Mutual Trust

Changelog

Public behaviour changes are listed here. Breaking changes to public contracts require a new version and an overlap window.

Documentation menu

2026-11-14

Documentation

  • New documentation site: concepts, environments, guides for enrollment, renewal, revocation, partners, billing, organization and troubleshooting; reference pages for the API, CLI, wire formats, errors, security, MCP, identity and the GCP profile.
  • Added llms.txt and llms-full.txt.
  • Gateway guides for Envoy, Istio, Kubernetes ingress-nginx, NGINX, Traefik, HAProxy, Kong, Caddy, AWS API Gateway, AWS ALB, Cloudflare and the standalone mTLS proxy under Gateways.

API 1.0.0-early-access

  • Added API credentials: GET/POST /v1/organizations/{id}/api-credentials and POST …/{cid}/revoke. Send them as Authorization: Bearer mtk_….
  • Added POST /v1/mcp/authorizations for MCP consent.
  • Operations now report delivered separately from applied per gateway.
  • Audit export requires a separately assigned export grant.

Sign-in

  • Passkeys are the primary sign-in: create an account with a passkey, sign in with a passkey, and add or remove passkeys from your account. Enterprise SSO through OIDC remains available. See Identity and access.
  • The staff console supports passkeys, with a one-time bootstrap for the first staff passkey.

mt CLI 1.0.0 (native)

  • mt is now one native binary for macOS, Linux and Windows (amd64, arm64) with the enforcer (mt enforcer) and the adapter runtime (mt adapt) built in. Install with curl -fsSL https://mutualtrust.io/install.sh | sh or irm https://mutualtrust.io/install.ps1 | iex, or the .deb and .rpm packages. See CLI reference.
  • Releases are signed: SHA256SUMS.sig (Ed25519, release key) is verified by the installers and by mt self-update.
  • mt renew runs a reload hook (--on-renew, without a shell, or --signal) and confirms the reload only after it succeeds; files are committed atomically. mt service install sets up systemd, launchd or a Windows service.
  • --json output and documented exit codes (3 denied, 4 unreachable, 5 not enrolled) for automation; --key-store keychain on macOS.
  • State moves to the OS configuration directory; an existing ~/.mt is copied on first use. The Node.js build (mt.mjs) stays available as an optional JavaScript CLI.

CLI 0.9.0 and reference gateway 0.9.0

  • Initial release: gateway, enroll (sandbox token and OIDC), renew (with --watch), call and status.
  • mt enforcer install installs the Mutual Trust enforcer (mt-enforcer), and mt gateway runs it in proxy mode in front of your API.
  • Envoy profile with an ext_authz companion.