Changelog

Decide who can use each MCP server from its own Access page, and manage killswitches beside the person they restrict

Access control now starts from the thing you are protecting. Every MCP server has an Access page that answers "who can use this server": grant people or roles, set what each one can do, and narrow a rule to particular tools or to tools carrying an annotation. The organization-wide role editor is rebuilt on the same model. Killswitches move onto the Access tab of the person they restrict, so listing, creating, lifting, and the full version history all happen on that person's page. API keys can be bound to a single project at creation, and RBAC-filtered tool inventories are now marked private so a shared cache can never serve one person's tool list to another.

Features

• Per-server Access page and rebuilt role editor #6156 - The read-only Team Access tab on each MCP server becomes an Access page where you grant a person or a role access to that server alone. Each rule reads as a sentence, and narrowing to specific tools or to an annotation such as read-only is a dropdown away. Direct rules are editable in place, inherited organization rules link back to the role that owns them, and a "People this reaches" panel resolves every rule to the members it covers. Role authoring moves onto its own page where permissions are picked from one searchable menu and narrowed on their own row. A guardrail refuses to write a block that would lock the caller out. (Author: @adaam2)
• Killswitches managed from the identity's Access tab #6210 - The separate organization-wide Killswitch screen is retired. Team, connection, and session entry points now open the restricted person's Access tab, where you list, create, edit, and lift killswitches and read their version history. The mark beside a person's name is an icon whose hover text says what the state stops. Old Killswitch addresses redirect, with a single record opening on its subject's Access tab so audit-log links still land on the exact record, in the project and time period the link was read from. (Author: @danielkov)
• API keys bound to one project #6116 - The API key form gains an optional project selector. Omitting it still creates an organization-wide key, and a bound key's project shows separately from its permission scopes in the result and the key list, so a restriction is never confused with a scope. A follow-up restores hosted MCP project context for organization-wide keys executing platform tools while rejecting conflicting bindings (#6115). (Author: @danielkov)
• Filtered tool inventories are never cached across people #5955 - Remote MCP proxy tools/list results that pass through the per-tool RBAC filter are labelled cacheScope: "private" with ttlMs: 0. The MCP 2026-07-28 revision reads an absent scope as public, which would have let a shared cache serve one principal's tool inventory to another, or let a client keep an inventory after the grants that shaped it were revoked. The label applies whether or not anything was filtered, so it never reveals that a caller was. (Author: @bflad)

Agents become first-class identities with their own credentials, policies, and owners

An AI agent no longer has to borrow a person's API key. The platform can now hold an agent as a principal in its own right: a human owner creates it, grants it an allow-only runtime policy narrower than their own, issues it API keys with a required expiry, and can suspend, rotate, transfer, or revoke it. Every request an agent makes is admitted against three live policies at once, the immutable grant it was delegated, its own direct policy, and its current owner's policy, so an agent can never do more than the person accountable for it. If that owner leaves the organization, the agent is blocked until an admin explicitly reassigns it. Agent credential issuance is rolling out per organization behind the gram-agent-credentials-m2 flag.

Features

• Create and manage agent principals #6047 - Human-only APIs and a setup page for creating, renaming, suspending, resuming, revoking, and deleting first-class agents. Owners manage identity and lifecycle without extra grants, other people are checked against exact agent:* permissions, and every transition writes its before-and-after audit event in the same transaction. (Author: @danielkov)
• Agent API keys with delegated grants and bounded expiry #6071 - Issue, list, rotate, and revoke API keys for an agent through the existing keys API. Each key carries an immutable delegated policy, the identity of the human who authorized it, a required expiry, and a one-time secret. Issuance, listing, and rotation are behind the per-organization gram-agent-credentials-m2 flag; revocation always works. (Author: @danielkov)
• Every agent request is admitted against live policy #6068 - Agent credentials are checked on every call against the delegated grant, the agent's direct policy, and the current owner's policy together, and malformed, expired, inactive-parent, or owner-ineligible requests are rejected. Telemetry and audit records name the agent as the actor while keeping its authorizer and owner as separate provenance. (Author: @danielkov)
• MCP sessions for agent subjects #6072 - Agents can hold MCP sessions using the same challenge, token, refresh, and revocation machinery people use. The live parent and delegated policy are re-checked on every access and refresh, and a replayed refresh is denied once its successor session has been revoked. (Author: @danielkov)
• Direct agent policies, allow-only by design #6051 - Owners and people holding agent:write can create, update, and delete an agent's direct runtime policy. Only allow rules from the agent-safe scope registry are accepted, so this surface cannot write a deny rule, a reusable role, or another principal's grants. (Author: @danielkov)
• Owner loss blocks the agent until it is reassigned #6053 - When an owner is deleted, deactivated, or removed from the organization, the agent latches into a blocked state that survives the owner regaining eligibility. Explicit transfer by the current owner, or reassignment by an admin, is the only way out, and both preserve the agent's identity and direct policy. (Author: @danielkov)
• Agent management capabilities in custom roles #6041 - Four new capabilities, agent:read, agent:write, agent:authorize, and agent:transfer, are added to new organization-admin roles and exposed in the custom role editor under an Agents group, kept separate from the runtime scopes an agent itself may hold. (Author: @danielkov)

Bug fixes

• Typed agent policy selectors #6077 - Create and update request bodies preserve typed policy selectors, and the dashboard API client contracts are regenerated to match. (Author: @danielkov)

Choose which AI tools your device agents scan for, export risk findings over OTLP, and a sharper prompt injection judge

The Shadow AI scan list is yours to edit. From the Device Agent configuration tab, organization admins add their own targets, switch a built-in default off and back on, and edit or delete what they added, with no agent release needed for a change to reach devices. Risk findings join the data export sources, delivering new findings to your SIEM or observability stack as privacy-safe OTLP log events. Prompt injection detection is rebuilt around a typed judge, and every prompt-based risk policy now runs on one benchmarked model that catches more and misfires less at lower latency.

Features

• Manage Shadow AI scan targets per organization #6171 - The list of AI tools device agents probe for is served per organization: the built-in defaults overlaid with the targets you add or customize through the new agent.listAiScanTargets, agent.upsertAiScanTarget, and agent.deleteAiScanTarget endpoints. Every change lands in the audit log, and the served list version is echoed on scan receipts. The Device Agent Configuration tab gains a section where targets are entered as tags (#6173). (Author: @subomi)
• Risk findings as an OTLP data export #6018 - Add Risk Findings as a project-scoped source in Data exports and new, non-excluded findings are relayed to your configured OTLP log destinations. The log carries a stable finding ID plus policy, rule, source, and confidence for filtering and deduplication, never the matched content. Exclusions are re-evaluated immediately before each delivery and fail closed. (Author: @tgmendes)
• One benchmarked judge model for prompt-based risk policies #6024 - The per-policy model picker is gone and every prompt-based policy runs on Gemini 3.5 Flash Lite. On the risk judge benchmark the new model improves accuracy, precision, latency, and token usage over the previous default while keeping perfect recall. Policies keep their temperature and fail-open settings. (Author: @vishalg0wda)
• Typed prompt injection detection #4479 - The prompt injection judge now makes one call per event with bounded session context and returns a typed finding: the kind of directive, its target, whether it is operational, and a privacy-safe rationale. Your risk policies decide block versus surface exactly as before. (Author: @vishalg0wda)
• Turn off the observability plugin per project #6161 - Org admins can disable a project's observability plugin from the Observability card on the Plugins page. A disabled plugin is omitted from the published marketplace, is not installed by the device agent, and rejects direct downloads, and a connected marketplace is republished automatically. Marketplace settings changes are recorded in the audit log. The backing column shipped separately as a schema-only migration (#6170). (Author: @speakeasyforgebot)
• Gateway calls classified as the gateway, not shadow MCP #6180 - A hook-observed call whose server URL is a gateway endpoint now shows as that gateway in Tool Logs and insights instead of falling through to shadow MCP. Gateway activity hides members no longer on the gateway, and the activity charts link to the tool logs and insights pages filtered to that gateway. (Author: @daviddanialy)
• Clearer Watchdog exposure bar #6129 - Hovering a category dims the other slices so one reads at a time, and Custom Rules gets its own color so no category looks inactive. (Author: @adaam2)

Bug fixes

• Policy scopes saved as the scanner reads them #6092 - Policy setup saves message type selections as category detection scopes, so the "Applies to" value in Policy Center matches the scanner's effective scope and the scopes a policy's other categories relied on are preserved. (Author: @vishalg0wda)
• Imported chats with NUL bytes no longer fail the sync #6103 - AI provider chat messages and titles containing NUL bytes are stored with the byte dropped instead of failing the compliance sync for that window. (Author: @subomi)

Point an MCP server at your identity provider's issuer and see who each connection belongs to

External OAuth configuration now works the way identity providers publish it. Choose provider-hosted or platform-hosted OAuth metadata, review the live discovery result before saving, and switch an existing configuration safely. Discovery probes every well-known location and merges the OpenID Connect and RFC 8414 documents, so fields a provider publishes in only one of them are captured. Remote logins request the scopes a provider actually advertises, retry once without a resource indicator when an issuer rejects it, and validate the RFC 9207 iss parameter. When an issuer returns an ID token, the platform verifies it and shows the connection as "Connected as" that person. The Authentication settings for an MCP server are reorganized into three rows with one table for allowed clients.

Features

• Issuer-backed external OAuth configuration #6049 - Choose whether an MCP server advertises provider-hosted or platform-hosted OAuth metadata, and switch an existing configuration after reviewing live discovery results. The server side ships in two halves so the change rolls out without a flag: every server first learns to read and advertise issuer-only records (#6045), then the create, update, and clear operations land with an SSRF-safe discovery step that requires an exact issuer match (#6085). (Author: @walker-tx)
• Discovery merges every well-known document #6094 - Issuer discovery probes every well-known candidate and merges same-issuer OpenID Connect and RFC 8414 documents, capturing jwks_uri, claims_supported, and ID token signing algorithms wherever the provider publishes them. Discovery and refresh also record the userinfo and introspection endpoints, back-channel logout, and RFC 9207 support, and the create forms accept the same fields. (Author: @daviddanialy)
• Spec-aligned scopes, resource indicator retry, and iss validation #6109 - Remote logins request openid, email, profile, and offline_access whenever the issuer advertises them, and operators can pin a verbatim scope request per issuer with scope_override. A login or refresh answered with invalid_target is retried once without the RFC 8707 resource parameter, and resource_indicator_supported can be set to false on an issuer that never accepts it. Issuers advertising RFC 9207 have iss validated on the callback, and the consent page offers a reconnect when a live grant lacks openid. (Author: @daviddanialy)
• "Connected as" from the issuer's ID token #6104 - When code exchange or refresh returns an ID token, it is verified against the issuer's published keys and reduced to its claims, and the consent card shows who the upstream grant belongs to. Non-standard token response members are kept alongside, minus anything credential-shaped; the raw token is never stored. (Author: @daviddanialy)
• Reorganized MCP Authentication settings #6132 - Session length, client access, and connected services each get their own row with a one-line hint, terminology moves behind "What is this?" modals, and the verified client catalog and your own allowed client URLs become one table behind a "Manage allowed clients" link. Dashboard only, no API change. (Author: @adaam2)

Bug fixes

• Dead refresh grants reported on a 2xx are cleared #6088 - OAuth error bodies on successful upstream token responses are read, so a dead refresh grant reported that way, such as GitHub's bad_refresh_token, clears the stored token instead of being retried forever. (Author: @daviddanialy)

Review shadow MCP, assign access roles, and read the event feed from Platform MCP

Admin work that used to require the dashboard can now be done from the Platform MCP server inside your coding agent. Ask for the last events in your organization's Event Feed, list unsanctioned MCP usage in a project and approve or deny a reviewed target, create or update custom MCP access roles and assign them to members, and drill into masked tool and skill usage by user. Every read is privacy-safe: raw URLs, hosts, person-level details, and evidence documents never reach the model, and every mutation is confirmed, idempotent, and budgeted so an agent retry cannot double-apply a decision.

Features

• Event Feed from Platform MCP #6136 - The new list_organization_events tool returns the most recent Event Feed entries for an organization admin, newest first, over the last day by default and up to seven. Results are summaries with a dashboard link to the full feed; attributes, trace IDs, and user identities are never returned. (Author: @simplesagar)
• Inspect and decide shadow MCP access #6117 - The list_shadow_mcp_inventory and get_shadow_mcp_review tools show unsanctioned MCP usage in a project with its review and enforcement state using generic target labels and exact event counts. The decide_shadow_mcp_access tool then approves or denies a reviewed target with a bounded rationale and an idempotency key, reusing the dashboard's own approval transaction (#6118). Available for projects on the MCP approval rollout. (Author: @TristanSpeakEasy)
• Manage and assign MCP access roles #6113 - Confirmed, idempotent tools create and update custom MCP access roles, and a follow-up assigns them to members without replacing the roles those members already hold (#6127). Privacy-safe reads of role, member, and configured MCP access back both (#6075). (Author: @TristanSpeakEasy)
• Usage attribution by user #6181 - Drill-downs for masked MCP tool and skill usage by user, with tool and error attribution scoped to the selected server at call level. (Author: @TristanSpeakEasy)
• Plugin assignment reads #6062 - Privacy-safe reads for plugin assignments and assignment versions, so an agent can check what is assigned before proposing a change. Optional subject counts may be integers, suppression labels, or null (#6153). (Author: @TristanSpeakEasy)
• Clearer inventory and setup failures #6054 - The MCP inventory names each server's backend kind and the management operations it supports, and setup failures are classified into privacy-safe categories with actionable next steps (#6056). (Author: @TristanSpeakEasy)
• Platform MCP setup lives in headless mode #6144 - The separate Platform MCP settings page is gone; setup happens from headless mode, and old /platform-mcp links redirect there with their entry source preserved. (Author: @adaam2)

Bug fixes

• Catalogue servers alongside legacy servers #6182 - Reviewed catalogue MCP servers can be registered in projects that also contain legacy toolset-backed servers. (Author: @TristanSpeakEasy)

One flow for adding MCP servers, whatever kind they are

The MCP page is now the inventory and the only place a server is added. One "Add new" button offers the catalog, a remotely hosted server, a tunneled one, and an Advanced group for OpenAPI documents, functions, and building a server from a source the project already has. Servers are named for how they are reached rather than the backend behind them, remote servers verify connectivity before they can be saved, and breadcrumbs lead back up from every step. Sources move under MCP instead of going away, with a page per source showing its file, the tools it produced, and the deployments it is versioned by. Old source and catalog links redirect. Further down, project admins can rename a project, Legacy Pro organizations receive the enterprise feature bundle, organization setup gets its logging step back, and a run of fixes covers logout, sign-up, and plugin rollout.

Features

• One flow for adding MCP servers #6012 - The MCP page becomes the inventory and the only place a server is added. Remote servers must verify connectivity before they can be saved, sources live at /mcp/sources with a page per source, deploying a function offers the flow that builds a server from it, and old /sources and /catalog URLs redirect. A follow-up restores the grid and table toggle on the servers and sources lists and the plugin skills section, adds a search box to Environments, and brings back the source page's MCP servers list, document viewer, and function runtime details (#6142). (Author: @adaam2)
• Legacy Pro organizations get enterprise feature access #5912 - An operator-run, dry-run-by-default backfill grants Legacy Pro organizations the enterprise-access entitlement bundle while preserving any entitlement an admin explicitly disabled. Billing and resource limits are unchanged. (Author: @simplesagar)
• Rename a project from Settings #5880 - Project settings show the display name and slug, and project admins can update the display name. The new projects.update endpoint validates and audits the change, and the dashboard refreshes its project cache so the new name appears everywhere. (Author: @alx-xo)
• Unsupported MCP protocol versions rejected before auth #6201 - Hosted, platform, and gateway MCP surfaces answer an unsupported protocol version with error code -32022 and the requested and supported versions, so a client can retry with a compatible one instead of being served under legacy semantics. Proxied backends still relay to their upstream. (Author: @bflad)
• Gateway install page and clearer tool-call keys #6157 - MCP gateway endpoints serve an installation page instead of a not-found page. The execute_tool description, gateway instructions, and missing-name error now name the name and arguments keys so clients stop guessing a tool key (#6087). (Author: @daviddanialy)
• Organization setup gets its logging step back #6219 - Both the wizard and the board regain an "Enable logging" step with a single switch that turns on Enable Logs, Record Tool I/O, and Agent Session Capture together. The board marks the task done once all three are on, the wizard resumes past it, and the "enterprise rollout" card on the organization home opens the wizard it describes. New organizations still start with the bundle enabled. (Author: @simplesagar)
• Setup wizard and board, side by side #6098 - The Wizard/Board switcher returns, so the linear wizard at /setup/wizard is available alongside the board. Setup task assignees are notified by email, assigned owners can verify onboarding traffic, and the header and footer are expanded with support escalation and a responsive layout (#6063). The Cowork manual setup callout is restored in the same change. (Author: @simplesagar)
• Setup reminder moves to the sidebar #6148 - The full-width setup banner on every organization page is replaced by a persistent "Finish organization setup" entry in the sidebar footer, and the organization home headline fits on one line. (Author: @adaam2)

Bug fixes

• Logout returns you to the login page #6042 - Logging out from the account menu now redirects to login. The page still navigates if the logout call rejects or stalls. (Author: @alx-xo)
• Signing up again after a WorkOS deletion #6046 - Signing up with an email that was deleted in WorkOS reactivates the user, restores RBAC access, and keeps sign-up off the book-a-demo gate. (Author: @alx-xo)
• Legacy register flow removed #5921 - The session-aware /register compatibility flow is gone; stale links redirect to /sign-up. (Author: @alx-xo)
• Identity pages keep their place in the sidebar #6199 - The Observability group stays open on identity pages, a breadcrumb leads back to the roster, and roster cells are evened out. (Author: @adaam2)
• Plugin rollout keys auth can find #6149 - The plugin rollout sweep no longer mints API keys under the system placeholder creator, and existing orphaned keys are rewritten onto a real organization member. (Author: @speakeasyforgebot)
• Audit log attributes background work and spend-cap changes correctly #6140 - Scheduled jobs are recorded as the system acting surface instead of unknown, so an unknown surface once again means an unattributed request. Spend-cap changes carry the surface they came through into the workflow, so your own change is no longer recorded as an unattributed write (#6141). (Author: @simplesagar)

Kanban board for enterprise onboarding

Rolling out an organization no longer funnels through a single-person wizard. Setup is now a four-column board where each task can be assigned to a member or an email address, blocked tasks show what they are waiting on, and admins can invite a team to take their share. Every status and ownership change is recorded in the audit log and surfaced as a webhook event, so the rollout is visible outside the dashboard too. The board is rolling out behind a flag and the wizard remains reachable through a switcher on both views.

Features

• Multi-owner setup board #6031 - Setup tasks now live on a board with durable status and ownership, dependency blockers, and dialogs that guard against a task being completed twice. Assign tasks to members or email addresses, invite a team optionally, and switch between the board and the linear wizard from either view. The setup-task API is organization-authorized, and task events appear in the audit log and webhook surfaces. Platform admins can reveal hidden tasks. Rolling out behind the gram-setup-board flag. (Author: @svadrutk)

One page for every person and agent your organization has seen

The new Identities section gives each person and agent a single page that gathers their access, usage, security findings, cost, devices, and activity from every subsystem, whether or not they have an account on the platform. Every place the dashboard names a person now links there. The same release fixes per-user usage, which showed zero tokens and zero spend for anyone working through Claude Code or Codex while the cost dashboard billed them in full.

Features

• Identities: a page per person and agent #5949 - Each project gains an Identities index of everyone the organization has seen, replacing Employee Enrollment (its old URL redirects). Each identity page answers one question per tab: Overview flags anyone working through a personal AI account rather than the team one, Usage filters by team or personal account class, Cost shows where the tokens went and what came from cache, Connections groups live MCP connections and the data-flow graph by server, and Activity plots the rhythm a row list cannot. Figures rank against peers for the same window. Names on budgets tables, project home top-user cards, chat transcripts, and killswitch detail are now real links to the identity, so they support cmd+click and copy-link. (Author: @adaam2)

Bug fixes

• Per-user usage counts Claude Code and Codex #5949 - The per-user metrics summary read only the generic usage attributes, so anyone working through Claude Code or Codex showed zero tokens and zero spend. Both now count. Audit log actors resolve to names in the feed, its actor filter, and the admin activity list instead of reading as columns of email addresses, and resolution goes through the organization's memberships so an actor ID from another tenant never names a stranger. (Author: @adaam2)
• Identity widgets honor the time range and admit failure #5949 - The audit trail, authorization challenges, and per-person shadow MCP servers now respect the selected time range instead of reading their whole history, with managed devices deliberately left outside it as a current inventory. A panel whose request failed says so and offers a retry instead of reporting "no roles assigned" or "not enrolled" off data that never arrived, and the Cost and Usage tiles show a dash rather than $0 when metrics fail to load. Authorization challenges now key on the identifier the authorization engine records, so the panel no longer reports a clean history for people who may not have one. (Author: @adaam2)

Export agent telemetry to your own observability stack from the dashboard

Data exports are now self-serve. Under the organization's Data section, beside the Event Feed, org admins can route each project's normalized OpenTelemetry logs, metrics, and traces to an OTLP destination of their own, creating the destination inline or reusing one, with no support ticket in the loop. See the data export docs for how routes and destinations fit together.

Features

• Configure data exports from the Data section #5811 - The new Data exports page lists every configured project route in one organization-level topology and offers a single New export workflow: pick an eligible project, its data source, and an existing or inline-created OTLP destination. Enable, configure, and delete controls sit on each source card. Viewing needs org:read and changes need org:admin. The former Event Feed URL under Data redirects to its new home. (Author: @tgmendes)
• Manage export destinations through the API #5792 - A project-scoped data exports service adds list, create, update, and delete operations for destinations alongside route management, with the same organization-level permissions as the dashboard. Each destination carries a destination_type discriminator with transport-specific configuration, so SIEM and object storage destinations can join OTLP without changing the shape of existing ones. (Author: @tgmendes)

MCP endpoints refuse cross-origin browsers, and a role grant can now scope to a single server

Every MCP endpoint the platform serves now validates the Origin header and rejects cross-origin browser requests, as the MCP specification requires, with native MCP clients unaffected. Access control gets finer too: a role grant scoped to one MCP server now unlocks managing exactly that server. Tunneled servers can record a resource identifier so user credentials route to them by exact match and an unmatched credential is never forwarded.

Features

• Cross-origin browser requests are rejected #5899 - MCP endpoints answer cross-origin browser requests with 403 and reject POSTs that are not Content-Type: application/json with 415. Native MCP clients send neither Sec-Fetch-Site nor Origin, so they are unaffected, and embedded chat keeps working through its session token's audience claim. A follow-up exempts the OAuth callback routes that share the MCP path prefix, which were briefly answered with 403 when a browser followed an identity provider's redirect back (#5913). (Author: @bflad)
• Role grants scoped to one MCP server #5909 - Get, update, delete, and tool-filter reads on an MCP server now check mcp:read and mcp:write against that server's own grant resource, aligned with the serving path, and listing returns only the servers the caller holds a grant for. Project-wide and wildcard grants behave as before. (Author: @daviddanialy)
• Tunneled servers route credentials by resource identifier #5905 - Tunneled MCP source settings gain a Resource Identifier section for the server's RFC 9728 protected resource identifier. Gateway consent stamps it as the RFC 8707 resource on the grants members mint, and the tunneled backend accepts a credential only when it is unqualified or names that identifier. The lone-token fallback is gone on every surface, so an unmatched credential is never forwarded. Updating a tunneled server no longer requires resending its name, so saving one setting can never revert a rename that landed in between. (Author: @daviddanialy)
• One slug namespace for hosted servers and endpoints #5917 - Slug availability checks now span both hosted MCP servers and MCP endpoints, so an endpoint can no longer take a slug a live hosted server still resolves under, and vice versa. (Author: @daviddanialy)
• Internal #5918 - Groundwork with no change to production traffic: hosted MCP servers resolved through an endpoint will take their visibility, issuer gating, and RBAC resource from the endpoint's server record rather than the toolset (#5919), and test fixtures stop sharing one toolset across live server records (#5954). (Author: @daviddanialy)

Logging on by default for new organizations, OpenClaw joins the agent sources, and MCP collections are removed

This release removes MCP collections, so read the Breaking changes section below if your organization used them. New organizations now start with logs, tool I/O recording, and agent session capture switched on, so the first session is visible without a setup step. OpenClaw becomes a named agent source whose sessions count toward usage and cost, skill improvements are recommended passively from efficacy analysis, and the remote MCP connect page asks for fewer clicks.

Breaking changes

• MCP collections are removed #5938 - The collections service and its /rpc/collections.* endpoints are gone, along with the Collections pages and sidebar entry, the Publishing section on MCP server settings, the collection group panel in access grant rules, the "Catalog kind" filter on Sources, and the Collection origin label on catalog sources. Collection audit actions are no longer recorded; the audit_log.mcp_collection_event_v1 webhook event stays registered but deprecated so subscriber event lists keep working. The backing tables are dropped in a follow-up migration. (Author: @adaam2)

Features

• New organizations log from the first session #5948 - Enable Logs, Record Tool I/O, and Agent Session Capture are on at creation for every new organization, and the enterprise setup wizard drops its logging opt-in step. Trial expiry no longer disables logging. Existing organizations are unchanged, and org admins can still turn each setting off under Logging & Telemetry. (Author: @simplesagar)
• OpenClaw is a first-class agent source #5929 - OpenClaw appears as a single entry in the agent-type filter, and its sessions take part in prompt-to-response turn correlation using OpenClaw's own per-run identifier. Its sessions now contribute to token, cost, and tool-call summaries, which previously counted only Codex, Cursor, and OpenCode (#5932), from deployment onward. The generated plugin package includes OpenClaw install instructions, including the conversation-access setting that prompt and usage capture depends on (#5933). (Author: @bradcypert)
• Skill improvements are recommended without asking the agent #5838 - High-confidence, transcript-grounded skill recommendations are now generated during efficacy analysis and flow into the existing edit-suggestion workflow. New plugin packages and managed assistants no longer expose the skill-feedback tool; previously installed clients can keep submitting through the retained endpoint. (Author: @danielkov)
• The remote MCP connect page asks for less #5861 - A server whose single required service is not yet linked sends you straight to that provider instead of an interstitial with one button, while a server fronting several providers keeps Connect as its own step. The header names the requesting client and the server side by side, tool access leads with "All tools" and reveals the picker only when narrowed, and the page now shares the dashboard's design system. (Author: @adaam2)
• Watchdog explains the org risk score #5988 - An info tooltip spells out that each signal inherits its score from its policy and that the overall score weights the most severe signal, the average of the top signals, and the total number of findings rather than a plain average. (Author: @simplesagar)
• The demo organization stays one click away #5958 - The account menu keeps an Explore demo org entry after the trial welcome banner stops showing it. (Author: @simplesagar)
• Gateway endpoints, rolling out behind a flag #5836 - Behind the gram-gateway-endpoints rollout flag, calls dispatched through a gateway are now attributed to it in telemetry and billing events, the observability overview can filter to one gateway, and the gateway's Overview tab shows usage scoped to it, the discovery funnel, and calls by member, with activity markers on gateway cards in the MCP listing (#5837, #5986). Gateway cards show their members' logos and a status dot, member management moves onto the Overview tab, and team-access rows on gateways and MCP servers alike click through to a pre-filled grant dialog (#5883). Production end-to-end testing fixes follow: removing a member unbinds its provider from the consent screen, malformed JSON-RPC bodies return the spec's parse-error code, and the add-member sheet no longer implies unproxied servers can be added (#5962). (Author: @daviddanialy)

Bug fixes

• Ingestion keeps up under heavy challenge volume #5829 - Authorization challenge logging now writes in batches instead of one insert per event, which had held pooled connections and let challenge, event feed, and risk finding ingestion fall behind a growing backlog. (Author: @bradcypert)
• Deleting a tunneled source no longer hangs #5962 - The confirm dialog closes and navigates on success instead of sticking on "Deleting…". (Author: @daviddanialy)
• Internal #5834 - Telemetry tables gain gateway attribution columns ahead of emission, with no customer-visible surface. (Author: @daviddanialy)

One feed for every signal your agents emit

The new Data section shows every OpenTelemetry log and span ingested through the platform in one org-level Event Feed, in preview. Search it, filter by kind, source, and name, watch volume over time, and open any event for a parsed or raw view. The same ingest surface now accepts OTLP metric exports and relays them to your configured OpenTelemetry destinations, so agent telemetry can flow into the observability stack you already run.

Features

• An event feed for every OTel signal, in preview #5641 - The org-level Data section shows every OpenTelemetry log and span ingested through the platform: search, kind/source/name filters, a stacked volume chart, an infinite-scrolling table, and a detail sheet with parsed and raw views. New org-scoped read endpoints back the page (#5640) over per-signal ClickHouse tables (#5639). (Author: @subomi)
• OpenTelemetry metrics relay to your destinations #5758 - The public API now accepts authenticated OTLP metric exports and relays them to configured OpenTelemetry destinations, preserving producer resources, instrumentation scopes, and schema URLs. (Author: @tgmendes)

Bug fixes

• The Event Feed description names Speakeasy's endpoints #5669 - Copy on the page now matches product branding. (Author: @svadrutk)

Serve MCP at the apex of your own domain

Custom domains now work at the root, so your MCP servers can live at company.com, not just a subdomain. The setup wizard offers A-record instructions with a CNAME/A toggle, DNS verification waits out slow propagation instead of failing fast, and a default MCP server can be staged before DNS cuts over, so a migration from another MCP host configures everything up front. The OAuth surface serving those domains gets stricter and steadier in the same release.

Features

• Custom domains work at the apex #5690 - Root domains that cannot carry a CNAME record are now supported: the setup wizard offers A-record instructions with a CNAME/A toggle, DNS verification polls for up to 24 hours instead of failing fast on slow propagation, and "Check now" wakes a pending check immediately. A default MCP server can be staged while the domain is still configuring, with cutover converging on its own once DNS lands. Health checks flag stray A or AAAA records, and a domain can no longer activate without its TXT ownership proof. (Author: @ThomasRooney)
• MCP sign-in gets stricter and steadier #5782 - The OAuth surface now validates the RFC 8707 resource parameter on both the authorize and token legs, rejecting values that name the wrong endpoint while leaving clients that omit the parameter untouched. The comparison target is built from the address each request arrived on, so a server reachable under both a custom domain and the platform origin validates correctly under either. (Author: @aa-wong)
• One shared connection per agent and upstream #5572 - A remote-session credential is now one shared grant per subject and client, so status, refresh, and disconnect act on the same credential from every bound surface, and revoking it anywhere destroys it globally with a best-effort upstream revocation. (Author: @daviddanialy)

Quarantine an agent session the moment it violates policy

Enforcement gains teeth. Risk policies can now freeze an entire agent session on violation until an org admin releases it, and MCP tool-call killswitches are enforced on every path, including private remote and tunneled servers, with a management API and a dashboard rolling out for creating and lifting them.

Features

• Quarantine an agent session on violation #5561 - Risk policies gain a quarantine action: a violation denies the triggering event and freezes the whole agent session, with prompts and tool calls refused by a message naming the policy, until an org admin releases it from the new Quarantines tab. Opens and releases are audit-logged. (Author: @vishalg0wda)
• Killswitches enforced on every tool-call path #5839 - Active MCP tool-call killswitches now stop calls before they reach private remote and tunneled servers, not just hosted ones. A management API lets org admins create, edit, and lift killswitches with schedules, server scope, overlap previews, and history (#5855), and a Killswitch dashboard with principal-first workflows is rolling out to a limited cohort of organizations (#5863). (Author: @danielkov)

Bug fixes

• Guardrail policies only offer supported detections #5862 - The policy editor no longer lists detection types the engine cannot actually enforce. (Author: @vishalg0wda)

GitHub Copilot joins observability, billing lands on one page, and gateway endpoints start rolling out

If your organization uses GitHub Copilot, its sessions now show up in the same timelines, spend gates, and policy checks as the other four platforms. Billing consolidates into one usage view for every plan, with promotion codes accepted at checkout, and cost analytics now report the tokens people actually used. Captured sessions can be recalled from inside any connected agent, and gateway endpoints, one MCP endpoint fronting a curated set of servers, begin rolling out behind a flag.

Features

• GitHub Copilot becomes the fifth observability platform #5376 - Copilot hook events land on the same ingest path as the other platforms, so Copilot sessions appear in the same timelines, spend gates, and policy checks. The dashboard offers a downloadable Copilot plugin package with a hooks-scoped key already embedded. Hooks fire in Copilot CLI only; MCP servers and skills from the same plugin load in VS Code and the Copilot app, but those surfaces report no telemetry. (Author: @svadrutk)
• One billing page for every plan #5827 - Pay-as-you-go organizations get the same token usage view as enterprise, with the invoice estimate at its head and an explicit empty state before any usage is recorded. Checkout now accepts Stripe promotion codes (#5722). (Author: @danielkov)
• Cost analytics report what people actually used #5824 - Token numbers on the costs page and project overview now show plain LLM tokens (input plus output), matching the employee pages, with cache-creation tokens visible as their own labeled metric. Employee views fold a person's full identity, including linked personal-account emails, so their usage no longer splits into an unattributed duplicate row (#5780). (Author: @daviddanialy)
• See how each connected agent authenticates #5736 - The MCP connections list now derives each registration's credential kind server-side and badges the two worth interrupting a scan for: key-authenticated and cannot-authenticate. The registration detail sheet states the kind for every client and is reachable again from the agent row's menu. (Author: @bflad)
• Client admission defaults to an honest open mode #5807 - Issuers that never configured client admission now rest at an explicit open policy instead of an internal mode nothing displayed, so enforcement becomes something an operator opts into rather than a default anyone lands on. No client that authenticates today stops authenticating, and catalog-gap measurement survives the change. (Author: @bflad)
• Recall a captured session from any connected agent #5719 - Two new Platform MCP tools bring session recall without the device agent: list your own captured coding-agent sessions and continue one as a redacted handoff digest inside the current conversation, with each recall audit-logged and linked by lineage. (Author: @simplesagar)
• Antigravity joins the install options #5732 - The hosted MCP install page replaces Gemini CLI with Antigravity CLI and adds Antigravity IDE, both using Antigravity's mcp_config.json format. (Author: @speakeasyforgebot)
• Platform MCP installs from a public marketplace #5801 - The first-party Platform MCP package now publishes from a public plugin marketplace instead of being injected into each organization's private plugin repository, so installs become the same two commands for everyone and OpenCode gains an install route it never had. Access still fails closed on the same entitlement. The connect flow adds a catch-all "Other agent" option for agents outside the certified set (#5795). (Author: @adaam2)
• Gateway endpoints, rolling out behind a flag #5664 - Behind the gram-gateway-endpoints rollout flag, a gateway is one MCP endpoint fronting a curated, ordered set of MCP servers, managed from the dashboard with Overview, Members, Inspect, Clients and Sessions, and Settings pages. The Inspect tab reads the endpoint live over MCP and shows exactly what a client receives. This release adds drill-down into hosted members (#5604), dispatch to remote and tunneled members with per-member credential routing (#5781), default auth wiring on creation (#5853), and sessions that degrade per member instead of rejecting outright when a provider is unconnected (#5882), on the control plane and protocol groundwork from 1.17.0. (Author: @daviddanialy)
• Manage signing keys from the dashboard #5679 - For organizations with the customer-managed encryption keys entitlement, a new Signing Keys section on the Encryption Keys page creates JSON Web Key Sets from a GCP KMS key and manages the publish, activate, retire, and revoke lifecycle of their published keys, on the management API introduced in 1.17.0. (Author: @bflad)
• Resolve one person across every subsystem #5793 - The new identity.resolve endpoint takes an identity URN in any form the platform stores activity under, such as a user ID, email, API key, or agent-reported external ID, and returns every identifier for the same subject plus their directory attributes, so any surface can link with whichever identifier it holds. (Author: @adaam2)
• Platform operators only #5731 - Visible to platform operators, not customer organizations. The admin dashboard gains an organization Activity view over cursor-loaded audit history (#5730), live and completed trial details on the organization overview (#5714, #5713, #5715) with legacy trial fields removed (#5716), a customers-only stat strip (#5650), an S-token calculator page (#5668), and audit rows that keep the staff name privately while customers see Speakeasy Team (#5728). (Author: @walker-tx)

Bug fixes

• Assistants see their directly attached servers #5830 - Assistant surfaces now count MCP servers attached directly to the assistant, not only those reached through a toolset, and the composer's @-picker explains an empty Tools section instead of hiding it. (Author: @alx-xo)
• The Skills list loads its insights faster #5791 - Activation, efficacy, and savings metrics now load without computing unused cost and regression signals. (Author: @tgmendes)
• Transcripts hide OpenClaw's message envelope #5822 - Session transcripts, titles, and summaries no longer render OpenClaw's inbound metadata framing; stored messages are unchanged. (Author: @bradcypert)
• Small fixes across the dashboard #5790 - The browser tab icon follows the browser's own light/dark setting so it no longer disappears (@adaam2). The login page links to sign-up (#5616, @alx-xo). Deleting a project returns you to the organization home instead of the deleted project's settings (#5841, @alx-xo). (Author: @adaam2)
• Internal #5765 - Groundwork with no customer-visible surface: MCP servers record and index their upstream authorization server (@daviddanialy); new metrics count upstream session refreshes and rejected MCP requests (#5681, @bflad). (Author: @daviddanialy)

The Shadow MCP inventory tells the truth about enforcement, and the stop button really stops

Every row in the Shadow MCP inventory now reports what enforcement actually delivers, from one server-computed verdict, and policy edits that would silently override recorded access decisions require explicit confirmation. The assistant's stop button now actually ends the turn server-side instead of letting it keep generating and spending in the background, and Windows machines install the device agent from a signed MSI.

Features

• Enforcement reported truthfully, row by row #5564 - Each inventory row renders from one server-computed access summary instead of re-deriving enforcement in the browser. A server approved for part of an audience reads Restricted rather than Allowed, and a decision nothing enforces or the current rules contradict says so, naming what displaced it. (Author: @daviddanialy)
• Policy edits can't silently override decisions #5571 - Editing a blocking policy's allow or block list now checks the change against recorded access decisions. Contradicting one requires explicit confirmation in a dialog that lists the affected servers, and a confirmed save marks each displaced review as superseded, actor-attributed and audit-logged, with decision history preserved. (Author: @daviddanialy)
• A detail page that answers instead of repeats #5531 - The Shadow MCP server detail page is reworked around a summary strip of status, calls, people, and last-called, dropping the fact list that restated the traffic table beneath it. Long user lists collapse, and the unreviewed badge says Unreviewed instead of contradicting the notice under it. (Author: @daviddanialy)
• The stop button now stops the assistant #5614 - Pressing stop previously only aborted the browser's view of the turn: the reply kept generating server-side, kept calling tools, kept spending, and reappeared on reload. Stop now cancels queued turns and interrupts the one in flight. The partial reply stays in the transcript, and every tab watching the chat settles instead of tailing a turn that has ended. (Author: @adaam2)
• Windows installs from a signed MSI #5607 - The Windows device-agent walkthrough now installs from a signed MSI that registers the machine-wide service itself, with a stable download link that always resolves to the current signed version and an Intune note for fleet deployment. (Author: @bradcypert)
• A management API for signing keys #5593 - For organizations with the customer-managed encryption keys entitlement, the new jsonWebKeySets API offers org-scoped CRUD of JSON Web Key Sets backed by customer KMS keys, plus the publish, activate, retire, and revoke lifecycle of their published keys. (Author: @bflad)
• Sign-in surfaces harden #5505 - Remote session issuers now capture the upstream's advertised PKCE support and warn when an identity provider does not advertise S256. Client documents may register redirect URIs on a different origin than the client ID, with exact-match validation still enforced (#5608). (Author: @bflad)
• The Secure section reorganizes #5558 - Navigation is now Watchdog, Guardrails, and Shadow MCP: the Risk Policies page becomes Guardrails and absorbs Detection Rules as a tab, with old URLs redirecting, Risk Events returns below Watchdog (#5597), and one Suppress dropdown replaces the separate suppression buttons (#5551). (Author: @dennnis-ez)
• Groundwork for gateway endpoints #5569 - Not yet customer-visible: the control plane for meta MCP servers with ordered member sets, and the gateway protocol surface serving the fixed tool contract on the canonical MCP path (#5573). The dashboard experience ships in 1.18.0 behind a rollout flag. Session portability also gains a per-organization toggle on the admin features pages (#5557, @simplesagar). (Author: @daviddanialy)
• Platform operators only #5601 - Visible to platform operators, not customer organizations: per-key inference limits on the billing admin page, and complete monthly inference spend history with a graph (#5627). (Author: @danielkov)

Bug fixes

• Concurrent token refreshes stop racing each other #5293 - MCP clients with several open sessions now share one refresh-token rotation with a short grace period instead of racing into an invalid_grant error, and the consent page shows a connected upstream grant even when a different identity provider originally created it (#5565). (Author: @danielkov)
• Watchdog suppression works past the time window #5609 - Suppressing a signal now collects its findings without the page's time window, fixing a silent no-op for findings older than the view, and an empty collection shows an error instead of doing nothing. (Author: @dennnis-ez)
• Per-user telemetry stops counting platform-side inference #5556 - Risk-analysis judges and other platform-side completions no longer count as the session owner's usage on employee surfaces. (Author: @daviddanialy)
• OTel forwarding keeps retained header values #5598 - Adding or removing one forwarding header no longer clears the encrypted values of the headers you kept. (Author: @disintegrator)
• Assistant onboarding no longer crashes on refresh #5592 - Loading the assistant onboarding page directly tripped React's hook-order invariant once permission grants finished loading; each frontend tool now renders as its own element. (Author: @bradcypert)
• The command palette finds every MCP server #5456 - Remote, tunneled, and unproxied servers now appear in the MCP Servers group alongside toolset-backed ones instead of being reachable only from the list page. (Author: @aa-wong)
• Enrollment refuses impersonated sessions #5545 - Manual device-agent enrollment is refused while impersonating an organization or user, or without membership in the active organization. (Author: @bradcypert)
• Roles can be created without a description #5330 - The Create Role dialog accepts an empty description field and omits it from the request. (Author: @qstearns)
• Internal #5625 - Skill insight queries avoid scanning unrelated session telemetry (@tgmendes); local dashboard dev proxies session-handoff URLs correctly (#5590, @simplesagar). (Author: @tgmendes)

Approvals survive new policies, moved sessions stay linked, and suppressed findings get one list

An MCP server approved before any blocking policy existed used to end up blocked anyway when a policy arrived later. Creating a blocking policy now replays the project's recorded decisions onto it, so an approval means what it said, and servers blocked only for some users read Restricted instead of Blocked. Sessions that move between agents now stay linked in both directions, suppressed Watchdog findings gather in one list with the provenance behind each, and the device agent gains a walkthrough for Claude Code on the web.

Features

• Standing approvals are honored when a blocking policy is created #5322 - Creating a blocking shadow MCP policy, or turning one blocking, now replays recorded approval decisions onto it in the same transaction: approvals get their bypass audience, denials get block rules, and a policy that cannot express a scoped approval refuses creation and names the servers instead of silently widening what was recorded. The inventory also distinguishes a server blocked for everyone from one blocked only for some, with a new Restricted state and reasons that name a denied review explicitly. (Author: @daviddanialy)
• Moved sessions stay linked #5459 - When a session moves between agents, a lineage edge now links the original to its continuation, and the Agent Sessions panel shows both directions with navigation between them. (Author: @simplesagar)
• Suppressed findings live on the Watchdog page #5528 - Every suppressed finding, whether by exclusion rule, manual dismissal, or automated sweep, now sits in one collapsible section with the provenance behind it, a restore action, and a link to the rule behind rule-based suppressions. The listings API covers rule exclusions it previously missed (#5521), and risk results carry converged suppression fields (#5513). (Author: @dennnis-ez)
• See what the research agent actually did #5452 - For organizations on the MCP approval rollout, a research run's review page now shows its per-action trace: every search and page fetch in order, with the outcome, the injection judge's verdict, and a bounded preview of the untrusted text it saw. Only previews are stored, and no new inference runs. (Author: @daviddanialy)
• The device agent reaches Claude Code on the web #5489 - A new walkthrough covers Anthropic-hosted Claude Code on the web, with a self-contained script and a SessionStart hook that revives the daemon each session. The platform tiles also stack their labels so all four fit a row (#5548). (Author: @subomi)
• Author and distribute skills over Platform MCP #5544 - OAuth-authenticated clients can list, read, create, and re-version skills in a project and distribute one to an exact plugin or assistant, with conflict-safe versioning so concurrent authors cannot silently overwrite each other. (Author: @adaam2)
• Pay-as-you-go bills reflect everything that ran #5515 - Invoices now bill platform-initiated inference alongside customer-facing spend. (Author: @danielkov)

Bug fixes

• Internal #5467 - Groundwork with no customer-visible surface: product-feature APIs gain explicit organization scoping and authorization (#5466, #5469, #5468, @walker-tx); demo organization sessions align enforced scopes with reported grants (#5535, @adaam2). (Author: @walker-tx)

See and control your pay-as-you-go bill, read MCP connections end to end, and stay connected to Platform MCP

Pay-as-you-go organizations can now watch the bill take shape instead of waiting for the invoice. Billing shows the current cycle as it accrues, with the estimated total, subscription controls, separate spend caps for Security and Other inference, and a billing contact alongside. MCP Connections becomes a graph you can read in either direction, a person's agents or an agent's people, split into active and inactive rows with a status dot on each. Platform MCP connections now survive token expiry without a fresh sign-in, and the assistant answers setup questions from reviewed guides with citations. For organizations on the MCP approval rollout, a research agent investigates a server on request, and approved servers are re-checked daily for permission changes.

Features

• Your pay-as-you-go bill, before it arrives #5371 - Billing shows the current cycle for pay-as-you-go organizations: tokens under management and their flat-rate cost, Other inference spend through the last completed day, and the estimated invoice total once Stripe billing has started. The monthly Other inference meter now says plainly that it runs on the calendar month. Behind it, tokens-under-management usage reports to Stripe from durable hourly snapshots (#5345), Other inference spend bills through durable invoice allocations that freeze after 48 hours and carry corrections forward after a 72-hour observation window (#5351), and billing cycles align to UTC midnight (#5340). (Author: @danielkov)
• Manage the subscription yourself #5370 - Organization admins see live subscription status on Billing, open a controlled customer portal, and cancel or resume at the end of the period. If the subscription lapses, pay-as-you-go admission closes and the Other inference key is disabled, with later billing events reconciled against the organization's current state (#5363). (Author: @danielkov)
• Billing problems surface where they're felt #5372 - A failed payment now heads the billing page with a direct link into the Stripe portal, and an organization that has reached a monthly inference cap gets a banner on every page naming what stopped, with a link straight to that cap's control. (Author: @danielkov)
• Separate caps for Security and Other inference #5368 - Pay-as-you-go admins view and set an independent monthly cap for each platform-managed inference key. Each change updates only the selected key, survives lifecycle reconciliation, and records a per-key audit event. Spend alerts re-arm after an explicit cap change while still deduplicating when reconciled provider limits fluctuate (#5369). (Author: @danielkov)
• A billing contact and the emails that reach it #5366 - Pay-as-you-go admins can set or clear a billing notification email. When none is set, weekly usage summaries and spend alerts go to every organization admin. Activating pay as you go sends a confirmation that states the metered rate, which inference is billed at provider cost, and which is funded by Speakeasy (#5445). A reminder goes out three days before an eligible trial ends, and billing contacts hear when subscription loss or a trial demotion pauses access (#5367). (Author: @danielkov)
• MCP Connections reads as a graph #5392 - A row names a person, provider, or agent, and opening it shows the nodes on the other side, a person's agents or an agent's people, on the same columns. Rows are ordered by when they last carried traffic and split into active and inactive connections (dormant for over a week, or no longer usable), and inactive ones stay visible and revocable instead of being filtered away. The same list renders on the MCP server detail tab and the employee page. Each row leads with a status dot, green live, amber expiring, red needs re-auth, grey idle or revoked, and the OAuth client on the other side is now called an agent throughout; the organization page moves from /user-sessions to /mcp-sessions (#5441). For API consumers, userSessions.listUserSessions now returns each session's last_used_at and its upstreams, the remote sessions the platform holds for the same subject and issuer, so both legs of a brokered connection come back from one call (#5390). (Author: @adaam2)
• Platform MCP stays connected #5373 - Platform MCP clients no longer send you back through authorization every time a short-lived access token expires. One-hour access tokens rotate through refresh tokens with a 30-day sliding idle window and a 90-day authorization cap, and the dashboard shows clear reconnect guidance when an authorization expires or is revoked. (Author: @TristanSpeakEasy)
• Setup guides and cited docs search in Platform MCP #5490 - Reviewed provider setup guides are served as Platform MCP resources, and a new search_gram_docs tool answers from that pinned corpus with cited excerpts and links back to the full guide. Content past its revalidation date is flagged, then withheld, and a question nothing reviewed can answer returns guide_unavailable instead of invented steps. Citations render in the assistant as passages with resource links. Organizations that haven't enabled Platform MCP now see a dismissible setup recommendation in empty states and organization navigation, routed into the resumable setup flow (#5380, @TristanSpeakEasy). (Author: @adaam2)
• Catalog servers keep their icons #5042 - Installing a server from the catalog now stores the registry's icon and shows it in the server detail sidebar and collection listings instead of a generic placeholder. Remote servers with no catalog icon get the vendor's favicon by default. (Author: @AshGodfrey)
• Assign plugins to directory groups and attribute values #5488 - Organization admins can target active directory groups and exact directory attribute values as plugin assignment audiences, listed alongside Everyone and organization roles from one plugins.listAudiences call. (Author: @tgmendes)
• Requesters say why they need a server #5198 - A blocked employee's request page now redeems the block link into a short form instead of filing the ask the moment it loads, and the justification carries onto the review as the requester's note. Previously every note was the policy's block reason, so "who asked, and why" told a reviewer nothing about any individual ask. Rolling out with the approval feature. (Author: @daviddanialy)
• Approved MCP servers are re-checked daily #5198 - A daily sweep re-gathers evidence for approved servers and compares the permission-relevant slice (OAuth scopes, authority mode, demanded credentials, published advisories) against the snapshot the approval rested on. Drift sets a changed-since-approval flag that only a new decision clears, announces once per distinct change through the audit-log webhook channel, and shows as a diff banner on the review page and a badge on the inventory (#5196). The review page is also condensed so a full dossier fits in far less scrolling, with observed traffic joining the evidence as "Who is currently using it?". Rolling out with the approval feature. (Author: @daviddanialy)
• Research an MCP server on request #5158 - A Run Research button on the approval page starts a bounded agent run over cited web search and page fetch (#5147) and renders the report: a summary, an independent-coverage level, and tiered claims where every web-sourced claim carries its citations or is dropped. Every fetched page passes through a prompt-injection judge, and a page that tries to steer the reviewer is recorded as a finding on the report rather than only defended against. At most one run per request is in flight, and research spend is not billed to your organization today. Rolling out with the approval feature. (Author: @daviddanialy)
• Per-user device, risk, and shadow MCP lookups #5499 - The lookups an identity view needs: deviceIntegrations.listManagedDevices takes user_ids and user_emails, risk.listResults takes external_user_ids matched whole rather than as a substring, and access.listShadowMCPInventoryServersForUser returns the shadow MCP servers one person reached, with work and personal addresses resolving to the same subject. (Author: @adaam2)
• Identity providers link to their detail page #5463 - Remote identity providers listed on an MCP server's Authentication settings are now links, so reaching a provider no longer means finding it again from the Remote Identity Providers page. (Author: @aa-wong)
• MCP 2026-07-28 protocol revision #5408 - Every result the hosted and platform MCP surfaces return now carries the resultType field the revision requires and identifies the responding server under io.modelcontextprotocol/serverInfo in _meta, filled only when an upstream server hasn't already supplied them. MCP observability keys on each request instead of the initialize handshake the revision removes, and the MCP-Protocol-Version header no longer leaks into tool environment variables (#5396). (Author: @bflad)
• Platform admin: MCP server counts and reworked organization views #5426 - Visible to platform operators only. The admin projects list reports how many MCP servers each project has, and the organization record's Projects and Members views gain counts, monograms, and a "Never" for members who haven't signed in (#5428). Staff-only chat analysis settings are scoped to the organization selected in each request (#5461). (Author: @walker-tx)
• Internal #5425 - Privacy-safe telemetry for durable Platform MCP authorization, with the operational dashboard, monitor, and revocation-probe contract documented (@TristanSpeakEasy). Stripe webhook events from newer API versions are accepted within the compatible release train (#5364, @danielkov). Function templates use newer MCP SDK and Inspector versions (#5417, @dependabot). (Author: @TristanSpeakEasy)

Bug fixes

• Sign-in redirects stay on the dashboard #5244 - Post-login redirect targets that a browser could read as another origin are rejected and fall back to the default sign-in destination. (Author: @qstearns)
• Trial limits end when the trial does #5424 - The trial credit cap holds until the trial is demoted rather than the moment its window closes, so a first key minted in the gap no longer receives the enterprise ceiling. Session capture, logs, tool I/O logs, and Platform MCP now stop when a trial is demoted and return when it's re-armed or converted to pay as you go (#5454). (Author: @alx-xo)
• Resource reads attribute to the right server #5448 - MCP resources/read requests record the server URL in billing telemetry and logs instead of the session id, so the MCP URL filter is no longer polluted with random UUIDs. (Author: @bflad)
• Tool call annotations no longer flash as chat prose #5491 - The short activity phrase the assistant emits before a batch of tool calls is held until the tool group opens instead of rendering as a paragraph and then jumping into the heading. (Author: @adaam2)

Approve or deny MCP servers with gathered evidence, and pause risk policies without deleting them

Deciding whether your organization should trust an MCP server no longer means researching it yourself. The Shadow MCP page becomes one servers table where every row carries its review state, and opening a server shows an evidence dossier gathered for you: who publishes it, what it asks for, what it declares it can do, whether it's real and maintained, and whether your teams already talk to it. Decisions enforce the moment they're recorded. The workflow is rolling out to organizations with the approval feature enabled. Separately, risk policies can now be paused and resumed instead of deleted.

Features

• One review surface for every MCP server #5079 - The inventory and access requests merge into a single servers table, with pending decisions sorted first. A blocked employee's ask attaches as a requester on the server's single review instead of minting a per-user bypass, decisions are made in place with a required rationale, and an approval or denial enforces through the same policy machinery the allow and block controls used, in the same transaction that records it. Rolling out with the approval feature. (Author: @daviddanialy)
• Evidence gathered for you #5144 - Dossiers consult the code host for repository health, OSV.dev for published vulnerability advisories, and the domain registry for registration records, alongside the server's own OAuth metadata and tool declarations probed without credentials (#5078). Your organization's own exposure, meaning who already calls the server and how often, is the one observed signal in the set. A source that can't be read records a gap, never a clean empty section. (Author: @daviddanialy)
• Anyone can request a review #5074 - Members name a server by URL or launch command and say why, no permission grant needed. Repeat asks attach to the existing review, a denied review reopens with its history intact, and reviewing the queue is granted separately from committing the organization to a decision (#5072). (Author: @daviddanialy)
• Pause risk policies without deleting them #5303 - Policy Center and policy detail pages gain disable and re-enable controls, and the delete confirmation offers "Disable instead", so enforcement can stop temporarily without losing the policy or its history. (Author: @simplesagar)
• Canonical identities in analytics, behind a flag #5256 - Cost analytics, employee detail pages, enrollment, and billing breakdowns can fold one person's directory, personal, and case-variant emails into a single canonical identity (#5257). Off by default behind a rollout flag with a shadow-compare mode validating the fold on live traffic first. The identity map syncing behind it landed as internal infrastructure (#5248, #5252, #5264). (Author: @daviddanialy)
• Platform admin: full trial and organization lifecycle #5297 - Visible to platform operators only. Operators can now create an organization without leaving the admin app, disable and re-enable one (#5290), extend a running enterprise trial (#5294), restart a demoted one with the restart recorded in the activity log (#5301, #5327), set account types in bulk (#5342, #5352), peek at an organization beside the list (#5284), and read platform-wide counts above the list (#5331). (Author: @walker-tx)

Bug fixes

• Running sessions stay in date-filtered lists #5274 - A session that logged a message after the page's frozen range bound vanished from the Agent Sessions list until the range was re-selected. The filter now tests interval overlap, so active sessions stay visible. (Author: @daviddanialy)
• Failing integration syncs back off and explain themselves #5285 - A chronically failing AI integration poll now backs off exponentially instead of ringing failure monitors forever, and its visible status carries an actionable error without exposing provider payloads. A success or config save makes it due again immediately. (Author: @daviddanialy)
• Trial reminder emails stop when they should #5275 - Converting or expiring a trial now clears its reminder sequences, so paying and expired organizations stop receiving countdown emails. (Author: @alx-xo)

Exact assistant session totals and a hardened dashboard

Assistant session listings now report exact range-bounded activity totals with pagination that no longer distorts the numbers, and the dashboard ships three browser hardening headers a penetration test flagged as missing. Device-agent fleet configuration is also scoped to organization admins, matching who could already change it.

Features

• Exact assistant session totals #5265 - Activity totals are computed exactly for the selected range, independent of pagination, so the summary numbers stop shifting as pages load. (Author: @danielkov)
• Stronger browser isolation #5269 - Dashboard responses now carry cross-origin resource, opener, and cross-domain policy headers, closing three findings from a penetration test without breaking cross-origin asset loads. (Author: @walker-tx)
• Device-agent configuration is admin-only #5101 - Viewing fleet configuration now requires organization admin, matching the existing requirement on changing it, and the tab hides from non-admins while Setup stays available to everyone. (Author: @speakeasyforgebot)
• Platform admin: operator tooling #5266 - Visible to platform operators only. The organizations list keeps its search and filters in the URL so a view can be pasted to a colleague, a login URL contract opens the customer dashboard already scoped to a chosen organization (#5277), and organization rows report real trial state instead of a defaulted date that made every row look like a trial (#5276). (Author: @walker-tx)

Bug fixes

• AI-suggested exclusions save #5258 - Suggested exclusion patterns were validated with a different regex engine than the one the platform matches with, so valid suggestions failed as invalid. The form now validates with the matching engine, surfaces server-side errors, and retries a failed suggestion once with corrective feedback. (Author: @dennnis-ez)
• Demo visitors land on sample data #5250 - Entering the demo organization lands on its default project instead of an empty organization home. (Author: @alx-xo)
• Publish status no longer stuck on needs syncing #5260 - Organizations on the phased hooks rollout saw a permanent "needs syncing" after every hooks version bump they weren't eligible for yet. Freshness now runs the same eligibility check as publishing, so only changes that would actually apply count. Hook installations are also served an updated binary (#5148). (Author: @daviddanialy)

Configure and observe assistants from one panel, and see one person behind many accounts

The assistant detail panel is now the one place to run an assistant: name, model, concurrency, and warm TTL are editable in place, the Sessions tab shows cost and token stats over a selectable range, and triggers expand to show their recent traffic with each event linking to the conversation it routed to. Cost analytics also starts folding a person's work and personal AI accounts into one identity, so drill-downs report a whole person rather than a slice.

Features

• Assistant detail panel: edit in place, observe in place #5230 - Overview settings are editable behind an explicit edit mode, the Sessions tab aggregates sessions, messages, cost, and tokens over a selectable time range with per-session cost in the list, and each trigger expands to its recent dispatches. (Author: @danielkov)
• Work and personal accounts roll up to one person #5221 - Cost analytics email filters and user drill-down pages now include an employee's directory email and linked AI account emails, so the same totals appear whichever identity the telemetry arrived under. (Author: @daviddanialy)
• LiteLLM sessions keep their label #5187 - A session routed through LiteLLM stays matched to the LiteLLM filter and displays as its client via LiteLLM, even when the agent's own hook stream captures the transcript. (Author: @danielkov)
• Composer references become chips #5236 - Tool and skill references render as colored inline chips in the assistant composer, deleting a skill's token detaches it, and hyphenated tool names now match in autocomplete. (Author: @adaam2)
• Platform admin: model keys encrypted at rest #5201 - Visible to platform operators only. Platform OpenRouter keys are encrypted at rest, with an admin page listing each organization's keys, limits, live usage, and encryption state, and enable and disable actions audit-logged against the owning organization. (Author: @bflad)

Bug fixes

• LiteLLM-proxied sessions no longer duplicate turns #5152 - The proxy and the agent's own hook stream both reported the same assistant turn, and both rows survived. The duplicate is now dropped for sessions a hook stream already captured, and bare Claude adapter sessions resolve to the Claude Code surface instead of colliding with Claude desktop imports. (Author: @speakeasyforgebot)
• URL imports hardened against SSRF #5231 - OpenAPI-from-URL and image-from-URL fetches reject non-HTTPS targets and private address space, with redirects capped and re-checked so a hostile target can't chain into internal networks. (Author: @speakeasyforgebot)
• Typed dates work in the time range picker #5225 - Natural-language date parsing silently failed on most pages because the request was missing its project header. The picker now injects it everywhere, fixing the project home, security, and billing pages in one place. (Author: @simplesagar)

Faster assistants, file attachments in chat, and organization names in every language

Assistants no longer send every MCP tool schema to the model on every call: tools are discovered on demand, servers connect on first use, and dropped connections reseat themselves, which keeps prompt caching effective for large toolsets and takes MCP handshakes out of cold-start latency. The Project Assistant accepts file attachments, and organization names now accept punctuation and every script, so "Acme, Inc." and a company named in Japanese both get through the door. One breaking change below on external key management.

Breaking changes

• External key updates can no longer change what a key is #4971 - The AWS KMS and GCP KMS update methods drop the fields that defined key identity (key_arn, resource_name, algorithm); changing those now means deleting the key and creating a new one. Deleting a key is refused while a key set or published key still references it, and creating a GCP key requires a fully qualified crypto key version path. (Author: @bflad)

Features

• Assistants respond faster and cache better #4121 - MCP tools are found through a search tool instead of being advertised wholesale, servers connect on first use rather than at startup, and dropped connections reseat automatically. The same release adds a local runtime provider so assistant runtimes run in Docker for local development. (Author: @danielkov)
• Attach files to the Project Assistant #5139 - Drop files anywhere on the chat or use the paperclip. Images and text-like files, including OpenAPI documents, travel with the turn; anything unreadable inline arrives as a short-lived download link. The composer also recalls past prompts terminal-style with the arrow keys (#5178), merges skills and tool mentions into one "Add context" picker (#5142, #5177), and hides its example prompts once a file is attached (#5176). (Author: @adaam2)
• Organization names in every language #5203 - Names accept punctuation and every script, so "Bob's Bakery", "Café Zoë", and companies named in Japanese, Arabic, or Cyrillic all pass validation. Invisible formatting and control characters are still rejected, and URL slugs are unaffected. (Author: @alx-xo)
• Choose accepted OAuth clients from the dashboard #5027 - An MCP server's authentication settings now offer the verified client catalog, any spec-valid client, or none, plus your own document URLs, each verifiable before it's added. Client metadata documents are also cached with proper revalidation instead of refetched on every authorization (#5154). (Author: @bflad)
• Revoking a session revokes it upstream too #5118 - Revoking a remote session now posts the stored token to the issuer's RFC 7009 revocation endpoint, so the upstream provider drops it instead of leaving a live token working elsewhere until it expires. This covers every path that ends a session, including the end-user "Disconnect" on the consent screen. (Author: @aa-wong)
• Set a session refresh policy for the whole organization #5066 - Admins choose Disabled, User controlled, or Required from the MCP Connections page, and end users see the effective policy on the consent screen. Required keeps every eligible connection refreshed; Disabled says plainly that idle connections will lapse. (Author: @speakeasyforgebot)
• Tool calls summarized at a glance #5209 - Agent session views gain compact tool-call rows with persisted two-sentence summaries and risk-first detail expansion, so scanning a long session no longer means expanding every call. (Author: @chase-crumbaugh)
• Watchdog: ranked risk signals, rolling out #5124 - A new Watchdog page clusters live findings into ranked signals with severity scores, trends, and a drawer that turns a signal into an exclusion in one action (#5143, #5207). Rolling out behind a feature flag; it replaces Risk Overview and Risk Events where enabled. (Author: @dennnis-ez)
• Skill details split into focused pages #5159 - Content, usage, feedback, versions, and settings each get their own page instead of one long scroll. (Author: @alx-xo)
• LiteLLM sessions show their originating client #5140 - An agent session routed through LiteLLM displays the supported client that produced it while still matching the LiteLLM filter. (Author: @danielkov)
• Registry evidence on catalog entries #5076 - Catalog entries from external MCP registries now carry the registry's declared source repository and published packages, feeding the approval evidence surface. The API descriptions note these are declarations, not observations. (Author: @daviddanialy)
• Warnings for duplicate identity provider URLs #5136 - Creating or editing a provider that duplicates an existing issuer URL now warns, without blocking the write, since duplication has legitimate uses. (Author: @bflad)
• Logging out clears everything #5131 - Logout now instructs the browser to drop cookies and storage across the whole domain, closing the gaps a plain expiring cookie leaves. Theme preference and project favorites survive. (Author: @disintegrator)
• Exclusion changes apply retroactively everywhere #5204 - Creating, updating, disabling, or deleting a risk exclusion now rewrites the affected findings' state in the analytics store as well as the primary database. (Author: @dennnis-ez)
• MCP protocol version telemetry #4957 - All five inbound MCP paths emit requested and negotiated protocol versions, so client adoption can be measured and version-specific failures diagnosed. (Author: @bflad)
• Platform admin and internal groundwork #5069 - Groundwork for the MCP approval workflow landed without user-facing behavior: summarizing what a tool declares it can do and resolving observed servers to stable artifact identities (#5036). Authorization challenge logging moved to a queue-backed pipeline (#5070) and challenge log pages now serve from pre-aggregated summaries (#5185). Platform operators gained a pay-as-you-go rate adjustment input on the contract estimator (#5145). (Author: @daviddanialy)

Bug fixes

• Employee usage pages no longer under-report #5199 - The rows that carry tokens and cost identify people by provider account email, while hook events carry a resolved user id, and per-employee queries only matched one shape. Employee pages now scope to a person's whole identity set, so someone on a personal AI account stops showing sessions next to zero cost. (Author: @daviddanialy)
• Codex hooks no longer fail with exit 127 #5103 - A background plugin refresh could delete the directory a running Codex session's hook command pointed at. The bootstrap now persists itself in a version-independent location, and a hash-computation bug that silently dropped hooks whose commands contained shell metacharacters is fixed. (Author: @speakeasyforgebot)
• Cursor events attribute to their sessions #5011 - Cursor usage events now decode the conversation id into the standard conversation attribute, tying usage to the session that produced it. (Author: @bradcypert)
• Misconfigured Slack clients no longer mask real alerts #5015 - Slack refusals a caller has to fix, such as a channel the bot was never invited to, are now caller-attributed warnings instead of server errors, so one noisy client can't hold an error monitor at threshold and hide a genuine regression. (Author: @bradcypert)
• Block pages and challenge rows link where you'd expect #5137 - Durable block pages link to the owning project's risk event log, and skill and environment rows on the access challenges page link to their pages instead of showing a bare id (#5134). (Author: @danielkov)
• "Continue chat" only offers your own sessions #5133 - The assistant dock's continue option now lists only sessions the viewer started from the dashboard, backed by a new user filter on chat listing. (Author: @danielkov)
• Audit entries name actors without an organization #5202 - Actions taken from organization-less sessions, such as self-signup provisioning, now record the actor's email instead of a bare id. (Author: @alx-xo)
• Platform admin: organization list paging #5218 - The admin organizations list no longer returns a cursor to an empty page when results are an exact multiple of the page size. Hook installations are also served an updated binary (#5135). (Author: @walker-tx)

Assistants can see images from Slack, and skills are scanned for prompt injection

An assistant triggered from Slack now reads the images attached to the message, and can fetch images referenced later in a thread, so screenshots stop being dead weight in a conversation. Skill manifests are scanned for prompt injection the moment they're captured, with findings shown on skill details, and an organization whose trial ends lands on a page that says so instead of a generic gate.

Features

• Assistants see images shared in Slack #4361 - Images attached to a triggering message travel with the turn as vision content, validated against an image allowlist, and a new asset inspection tool lets the assistant fetch an image referenced later in the thread through a short-lived sealed download URL. Image bytes live only in the live inference path and are never persisted at rest. (Author: @claude[bot])
• Slack attachments are visible to triggers #4358 - Messages that share files surface each attachment's name, type, and size in the turn context, and the file list is addressable from trigger filters, so a trigger can route on "message with a file" without fetching contents. (Author: @claude[bot])
• Skills are scanned for prompt injection #5031 - Captured skill manifests are judged against your Prompt Injection policy at capture time, current-version findings appear on skill details, and admins can configure the policy from the Skills page. Scanning never fails an upload, and an unavailable judgement retries later rather than passing as clean. (Author: @svadrutk)
• Ended trials land on an upgrade page #5108 - An organization whose enterprise trial has ended sees a page that says so and books an upgrade call, and anyone still inside a trial can reach it early from the sidebar countdown. Admins also receive lifecycle emails when a trial starts and as it approaches expiration (#5043). (Author: @alx-xo)
• Internal: groundwork and dashboard scaffolding #4360 - The assistant runtime's message representation widened to structured content parts, which is what the Slack image support above builds on. A signals endpoint landed backing a risk monitoring page that ships behind a flag in the next release (#5104), and the dashboard gained a shared page-template layer with about 34 pages migrated onto it (#5094). (Author: @claude[bot])

Bug fixes

• Assistants pick up runtime updates automatically #5120 - A regularly used assistant could keep its admission-time runtime image forever. Deploys now recycle stale runtimes lazily at turn admission, so assistants roll onto the current image without waiting for an idle window. (Author: @danielkov)
• Skill share pages resolve on custom domains #5088 - Custom domain routing now covers shared skill pages, which previously returned an edge 404. Existing domains pick up the route on their next settings save. (Author: @simplesagar)

Search and filter every client and session connected to an MCP server

The Clients and Sessions tab on MCP server pages now leads with live counts and renders both listings as searchable, sortable tables, so answering "who is connected to this server right now" takes one click instead of a scroll. MCP OAuth responses also meet the newest authorization spec, protecting clients that hold flows against several servers at once.

Features

• Searchable client and session tables #5077 - Both listings are searchable, filterable, and sortable, with member avatars and creation dates on sessions. Each client row reports how many active sessions it holds, and clicking that count narrows both listings to that client. (Author: @bflad)
• OAuth responses defend against mix-up attacks #4956 - The authorization server now emits the RFC 9207 issuer parameter on every response and advertises it in metadata, satisfying the MCP 2026-07-28 authorization response validation requirement. (Author: @bflad)

Bug fixes

• Shadow MCP finding descriptions stay generic #5056 - Risk finding descriptions no longer name the specific tool that was called. (Author: @disintegrator)
• Onboarding covers Claude Cowork and shows conversations #5057 - Choosing Device Agent during onboarding now notes that Claude Cowork's cloud sandbox needs its own manual setup step and links to it. Conversation events also reach the confirm-traffic feed, so it shows prompts and replies rather than only tool calls, and MDM vendor wording follows the Iru rebrand. (Author: @mfbx9da4)