2026
Updated
Network Requirements moved to Getting Started. The page now has one short table each for the
self-hosted gateway, the SaaS Gateway and the endpoint agent, plus the hosts dashboard users need.
The old Resources link redirects to the new location.
Added
Network Requirements. A new Network Requirements page lists
every host and port the self-hosted gateway, the SaaS Gateway and the endpoint agent connect to,
what each connection carries, and how proxies and TLS inspection affect them. It compares the
self-hosted gateway with the SaaS Gateway side by side, with separate allowlists and data flows
for each. Gateway Requirements, Deploy, Activate, Environment, the SaaS Gateway pages and the FAQ
now link to it, and the FAQ answers about where prompts go were corrected for both options.
Added
Out-of-date Amazon Bedrock roles are flagged. When your Guardway IAM role was made from an
older template, the connection shows Update available, says which agent kinds aren’t
inventoried, and Update role walks you through updating the CloudFormation stack.
Updating an existing role
explains the steps and where to see your template version.
Added
Amazon Bedrock inventory includes AgentCore. Bedrock Agents (Classic) is closed to new AWS
accounts, so Amazon Bedrock now also inventories
AgentCore harnesses and runtimes. Harnesses come with their model, tools, MCP servers, gateway tools,
memory and guardrail. Each agent’s Type says which kind it is. The role needs the new
bedrock-agentcore read actions. Updating an existing
role explains how to
add them; until then the connection keeps syncing Bedrock Agents and shows a warning.Changed
Amazon Bedrock connects with an IAM role, not an access key. Amazon
Bedrock now explains the read-only role Guardway
assumes with your organization’s External ID, how to create it with Launch stack in AWS
(CloudFormation) or with Terraform, and the exact permissions it needs. A new Migrating from
access keys section covers connections that show Needs migration: syncing stopped, the stored
key was deleted, and Switch to IAM role keeps the connection and its agents.
Added
Claude connector: prompt previews, for Owners and Admins. A new
Prompt previews section explains how Owners and Admins
can ask Claude for the text of an AI session (
get_session_prompts, get_event_prompts). It is off
by default: switch it on per connector in Account › Connected apps, or give a Claude Code token
the prompts:read scope. Reconnecting switches it off. What Claude sees about people’s AI
use, the token scope table and the
troubleshooting entry are updated.Updated
GitHub: the Guardway GitHub App and pull request scanning. The
GitHub integration section now describes connecting through
the Guardway GitHub App instead of a personal access token: the permissions it asks for, the GitHub
screen and its tabs, connecting more than one GitHub account, and what removing or disconnecting does.
A new Pull request scanning section covers the per-account Scan pull requests toggle, the
Guardway check, the summary and inline comments it posts, and which pull requests are skipped.
Organizations and the Discovery overview no longer
refer to a GitHub token.
Added
Cursor: how Guardway governs it. A new Cursor page under
Guardway CLI explains why Cursor is governed on the device rather than routed through your
gateway, what Guardway covers through Cursor’s hooks, what the Cursor posture card shows, how
Keep Cursor prompt previews works, and the known limits.
Telemetry now names the Send Claude Code and Cursor
usage to Guardway switch and describes the prompt previews switch.
Added
Budgets and Alerts — the three kinds of spend budget side by side. A new
Budgets and Alerts page under Platform compares the per-key budget (a
lifetime cap that never resets), the application budget (daily, monthly, or lifetime, shared by every
key bound to the application), and the team budget (calendar month, UTC): what each covers, where to
set it in the dashboard and through the Claude connector, and how Claude asks which kind you mean. It
describes the
budget.threshold and budget.exceeded alerts, which subscriptions receive them, and
their payload, with an FAQ for a key that shows a budget but sends no alerts.
API Keys now says the key budget is a lifetime cap and that its
thresholds send budget.threshold.Updated
Linux package installs update themselves. Agent updates
now explains how a machine installed from the
.deb or .rpm package follows Auto-install: the
agent checks the package against the signed release index, installs it with dpkg or rpm, and
tries again later if apt or dnf is busy. Package installs older than 0.2.160 need the 0.2.160 or
later package installed over them once.Added
Ask Claude about AI use across your company. The Claude Connector
page has two new sections. Endpoints and people
lists the tools that show who uses which AI tools on which machines, personal versus corporate AI
accounts, Claude Code and Cursor session timelines and a shadow AI report, with example prompts.
Discovery and AI inventory covers
repositories that use AI and their AI bill of materials, cloud agents and their OWASP Agentic Top 10
findings, and refreshing cloud agents (Owners and Admins, with a cooldown of about 15 minutes);
repository scans stay on the dashboard’s Scan button. A new
What Claude sees about people’s AI use
section explains that Claude sees metadata only, never prompt or response text, AI account
addresses, IP addresses or cloud agent system prompts. The token scope table adds the
Endpoints & people and Discovery access levels, and the page notes that the setup check
now sees machines as counts only. Troubleshooting covers a missing scope, a route that isn’t open
yet, the refresh cooldown, repository scans and prompt text.
Added
Sizing — how big a VM the gateway needs at 100k, 1M and 10M requests a day. A new
Sizing page under Gateway gives the VM, disk and retention for each
tier, the measured cost of a request in CPU and disk, a formula for the local database size by
workload, the
.env settings for each tier, what ML PII detection adds, how the gateway sheds load
above its in-flight limit, and how to diagnose and reclaim disk. It applies to gateway v0.5.46 or
later. Requirements now states the 100k/day production baseline
and lists the bundled Postgres, with Redis described as bundled and off by default.
Environment gained the capacity and retention variables
(GUARDWAY_RETENTION_DAYS, GUARDWAY_WEBHOOK_RETENTION_DAYS, GUARDWAY_LOG_BODY_MAX_BYTES,
GUARDWAY_MAX_INFLIGHT, the database pool sizes) and the bundled Postgres tuning keys.Added
Manage API keys from Claude. A new Claude Connector page explains
how to connect claude.ai, Claude Desktop or Claude Code to Guardway and manage your organization’s
gateway API keys by asking Claude: list and inspect keys, create them with restrictions, edit,
rotate and revoke them. It covers signing in with your Guardway account (or an API token in
Claude Code), how your role limits what Claude can do, one-time reveal links that keep key secrets
out of the chat, the approval step before a rotate, a revoke or a change that removes a
restriction, how to disconnect, and common errors. Claude can also read your usage and spend,
guardrail and MCP activity, the audit log and your policy posture, read-only; the page lists those
tools, example questions, the scopes a Claude Code token needs for each, and why cost can read
low (unpriced models count as $0, and usage lags by about an hour). Owners and Admins can also
change policies and guardrail rules from Claude: the page lists the four tools with example
prompts, explains that a change that weakens protection (or a new policy) shows a preview and
waits for your approval, that Claude turns things off instead of deleting them, and that changes
reach gateways on their next config refresh. It adds the Read and change policies & guardrail
rules token access and troubleshooting for confirmations and edits that collide. New sections
cover managing members and invitations, acting on anomalies and alert rules and checking gateway
health, reading the effective policy an application gets and switching MCP tools on and off, and
adding providers and MCP servers. They say which of these ask for your approval first (inviting,
promoting or removing a member, rebaselining an anomaly, an alert rule that alerts less, switching
MCP tools or servers on, adding provider models or changing an endpoint URL). A new Secrets never
go through Claude section explains the one-time link for entering provider and MCP server
credentials in Guardway, and what to do if you paste a key in the chat. The token scope table adds
the Members, Operations (alerts & anomalies) and Connections (providers & MCP servers)
access levels.
Updated
Agents says whether agent code is in a git checkout, and where an MCP server’s code lives.
Agents now quotes what the Repository and Folder fields
of an endpoint agent’s sheet say: a checkout with no remote reads “checkout; no remote reported”,
and a folder reads “no git checkout found” when that machine’s endpoint agent reports checkouts, or
“no remote reported; showing the folder” when it does not. Likely to run
lists how the note names where agent code sits, including a Claude Code plugin copy.
Agent evidence now explains the Source folder on an MCP
server’s sheet: the code folder the endpoint agent matched the configured server to. When that
folder’s only marker is the MCP server SDK, it is listed under MCP only, not as an agent, so the
Agents count can drop when a machine’s endpoint agent is updated. The
Tools column now says which grants the endpoint agent marks
(broad), including a shell-capable tool and an all except … grant that leaves the shell on,
and that a definition granting no tools reads none. The Agents screenshot is updated.
Updated
Azure providers list their deployments. Providers now
explains that on gateway v0.5.43 and later an Azure OpenAI or Azure AI Foundry provider’s model list
is the resource’s deployments, the same list
az cognitiveservices account deployment list shows,
instead of every model the region offers, so there is no need to type deployment names. A newly
upgraded gateway switches 10 minutes after it starts. Models notes
that the enabled-models list does not restrict a listed deployment; disabled_models blocks one.Updated
Inventory → Agents ranks agents by how likely they are to run. Agents now
documents the tab under AI Supply Chain → Inventory, which lists agents found on endpoints as
well as in cloud accounts. The Likely to run column (Deployed, Armed, Local code,
Harness missing) opens with what an installed AI tool loads on its next session. Runs via
names the harness, cloud platform, repository or folder instead of a folder shown as a platform.
The page explains how Guardway knows a row is an agent (a definition, an agent framework, an LLM
library, a model SDK or the MCP server SDK), and that agent code the endpoint agent does not score
reads not scored, never clean. A line under the heading names the AI tools whose agent
definition folders are scanned, so an agent defined for any other tool reads as not reported
rather than as absent.
Fixed
API Keys, MCP and Security corrected against the dashboard.
API Keys now follows the create dialog’s Identity,
Limits and Access steps, and says that its IP allowlist and Metadata fields are not
saved with the key yet. It covers making a key MCP-only, including the LLM access switch shown when no
provider is configured, and states that an Allow list key may call every tool of a server it lists
without per-tool rules. MCP now gives the gateway version for
MCP-only keys and the error each endpoint returns. It also shows how a refused server differs from a
refused tool, and notes that Gateways can limit a server to selected gateways.
Security now points to Security → Guardrails and its
Rules and SLM Guardrails tabs.
Updated
Added
MCP — one front door for your MCP servers, scoped per team. A new
MCP page under Configuration, matching the dashboard menu:
registering servers and their upstream credentials, the per-server and combined
/mcp URLs
(<server-slug>__<tool> names), client setup for Claude Code, VS Code and Claude Desktop, and a
worked example that gives two teams different tools per API key or per application. MCP-only API
keys need no provider. MCP moved out of Security, and the MCP
section of API Keys matches the current dialog. Per-key tool
rules need gateway v0.5.39 or later.Fixed
Skill Custody — how a symlinked skill folder is reported. The
Skill Custody page said a skill behind a symlinked folder
(for example
~/.claude linked into a dotfiles repository) shows as Custody failed. It does
not: the folder is listed in the custody panel’s Partial coverage box with the reason. The page
now says so, and the Custody failed chip is described as what it is, a move that was attempted
and did not complete.Added
Skill Custody — stop a blocked skill in every AI tool, not only Claude Code — a new
Skill Custody page under Discovery → Guardway CLI.It explains what happens when your organization blocks a skill: Claude Code denies it everywhere,
and on managed machines custody also moves it out of every other AI tool’s skill folders, giving
it back when the block is lifted. The page covers turning custody on with Block skills in every
AI tool in the Detection Policy, what each status and chip in an endpoint’s Skills & findings
tab means, why custody refuses to act through a symlinked skill folder, and what the uninstaller
does with held skills.
Added
Access Profiles — one set of limits for every endpoint machine’s key — a new
Access Profiles page under Platform → Configuration.Every machine running the Guardway agent gets its own gateway API key. Until now, setting what
those keys were allowed to do — which models, what rate, what budget, when they expire — meant
editing each key by hand. An Access Profile is a named, reusable set of those constraints that a
policy selects once and every machine inherits. The page covers creating a profile, assigning one
in a policy’s Posture pane, what changes when you edit one, and why shortening the expiry window
re-keys the fleet.API Keys documents the new System-managed tab — endpoint
keys grouped by profile, view and revoke only, and what revoking one actually does. The
Gateway Overview now explains where those per-machine keys come from.
Added
Uninstall & Recovery for the Guardway CLI — a new
Uninstall & Recovery page, plus the
uninstall command in
the CLI Reference.A managed install routes Claude Code through a local tap, and that wiring outlives the agent: if
the tap stops while the settings still point at it, sessions dial a port nothing answers. The page
leads with the fix rather than the reference — sudo gw-cli uninstall --repair un-wires Claude
Code and leaves the agent installed, with fallbacks that work even when gw-cli itself is gone.Also documents the teardown order the uninstaller guarantees (un-wire, verify from disk, and only
then remove anything — the binary last), and why already-open sessions need restarting: they read
settings at launch and hang rather than reporting an error.Updated
Gateway v0.4.41 is released — the data-boundary default described on
Privacy and Security and the compliance
pages is now the current gateway behaviour, so the “next release” phrasing
was removed. Prompts and completions are excluded from cloud-pushed events by
default from v0.4.41; versions up to v0.4.40 include them.
Added
Compliance mappings: ISO/IEC 42001 and the EU AI Act — plus a corrected data boundaryTwo new pages under Resources → Compliance map Guardway capabilities to
the frameworks enterprise buyers ask about:
- ISO/IEC 42001 Mapping — clause-by-clause (4–10) and Annex-A control mapping, with an auditor artifact list and the limits stated plainly. Guardway holds no 42001 certification and the page says so.
- EU AI Act Mapping — Articles 9, 10, 12, 14, 15 and 50, each with the supporting capabilities and the gaps called out (no training-data visibility, no human-in-the-loop approvals, US-only control plane).
Updated
Guardway CLI: guided setup, environment doctor, finding accepts, and traffic correlationThe CLI Reference now documents the newest
gw-cli commands:setup— one guided command installs NVIDIA SkillSpector (the authoritative scan engine) pinned to a reviewed commit, with full disclosure and confirmation. Scans then report engine Built-in + SkillSpector, and SkillSpector works without a provider key.doctor— reports the scanning environment: which engine a scan will actually use, SkillSpector / Python / uv status, and the current air-gap and LLM modes.accept— mark reviewed findings as trusted so they stop counting against OWASP compliance; per-skill accepts are pinned to the skill’s content hash and re-surface if the skill changes.- The
servepage now explains the correlation engine: live LLM traffic that matches a flagged skill is recorded as a correlation — runtime-confirmed risk, visible on the dashboard and inreport.
gw-cli setup over the manual SkillSpector install.Added
Guardway CLI docs, with OWASP Agentic Skills Top 10 coverage & governanceNew Discovery → Guardway CLI section documenting the endpoint agent (
gw-cli): inventory, risk scoring, the local dashboard, and vetting.- Full CLI Reference including the new
approvecommand (records a governance baseline so new or changed artifacts are flaggedGOV-UNAPPROVED) andvetprovenance (HEAD commit, signature, pin class). - Inventory & Risk Scoring now documents OWASP Agentic Skills Top 10 (AST01–AST10) coverage, the PASS / ATTENTION / FAIL compliance model, and the new metadata / isolation-posture /
MCP-EXFILdetections. - Clarifies the two OWASP agentic frameworks Guardway uses: AST (Agentic Skills — installed artifacts at rest, on the endpoint) vs ASI (Agentic Security Initiative — a running agent, on the Agents page).
- The Local Dashboard page documents the OWASP compliance panel.
Updated
Agents, Topology, and Integrations docs aligned with the current dashboardDocumentation now matches the live sidebar and workspace layout.
- New Topology page for the gateway → provider → model → agent graph.
- New Dashboard → Agents page for org-wide agent metrics (stat rail and breakdowns). The Agents workspace documents Inventory and Findings only — no Dashboard tab on that page.
- Settings → Integrations rewritten for the catalog hub, category filters, View integration dialog (Overview / Connect), plus Azure AI Foundry, Amazon Bedrock, and Microsoft Entra ID (including Identities on agent detail).
- Platform sidebar order in the docs now includes Topology and Playground → Agents → Logs.
Added
OWASP Top 10 for Agentic Applications findings on the Agents pageThe Platform → Agents page now surfaces OWASP Agentic Top 10 findings detected on each discovered agent.
- The Dashboard tab has a new tile row covering Total findings, Critical + High, and ASI categories hit, plus a Findings by ASI category card that links into the filtered Findings tab.
- The Inventory tab has a new Risk column showing each agent’s worst severity and open finding count.
- A new Findings tab lists every open finding across the org with linkable filters by Category (ASI01–ASI10) and Severity (Critical / High / Medium / Low / Info).
- The Agent detail page shows the worst-severity chip in the header and a new OWASP Top 10 findings card directly below it, grouped by ASI category with collapsible Remediation and Evidence per finding.
- Five categories are evaluated in this release — ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Supply Chain, ASI05 Unexpected Code Execution, ASI07 Insecure Inter-Agent Communication. See the new OWASP Top 10 categories section on the Agents page for the rule reference, severity meanings, and finding lifecycle.
Added
Agents page and Azure AI Foundry integrationNew runtime-discovery surface for AI agents running in your cloud providers.
- New Platform → Agents page covering the Dashboard tab tiles, the Inventory table, the per-agent detail view, and how gateway-routing classification works (
routed/direct/unknown). - The Azure AI Foundry connector discovers both prompt agents (the new Foundry experience) and legacy Assistants-API agents in a single inventory.
- Settings → Integrations now covers Azure AI Foundry alongside GitHub: the four Service Principal fields, a step-by-step Azure portal walk-through, and a corrected permissions matrix showing why Azure AI User (or Azure AI Developer) must be assigned at the AI Services account scope — subscription-level alone leaves the data-plane agents API returning 401.
- A Resync button on the integration card triggers an immediate discovery refresh after adding new accounts, projects, or agents in Azure.
Updated
Docs sidebar now mirrors the dashboard menuEvery page label, sub-group, and order in the docs now matches what you see in the dashboard. Highlights:
- New Dashboard sub-group (Overview, Usage, Spend, Security) under Platform.
- Configuration sub-group consolidates Providers, API Keys, Models, Security (MCP + Guardrails + SLM), Routing, and Members.
- Settings sub-group covers Organization, Members, Roles, Pricing, Notifications, Integrations, Audit Log, Traffic, and Console.
- Logs, Playground, and gateway-deployment pages are reachable from the sub-group that matches the dashboard.
- Old gateway-section URLs (Connect Provider, Sync Models, Playground, Routing, MCP, Guardrails, Logs and Traces, Access, Webhooks, Session, Audit) redirect to their new homes.
- Gateway → Deploy rewritten end-to-end against the Register Gateway dialog; Environment is now the canonical env-var reference.
- New Discovery → Repositories page covering the per-repo inventory view.
Updated
Docs v1 — gateway onboarding rewrite
- Rebuilt navigation around the real onboarding path: sign up → deploy → activate → connect provider → sync models → playground → logs.
- New Platform section covering orgs, teams, keys, and usage.
- Moved glossary and limitations into Resources; added a Support page.
- API reference marked Coming soon until the public management API ships.
- Reskinned with Inter and the Guardway orange primary.