Release notes

What's new in trAPIoka

What we shipped, when, and what it means for your systems. Last updated .

  1. Operations

    Per-route CORS, WebSocket passthrough and configuration bundles

    Browser apps and real-time clients now go through the same governed routes as everything else, and a whole installation's setup can move between environments as one file.

    • CORS policy per route: allowed origins, methods and headers, with preflight answered by the gateway.
    • WebSocket passthrough per route: upgrade and stream through trAPIoka with auth and audit intact.
    • Export and import configuration bundles: routes, APIs and credentials by name, with a dry run first. Secrets travel sealed with your passphrase.
    • Rate limits are enforced across every gateway instance, not per pod.
  2. Security

    Unattended restarts, user removal and sharper log search

    On-prem appliances come back after a reboot without someone typing an unseal key, and admins get the last pieces of user lifecycle and log forensics.

    • Host-key unseal for the built-in secrets vault, so an appliance restarts on its own without a cloud KMS or TPM.
    • Admins can delete any user (never themselves); sessions and workspace access go with them and the action is audited.
    • Search request logs by body text and by source-IP range (CIDR).
  3. Debugging

    Interceptor v2: a debugger for live traffic

    Pause a real request at the gateway, see exactly what each pipeline stage did to it, change it, and send it on.

    • Hold matching requests on arrival and again before the answer goes back.
    • Edit method, path, query, headers or body, or abort with a status of your choice.
    • A timeline of every stage: auth, inspection, transforms, resilience and the upstream call.
    • Run to response, restart, or step back to an earlier stage.
    • Mock the upstream for one held request. Edited requests are re-inspected, so nothing slips past the firewall.
    • Time spent paused is excluded from latency metrics and SLAs.
  4. Observability

    Live Logs

    Flip the Logs page to Live and watch requests arrive as they happen, with the same filters as search.

    • Rows reach the screen 18 ms after the response at p99 in our tests.
    • Streaming only runs while someone is watching, so it costs the gateway nothing otherwise.
    • Request-log intake now drains bursts of about 18,000 events a second.
  5. Protocols

    Route Groups

    One call runs an ordered set of routes and answers with every result at once.

    • Sweep a device with many checks over one SSH, PowerShell or database login instead of one login per check.
    • Every member runs its own full pipeline: auth, inspection, transforms and resilience.
    • Callers can pick a slice or an order per call; loops and runaway fan-out are refused.
  6. AI

    AI Toolkits over MCP

    Any route, including a SOAP service, a database query or an SSH command, can become a tool your AI agents call over the Model Context Protocol.

    • Each tool carries a danger tier: read only, idempotent write or destructive.
    • Toolkits set a ceiling. Tools above it are invisible to the agent and refused if called.
    • Every call takes the normal path: auth, inspection, transforms, rate limits and audit.
    • Turn a toolkit off and it disappears for every agent at once.
  7. Performance

    Sub-millisecond gateway processing

    We moved every remaining network round-trip off the request path. In our load test the gateway added 47 µs at the median.

    • Processing time p50 47 µs, p99 575 µs at about 17,900 requests a second.
    • Microsecond timing headers on every response, so you can check it yourself.
    • Scripted transforms ride pooled streams instead of one call per request.
  8. Protocols

    Database routes for PostgreSQL, MongoDB, SQL Server and Oracle

    Publish a vetted query as an API. Callers send values, never query text.

    • Values are always bound as parameters, so injection has nowhere to go.
    • Row and byte caps, deadlines and TLS verification on every call.
    • Credentials stay encrypted in the vault; routes only hold a reference.
    • Reach databases directly or through a connector inside a private network.

Want to see any of this on your systems?

We'll run it against the pair you care about.

Request a demo →