Skip to main content

DVARA 1.13 — Smaller images, MCP refusals you can act on, and Helm installs that work

· 5 min read
DVARA Team
DVARA Team

DVARA 1.13.0 is a fix release. The images are about a third smaller. MCP refusals now return the status and the audit records a client needs. The Helm chart refuses values that broke an install, and routes go to the providers they list.

Smaller images​

The images are about a third smaller, by removing duplicate jar files.

Image1.12.0 download1.13.0 download
dvara-gateway507 MB337 MB
dvara-flightdeck511 MB309 MB

MCP refusals a client can act on​

  • An under-scoped token gets HTTP 403. On native /mcp, a token with only mcp:read that called a tool got HTTP 200 with the error inside, so an OAuth client could not tell it needed a wider token. It now gets 403 and a WWW-Authenticate: Bearer error="insufficient_scope" challenge naming the scope.
  • Refusals leave a record. A call refused for its scopes, or a DVARA API key sent when API keys are off, now writes MCP_AUTH_REFUSED. A refusal for a suspended workspace now writes WORKSPACE_SUSPENDED_BLOCK. Neither credential is ever recorded.
  • A rate-limited call says when to retry. It carries Retry-After and retry_after_seconds, and shows in MCP → Tool Calls with status 429.
  • An approval that cannot be raised says so. When Flightdeck cannot register an approval, the call gets its default action at once and the audit says MCP_APPROVAL_UNAVAILABLE. Before, it waited and was reported as a timeout, though no one was ever asked. A2A hops now work the same way.
  • The first call after an MCP server restarts works. DVARA opens a new session and sends the call once more. It does this only when the server refused the call before running it, so a tool never runs twice.
  • mcp_arg policy conditions see the tool's arguments. They looked one level too high, found nothing, and matched every call.

See the MCP gateway API.

A Helm install works, or is refused with the fix​

  • Inline api_keys in llmGatewayServer.gatewayConfig made every gateway pod fail to start. The chart now refuses them and says to create keys in Flightdeck.
  • With your own Secret (secrets.existingSecret), the chart no longer makes a cluster certificate you did not ask for. Set cluster.tls.secretName, or the new cluster.tls.create: true.
  • With gateway persistence on, some clusters refused the StatefulSet update. It now replaces one pod at a time, which every cluster accepts.

See Settings the chart refuses.

Routes go where they say​

  • A model-prefix route sends its models to the providers it lists. A route for ai/* with provider: openai got 400 no_provider, because the route ignored its providers. It now uses them, in the order listed.
  • Static routes work on the Enterprise Gateway, with every strategy. They were dropped at startup, and some strategies stopped the Gateway. Flightdeck's routes still come first.
  • In DVARA Open Source, routes from gateway.yaml and from the startup properties are both served. The file's routes used to replace the others.

See Routing.

Webhooks​

  • A webhook saved with no signing secret never delivered, and nothing said so. Flightdeck now makes a strong secret and shows it once. A webhook with no secret is marked Not delivering.
  • A webhook subscribed to INJECTION_DETECTED now fires.
  • The approve and deny links in an approval webhook can be clicked. A click opens a page that asks you to confirm, so a link preview cannot approve a call.

See Webhooks.

Smaller fixes​

  • The AWS Secrets Manager and Azure Key Vault credential stores start in the gateway image.
  • OTEL_EXPORTER_OTLP_ENDPOINT takes a base URL, such as http://collector:4318. A full traces URL still works.
  • The Gemini provider sends its key to Google in a header, not in the URL.
  • Governance → Audit can find a call by its trace ID, and MCP → Tool Calls shows and filters by agent.
  • A batch's error file can be downloaded.
  • Streamed calls on a canary route are counted in the canary report.
  • An eval pass threshold of 0 means 0.
  • The model catalogue is the 26 October copy: 23 models added, 38 repriced, 27 retired models removed.

Read this before upgrading​

  1. Run helm template with your values first. The chart refuses inline api_keys, and a cluster certificate beside existingSecret unless you ask for one.
  2. Error codes are all lower case. IP_ACCESS_DENIED is now ip_access_denied, and FILE_TOO_LARGE is now file_too_large. Update clients and alerts that match them.
  3. Give the metrics key its own value. If it equals the operator key, the Gateway and Flightdeck no longer start.
  4. Native /mcp scope refusals return HTTP 403, not 200. Update monitors that read the status.
  5. Check your routes. Static routes on the Enterprise Gateway now take traffic, and a model-prefix route with providers now goes to the providers it lists.
  6. Back up the database. Flightdeck adds two migrations when it starts (V91, V92).

The upgrade guide has every change.

Try DVARA 1.13​

The images ghcr.io/dvarahq/dvara-gateway:1.13.0 and ghcr.io/dvarahq/dvara-flightdeck:1.13.0 and the Helm chart 1.13.0 are out now. DVARA Open Source 1.13.0 is out too. Its runnable jar is now on the GitHub Release, and the libraries are on Maven Central. Follow the Open Source quickstart, or book a walkthrough of the Enterprise platform.