - Cost recalculation now streams progress via SSE with batch processing
  * **Vendor-Prefix Pricing Fallback** - Extended Bedrock vendor-prefix pricing fallback to OpenAI, Google, and xAI models
  * **Complexity Router Improvements** - Added stemming alongside exact keyword match and a no-signal fallback to the complexity analyzer
  * **MCP VK Header** - Added `x-goog-api-key` as a supported virtual-key header on the MCP auth path

  ## 🐞 Fixed

  * **Anthropic Redacted Thinking** - Round-trip `redacted_thinking` blocks on chat completions so tool-use turns with extended thinking replay correctly (thanks [@fus3r](https://github.com/fus3r)!)
  * **Bedrock Streaming Block Boundaries** - Emit `contentBlockStop` events on the Bedrock ConverseStream egress (thanks [@fus3r](https://github.com/fus3r)!)
  * **Cache Token Accounting** - Report `cached_tokens` as reads only per the OpenAI spec so cache writes are not billed as reads (thanks [@fus3r](https://github.com/fus3r)!)
  * **Streaming Retries & Fallbacks** - Clear the per-attempt stream close claim so streaming retries and fallbacks work after SSE-embedded provider errors (thanks [@fus3r](https://github.com/fus3r)!)
  * **Governance Team IDs** - Decode URL-encoded team IDs in fetch, update, and delete endpoints (thanks [@nnNyx](https://github.com/nnNyx)!)
  * **Semantic Cache Keys** - Resolve semantic cache internal embedding keys like external requests (thanks [@nnNyx](https://github.com/nnNyx)!)
  * **Gemini Batch Responses** - Surface Gemini batch inline responses from the response field instead of dest (thanks [@nnNyx](https://github.com/nnNyx)!)
  * **Governance Rate-Limit CPU** - Skip O(N) reference refresh on request-time rate-limit and budget reset
  * **Tier Cost Calculation** - Evaluate tier costs via input tokens instead of total tokens
  * **Cancelled Requests** - Fixed stats and log state for cancelled requests
  * **Billing on Failed Streams** - Fixed billing on failed Responses stream requests for Anthropic and Bedrock, and cost for image generation and edit streaming
  * **Custom Provider Budgets** - Custom providers with spaces in their names can now set budgets
  * **Model Parameters URL** - Honor `model_parameters_url` changes in config.json like `pricing_url` (thanks [@jeremym-tanium](https://github.com/jeremym-tanium)!)
  * **Bedrock Truncation Signal** - Signal Bedrock `max_output_tokens` truncation on the Responses API (thanks [@jeremym-tanium](https://github.com/jeremym-tanium)!)
  * **MCP Reconnect** - Fixed MCP clients registering as connected with an empty tool set when ListTools fails during startup (thanks [@HackToHell](https://github.com/HackToHell)!)
  * **MCP Tool Ordering** - Deterministic MCP tool ordering for prompt cache stability
  * **Vertex gs\:// Images** - Pass through `gs://` image URLs on Vertex Gemini (thanks [@G-XD](https://github.com/G-XD)!)
  * **Hybrid Log Token Usage** - Rebuild token usage from denormalized columns in the hybrid log list (thanks [@G-XD](https://github.com/G-XD)!)
  * **Anthropic Files** - Preserve file ID document sources (thanks [@mmacvicar](https://github.com/mmacvicar)!) and forward file IDs and content type on the Anthropic files integration
  * **Gemini Upload MIME Type** - Preserve file upload MIME types (thanks [@mmacvicar](https://github.com/mmacvicar)!)
  * **Content Logging Bypass** - Sanitize `ErrorDetailsParsed` so raw payloads honor `disable_content_logging` (thanks [@citrocat](https://github.com/citrocat)!), plus error-detail sanitization on the log update path
  * **Trace Store Memory Leak** - Sweep orphaned deferred spans in trace store TTL cleanup (thanks [@citrocat](https://github.com/citrocat)!) and complete deferred LLM spans on streaming goroutine exit
  * **Claude Code Passthrough Streaming** - Consistent content\_block indices for server tools (thanks [@surki](https://github.com/surki)!)
  * **Codex Tool Search Round-Trip** - Preserve codex `tool_search_call` and `tool_search_output` input items on the Responses API (thanks [@raghu-nandan-bs](https://github.com/raghu-nandan-bs)!)
  * **Gemini Fixes** - Guard tool call config, fix the 2.5-pro thinking budget value, OpenAI-through signature compatibility, and video reference field mapping (thanks [@vojthor](https://github.com/vojthor)!)
  * **DeepSeek Thinking** - Convert thinking to disabled when tool choice is required
  * **OpenAI Integration** - Propagate `max_tokens` from the OpenAI integration and pass `chunking_strategy` through as an extra param
  * **Bedrock Error Types** - Fixed error type setting in all integrations for Bedrock
  * **Perplexity Responses** - Fixed Perplexity Responses API compatibility
  * **Secret Detection** - Set `SecretTypePlainText` for plain-text JSON and non-prefixed secret values, and check whether virtual key values are secrets
  * **Empty Tool Results** - Fixed empty tool call result insertion failures
  * **Error Redaction** - Redact decoder details from invalid request payload errors
  * **Vertex Idle Timeout** - Fixed idle timeout wiring in the Vertex path
  * **Web Fetch** - Assorted web fetch fixes
  * **MCP Token Refresh** - Skip background token refresh for disabled or unconfigured MCP clients and exclude terminal-status OAuth configs from the refresh query
  * **SSO Login Loop** - Fixed an endless login loop on SSO
  * **UI Fixes** - Governance form calendar-aligned toggle gating, dashboard array query params, MCP sessions table scrolling with sticky header, audit logs layout, and model catalog key aliases displayed as model names

  ## 🐙 Closed GitHub Issues

  * [#2347](https://github.com/maximhq/bifrost/issues/2347) - MCP tool ordering is non-deterministic, breaking prefix-based prompt caching
  * [#3106](https://github.com/maximhq/bifrost/issues/3106) - Governance team delete/fetch fails for SCIM-synced team IDs containing spaces or URL-sensitive characters
  * [#3121](https://github.com/maximhq/bifrost/issues/3121) - OpenAI responses.retrieve() not supported
  * [#3139](https://github.com/maximhq/bifrost/issues/3139) - Bifrost adds non-standard reasoning/reasoning\_details fields to chat completions when using a custom provider for deepseek v4 models
  * [#3357](https://github.com/maximhq/bifrost/issues/3357) - Bifrost billing discrepancy for cancelled requests
  * [#3951](https://github.com/maximhq/bifrost/issues/3951) - Gemini batch: inline responses (dest.inlinedResponses) are silently dropped, leaving output\_file\_id null
  * [#4262](https://github.com/maximhq/bifrost/issues/4262) - Bedrock ConverseStream egress never emits contentBlockStop (breaks strands streaming)
  * [#4314](https://github.com/maximhq/bifrost/issues/4314) - MCP client registered as connected with empty tool set when ListTools fails during connect/reconnect
  * [#4402](https://github.com/maximhq/bifrost/issues/4402) - Vertex provider drops image blocks whose URL uses `gs://` scheme
  * [#4446](https://github.com/maximhq/bifrost/issues/4446) - Add per MCP server level tool timeout configuration
  * [#4679](https://github.com/maximhq/bifrost/issues/4679) - Bedrock Responses API does not signal max\_output\_tokens truncation
  * [#4689](https://github.com/maximhq/bifrost/issues/4689) - Custom providers cannot set budget
  * [#4720](https://github.com/maximhq/bifrost/issues/4720) - chunking\_strategy is dropped for OpenAI-compatible transcription requests
  * [#4721](https://github.com/maximhq/bifrost/issues/4721) - Logs table Tokens column shows N/A when hybrid object storage is enabled
  * [#4756](https://github.com/maximhq/bifrost/issues/4756) - semantic\_cache internal embedding path bypasses plugin pipeline, causing "no keys found" while direct /v1/embeddings works
  * [#4777](https://github.com/maximhq/bifrost/issues/4777) - Image generation stream: completed chunk returns empty output\_tokens\_details, causing under-billing
  * [#4788](https://github.com/maximhq/bifrost/issues/4788) - DeepSeek Anthropic-compatible provider causes "stream closed" error in v1.6.0 (regression from v1.5.16)
  * [#4816](https://github.com/maximhq/bifrost/issues/4816) - /v1 chat completions folds cache-write tokens into prompt\_tokens\_details.cached\_tokens
  * [#4851](https://github.com/maximhq/bifrost/issues/4851) - v1.6.2 governance rate-limit reset causes high CPU in BumpRateLimitUsage/updateRateLimitReferences
  * [#4863](https://github.com/maximhq/bifrost/issues/4863) - model\_parameters\_url in config.json is ignored after the DB value is set
  * [#4868](https://github.com/maximhq/bifrost/issues/4868) - Memory leak: orphaned deferred spans in TraceStore are never TTL-swept
  * [#4872](https://github.com/maximhq/bifrost/issues/4872) - Raw request/response payloads bypass disable\_content\_logging via ErrorDetailsParsed
  * [#4942](https://github.com/maximhq/bifrost/issues/4942) - redacted\_thinking blocks are dropped on chat completions, breaking tool-use replay with extended thinking
</Update>

<Update label="Core" description="1.6.3">
  * feat: added DeepSeek as a first-class provider (#4852)
  * feat: added `bedrock_mantle` as a first-class provider with native-Anthropic and OpenAI-compatible routing and SigV4 key config (#4736, #4737)
  * feat: added JWT Bearer authentication path for `/mcp` with session validation, a `virtualKeysByID` secondary index, and cached signing key and VK lookups (#4508, #4783)
  * feat: added per-MCP-server tool execution timeout (#4472, closes #4446) (thanks [@Purvi09](https://github.com/Purvi09)!)
  * feat: added missing OpenAI Responses lifecycle methods (#3125, closes #3121) (thanks [@17jmumford](https://github.com/17jmumford)!)
  * feat: added IPv6 support (#4895)
  * feat: added ClickHouse support for the log store (#4748)
  * feat: extended Bedrock vendor-prefix pricing fallback to OpenAI, Google, and xAI models and folded `bedrock_mantle` onto `bedrock` lookups (#4924)
  * feat: added `is_deprecated` to model pricing and catalog responses and mark deprecated models instead of filtering them (#4779, #4792, #4936)
  * feat: added latency info on errors (#4867, #4876)
  * feat: added multiple teams, customers, and business units to connectors (#4875)
  * feat: virtual key values use `schemas.SecretVar` to support the env store (#4817)
  * feat: `chunking_strategy` passes through as an extra param for OpenAI models (#4741, closes #4720)
  * feat: simplified Responses lifecycle permissions to explicit per-verb flags (#4880)
  * fix: round-trip Anthropic `redacted_thinking` blocks on chat completions so tool-use turns with redacted reasoning can be replayed (#4943, closes #4942) (thanks [@fus3r](https://github.com/fus3r)!)
  * fix: emit `contentBlockStop` events on the Bedrock ConverseStream egress so consumers that assemble messages on block boundaries get complete content (#4923, closes #4262) (thanks [@fus3r](https://github.com/fus3r)!)
  * fix: clear the per-attempt stream close claim so streaming retries and fallbacks are not dead on arrival after an SSE-embedded provider error (#4911, closes #4788) (thanks [@fus3r](https://github.com/fus3r)!)
  * fix: emit reads-only `cached_tokens` in usage per the OpenAI spec so cache writes are not priced as cache reads (#4906, closes #4816) (thanks [@fus3r](https://github.com/fus3r)!)
  * fix: forward file IDs and content type on the Anthropic files integration (#4956)
  * fix: preserve Anthropic file ID document sources (#4832) (thanks [@mmacvicar](https://github.com/mmacvicar)!)
  * fix: preserve Gemini file upload MIME types for GenAI file URI completions (#4833) (thanks [@mmacvicar](https://github.com/mmacvicar)!)
  * fix: propagate `max_tokens` from the OpenAI integration (#4966)
  * fix: error type setting in all integrations for Bedrock (#4958)
  * fix: guard setting tool call config in Gemini (#4959)
  * fix: Gemini 2.5-pro thinking budget value (#4947)
  * fix: Gemini OpenAI-through signature compatibility (#4810)
  * fix: surface Gemini batch inline responses from the response field, not dest (#4904, closes #3951) (thanks [@nnNyx](https://github.com/nnNyx)!)
  * fix: Gemini video reference fields map to instances (thanks [@vojthor](https://github.com/vojthor)!)
  * fix: web fetch fixes (#4945)
  * fix: set `SecretTypePlainText` for plain-text JSON and non-prefixed secret values (#4946) and check whether virtual key values are secrets (#4927)
  * fix: idle timeout wiring in the Vertex path and recover from idle-timeout timer-goroutine panic (#4937)
  * fix: set content type header consistently for Responses API requests (#4935)
  * fix: deterministic MCP tool ordering for prompt cache stability (#4932, closes #2347)
  * fix: consistent content\_block indices for server tools on Claude Code passthrough streaming (#4890) (thanks [@surki](https://github.com/surki)!)
  * fix: empty tool call result insertion failures (#4925)
  * fix: sanitize error details on the log update path and set the raw-storage log flag on standalone MCP tool executions (#4913)
  * fix: complete deferred LLM span on streaming goroutine exit (#4885)
  * fix: billing on failed Responses stream requests for Anthropic and Bedrock (#4842)
  * fix: cost for image generation and image edit streaming (#4802, closes #4777)
  * fix: Perplexity Responses API compatibility (#4813)
  * fix: signal Bedrock max\_output\_tokens truncation on the Responses API (#4680, closes #4679) (thanks [@jeremym-tanium](https://github.com/jeremym-tanium)!)
  * fix: preserve codex `tool_search_call` and `tool_search_output` input items and accept object-valued tool-call arguments on the Responses API streaming path (#4121) (thanks [@raghu-nandan-bs](https://github.com/raghu-nandan-bs)!)
  * fix: MCP reconnect failure on startup (#4316, closes #4314) (thanks [@HackToHell](https://github.com/HackToHell)!)
  * fix: pass through `gs://` image URLs on Vertex Gemini (#4568, closes #4402) (thanks [@G-XD](https://github.com/G-XD)!)
  * fix: skip model check for Responses lifecycle APIs (#4920)
  * chore: refactored Anthropic request building into `BuildAnthropicChatRequestBody`, shared `completeRequest` across Anthropic, Azure, and Bedrock, lazy `BodySigner` SigV4 signing, and `BearerAuthHeader` helper (#3309, #4394, #4425, #4735)
</Update>

<Update label="Framework" description="1.4.3">
  * feat: added ClickHouse support for the log store with a hybrid store mode (#4748, #4893)
  * feat: added OAuth 2.1 gateway auth: AS discovery endpoints, signing key management, `MCPServerAuthMode` config, issuance endpoints (DCR, authorize, token) with PKCE and refresh token rotation, session listing, revocation, family-revocation, VK liveness checks, and sweep worker (#4505, #4506, #4509)
  * feat: revoke VK-mode OAuth2 grants on VK deletion with user-liveness checks at refresh and request time (#4806)
  * feat: push OAuth2 sessions filtering and pagination to SQL with total count (#4775)
  * feat: added expiry field to virtual keys (#4887)
  * feat: virtual key values use `schemas.SecretVar` to support the env store (#4817)
  * feat: added `BedrockMantleKeyConfig` support to key hashing, schema/table mapping, and sensitive field clearing (#4737, #4886)
  * feat: added per-MCP-server tool execution timeout (#4472, closes #4446) (thanks [@Purvi09](https://github.com/Purvi09)!)
  * feat: added connection\_type, auth\_type, state, virtual\_key, and server/client\_id filters with pagination to the MCP clients list (#4839, #4767, #4841)
  * feat: added `user_name`, `team_ids`, `team_names`, `customer_ids`, `customer_names`, `business_unit_ids`, and `business_unit_names` to log list select columns (#4866)
  * feat: added `UpsertModelParametersBatch` for batched model parameter sync (#4800)
  * feat: added `is_deprecated` to pricing and catalog responses and mark deprecated models instead of filtering them (#4779, #4792, #4936)
  * feat: drop reasoning when tools are present but `reasoning_with_tool_calls` is unsupported (#4630)
  * feat: extended vendor-prefix pricing fallback to OpenAI, Google, and xAI models (#4924)
  * feat: lowered `auth_code_ttl` default to 300s and enforce a 900s maximum (#4822)
  * fix: sweep orphaned deferred spans in trace store TTL cleanup (#4869, closes #4868) (thanks [@citrocat](https://github.com/citrocat)!)
  * fix: rebuild token usage from denormalized columns in hybrid log list (#4722, closes #4721) (thanks [@G-XD](https://github.com/G-XD)!)
  * fix: stats for cancelled requests (#4930)
  * fix: tier costs evaluated via input tokens instead of total tokens (#4917)
  * fix: append datasheet models for incomplete list-models calls (#4879)
  * fix: skip background token refresh for disabled or unconfigured MCP clients and guarantee non-nil logger in sync workers (#4848)
  * fix: exclude terminal-status OAuth configs from the expiring token refresh query (#4754)
  * fix: check whether virtual key values are secrets (#4927)
  * fix: web fetch fixes (#4945)
  * fix: Perplexity Responses API compatibility (#4813)
</Update>

<Update label="compat" description="0.1.25">
  * feat: drop reasoning when tools are present but `reasoning_with_tool_calls` is unsupported (#4630)
  * fix: convert thinking to disabled when tool choice is required for DeepSeek (#4861)
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="governance" description="1.6.3">
  * feat: added expiry enforcement for virtual keys (#4887)
  * feat: complexity analyzer stemming support alongside exact keyword match and a no-signal fallback (#4708, #4791)
  * feat: added `virtualKeysByID` secondary index with cached signing key and VK lookups on the `/mcp` JWT auth path (#4783)
  * feat: virtual key values use `schemas.SecretVar` to support the env store (#4817)
  * fix: skip O(N) reference refresh on request-time rate-limit and budget reset (#4883, closes #4851)
  * fix: skip model check for Responses lifecycle APIs (#4920)
  * fix: empty tool call result insertion failures (#4925)
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="jsonparser" description="1.5.26">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="logging" description="1.5.26">
  * feat: latency info on errors (#4867)
  * feat: stream cost recalculation progress via SSE with batch processing (#4778)
  * fix: sanitize `ErrorDetailsParsed` so raw payloads honor `disable_content_logging` (#4873, closes #4872) (thanks [@citrocat](https://github.com/citrocat)!)
  * fix: sanitize error details on the log update path and remove redundant immediate error serialization (#4913)
  * fix: cancelled state in logs (#4831, closes #3357)
  * fix: empty tool call result insertion failures (#4925)
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="maxim" description="1.6.26">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="mocker" description="1.5.26">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="modelcatalogresolver" description="1.0.7">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="otel" description="1.3.3">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="prompts" description="1.0.26">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="semanticcache" description="1.5.26">
  * fix: resolve internal embedding keys like external requests (#4903, closes #4756) (thanks [@nnNyx](https://github.com/nnNyx)!)
  * fix: clear body-transport state for internal embedding requests via `ClearContextForInternalRequest` (#4918)
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>

<Update label="telemetry" description="1.5.26">
  * chore: upgraded core to v1.6.3 and framework to v1.4.3
</Update>