[ca] CLI Version Update: MCP Gateway v0.3.23 → v0.3.24

[github-actions]

Summary

A new MCP Gateway (gh-aw-mcpg) release is available. This is the only agentic CLI/MCP component with a version change since the last check; all other monitored tools are current.

Component	Current	Latest	Status
MCP Gateway (gh-aw-mcpg)	v0.3.23	v0.3.24	⚠️ Update available
Claude Code	2.1.168	2.1.168	✅ Current
Copilot CLI	1.0.60	1.0.60	✅ Current
Codex	0.137.0	0.137.0	✅ Current
GitHub MCP Server	v1.1.2	v1.1.2	✅ Current
Playwright MCP	0.0.75	0.0.75	✅ Current
Playwright CLI	0.1.13	0.1.13	✅ Current
Playwright Browser	v1.60.0	v1.60.0	✅ Current

Update MCP Gateway

• Previous: v0.3.23 → New: v0.3.24
• Timeline: v0.3.23 (2026-06-05) → v0.3.24 (2026-06-08) — 3 days
• Constant: DefaultMCPGatewayVersion in pkg/constants/version_constants.go
• Note: Used as the default sandbox.agent container image (ghcr.io/github/gh-aw-mcpg:v{VERSION}).

Breaking Changes

• Gateway "API key" surface renamed to Agent ID with X-Agent-ID routing. Compat aliases were introduced and then the deprecated API-key aliases were removed within this release (Rename gateway “API key” surface to Agent ID with compat aliases and X-Agent-ID routing gh-aw-mcpg#7114, [Repo Assist] refactor: remove deprecated API key alias functions gh-aw-mcpg#7150, Remove deprecated API-key aliases and complete AgentID rename gh-aw-mcpg#7159). If any gh-aw code or config references the gateway API-key surface, verify it uses the Agent ID surface after upgrade.

Key Features

• New unauthenticated /reflect endpoint for live DIFC label snapshots in gateway and proxy modes (Add unauthenticated /reflect endpoint for live DIFC label snapshots in gateway and proxy modes gh-aw-mcpg#7168)
• Proxy now passes through /rate_limit for the CLI proxy liveness probe (fix(proxy): passthrough /rate_limit for CLI proxy liveness probe gh-aw-mcpg#7187)

Performance

• Middleware fast path: skip json.Marshal for small text responses ([Repo Assist] perf(middleware): skip json.Marshal for small text responses (fast path) gh-aw-mcpg#7094)

View Full Changelog

Fixes

• fix(proxy): passthrough /rate_limit for CLI proxy liveness probe — fix(proxy): passthrough /rate_limit for CLI proxy liveness probe gh-aw-mcpg#7187

Refactors / Internal

• Rename gateway API key surface to Agent ID with compat aliases and X-Agent-ID routing — Rename gateway “API key” surface to Agent ID with compat aliases and X-Agent-ID routing gh-aw-mcpg#7114
• Remove deprecated API key alias functions — [Repo Assist] refactor: remove deprecated API key alias functions gh-aw-mcpg#7150
• Remove deprecated API-key aliases and complete AgentID rename — Remove deprecated API-key aliases and complete AgentID rename gh-aw-mcpg#7159
• extract withReconnectLock to eliminate reconnect boilerplate — refactor(mcp): extract withReconnectLock to eliminate reconnect boilerplate gh-aw-mcpg#7103
• Refactor TimeoutPositive to reuse TimeoutMinimum — Refactor TimeoutPositive to reuse TimeoutMinimum and remove duplicated validator logic gh-aw-mcpg#7105
• Semantic function clustering: remove wrapper indirection — Refactor semantic function clustering targets: remove wrapper indirection and co-locate thin/misplaced functions gh-aw-mcpg#7101
• Refactor cmd HTTP server lifecycle into shared serveAndWait helper — Refactor cmd HTTP server lifecycle into shared serveAndWait helper gh-aw-mcpg#7104
• extract session ID header extraction into helper — [Repo Assist] refactor(server): extract session ID header extraction into helper gh-aw-mcpg#7151
• consolidate map utilities, deep clone, and logger constant — refactor: consolidate map utilities, deep clone, and logger constant gh-aw-mcpg#7156
• deduplicate session ID extraction into a shared helper — refactor(server): deduplicate session ID extraction into a shared helper gh-aw-mcpg#7158

Tests

• Add tests for mcpresult.ExtractTextContent — [test] Add tests for mcpresult.ExtractTextContent gh-aw-mcpg#7060
• Improve tests for mcp package — [test-improver] Improve tests for mcp package gh-aw-mcpg#7067
• Add tests for schema compilation and guard policy error paths — [test] Add tests for schema compilation and guard policy error paths gh-aw-mcpg#7112
• Improve tests for launcher/health_monitor — [test-improver] Improve tests for launcher/health_monitor gh-aw-mcpg#7124
• Add tests for launcher.handleErrorState and clearServerForRestart — [test] Add tests for launcher.handleErrorState and launcher.clearServerForRestart gh-aw-mcpg#7161

Docs / Chore

• update schema URL to gh-aw v0.78.2 — 🔄 chore: update schema URL to gh-aw v0.78.2 gh-aw-mcpg#7082
• update schema URL to v0.78.3 — 🔄 chore: update schema URL to v0.78.3 gh-aw-mcpg#7138
• correct ${VAR} expansion scope and add missing internal packages — docs: correct ${VAR} expansion scope and add missing internal packages gh-aw-mcpg#7102
• fix three documentation inaccuracies (port field, MCP methods, tracing var expansion) — docs: fix three documentation inaccuracies (port field, MCP methods, tracing var expansion) gh-aw-mcpg#7157
• add debug logging to forwardAndReadBody and writeEmptyResponse — [log] proxy/handler: add debug logging to forwardAndReadBody and writeEmptyResponse gh-aw-mcpg#7066
• Add debug logging to HTTP server lifecycle in serve.go — [log] Add debug logging to HTTP server lifecycle in serve.go gh-aw-mcpg#7123

View Migration Guide

1. Edit pkg/constants/version_constants.go:
   • DefaultMCPGatewayVersion Version = "v0.3.23" → "v0.3.24"
2. Per the constant's in-code warning, MCP Gateway bumps require a full rebuild and a double recompile:

   make build && make recompile && make recompile
   

   The first recompile regenerates lock files with the new version; the second refreshes the container SHA pins resolved during the first pass.
3. Verify with git status (do NOT commit *.lock.yml or pkg/workflow/js/*.js directly).
4. Verify the Agent ID rename does not break gateway routing in gh-aw (search for any API-key surface usage; ensure X-Agent-ID routing is used).

Note: This automated checker has create_issue-only safe outputs (no PR/push), so the constant edit and recompile were not performed in this run — they require a human-driven PR.

Impact Assessment

• Risk: Medium — primarily refactors/tests, but includes a routing-surface rename (API key → Agent ID) with removed deprecated aliases. The double-recompile requirement and container SHA re-pinning warrant a careful PR + CI run.
• Affects: default sandbox.agent container, gateway/proxy routing, DIFC reflect observability.

Recommendations

• Priority: Normal. Schedule a PR bumping DefaultMCPGatewayVersion to v0.3.24, run make build && make recompile && make recompile, and let CI validate before merge.
• Pay attention to the Agent ID rename when reviewing gateway integration code.

Package Links

• Repository: https://github.com/github/gh-aw-mcpg
• Release Notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.24
• Full Changelog: github/gh-aw-mcpg@v0.3.23...v0.3.24
• Docker Image: ghcr.io/github/gh-aw-mcpg:v0.3.24

References:

• §27121260417

Generated by 🔢 CLI Version Checker · 101.8 AIC · ⌖ 33.6 AIC · ⊞ 11.3K · ◷

• expires on Jun 9, 2026, 11:05 PM UTC-08:00