Pantheon release notes

The Pantheon MCP Server now supports more AI clients. You can connect the clients below to operate on your Pantheon fleet through the same governed, user-authorized access introduced in the Pantheon MCP Server (Beta) release.

What's included

Pantheon MCP now supports these AI clients:

• Claude AI and Claude Code
• ChatGPT
• Codex
• GitHub Copilot
• Google Antigravity

Authorization stays with Pantheon: the server forwards your own Pantheon identity, so an agent can only reach what you can already access.

Who it's for

Developers and teams who want to manage Pantheon sites and environments through the AI client they already use, while keeping control of what agents can change.

How to get started

Add the Pantheon MCP server in your preferred client and sign in with your normal Pantheon account through the OAuth flow. To disconnect and log out, remove the Pantheon MCP connection in your client.

For client-specific setup steps, see related documentation.

Availability

All Pantheon customers. For feedback, please sign up for the Pantheon Community Slack here if you don't already have an account and join us in the #beta-mcp-server channel.

Sites on the Next Generation GCDN can now exempt trusted tools from bot protection by their User-Agent, without contacting support.

Bot bypass tokens cover automation you can configure to send a request header. Some tools can't do that: hosted uptime monitors, SEO scanners, accessibility scanners, and partner integrations often let you see or set their User-Agent but not add a custom header.

You can now use Terminus to add up to 8 User-Agent strings to each of your site's domains. Requests whose User-Agent header exactly matches one of a domain's entries skip the standard challenge for automated traffic on that domain. Targeted protections, rate limiting, and the managed WAF still apply to every request.

Key details:

• Entries apply to a single domain. The domain must be a verified custom domain on the Next Generation GCDN, and you must have access to the site to manage its entries. If a tool requests both example.com and www.example.com, add the entry to each. Wildcard domains are not supported. To manage entries, use terminus gcdn:ua-bypass:add, gcdn:ua-bypass:remove and gcdn:ua-bypass:list.

• Matching is exact and case-sensitive against the full User-Agent string, including any version number. If a tool changes its User-Agent, for example after an upgrade, update the entry.

• A User-Agent is not a secret: any client that sends the same string also skips the challenge. Prefer a distinctive string that identifies your tool. Entries that look like a web browser's User-Agent are refused unless you confirm with --allow-browser-ua. If your automation can send a request header, use a bot bypass token instead.

• Changes take effect within a few minutes. Remove entries you no longer need.

Update the plugin with terminus gcdn:update, or install it with terminus self:plugin:install pantheon-systems/terminus-gcdn-plugin.

For setup instructions, see User-Agent Bypass in the Next Generation GCDN guide.

Version 0.9.7 of the Push to Pantheon GitHub Action is now available. This release adds inputs that control what a new Multidev clones from its source environment, and makes the target_env input more forgiving about capitalization.

What's new

• Control what new Multidevs clone: Two new optional inputs, clone_files and clone_database, control what the action copies from source_env when it creates a Multidev. Both default to true, so existing workflows behave as before. Set either to false to skip that content (the action passes --no-files or --no-db to terminus multidev:create). This is useful when a Multidev only needs code, or when cloning a large database or files directory slows down every pull request. The inputs only apply when the action creates the Multidev. They have no effect on a Multidev that already exists. They also don't apply when the action deploys with Terminus Build Tools, which creates the Multidev itself. In that case the action logs a warning if either input is set to false. (#199)
• Uppercase target_env values are lowercased: Pantheon environment names must be lowercase. In 0.9.4 through 0.9.6, a target_env with uppercase letters failed the deployment with a message that the name was not a valid Pantheon environment. The action now lowercases the value and logs a message noting the change. Other naming problems, such as underscores, and reserved names like master, are still rejected. Branch names longer than 11 characters are still truncated to a maximum of 11 characters. (#200)

Example

This workflow step creates new Multidevs with code only, without copying the database or files from the source environment:

How to upgrade to 0.9.7

Update your workflow file to use 0.9.7:

For more information about this release, see the GitHub release page. To learn more about deploying to Pantheon from GitHub, see GitHub Actions.

If you have questions or concerns about the action, ask in Pantheon Community Slack or use the Push to Pantheon issue queue.

Pantheon now provides a Drupal 12 upstream for testing. New sites created from it start on the latest Drupal 12 release, currently 12.0.0-beta2, with PHP 8.5 and MySQL 8.4.

Drupal 12 is still in beta, so use it for testing, not for production sites. Drupal 12 compatibility for Pantheon's modules is in progress. The Drupal core release schedule plans the release candidate (12.0.0-rc1) for the week of November 9, 2026, and the stable release (12.0.0) for the week of December 7, 2026.

Create a Drupal 12 site

Create a site with Terminus:

Drupal 12 does not appear in the dashboard's site creation flow yet, so use Terminus.

Known issue: error after installing

After you install Drupal 12, you may see this error from Drupal core:

If you see it, clear the cache:

Pantheon is continuing the phased migration of Advanced Global CDN (AGCDN) to our next-generation edge platform. Starting October 15, 2026, AGCDN customers who use rate limiting or geolocation, and whose current configuration is fully supported in Phase 2, are eligible to migrate. Pantheon will contact eligible customers directly.

What's included

Phase 2 adds two features that you configure yourself in a pantheon-edge.yml file at the root of your site's code repository. Each site environment uses its own settings, and changes go live when you push and deploy your code. Changes no longer require a request to Pantheon.

• Rate limiting: Limit how many requests a single client, identified by IP address or JA4 fingerprint, can make to a site environment, using one of four pre-defined tiers.
• Geolocation: Send the visitor's approximate location, such as country, region, and city, to your site in a single Pantheon-Geo request header.

Before you migrate

• If your site reads AGCDN geolocation headers, update your code to read the Pantheon-Geo header. The header name, format, and available fields are different from AGCDN.
• Rate limiting uses pre-defined tiers. Custom request thresholds and time windows, including 1-second windows, aren't available.
• At launch, pantheon-edge.yml is supported for sites that push code to their Pantheon Git repository. Support for sites that use GitHub, GitLab, or Bitbucket integration, and for Next.js sites, is coming later.

How migration works

This migration is not self-serve. Pantheon's Professional Services team will:

1. Review your current Legacy AGCDN configuration and confirm feature support with current capabilities on NextGen.
2. Migrate your supported rules and configuration.
3. Make the migrated configuration available for you to review.
4. Coordinate the DNS cutover with you during an agreed change window.
5. Validate the configuration after cutover.

Action required

If you are eligible for Phase 2, you will receive an email. Respond to the ticket to confirm your technical contact so we can schedule your migration.

AGCDN customers who are not contacted for Phase 1 or Phase 2 don't need to do anything at this time, and will be contacted at a later date.

Learn how to configure rate limiting and geolocation in the Advanced Edge documentation. Learn more about our switch to Next-generation GCDN with bot protection in this related blog post.

Pantheon's new product, P1, is now in Beta. P1 is Pantheon's AI-native web composition layer. It brings AI-assisted building, direct page editing, reusable components, and governed collaboration into one workflow—so teams can move faster without giving up standards, review, or control.

What's included in the Beta

The P1 Beta provides a foundation for teams that want to modernize how they create and manage web experiences.

• Visual, component-based page building with reusable components and templates.
• AI-assisted building and direct editing for marketers, editors, developers, and agents.
• Protected workstreams that let teams work in parallel while keeping the live site safe.
• Review, merge, publish, and revert workflows so teams can see what changed and approve consequential updates before they go live.
• Media management for the assets used in web experiences.
• A modern Next.js and React foundation that works alongside existing Pantheon workflows and connected systems.

P1 extends the systems and investments teams already rely on. It adds a creation and governance path without replacing existing WordPress, Drupal, or Next.js experiences.

Built for speed and control

P1 gives people and AI a shared environment to create, review, and evolve web experiences. Developers can establish reusable building blocks and guardrails, while marketers and editors can assemble and update pages directly within those standards.

Workstreams make parallel work visible and attributable. Teams can develop an initiative, review the proposed changes, compare them with the live experience, and merge approved work through a controlled path to production.

Beta access

P1 Beta access is limited and subject to review. The Beta is for organizations ready to work closely with Pantheon, launch a real website, and provide feedback as the product continues to mature.

What to expect during the Beta

P1 is usable for production implementations, but some capabilities, workflows, documentation, and implementation patterns may change during the Beta. Participants work closely with the P1 team and help shape improvements to the product and the implementation experience.

P1 Beta is an early step toward a broader release. Pantheon keeps adding capabilities and refining the experience based on customer feedback and real-world use.

Start building with P1

Visit p1.pantheon.io to learn more and request access. Use the P1 documentation when you are ready to explore the product. Read a blog post from Pantheon co-founder Josh Koenig on why Pantheon built P1.

Pantheon is introducing the official Pantheon MCP Server, a governed way to let compatible AI agents operate on your Pantheon fleet through the platform API.

The MCP server exposes Pantheon operations as agent tools, mostly read-only, with any action that changes something requiring your approval in your AI client. It forwards the user's own Pantheon identity, so an agent can only reach what that user already can.

What's included

• A stateless MCP server that maps Pantheon operations to agent tools, covering workspaces, sites, environments, builds and deploy status, runtime logs, secrets, and upstreams, with no delete capabilities in this beta.
• Authorization stays with Pantheon: the server forwards the user's own token and the platform decides what that token may see and do.

Who it's for

Developers and teams using compatible AI coding agents who want to manage Pantheon sites and environments through agent workflows while keeping control of what agents can change.

How to get started

Connect from Claude Desktop, Web, or Code using the Pantheon MCP listing. Sign in with your normal Pantheon account through the OAuth flow; the client stores your token securely. Disconnect from the Pantheon MCP in the client to log out.

Support for more AI agents is coming soon.

For more details, see related documentation.

Availability

All Pantheon customers. For feedback, please sign up for the Pantheon Community Slack here if you don't already have an account and join us in the #beta-mcp-server channel.

Pantheon is opening the Beta of the Public API v1, a stable, Auth0-secured REST API for automating platform operations across your fleet.

The Public API v1 gives partners, DevOps teams, and agencies a documented, contract-stable way to run Pantheon operations programmatically. It extends the earlier alpha with expiring tokens and an OpenAPI 3.x schema that Pantheon commits to through GA.

What's included

• Auth0-secured authentication with expiration, replacing full-grant session tokens.
• Full operational surface: site, environment, backup, domain, and workflow operations.
• Initial capabilities: Upstream, Secrets Manager, access to Next.js build and runtime logs, and more.
• Published as an OpenAPI 3.x schema, so you can generate first-class clients directly.
• v1 contract stability, committed through GA.

Who it's for

Technology partners embedding Pantheon in their own products, enterprise DevOps teams standardizing across many sites, agencies building client dashboards, and regulated-industry customers who require expiring tokens.

How to get started

The API is served at api.pantheon.io under /v1. Interactive docs are at /docs and the OpenAPI spec at /v1/openapi.json. Authenticate with your own Auth0-issued token.

For more details, see related documentation.

Alpha (v0) users

The v0 API keeps running for about 60 days after today's Beta release of v1, then shuts down. The /v1 endpoints reject legacy machine tokens, so move to personal access tokens.

Availability

All Pantheon customers. For feedback, please sign up for the Pantheon Community Slack here if you don't already have an account and join us in the #beta-public-api channel.