Antigravity CLI 1.5.9 stops MCP auth headers leaking on redirects

What changed

Before 1.5.9, custom headers set for an HTTP MCP server, such as API keys, could be sent to a different host if the server replied with a redirect; they now go only to the configured server’s own origin. The run_workflow tool, which lets the agent run a Python script that fans work out to many subagents, is now available to all users. Admins get pluginControls settings to turn off plugins or just the marketplace without Gemini Enterprise.

Who it affects

Antigravity CLI users with header-authenticated HTTP MCP servers, and admins managing plugin policy.

What to do

Update to 1.5.9, and rotate API keys sent in custom headers to MCP servers that redirect.

Source: https://github.com/google-antigravity/antigravity-cli/releases/tag/1.5.9