> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Desktop App

> Release notes for Formal Desktop App

<Update label="July 9, 2026" tags={["Bug Fixes"]}>
  ## 0.22.2

  **Fixed**

  * Fix a bug with forward-to-connector network rules on Linux endpoints
</Update>

<Update label="July 9, 2026" tags={["New Features"]}>
  ## 0.22.1

  **New**

  * Support setting checkForUpdates, hideSystrayIcon, transparentProxyEnable, transparentProxyEnforce, transparentProxyFail, transparentProxyAllowQuic as mcx preference settings.
</Update>

<Update label="July 8, 2026" tags={["Improvements", "Bug Fixes"]}>
  ## 0.22.0

  **Changed**

  * Bumped the minimum supported macOS version to 15.0.
  * No longer start the desktop app during the base package postinstall.
  * Replace custom MDM post-install scripts with managed preference settings. *Note*: MDM deployments that upgrade to this version should remove the custom post-install script.

  **Fixed**

  * Fix transparent proxy toggle knob rendering.
</Update>

<Update label="July 4, 2026" tags={["Improvements"]}>
  ## 0.21.1

  **Changed**

  * Rewrote the macOS menu bar: faster and more efficient.
  * Transparent proxy toggle now stays in sync and gives clearer feedback when toggled.
  * Transparent proxy toggle now requires being logged in with a working CA.
</Update>

<Update label="July 3, 2026" tags={["New Features"]}>
  ## 0.21.0

  **New**

  * Support the Gemini API as an LLM technology.
  * Add support for using the detected resource (hostname and port match) in CEL expressions in network rules.
</Update>

<Update label="July 2, 2026" tags={["Bug Fixes"]}>
  ## 0.20.6

  **Fixed**

  * Support Sequoia macOS versions.
  * Smooth the visual toggling of transparent mode.
</Update>

<Update label="July 1, 2026" tags={["New Features"]}>
  ## 0.20.5

  **New**

  * Add the `loaded_files` field.
</Update>

<Update label="June 30, 2026" tags={["Bug Fixes"]}>
  ## 0.20.4

  **Fixed**

  * Surface llm and input output tokens as numeric counts in logs.

  ## 0.20.3

  **New**

  * Surface `available_skills` and `loaded_skills` in LLM logs.

  ## 0.20.2

  **Changed**

  * Transparent proxy mode now requires login, avoiding unnecessary TLS interception when logged out
</Update>

<Update label="June 29, 2026" tags={["New Features"]}>
  ## 0.20.1

  **New**

  * Improve experience of intercepting AI agent traffic in network rules

  ## 0.20.0

  **New**

  * Add support for GCP APIs as a technology for the transparent proxy
</Update>

<Update label="June 25, 2026" tags={["New Features"]}>
  ## 0.19.1

  **Changed**

  * Avoid CA trust dialog when device login managed preference is set.

  ## 0.19.0

  **New**

  * Add support for AWS APIs as a technology for the transparent proxy
</Update>

<Update label="June 24, 2026" tags={["Improvements"]}>
  ## 0.18.2

  **Changed**

  * Updates CA trust at login to not require any CLI commands
</Update>

<Update label="June 21, 2026" tags={["New Features"]}>
  ## 0.18.1

  **New**

  * Allow CA trust prompt to be shown at login time after MDM installation
</Update>

<Update label="June 19, 2026" tags={["Improvements"]}>
  ## 0.18.0

  **New**

  * Support automatic login and CA trust.
</Update>

<Update label="June 18, 2026" tags={["Improvements"]}>
  ## 0.17.1

  **Changed**

  * Fall back to password authentication for MFA challenges when Touch ID is not available
</Update>

<Update label="June 17, 2026" tags={["New Features", "Improvements", "Bug Fixes"]}>
  ## 0.17.0

  **New**

  * Support autodetection of Postgres, MySQL, and MongoDB connections via the transparent proxy and in network rules
  * Support TLS interception for Postgres, MySQL, and MongoDB connections through `formal connect`/`formal ls` local proxy

  **Changed**

  * Rename the MacOS bundle from `Formal Desktop` to `Formal`
  * Surface "Formal" in certificate trust settings dialog instead of "security" during installation

  **Fixed**

  * Fix a bug where the CA trust dialog would not appear during MacOS package installation via MDM
  * Fix a bug where `formal transparent-proxy status` would report the extension not being installed when it actually was
</Update>

<Update label="June 12, 2026" tags={["New Features"]}>
  ## 0.16.0

  **New**

  * Add first-class support for granular logging and policy evaluation on LLM request bodies
</Update>

<Update label="June 12, 2026" tags={["Bug Fixes"]}>
  ## 0.15.4

  **Fixed**

  * Fix an issue where MySQL connections could crash the agent when the client did not send connection attributes
</Update>

<Update label="June 11, 2026" tags={["Bug Fixes"]}>
  ## 0.15.3

  **Fixed**

  * Fix a bug where network rules weren't passing HTTP resources properly to connector listeners with smart routing enabled.
</Update>

<Update label="June 10, 2026" tags={["Improvements", "Bug Fixes"]}>
  ## 0.15.2

  **Changed**

  * Allow protocol detection on HTTP requests when the TLS client hello doesn't specify an ALPN protocol
  * Improve performance of non-interactive `formal ls`

  **Fixed**

  * Fix a bug where network rules were lost after disabling and re-enabling the transparent proxy
</Update>

<Update label="June 9, 2026" tags={["Bug Fixes"]}>
  ## 0.15.1

  **Fixed**

  * Fix a bug where transparent connections to a resource would hang if there was a previous direct connection to the local listener for that resource
</Update>

<Update label="June 9, 2026" tags={["New Features", "Improvements"]}>
  ## 0.15.0

  **New**

  * Initial release of headless Linux deb package

  **Changed**

  * Automatically generate and trust transparent proxy CA certificate on Linux
</Update>

<Update label="June 9, 2026" tags={["Bug Fixes"]}>
  ## 0.14.3

  **Fixed**

  * Fix a bug where Postgres connections from GSS-enabled clients could hang when using the local TCP port instead of the Unix socket.
</Update>

<Update label="June 9, 2026" tags={["Improvements"]}>
  ## 0.14.2

  **Changed**

  * Improve performance of forwarding transparently proxied HTTP traffic to the Connector
</Update>

<Update label="June 8, 2026" tags={["New Features"]}>
  ## 0.14.1

  **New**

  * Support header rewrite actions for HTTP resources
</Update>

<Update label="June 5, 2026" tags={["New Features"]}>
  ## 0.14.0

  **New**

  * Support scenario monitors (LLM-as-a-judge) as a policy evaluation input
</Update>

<Update label="June 2, 2026" tags={["Improvements"]}>
  ## 0.13.1

  **Changed**

  * Improve MFA policy enforcement
</Update>

<Update label="June 2, 2026" tags={["New Features", "Improvements"]}>
  ## 0.13.0

  **New**

  * Emit HTTP policy evaluation inputs alongside logs
  * Add support for MongoDB SCRAM-SHA-256 authentication

  **Changed**

  * Improve policy evaluation latency
</Update>

<Update label="May 27, 2026" tags={["Improvements"]}>
  ## 0.12.2

  **Changed**

  * Improve policy block messages for HTTP connections
</Update>

<Update label="May 27, 2026" tags={["Improvements"]}>
  ## 0.12.1

  **Changed**

  * Improve LLM protocol autodetection
</Update>

<Update label="May 27, 2026" tags={["New Features", "Improvements"]}>
  ## 0.12.0

  **New**

  * Support protocol autodetection for LLM requests
  * Persist logs to disk so they survive network outages, capped at 1 GB
  * Support encrypting logs with asymmetric encryption keys

  **Changed**

  * Improve network rule format for readability. See our "Guide: Desktop App Setup" for more information.
  * Simplify the codesigning configuration of our macOS Desktop App. See our "Guide: Desktop App Setup" for more information.
</Update>

<Update label="May 23, 2026" tags={["New Features", "Improvements"]}>
  ## 0.11.0

  **New**

  * Add an `uninstall` command to completely remove Formal from the machine
  * Add an `input.source` field to allow policies to differentiate desktop policy enforcement from connector policy enforcement

  **Changed**

  * Improve performance of fetching updates from the control plane
  * Improve performance of `formal ls`
</Update>

<Update label="May 21, 2026" tags={["New Features", "Improvements"]}>
  ## 0.10.1

  **New**

  * Support [filling out Forms](/docs/guides/configuration/forms#filling-out-forms) using `formal form fill`

  **Changed**

  * Change macOS CA trust dialog back to the default Security dialog
</Update>

<Update label="May 21, 2026" tags={["New Features"]}>
  ## 0.10.0

  **New**

  * Add device trust support for MySQL
  * Forward MySQL policy block messages to clients
</Update>

<Update label="May 20, 2026" tags={["New Features"]}>
  ## 0.9.21

  **New**

  * Support Codex block messages
  * Support HTTP header rewrites for HTTP technology

  **Changed**

  * Decrease bundle size by 50%
  * Rename transparent proxy to transparent mode
  * Rename `ca install` for Linux to `ca trust` for macOS-Linux parity
</Update>

<Update label="May 19, 2026" tags={["Improvements"]}>
  ## 0.9.20

  **Changes**

  * Only check for updates if `check_for_updates` is set in `config.toml`.
</Update>

<Update label="May 18, 2026" tags={["Improvements"]}>
  ## 0.9.18

  **Changes**

  * Show a custom Formal dialog when asking the user for permission to add CAs
</Update>

<Update label="May 15, 2026" tags={["New Features"]}>
  ## 0.9.17

  **New**

  * By default, block QUIC traffic when the transparent proxy is enabled. Control this via the `allow_quic` configuration parameter.
  * Support Claude Chat for LLM sessions when `allow_quic` is false.
</Update>

<Update label="May 12, 2026" tags={["New Features"]}>
  ## 0.9.16

  **New**

  * Support enabling the transparent proxy on desktop app startup via config.toml
</Update>

<Update label="May 11, 2026" tags={["New Features", "Improvements"]}>
  ## 0.9.15

  **New**

  * Support auto-classification of HTTP and MCP traffic
  * Support device trust for MongoDB

  **Changed**

  * Install the network extension as part of the installer
</Update>

<Update label="May 11, 2026" tags={["New Features"]}>
  ## 0.9.14

  **New**

  * Support desktop evaluation and logging of MCP traffic
  * Support network rules that don't require resources

  **Fixed**

  * Indicate to users that sudo is required for `formal ca trust`
  * Use total input tokens instead of input tokens
  * Correct CA installation out of sync race conditions
</Update>

<Update label="May 7, 2026" tags={["New Features"]}>
  ## 0.9.13

  **New**

  * Support user identity in policy evaluation
  * Support transparent proxy for Linux
</Update>

<Update label="May 6, 2026" tags={["Improvements"]}>
  ## 0.9.12

  **New**

  * Support LLM header rewrites
  * Remove the `--only-agents`, `--transparent`, and `--local-tls` flags
</Update>

<Update label="May 5, 2026" tags={["Improvements"]}>
  ## 0.9.10

  **New**

  * Support session stage evaluation for the LLM technology
</Update>

<Update label="May 4, 2026" tags={["Improvements"]}>
  ## 0.9.9

  **New**

  * Support policy enforcement for the MCP technology without a connector
  * New `formal transparent-proxy install` and `formal transparent-proxy uninstall` commands
</Update>

<Update label="April 29, 2026" tags={["Improvements"]}>
  ## 0.9.8

  **Changed**

  * Add Formal CA to keychain via installer

  **New**

  * Support policy enforcement for HTTP resources without a connector
  * Support connection process and user information in network rules
</Update>

<Update label="April 28, 2026" tags={["Improvements"]}>
  ## 0.9.7

  **Changed**

  * Automatically add Formal CA to Keychain when enabling the transparent proxy
</Update>

<Update label="April 27, 2026" tags={["Improvements"]}>
  ## 0.9.6

  **Changed**

  * Enable the transparent proxy via the system tray.
  * Support users in network rules
</Update>

<Update label="April 23, 2026" tags={["Improvements"]}>
  ## 0.9.5

  **Changed**

  * Support custom block messages for Claude Code tool calls
</Update>

<Update label="April 20, 2026" tags={["Improvements"]}>
  ## 0.9.4

  **Changed**

  * Support network rules in transparent proxy
</Update>

<Update label="April 17, 2026" tags={["Improvements"]}>
  ## 0.9.3

  **Changed**

  * Support policy enforcement of LLM sessions without a Connector
</Update>

<Update label="April 13, 2026" tags={["Improvements"]}>
  ## 0.9.2

  **Changed**

  * Improve performance of transparent mode
</Update>

<Update label="April 10, 2026" tags={["New Features"]}>
  ## 0.9.0

  **New**

  * Add support for machine user auth via AWS SigV4
</Update>

<Update label="April 9, 2026" tags={["New Features", "Improvements"]}>
  ## 0.8.4

  **Changed**

  * Improve LLM session id saving for replay

  ## 0.8.3

  **New**

  * Support connecting to MCP resources
  * Support log encryption for LLM technology
</Update>

<Update label="April 7, 2026" tags={["New Features", "Improvements"]}>
  ## 0.8.2

  **New**

  * Separate TLS settings for LLM technology

  **Changed**

  * Emit session events for LLM technology sessions
</Update>

<Update label="April 6, 2026" tags={["New Features"]}>
  ## 0.8.1

  **New**

  * Do not require a Connector to use the LLM technology
</Update>

<Update label="April 2, 2026" tags={["New Features", "Improvements"]}>
  ## 0.8.0

  **New**

  * Support connecting with `--transparent` mode
  * Support connecting with `--only-agents` mode
  * Support connecting with `--local-tls` mode
  * Pass process ancestor information
  * Support LLM technology

  **Changed**

  * Reject CLI arguments for formal-agent
</Update>

<Update label="March 10, 2026" tags={["New Features"]}>
  ## 0.7.3

  **New**

  * Managed Connector SSH host keys in an isolated host keys file.
</Update>

<Update label="March 5, 2026" tags={["Bug Fixes"]}>
  ## 0.7.2

  **Fixed**

  * Fixed a bug where the resource alias was used for smart routing rather than the resource name.
</Update>

<Update label="February 27, 2026" tags={["New Features", "Bug Fixes"]}>
  ## 0.7.1

  **New**

  * Added support for [resource aliases](/docs/guides/core-concepts/resources/introduction#creating-a-resource)
  * Added a `--launch` argument to `formal connect` to launch the appropriate CLI program after connecting (for example `psql` or `ssh`).

  **Fixed**

  * Fixed a bug where the interactive `formal ls` parent process didn't exit when launching a CLI program, obscuring connection errors and policy block messages.
</Update>

<Update label="February 23, 2026" tags={["Improvements"]}>
  ## 0.7.0

  **Changed**

  * Improved `formal ls` performance by moving search filtering server-side
  * Reduced unnecessary API calls during credential renewal
</Update>

<Update label="February 19, 2026" tags={["Bug Fixes"]}>
  ## 0.6.0

  **Fixed**

  * Fixed a bug where the desktop app CLI would attempt to launch the agent when run without a TTY.
    * Note: this introduces a small breaking change where running `formal` without a TTY will now exit with an error and show help text. Please run `formal agent` instead.
</Update>

<Update label="February 19, 2026" tags={["Bug Fixes"]}>
  ## 0.5.7

  **Fixed**

  * Fix smart routing for MySQL resources
</Update>

<Update label="January 21, 2026" tags={["Bug Fixes"]}>
  ## 0.5.6

  **Fixed**

  * Fix a bug where the desktop app would timeout when listing resources in non-interactive mode
</Update>

<Update label="December 22, 2025" tags={["New Features"]}>
  ## 0.5.5

  **New**

  * Add support for JSONL and YAML output format to `formal ls`
</Update>

<Update label="December 19, 2025" tags={["Bug Fixes"]}>
  ## 0.5.4

  **Fixed**

  * Fix MySQL authentication with clients that send a null byte for empty passwords
</Update>

<Update label="December 19, 2025" tags={["Improvements"]}>
  ## 0.5.3

  **Changed**

  * Refresh MFA challenges every second
</Update>

<Update label="December 17, 2025" tags={["New Features", "Bug Fixes"]}>
  ## 0.5.2

  **New**

  * Add support for the new MySQL proxy implementation

  **Fixed**

  * Fix DynamoDB authentication
</Update>

<Update label="December 11, 2025" tags={["Improvements"]}>
  ## 0.5.1

  **Changed**

  * Improve MFA user experience
</Update>

<Update label="December 8, 2025" tags={["New Features"]}>
  ## 0.5.0

  **New**

  * Add support for MFA policy enforcement
</Update>

<Update label="Nov 27, 2025" tags={["Improvements"]}>
  ## 0.4.4

  **Changed**

  * It is no longer required to specify a resource name with `formal disconnect`. By default, it disconnects all resources.
</Update>

<Update label="November 24, 2025" tags={["New Features", "Improvements", "Bug Fixes"]}>
  ## 0.4.3

  **New**

  * Added support for Windows.
  * Added support for wrapping AWS S3 commands to funnel traffic through the Connector.

  **Changed**

  * Change SSH config configuration to be compatible with SCP via the Connector.
  * Change SSH config configuration to be use resource names as SSH host names.

  ## 0.4.2

  **Fixed**

  * Fixed a build issue where the desktop app would not provide an icon on Linux.
</Update>

<Update label="September 8, 2025" tags={["New Features", "Bug Fixes"]}>
  ## 0.2.7

  **Fixed**

  * Fixed a bug that prevented the desktop app from logging out from the command line.

  ## 0.2.6

  **New**

  * Added a `-y` flag to `formal auth login` to bypass the browser confirmation prompt.

  **Fixed**

  * Fixed a bug where the desktop agent could be launched multiple times.
</Update>

<Update label="August 25, 2025" tags={["New Features", "Improvements", "Bug Fixes"]}>
  ## 0.2.5

  **New**

  * Implemented pagination of resources to reduce startup delay of `formal ls`.

  **Changed**

  * Reworked connecting/disconnecting to resources to be asynchronous, which prevents a connection from blocking the TUI from rendering.

  **Fixed**

  * Fixed a bug where the desktop app would show multiple instances of the same resource while filtering and connecting.
  * Fixed a bug where the autolaunch functionality could freeze the TUI.
</Update>

<Update label="August 22, 2025" tags={["New Features", "Improvements"]}>
  ## 0.2.4

  **New**

  * Added support for using token authentication in headless mode.
  * Introduced a configurable timeout for the `formal agent` command with `--timeout`.

  **Changed**

  * Changed the `formal ls` command to lazily load resources and show a loading spinner instead of blocking the TUI from launching.
</Update>

<Update label="August 21, 2025" tags={["New Features"]}>
  ## 0.2.3

  **New**

  * Added a `formal agent` command to launch the Formal Agent through the CLI.
  * Added a headless mode, which can be launched through `formal agent --headless` and allows usage of the Formal Desktop without a GUI. See [Desktop App](/docs/guides/client-apps/desktop-app#headless-mode) for more details.
</Update>

<Update label="August 20, 2025" tags={["New Features", "Bug Fixes"]}>
  ## 0.2.2

  **New**

  * Added the ability to open a `psql` session automatically when connecting to a PostgreSQL resource through `formal ls`.
  * Added a permanent "latest" URL to download the latest version of the desktop app on Linux.

  **Fixed**

  * Fixed a bug where the desktop app could become unresponsive when connecting to a resource.
</Update>

<Update label="August 14, 2025" tags={["New Features", "Bug Fixes"]}>
  ## 0.2.1

  **Fixed**

  * Fixed a visual bug with the `formal ls` UI where a resource would not update its status after a connection request

  ## 0.2.0

  **New**

  * Added the ability to open an SSH session automatically when connecting to an SSH resource through `formal ls`
</Update>

<Update label="August 1, 2025" tags={["New Features"]}>
  ## 0.1.4

  **New**

  * Added support for Linux
</Update>

<Update label="May 20, 2025" tags={["New Features"]}>
  ## 0.1.0

  **New**

  * Added support for configuring the SSH client (i.e., `~/.ssh/config`) to more seamlessly connect to SSH, EC2, and ECS Fargate resources using the `formal ls` UI
</Update>

<Update label="March - April 2025" tags={["Improvements"]}>
  ## 0.0.91

  **Fixed**

  * Fixed versioning issue

  ## 0.0.90

  **Fixed**

  * Fixed versioning issue

  ## 0.0.89

  **New**

  * Added a link to download the latest version of the desktop app if an update is available

  ## 0.0.88

  **Changed**

  * Ensured errors are printed to `stderr` rather than `stdout` to provide a clean output stream to users

  ## 0.0.87

  **New**

  * Exposed certain classes of connection errors between the local proxy and the Formal Connector to users
</Update>

<Update label="January - February 2025" tags={["Bug Fixes", "New Features"]}>
  ## 0.0.86

  **Fixed**

  * Fixed authentication failures

  ## 0.0.85

  **New**

  * Added support for using `formal@<native-user>` as the username to specify the native user

  ## 0.0.84

  **New**

  * Added support for `json` option to `formal auth credentials -o`

  ## 0.0.83

  **New**

  * Added support for `json` option to `formal auth credentials -o`

  ## 0.0.82

  **Fixed**

  * Avoided crashing on EOF for `postgres`

  ## 0.0.81

  **Fixed**

  * Fixed desktop app auth status
</Update>

<Update label="2024 Releases" tags={["New Features", "Bug Fixes"]}>
  ## 0.0.80

  **Fixed**

  * Fixed desktop app auth status

  ## 0.0.79

  **New**

  * Added support for MongoDB smart routing

  ## 0.0.78

  **Fixed**

  * Fixed typo in error message `missing S3 resource name`

  ## 0.0.77

  **New**

  * Added support for TCP Proxy and Relays

  ## 0.0.75

  **Changed**

  * Removed the use of AWS profile

  ## 0.0.74

  **Changed**

  * Removed the use of AWS profile

  ## 0.0.73

  **Changed**

  * Added more efficient routing

  ## 0.0.72

  **Fixed**

  * Fixed support for `dynamodb`

  ## 0.0.71

  **New**

  * Added resource subdomain to Kubernetes resources for connectors

  ## 0.0.70

  **New**

  * Added support for connectors

  ## 0.0.69

  **New**

  * Added support for basic auth for `clickhouse`

  ## 0.0.68

  **New**

  * Added resource to policy evaluation

  ## 0.0.67

  **Changed**

  * Updated desktop app to renew key every 18 hours

  ## 0.0.66

  **New**

  * Added support for connector in policy evaluation

  ## 0.0.65

  **Changed**

  * Updated log message for fetchCABundle

  ## 0.0.64

  **Changed**

  * Added more logs to the `dynamodb` command

  ## 0.0.63

  **Changed**

  * Removed posthog

  ## 0.0.62

  **Fixed**

  * Fixed AWS CLI

  ## 0.0.61

  **Fixed**

  * Fixed AWS CLI

  ## 0.0.60

  **New**

  * Added AWS CLI to building process

  ## 0.0.59

  **New**

  * Added support for certificate bundle `dynamodb`

  ## 0.0.58

  **New**

  * Added support for API Token expiration
</Update>