Endpoint / Kubernetes Egress Agent

​

0.34.5

​

Fixed

• Exclude LuLu and Little Snitch traffic from Transparent Mode on macOS.

​

0.34.4

​

New

• Support is_llm_hostname in network rules.

​

Fixed

• Exclude CrowdStrike Falcon traffic from Transparent Mode on macOS.

​

0.34.3

​

Changed

• Minimize interaction with macOS app tracking domains.

​

0.34.2

​

Fixed

• Exclude link-local traffic on macOS.
• Exclude Cisco AnyConnect traffic on macOS.
• Infer the AWS region from EC2 instance metadata during OIDC login.

​

0.34.1

​

New

• Add support for Cursor and Devin as OIDC issuers for Endpoint authentication.

​

Fixed

• Fix an issue where the transparent proxy interfered with AirDrop on macOS.

​

0.34.0

​

New

• Add support for Endpoint OIDC login.

​

Changed

• Improve the reliability of the browser login flow.

​

0.33.2

​

Fixed

• Make response.time.processing in logs accurately reflect Connector processing time.

​

0.33.1

​

Fixed

• Allow Aikido Device Protection to coexist with transparent mode on macOS.

​

0.33.0

​

Changed

• Long structured LLM logs are no longer truncated.

​

Fixed

• The transparent proxy on Linux no longer intercepts traffic to Docker containers.

​

0.32.0

​

New

• Support Socket Registry Firewall for package registry traffic.
• Support selecting a native user with formal@<native-user> on MySQL and MongoDB.

​

Changed

• Detect package registry hostnames as socket instead of http.

​

Fixed

• Fix an issue where DNS could stop working on macOS in transparent mode.
• Only match network rules on resource.hostname when the host is an actual Formal resource, so unrelated traffic is no longer intercepted.

​

0.31.8

​

Changed

• Clarify macOS instructions for how to enable the Network Extension via System Settings.

​

0.31.7

​

New

• Support ClickHouse HTTP traffic in transparent mode.
• Support connection_process.is_browser in network rules.

​

0.31.6

​

Changed

• Stop reporting Cursor as an AI agent while support is in beta.

​

0.31.5

​

New

• Support password-protecting formal uninstall when configured via MDM.

​

0.31.4

​

Fixed

• Allow Tunnelblick and Aikido Device Protection to work alongside transparent mode on macOS.

​

0.31.3

​

Changed

• Cap audit log bodies at 500 KB per event, and record when a body was truncated.

​

Fixed

• Fix an issue with policy blocked tool call in Claude Desktop, which sends tool calls in its own format rather than standard MCP and so was still reporting an unexplained error.

​

0.31.2

​

Changed

• Improve performance of retrieving credentials when initiating Kubernetes connections.

​

0.31.1

​

Changed

• Return the policy reason inside the MCP response when a tool call is blocked, so the agent can see why instead of treating it as a broken connection.

​

0.31.0

​

New

• Add formal upgrade to install the latest version from the command line on macOS and Linux.

​

Changed

• formal version now reports the latest available version alongside the installed one.

​

Fixed

• Fix an issue where traffic could briefly bypass transparent mode on Linux while a network interface was coming up.
• Capture device-bound IPv6 connections on Linux when the interface has no IPv6 default route.
• Fix an issue where CPU could spike when the Formal API was unreachable.

​

0.30.6

​

Changed

• Support localhost interception configuration via an MDM provider.

​

0.30.5

​

Changed

• By default, transparent mode no longer intercepts loopback traffic. Enable transparent_proxy.intercept_localhost as specified in the managed preferences table to intercept loopback traffic.

​

0.30.4

​

Changed

• Allow using CEL string, list, and set extension functions in network rules.

​

0.30.3

​

New

• Surface input.session.id and input.request.id where applicable as policy evaluation inputs.
• Surface session ID and request IDs in the default formal block message across technologies

​

Fixed

• Allow Netskope and GlobalProtect to work alongside transparent mode on macOS.

​

0.30.2

​

Fixed

• Allow OpenVPN Connect to work alongside transparent mode on macOS.
• Fix AWS SDK uploads that use Content-Encoding: aws-chunked, which the AWS transparent proxy previously rejected.

​

0.30.1

​

Fixed

• Recognize Claude Code launched from Claude Desktop as connection_process.is_agent.

​

0.30.0

​

Changed

• Require forward_to_connector to be true when passing Postgres traffic to the Connector. Note: review your network rules and update them accordingly.

​

Fixed

• Fix NetworkManager connectivity checks while transparent mode is enabled on Linux.

​

0.29.0

​

New

• Support Cursor Desktop & Cursor CLI
• Support Devin Desktop (windsurf) and Devin CLI

​

0.28.4

​

New

• Support connection_process.is_agent in network rules
• Support specifying resource hostnames in formal connect

​

Fixed

• Surface tool names for MCP calls initiated by Claude Cowork

​

0.28.3

​

Changed

• Support intercepting HTTP2 in transparent mode

​

Fixed

• Fix an issue in enabling transparent mode with automatic login in macOS

​

0.28.2

​

Changed

• Do not support transparent mode until CAs are trusted on macOS.

​

0.28.1

​

Changed

• Support dynamic groups for automated MDM deployments of automatic login.

​

0.28.0

​

Fixed

• Network rules that forward websites to web resources (via a connector) now work.

​

0.27.0

​

New

• Add support for connecting to Redshift resources, both directly and in transparent mode.

​

0.26.4

​

Fixed

• Support intercepting MCP tool calls for Claude Prebuilt Integration Connectors in Cowork.

​

0.26.3

​

Fixed

• Enable customers to switch Cloudflare WARP modes while transparent mode is enabled.

​

0.26.2

​

Fixed

• Fix a bug in the Linux headless deb package where trusting the local CA certificate failed on older Ubuntu versions.

​

0.26.0

​

New

• Add support for writing to and reading from a cache from hooks.
• Add encrypt / decrypt policy actions for HTTP-based protocols.

​

Changed

• Add support for allowlisting CIDR ranges for hook outbound traffic.

​

0.25.2

​

New

• Support Formal Hooks on macOS.

​

0.25.1

​

Changed

• Block pasting in TUI forms.

​

0.25.0

​

Changed

• Move desktop tokens from “Login” keychain to “Local Items” keychain on macOS. Note: existing installations will have to re-authenticate.
• Require allowlisting environment variables and upstream network destinations for hooks.

​

0.24.0

• Add multi-factor authentication on Windows using Windows Hello (fingerprint, face, or PIN).

​

0.23.1

• Fix a bug where the Linux headless binary was not statically linked.

​

0.23.0

• Initial release of Formal Hooks

​

0.22.3

• Use posix_spawn internally to work around bug introduced on macOS 26.4+.

​

0.22.2

• Fix a bug with forward-to-connector network rules on Linux endpoints

​

0.22.1

• Support setting checkForUpdates, hideSystrayIcon, transparentProxyEnable, transparentProxyEnforce, transparentProxyFail, transparentProxyAllowQuic as mcx preference settings.

​

0.22.0

• Bumped the minimum supported macOS version to 15.0.
• No longer start the desktop app during the base package postinstall.
• Replace custom MDM post-install scripts with managed preference settings. Note: MDM deployments that upgrade to this version should remove the custom post-install script.

• Fix transparent proxy toggle knob rendering.

​

0.21.1

• Rewrote the macOS menu bar: faster and more efficient.
• Transparent proxy toggle now stays in sync and gives clearer feedback when toggled.
• Transparent proxy toggle now requires being logged in with a working CA.

​

0.21.0

• Support the Gemini API as an LLM technology.
• Add support for using the detected resource (hostname and port match) in CEL expressions in network rules.

​

0.20.6

• Support Sequoia macOS versions.
• Smooth the visual toggling of transparent mode.

​

0.20.5

• Add the loaded_files field.

​

0.20.4

• Surface llm and input output tokens as numeric counts in logs.

​

0.20.3

• Surface available_skills and loaded_skills in LLM logs.

​

0.20.2

• Transparent proxy mode now requires login, avoiding unnecessary TLS interception when logged out

​

0.20.1

• Improve experience of intercepting AI agent traffic in network rules

​

0.20.0

• Add support for GCP APIs as a technology for the transparent proxy

​

0.19.1

• Avoid CA trust dialog when device login managed preference is set.

​

0.19.0

• Add support for AWS APIs as a technology for the transparent proxy

​

0.18.2

• Updates CA trust at login to not require any CLI commands

​

0.18.1

• Allow CA trust prompt to be shown at login time after MDM installation

​

0.18.0

• Support automatic login and CA trust.

​

0.17.1

• Fall back to password authentication for MFA challenges when Touch ID is not available

​

0.17.0

• Support autodetection of Postgres, MySQL, and MongoDB connections via the transparent proxy and in network rules
• Support TLS interception for Postgres, MySQL, and MongoDB connections through formal connect/formal ls local proxy

• Rename the MacOS bundle from Formal Desktop to Formal
• Surface “Formal” in certificate trust settings dialog instead of “security” during installation

• Fix a bug where the CA trust dialog would not appear during MacOS package installation via MDM
• Fix a bug where formal transparent-proxy status would report the extension not being installed when it actually was

​

0.16.0

• Add first-class support for granular logging and policy evaluation on LLM request bodies

​

0.15.4

• Fix an issue where MySQL connections could crash the agent when the client did not send connection attributes

​

0.15.3

• Fix a bug where network rules weren’t passing HTTP resources properly to connector listeners with smart routing enabled.

​

0.15.2

• Allow protocol detection on HTTP requests when the TLS client hello doesn’t specify an ALPN protocol
• Improve performance of non-interactive formal ls

• Fix a bug where network rules were lost after disabling and re-enabling the transparent proxy

​

0.15.1

• Fix a bug where transparent connections to a resource would hang if there was a previous direct connection to the local listener for that resource

​

0.15.0

• Initial release of headless Linux deb package

• Automatically generate and trust transparent proxy CA certificate on Linux

​

0.14.3

• Fix a bug where Postgres connections from GSS-enabled clients could hang when using the local TCP port instead of the Unix socket.

​

0.14.2

• Improve performance of forwarding transparently proxied HTTP traffic to the Connector

​

0.14.1

• Support header rewrite actions for HTTP resources

​

0.14.0

• Support scenario monitors (LLM-as-a-judge) as a policy evaluation input

​

0.13.1

• Improve MFA policy enforcement

​

0.13.0

• Emit HTTP policy evaluation inputs alongside logs
• Add support for MongoDB SCRAM-SHA-256 authentication

• Improve policy evaluation latency

​

0.12.2

• Improve policy block messages for HTTP connections

​

0.12.1

• Improve LLM protocol autodetection

​

0.12.0

• Support protocol autodetection for LLM requests
• Persist logs to disk so they survive network outages, capped at 1 GB
• Support encrypting logs with asymmetric encryption keys

• Improve network rule format for readability. See our “Guide: Desktop App Setup” for more information.
• Simplify the codesigning configuration of our macOS Desktop App. See our “Guide: Desktop App Setup” for more information.

​

0.11.0

• Add an uninstall command to completely remove Formal from the machine
• Add an input.source field to allow policies to differentiate desktop policy enforcement from connector policy enforcement

• Improve performance of fetching updates from the control plane
• Improve performance of formal ls

​

0.10.1

• Support filling out Forms using formal form fill

• Change macOS CA trust dialog back to the default Security dialog

​

0.10.0

• Add device trust support for MySQL
• Forward MySQL policy block messages to clients

​

0.9.21

• Support Codex block messages
• Support HTTP header rewrites for HTTP technology

• Decrease bundle size by 50%
• Rename transparent proxy to transparent mode
• Rename ca install for Linux to ca trust for macOS-Linux parity

​

0.9.20

• Only check for updates if check_for_updates is set in config.toml.

​

0.9.18

• Show a custom Formal dialog when asking the user for permission to add CAs

​

0.9.17

• By default, block QUIC traffic when the transparent proxy is enabled. Control this via the allow_quic configuration parameter.
• Support Claude Chat for LLM sessions when allow_quic is false.

​

0.9.16

• Support enabling the transparent proxy on desktop app startup via config.toml

​

0.9.15

• Support auto-classification of HTTP and MCP traffic
• Support device trust for MongoDB

• Install the network extension as part of the installer

​

0.9.14

• Support desktop evaluation and logging of MCP traffic
• Support network rules that don’t require resources

• Indicate to users that sudo is required for formal ca trust
• Use total input tokens instead of input tokens
• Correct CA installation out of sync race conditions

​

0.9.13

• Support user identity in policy evaluation
• Support transparent proxy for Linux

​

0.9.12

• Support LLM header rewrites
• Remove the --only-agents, --transparent, and --local-tls flags

​

0.9.10

• Support session stage evaluation for the LLM technology

​

0.9.9

• Support policy enforcement for the MCP technology without a connector
• New formal transparent-proxy install and formal transparent-proxy uninstall commands

​

0.9.8

• Add Formal CA to keychain via installer

• Support policy enforcement for HTTP resources without a connector
• Support connection process and user information in network rules

​

0.9.7

• Automatically add Formal CA to Keychain when enabling the transparent proxy

​

0.9.6

• Enable the transparent proxy via the system tray.
• Support users in network rules

​

0.9.5

• Support custom block messages for Claude Code tool calls

​

0.9.4

• Support network rules in transparent proxy

​

0.9.3

• Support policy enforcement of LLM sessions without a Connector

​

0.9.2

• Improve performance of transparent mode

​

0.9.0

• Add support for machine user auth via AWS SigV4

​

0.8.4

• Improve LLM session id saving for replay

​

0.8.3

• Support connecting to MCP resources
• Support log encryption for LLM technology

​

0.8.2

• Separate TLS settings for LLM technology

• Emit session events for LLM technology sessions

​

0.8.1

• Do not require a Connector to use the LLM technology

​

0.8.0

• Support connecting with --transparent mode
• Support connecting with --only-agents mode
• Support connecting with --local-tls mode
• Pass process ancestor information
• Support LLM technology

• Reject CLI arguments for formal-agent

​

0.7.3

• Managed Connector SSH host keys in an isolated host keys file.

​

0.7.2

• Fixed a bug where the resource alias was used for smart routing rather than the resource name.

​

0.7.1

• Added support for resource aliases
• Added a --launch argument to formal connect to launch the appropriate CLI program after connecting (for example psql or ssh).

• Fixed a bug where the interactive formal ls parent process didn’t exit when launching a CLI program, obscuring connection errors and policy block messages.

​

0.7.0

• Improved formal ls performance by moving search filtering server-side
• Reduced unnecessary API calls during credential renewal

​

0.6.0

• Fixed a bug where the desktop app CLI would attempt to launch the agent when run without a TTY.
  • Note: this introduces a small breaking change where running formal without a TTY will now exit with an error and show help text. Please run formal agent instead.

​

0.5.7

• Fix smart routing for MySQL resources

​

0.5.6

• Fix a bug where the desktop app would timeout when listing resources in non-interactive mode

​

0.5.5

• Add support for JSONL and YAML output format to formal ls

​

0.5.4

• Fix MySQL authentication with clients that send a null byte for empty passwords

​

0.5.3

• Refresh MFA challenges every second

​

0.5.2

• Add support for the new MySQL proxy implementation

• Fix DynamoDB authentication

​

0.5.1

• Improve MFA user experience

​

0.5.0

• Add support for MFA policy enforcement

​

0.4.4

• It is no longer required to specify a resource name with formal disconnect. By default, it disconnects all resources.

​

0.4.3

• Added support for Windows.
• Added support for wrapping AWS S3 commands to funnel traffic through the Connector.

• Change SSH config configuration to be compatible with SCP via the Connector.
• Change SSH config configuration to be use resource names as SSH host names.

​

0.4.2

• Fixed a build issue where the desktop app would not provide an icon on Linux.

​

0.2.7

• Fixed a bug that prevented the desktop app from logging out from the command line.

​

0.2.6

• Added a -y flag to formal auth login to bypass the browser confirmation prompt.

• Fixed a bug where the desktop agent could be launched multiple times.

​

0.2.5

• Implemented pagination of resources to reduce startup delay of formal ls.

• Reworked connecting/disconnecting to resources to be asynchronous, which prevents a connection from blocking the TUI from rendering.

• Fixed a bug where the desktop app would show multiple instances of the same resource while filtering and connecting.
• Fixed a bug where the autolaunch functionality could freeze the TUI.

​

0.2.4

• Added support for using token authentication in headless mode.
• Introduced a configurable timeout for the formal agent command with --timeout.

• Changed the formal ls command to lazily load resources and show a loading spinner instead of blocking the TUI from launching.

​

0.2.3

• Added a formal agent command to launch the Formal Agent through the CLI.
• Added a headless mode, which can be launched through formal agent --headless and allows usage of the Formal Desktop without a GUI. See Desktop App for more details.

​

0.2.2

• Added the ability to open a psql session automatically when connecting to a PostgreSQL resource through formal ls.
• Added a permanent “latest” URL to download the latest version of the desktop app on Linux.

• Fixed a bug where the desktop app could become unresponsive when connecting to a resource.

​

0.2.1

• Fixed a visual bug with the formal ls UI where a resource would not update its status after a connection request

​

0.2.0

• Added the ability to open an SSH session automatically when connecting to an SSH resource through formal ls

​

0.1.4

• Added support for Linux

​

0.1.0

• Added support for configuring the SSH client (i.e., ~/.ssh/config) to more seamlessly connect to SSH, EC2, and ECS Fargate resources using the formal ls UI

​

0.0.91

• Fixed versioning issue

​

0.0.90

• Fixed versioning issue

​

0.0.89

• Added a link to download the latest version of the desktop app if an update is available

​

0.0.88

• Ensured errors are printed to stderr rather than stdout to provide a clean output stream to users

​

0.0.87

• Exposed certain classes of connection errors between the local proxy and the Formal Connector to users

​

0.0.86

• Fixed authentication failures

​

0.0.85

• Added support for using formal@<native-user> as the username to specify the native user

​

0.0.84

• Added support for json option to formal auth credentials -o

​

0.0.83

• Added support for json option to formal auth credentials -o

​

0.0.82

• Avoided crashing on EOF for postgres

​

0.0.81

• Fixed desktop app auth status

​

0.0.80

• Fixed desktop app auth status

​

0.0.79

• Added support for MongoDB smart routing

​

0.0.78

• Fixed typo in error message missing S3 resource name

​

0.0.77

• Added support for TCP Proxy and Relays

​

0.0.75

• Removed the use of AWS profile

​

0.0.74

• Removed the use of AWS profile

​

0.0.73

• Added more efficient routing

​

0.0.72

• Fixed support for dynamodb

​

0.0.71

• Added resource subdomain to Kubernetes resources for connectors

​

0.0.70

• Added support for connectors

​

0.0.69

• Added support for basic auth for clickhouse

​

0.0.68

• Added resource to policy evaluation

​

0.0.67

• Updated desktop app to renew key every 18 hours

​

0.0.66

• Added support for connector in policy evaluation

​

0.0.65

• Updated log message for fetchCABundle

​

0.0.64

• Added more logs to the dynamodb command

​

0.0.63

• Removed posthog

​

0.0.62

• Fixed AWS CLI

​

0.0.61

• Fixed AWS CLI

​

0.0.60

• Added AWS CLI to building process

​

0.0.59

• Added support for certificate bundle dynamodb

​

0.0.58

• Added support for API Token expiration