Changelog

Every dashboard sign-in, whether it's connecting your own account or approving a gateway's access, now has to finish in the same browser it started in, with a ten-minute window to complete. A sign-in link forwarded to another machine, or an old consent link revisited later, no longer continues: it has to restart. Access control gets sharper too: clearing a role's own rule on a server is now a single click instead of overwriting it, and a chat session run with an agent credential now records the agent, not the person who issued the key. More on this in Team access and Agent identity.

Features

• Dashboard sign-ins are now bound to the browser that started them #8703 - Connecting a personal account or approving a gateway's access now sets a secure cookie on the page that starts the challenge and checks it at every step, the same binding federated sign-ins already use. A sign-in opened in a different browser is sent to restart instead of continuing, and the window to finish closes after ten minutes. (Author: @daviddanialy)
• Chat sessions made with an agent credential now show as the agent's, not yours #8582 - A completion made with an agent API key or an admitted workload now records the acting agent on the session and carries no human identity, so the agent's owner can find and open the session without needing organization-wide transcript access. Sessions captured before this release are renamed to their agent on their next turn, but keep the visibility they already had. (Author: @dennnis-ez)
• Clear a role's own access rule on a server without replacing it #8333 - Every Connect, View, and Manage line on a server's Team Access tab now offers Clear, which removes that role's or person's own grant or block for that line without writing a new rule in its place. A line no rule decides now reads "Not set" instead of defaulting silently, and the same Clear control now also works on a role whose rule covers every server. (Author: @qstearns)
• Guardrails now check prompts sent through OpenCode's turn-start events #8694 - Prompts an adapter delivers through a turn-start event, including OpenCode's, are now captured and checked by your risk policies the same way an ordinary inbound message is, closing a gap where they went unrecorded and unscanned. (Author: @danielkov)

Bug fixes

• Changing a server's authorization server no longer breaks existing connections #8633 - With upstream auth enforcement on, a change to a server's derived authorization server no longer invalidates saved consent or an approved gateway connection. People are told to reconnect only when a new consent can actually offer them a connection, and detaching a server's own sign-in client stops the server offering it instead of failing with a conflict. (Author: @danielkov)
• Platform MCP's connection status now reflects the sign-in client actually in use #8640 - With upstream auth enforcement on, Platform MCP's connection status, connection test, catalog readiness, identity provider attachment, and the Okta resource connections page all now follow the auth clients a server offers, instead of stale sign-in bindings. (Author: @danielkov)
• An expired MCP session's refresh token stays expired #8731 - A refresh token from a session that reached its length limit now keeps answering that it has expired after the short replay window, instead of answering "unknown or already used," so health views correctly tell you to sign in again rather than blaming your AI app. (Author: @daviddanialy)
• Connection failures now name who can fix them #8701 - An expired sign-in, or one the person themselves ended, now counts as a failure rather than a policy block. A sign-in an admin or the directory ended is marked blocked, with the admin as the one who fixes it, and a refresh token sent by the wrong app, a damaged saved connection, or an agent connection that no longer matches its server each get their own outcome. (Author: @daviddanialy)
• A connection check that fails before reaching the service now explains why #8704 - The connect page's error now names the check that failed, suggests retrying only when the problem was an outage, and no longer shows internal error text. Any other unexpected error now points you to Speakeasy support if it keeps happening. (Author: @daviddanialy)
• Reconnecting a personal registration keeps the resource you picked #8695 - Connecting a personal registration now keeps the selected server's resource and scopes, including servers offering alternative providers. Strict providers no longer reject sign-in over a missing resource, and consent no longer asks you to reconnect for account details the server never requested. (Author: @danielkov)
• A sign-in added to an MCP server as a shared credential now connects reliably #8625 - Connecting, disconnecting, refreshing, and verifying a sign-in an administrator added as a server's credential now works end to end: connecting names the server as the requested resource, so providers that require one no longer refuse it, and these connections are refreshed and re-checked in the background like any other. (Author: @danielkov)
• Consolidating session issuers no longer stalls on a shared app registration #8834 - Merging one user session issuer onto another no longer stops just because the same app, such as Claude Code or Codex, is registered on both. The source registration's sessions, consents, and approvals now merge into the target's instead of blocking the migration. (Author: @qstearns)

Editing an agent used to reopen the full six-step setup wizard just to change which servers it reaches. Agents now get their own MCP sign-in tab, second after Overview, where adding, removing, or reconnecting a server saves immediately with a toast, no wizard and no Save button. The old Credentials tab is renamed Agent sign-in and issues a new key through that same flow instead of asking you to pick servers again. The Permissions tab now leads with the MCP servers an agent can reach, in their own section above its other grants, and its "Acting on behalf of" panel lists every server an agent may connect to alongside whose credential it uses there. Platform MCP can now read all of this too, through get_agent_mcp_access and list_agent_authorization_checks. More on this in Authorizing agents and Platform MCP.

Features

• Change an agent's MCP servers and sign-in from its own tab #8812 - A new MCP sign-in tab lists an agent's servers and how it signs in to each, and saves every change as it's made instead of walking the setup wizard again. A red count shows how many servers still need someone to sign in, and the old "Review connections" and "Change servers" links now land here. (Author: @mfbx9da4)
• Issue an agent key from a renamed Agent sign-in tab #8809 - An agent's Credentials tab is now called Agent sign-in and shows the same sign-in diagram as the creation wizard. Issuing a key there runs the wizard's own sign-in, install, and verify steps for the servers the agent already reaches, instead of asking you to pick servers or set an expiry again. (Author: @mfbx9da4)
• An agent's Permissions tab now leads with its MCP servers #8706 - The servers an agent may connect to now get their own section at the top of its Permissions tab, with an Edit servers button that opens the agent's MCP server step directly. (Author: @mfbx9da4)
• See exactly which credential an agent uses on each server, and how often #8713 - An agent's "Acting on behalf of" panel now lists every MCP server it may connect to, which credential it uses there, and its calls in the period, so a server it can reach but never called shows plainly as zero calls. (Author: @mfbx9da4)
• Platform MCP can now read an agent's access and authorization checks #8758 - get_agent_mcp_access lists the MCP servers an agent identity may connect to, the rules behind each, and whether it signs in with a shared credential or on behalf of named people. list_agent_authorization_checks lists its recent checks, denials first. (Author: @mfbx9da4)

Bug fixes

• A broken agent connection now says exactly what's wrong and who fixes it #8712 - Instead of a generic "ask your administrator," a broken connection now says the server needs re-authentication and links whoever can edit the agent straight to its MCP sign-in step. A rejected upstream call, a permissions problem, and a shared credential issue each get their own message naming no person and carrying no credential. (Author: @mfbx9da4)
• A gateway tool call blocked by a sign-in change now says who can fix it #8733 - When an admin changes a gateway server's sign-in setup after you approved it, the error now names the server and says whether reconnecting helps or an administrator has to step in, instead of always saying "reconnect." You can also now pick between two connected services for one server when sign-in enforcement is off. (Author: @daviddanialy)
• An agent's allowed MCP connections now show up next to its denials #8719 - Authorization checks now list failed checks first, grouped by scope and resource, followed by a section of the servers the agent was allowed to connect to, so a real denial no longer gets buried among routine allowed checks. (Author: @mfbx9da4)
• Editing an agent's permissions no longer silently drops grants it can't display #8707 - Edit permissions now loads every grant exactly as stored, including grants on a single MCP server or a whole project, and saves only the scopes you actually changed. The dialog lists every grant a save will add or remove before you confirm. (Author: @mfbx9da4)
• Every MCP server grant on an agent's Permissions tab now names its project #8724 - Grants saved from the permission picker without a project now read it from the server, so the Permissions tab never shows a grant with no project attached. (Author: @mfbx9da4)
• Opening a session from an agent's page no longer loses your place #8716 - Opening a session from an agent's Overview or Sessions tab now opens it in a drawer over the identity page, keeping the sidebar and session list in place, and the open session is kept in the URL so it can be linked, or closed with back. (Author: @mfbx9da4)
• An agent's tool calls chart now splits out failed and blocked calls #8726 - The chart now colors calls by outcome, succeeded, failed, blocked, or pending, with a legend and a failed count, using the same colors as the Tool logs status dots. (Author: @mfbx9da4)
• Grants on a hosted MCP server now link to the server itself #8725 - An agent's Permissions tab and its authorization checks now link a hosted server's grants to its /mcp page instead of an old /toolsets/ redirect. (Author: @mfbx9da4)
• Tool logs now break out a separate header for each day #8714 - Project Tool logs and an identity's Tool logs now open every day in local time with its own date header, so earlier rows no longer sit under the first day's date. (Author: @mfbx9da4)
• Long agent sessions now show their real duration #8715 - A session of a day or more now shows its duration in days and hours, such as "3d 20h," in session lists, the Costs session table, the session CSV, and turn cost badges. (Author: @mfbx9da4)
• An identity's breadcrumb now matches its tab names #8721 - The breadcrumb now names a section the way its tab does, such as "Controls & Safety" on an agent, instead of title-casing the URL. (Author: @mfbx9da4)
• Every resource picker checkbox now has its own accessible name #8723 - Screen readers can now tell rows in the resource picker apart, including a pinned, already-selected row. (Author: @mfbx9da4)
• Tool usage on a busy project's identity page now loads reliably #8709 - Tool usage reads now find an agent's traces before grouping them, so they finish within the time limit on busy projects instead of returning zero calls, and Tool logs now say when a read failed with a Retry instead of looping silently. (Author: @mfbx9da4)
• An agent's authorization checks no longer get buried under hook ingestion noise #8717 - Hook ingestion checks, one per hook event, are now left out of an agent's authorization checks, so the checks that actually say what the agent may reach aren't drowned out. (Author: @mfbx9da4)

Platform MCP tool results now render as cards in clients that support MCP Apps, such as ChatGPT: a read shows the resource, a list shows a count and the first few rows, a change shows what was done, and every card links straight to the matching dashboard page. Browsing the catalog gets the same treatment, with search results rendering as a carousel of server cards you can add to your project without leaving the chat. ChatGPT connections also now get the full Platform MCP toolset directly, since the app directory requires each operation to be its own tool rather than routed through a search-and-call pair. More on this in Platform MCP and the MCP catalog.

Features

• Platform MCP tool results now show as cards in MCP Apps clients #8794 - A tool call now returns a card for results you'd otherwise open in the dashboard: an MCP server, plugin, skill, risk policy, gateway, or dashboard. A refused or unavailable call shows the reason with a request-access link when one exists. Clients without MCP Apps, and the managed assistant, see the same results as before. (Author: @adaam2)
• Catalog search results now show as a card carousel #8791 - Searching the MCP catalog from an MCP Apps client now returns a carousel of server cards with the logo, name, and description. A server not yet in your project shows Add to project; one already there shows Open, linking straight to its dashboard page. (Author: @adaam2)
• ChatGPT connections now get every Platform MCP tool directly #8799 - ChatGPT now always lists the full Platform MCP toolset, narrowed by the existing ChatGPT allowlist, instead of the search, describe, and call tools other clients use to run tools by name, since the ChatGPT app directory requires each operation to be its own tool. (Author: @adaam2)
• Platform MCP ships a sign-in skill for clients that skip the OAuth prompt #8772 - When Platform tools are missing or a call fails with an authentication error, a bundled platform-sign-in skill now walks you through signing in for your client, including codex mcp login platform for Codex, which doesn't open the sign-in page for plugin MCP servers on its own. (Author: @adaam2)

Bug fixes

• Connect on a Platform MCP server card now opens the sign-in page directly #8777 - Connect now takes you straight to the provider instead of the server's Settings page, and the card shows the catalog name and logo, such as "Linear." (Author: @adaam2)
• The Platform MCP plugin is now listed as "Speakeasy Platform" #8844 - Claude, Cursor, and Codex marketplaces now list the plugin as "Speakeasy Platform." The underlying plugin name speakeasy and MCP server name platform are unchanged, so existing installs keep working. The Claude plugin also now ships a listing icon (#8845) and links to Speakeasy's privacy policy from its manifest (#8843). (Author: @adaam2)

A remote or tunneled server's long-lived MCP stream now closes with a reconnect hint before the load balancer's own deadline cuts it off, so a long-running session reconnects on its own instead of dropping. Organization gateways now pick up more of the servers you're entitled to reach, Tool logs record the actual reason a hosted call failed instead of leaving it blank, and the plugin banner on a server's overview explains exactly why it's in each plugin it belongs to. The built-in "Speakeasy Approvals" MCP server is also gone: held tool calls now always go through the shared approvals route instead of a per-project server. More on this in Organization and project gateways and Plugins.

Features

• Organization gateways now include more of the servers you're entitled to reach #8461 - Organization gateways now include supported servers that offer typed upstream credentials when auth enforcement is on, even without a personal OAuth registration linked to the gateway sign-in. Connection setup and access checks still apply. (Author: @danielkov)
• The plugin banner now explains why a server is in each plugin #8686 - An MCP server's overview now lists every plugin it's published to and why: the Default plugin takes every enabled server, and a plugin assigned to a role takes the servers that role can use, including servers added later. Organization admins see the role reasons. (Author: @bradcypert)
• Approval policies no longer need their own MCP server #8847 - Saving an approval policy no longer creates a per-project "Speakeasy Approvals" server. Held tool calls now always point agents at the shared /approvals-mcp route, which accepts a key, so there's one less server cluttering your MCP list and gateway membership. (Author: @mfbx9da4)

Bug fixes

• Long-lived MCP streams now rotate before they get cut off #8622 - A remote or tunneled server's long-lived listen stream, and a chat turn stream, now closes with a reconnect hint at a configurable maximum age before the load balancer's own deadline cuts it off, so a long-running session reconnects cleanly instead of dropping. (Author: @bflad)
• Gateways no longer list built-in servers as members #8762 - Consent pages and server lists on a gateway now show only the servers it can actually reach, following the built-in approvals server's removal above. (Author: @danielkov)
• Failed hosted tool calls now record their real error #8708 - A failed hosted tool call, direct or through a gateway, now records its most specific client-safe error on its Tool logs row, and a describe_server or describe_tools call that can't reach a member now gets its own failed row naming the reason instead of a blank one. (Author: @mfbx9da4)
• Connection health now tells apart "never signed in" from "setup changed" #8702 - A gateway member whose sign-in setup an admin changed now records as setup_changed, apart from a server you simply haven't signed in to yet, and names the person when reconnecting fixes it versus an admin when it doesn't. (Author: @daviddanialy)
• An agent's failed authorization checks no longer drown in routine denials #8755 - Gateways now record an authorization check only for the servers a call actually names, instead of one denied mcp:connect check per private server or tool you have no grant for, so failed checks show real denials instead of noise. (Author: @mfbx9da4)
• An MCP server under enforcement no longer inherits another server's sign-in client #8632 - With upstream auth enforcement on, a server now offers only the upstream sign-in clients configured for it, instead of picking up a client another server on the same issuer uses, or one a deleted server left behind. (Author: @danielkov)
• Shared skill pages on a custom domain work again #8301 - Shared skill pages served from a custom domain now route to the server backend instead of failing to load. (Author: @simplesagar)
• Slack tool errors now say what configuration is missing #8727 - A Slack platform tool call on a server with no Slack token, a rejected token, or a token missing a needed scope now fails with a message naming what's missing and who can fix it, instead of a generic internal error. (Author: @mfbx9da4)
• Calling a tool a server doesn't have no longer shows as a Speakeasy error #8655 - Connection history now keeps an unknown tool name out of its error reporting, so it no longer reads as a problem on Speakeasy's side. (Author: @daviddanialy)
• Failed OpenClaw gateway calls no longer sit stuck on "Pending" #8710 - The OpenClaw observability plugin now reports every call still waiting for a result at the end of each run, so a failed call shows as failed with its error instead of hanging as Pending. Reinstall the plugin to get this. (Author: @mfbx9da4)
• Clearer guidance for updating, reinstalling, or removing OpenClaw #8786 - The agent install step now has a folded section explaining that OpenClaw doesn't update the Speakeasy hooks plugin on its own, with the commands to remove it cleanly. A key issued from an existing agent's Install step now also keeps its hook ingestion grant. (Author: @mfbx9da4)
• A tool call interrupted by a deploy now fails cleanly instead of hanging #8584 - A tool call or function resource read still running 45 seconds into a shutdown is now cancelled with a proper error instead of being cut off when the deployment closes the connection. (Author: @bflad)
• The Amplitude and Sentry catalog entries now link to their own MCP docs #8410, #8594 - Both catalog entries now link directly to their provider's MCP documentation instead of a generic page. (Author: @cursor)

The organization setup wizard now only shows cards your recorded stack can actually use, instead of every card regardless of fit, and a new Set up Claude Desktop group covers plugin registration and the organization instruction for it. A Claude Cowork session's first turn now carries the signed-in Claude account, so it stops showing as anonymous when it reaches Speakeasy before the session's telemetry does. The project dashboard's session counts now match the Agent Sessions list they link to, instead of counting telemetry sessions that were never actually captured.

Features

• The setup wizard now hides cards your stack can't use #8783 - A card now shows only when one of its methods works with a vendor in your recorded stack, so an organization with Cursor sees Cursor's admin controls as its own card instead of bundled into a generic one, and the wizard copy names exactly which agents and integrations it covers. (Author: @subomi)
• A new Set up Claude Desktop group covers plugin registration #8790 - The setup wizard now has a dedicated group for Claude Desktop with two cards: plugin registration and the organization instruction. (Author: @subomi)
• Create marketplace folds into Distribute MCP servers #8796 - The wizard no longer has a separate Create marketplace card or Distribute MCP servers group. Distribute MCP servers is now one card that publishes the plugin marketplace and lets you choose which servers to distribute. Saved onboarding playbooks and older links move to the new card automatically. (Author: @subomi)
• Cowork sessions now show who's signed in from their first upload #8770 - Inside a Cowork VM, where no device agent runs, Speakeasy now reads the signed-in Claude account from the first transcript upload, so a session no longer shows as anonymous when its first turn reaches Speakeasy before telemetry does. (Author: @subomi)

Bug fixes

• Dashboard session counts now match the Agent Sessions list #8774 - The project dashboard's Sessions tile and Most Agent Sessions by User card now count the sessions actually shown on the Agent Sessions page, instead of telemetry session IDs that include sessions that were never captured. (Author: @adaam2)
• An agent session's owner now backfills correctly when telemetry arrives late #8769 - A session no longer shows as anonymous just because its first prompt arrived before identity telemetry did. Once telemetry names the person, Speakeasy fills in the owner, without ever replacing one already recorded or adding one to a session an agent key produced. (Author: @bradcypert)
• Typed MCP credential fields no longer clear when you switch tabs #8765 - Returning to the dashboard tab no longer clears what you typed into a server's client ID, client secret, or shared credential fields, and the issuer URL correction form now appears only when OAuth discovery actually fails. (Author: @qstearns)
• A page you can't view no longer drops the project switcher #8821 - A page you don't have permission to view now keeps the top bar in place, so the project switcher is always there to get you into a project you can open. With no accessible projects, it tells you to ask an admin to add you to one. (Author: @speakeasyforgebot)
• Assistant runtimes no longer flood the security log on every start and stop #8583 - A busy assistant no longer records a security event each time one of its sandboxes starts or stops; an agent's Credentials page now shows its running sandboxes as one "Assistant runtime" row with a count instead of a row per sandbox. (Author: @aa-wong)
• The organization setup screen's logo now links home #8797 - The Speakeasy logo at the top left of the setup screen now links to the organization home page. (Author: @speakeasyforgebot)

Signing in through your company's identity provider used to mean a fresh login every time the connection hit a blip: a rate limit, a temporary outage, or a refresh the provider rejected for a reason that had nothing to do with your token being dead. None of those force a new sign-in anymore. The platform keeps your saved connection and retries quietly in the background, so access comes back on its own once the underlying problem clears. More on this in Session length and refresh.

Features

• Company sign-in rides out transient refresh failures #8391 - A refresh rejection that doesn't say your token is dead, such as a misconfigured client or a temporary provider fault, no longer forces a new sign-in. The platform keeps your saved connection and retries every five minutes, so access returns on its own once the problem clears, or after 72 hours if the provider never gives a clear answer. (Author: @daviddanialy)

Bug fixes

• A dropped connection no longer breaks an in-progress token refresh #8454 - If a client disconnects while the platform is refreshing its provider token, the refresh now finishes and saves the new token, so you don't have to reconnect. (Author: @daviddanialy)
• Temporary provider outages no longer look like sign-in failures #8399 - Affected routes now answer with a retryable error, and sign-in, connect, and gateway pages say the problem should clear, instead of asking you to re-authenticate. (Author: @daviddanialy)
• Public MCP servers now ask you to reconnect instead of failing silently #8455 - If you're using a public MCP server without signing in and your provider connection can no longer be renewed, you're now asked to reconnect. Before, every request failed until you removed and re-added the connection. (Author: @daviddanialy)
• Sign-in refresh waits out provider rate limits #8555 - When an identity provider rate-limits a refresh, the platform now waits as long as its Retry-After header asks, up to five minutes, before trying again, instead of failing right away. (Author: @daviddanialy)
• Sign-in with Zoom and similar providers no longer fails on a metadata quirk #8648 - Providers whose OAuth metadata doesn't advertise RFC 9207 iss support, but whose OpenID metadata does, no longer fail with an unexpected-issuer error. (Author: @bflad)
• A zero or unreadable token lifetime no longer shows as expired #8385 - A sign-in where the provider reports a zero, negative, or unreadable token lifetime now works instead of appearing expired the moment you connect. (Author: @daviddanialy)
• The consent tool picker now loads for company sign-ins #8556 - People who connect through their company's identity provider can now see and choose a server's tools on the consent screen before giving access, the same as everyone else. (Author: @daviddanialy)
• Changing one MCP server's sign-in no longer breaks another server's #8672 - Saving a server's User Identity no longer removes the sign-in client that other servers on the same issuer use. Turning User Identity off now fully removes only that server's own clients, in every case. (Author: @bflad)
• An invited role now applies even to an existing membership #8647 - If your identity provider returns someone who's already a member but without the role they were invited with, the platform now applies that role instead of leaving it unchanged. (Author: @svadrutk)
• New organizations no longer get an org-wide sign-in they didn't set up #8644 - New organizations used to get an organization-wide sign-in at signup, which tied every new MCP server's upstream client to it and could show one server another's client. An admin now sets this up deliberately, and the Organization Gateway isn't available until they do. (Author: @daviddanialy)
• Upstream-auth enforcement resolves credentials and consent correctly #8615 #8643 - In organizations that enforce upstream auth, every caller now gets its upstream credential from what the server actually offers, instead of from whatever its sign-in happens to link; people whose credential had outdated header copies, or who could previously only fall back to company sign-in, now keep working. Gateway consent is decided the same way, so you can connect a server whose personal sign-in isn't linked to the gateway. (Author: @danielkov)
• A stale "no sign-in needed" gateway now explains what to do #8390 - If a gateway server starts requiring sign-in after you approved it as needing none, calling it now tells you to reconnect the gateway in your AI app, or ask an administrator, instead of failing without explanation. (Author: @daviddanialy)
• Signing out everywhere also revokes your chat tokens #8174 - Chat tokens derived from earlier dashboard sessions, including access to chat attachments and signed attachment URLs, are now revoked when you sign out everywhere. (Author: @bflad)

Two changes close real exposure paths this release: speakeasy auth can no longer be tricked into accepting a key for another organization through its local callback, and a chat attachment can no longer run as script inside your dashboard. On the access side, granting a sensitive permission now gets a review step that says exactly what the new holders gain, and administrators can hand out a scope for a few hours without touching anyone's role. More on this in speakeasy auth and Roles and Permissions.

Features

• CLI sign-in no longer accepts a swapped-in API key #7856 - speakeasy auth now exchanges a short-lived, single-use code for your API key instead of receiving the key directly on its local callback, so a key for another organization can no longer be substituted through that callback, and a process that reads the callback gets nothing usable. The callback also carries a single-use state token, so a stray or forged callback is rejected without ending your real login. (Author: @speakeasyforgebot)
• Chat attachments can no longer run script in your dashboard #7866 - Opening an HTML, SVG, XML, or other active attachment in chat now downloads it instead of opening it in a new tab, and every attachment is now served with a strict content-security policy and a nosniff header. Viewing an image or playing back audio you attached works exactly as before. (Author: @speakeasyforgebot)
• Sensitive permission grants now get a review step #8463 - Adding a permission to a role, or adding members or agents to a role that already grants a sensitive one, opens a review listing what's added, what the new holders gain, and a confirmation when any of it exposes other members' activity or allows destructive changes. Manage Roles and Grant Access show the same preview before you assign a role to someone. (Author: @dennnis-ez)
• Grant a scope for a few hours without changing anyone's role #8416 - Administrators can give a member, a role, an agent, or everyone a scope for between five minutes and 24 hours, such as an hour of chat:read for an investigation. The grant expires on its own, with no role change to undo and no sign-out required. This ships as an API (access.createTemporaryGrant and related calls); there's no dashboard UI for it yet. (Author: @tgmendes)

Bug fixes

• Removing assistant permissions from a built-in role now actually revokes access #7857 - Removing every assistant permission from the built-in Admin or Member role now revokes assistant access for its members, instead of leaving earlier access in place. (Author: @speakeasyforgebot)
• Reading an environment's values now requires its own permission #7863 - Selecting an environment whose values reach tool code, whether for direct tool invocation, a toolset's default environment, or an assistant's per-server environment, now requires environment:read on that specific environment, not just project or MCP write access. (Author: @speakeasyforgebot)
• Team Access saves no longer fail over a deleted agent #8596 - Saving a server's Team Access or an auth client's access no longer fails with "unknown principal" when a rule names an agent that was deleted. Rules for deleted agents are removed automatically, and deleting an agent now removes its rules everywhere. (Author: @adaam2)

Before you delete, disable, or reconfigure an MCP server, the confirmation now shows who's actively connected and when they last used it, so a routine change doesn't quietly cut someone off. Setting one up got clearer too: Platform MCP's setup banner and catalog card now name the exact step left instead of a generic "Finish setup." More on this in MCP Catalog and Tool Logs.

Features

• See who's connected before a breaking MCP server change #8432 - Deleting a server, turning it off, changing its sign-in, removing its upstream authorization server, or changing one of its addresses now shows a confirmation listing who holds an active connection and when each one last used it, with shared sign-ins called out, before you commit. (Author: @chase-crumbaugh)
• Setup banners and the catalog card name the exact step left #8676 #8607 - The Platform MCP card's setup link, and a banner on the MCP server's settings page, now say precisely what's left: add an API key, set up the OAuth client your team signs in with, or just sign in. Once it's done, the banner says the server is ready to use instead of always saying "Finish setup." (Author: @adaam2)
• Tool names read in plain language in Codex and other clients #8595 - MCP clients such as Codex now show plain-language titles for tool search, tool details, run, and code-mode tools, for catalog tools that used to say "Reviewed," and for the feedback tool, instead of raw internal names. The underlying tool names are unchanged. (Author: @adaam2)
• Gateway instructions tell an agent what it can reach before it searches #8654 - Gateway instructions now open with one line naming the servers the caller can use, so agents that load tools on demand, such as Codex, know what the gateway reaches up front. The line stays under 250 characters and ends with a count when servers don't fit; gateways with their own custom instructions keep them as written. (Author: @daviddanialy)
• Tool Logs names and links the real gateway behind a call #8565 #8608 - A tool call that reached an agent gateway or the organization gateway now shows that gateway's actual name and links to its own page (the agent's Permissions tab, or the Organization Gateway page) instead of a raw ID or a stored-gateway page with nothing on it. Tool Logs now names every gateway a call went through, including ones in other projects. (Author: @mfbx9da4)
• MCP client names can be forwarded to the provider, opt-in #8629 #8628 - Remote session clients can now send the connecting MCP client's self-reported name to the provider as speakeasy_client_name during authorization. It's off by default, and only sent for anonymous sessions. (Author: @daviddanialy)

Bug fixes

• Inspect now lists every tool, including ones you can't use #8600 - The Inspect tab now shows a server's whole tool catalog, split into Available and "Not available," instead of silently filtering to only what your own access includes. Viewing or syncing the tab no longer adds or removes recorded tools based on one person's access. (Author: @danielkov)
• Tool-blocking policies now cover tools the platform hasn't seen yet #8599 - Rules that block MCP tools by type, like "block destructive tools," now apply to tools on remote MCP servers that haven't been recorded yet, instead of depending on someone first opening the server in the dashboard. A call is refused if the tool can't be checked. (Author: @danielkov)
• Large tool inventories get a clear size error instead of a retry loop #8673 - Consent capture, gateway serving, explicit selections, and related paths now share one 10,000-tool budget. An inventory over that limit shows an actionable administrator-facing error instead of asking you to retry. (Author: @adaam2)
• OpenClaw calls through a gateway are classified correctly #8585 #8569 - OpenClaw's MCP tool calls now show as Shadow MCP calls in Tool Logs, named after the server they reached, instead of as local tools; and calls that actually reached a Speakeasy gateway now show as Gateway calls instead of Shadow MCP calls, so a gateway named "speakeasy" no longer looks like an unrelated third-party server. (Author: @mfbx9da4)
• OpenClaw and Kit prompt events no longer inflate tool-call counts #8559 - Prompt and session events from hook-based agents such as OpenClaw and Kit no longer count as tool calls, including rows stored before this change. (Author: @mfbx9da4)
• OpenClaw cron sessions get a readable title #8561 - OpenClaw cron sessions are now titled "Cron: <job name>" instead of showing the raw cron envelope, including sessions stored before this change. (Author: @mfbx9da4)
• Failed gateway tool calls are now logged, with clearer errors #8558 - Gateway tool calls that fail before dispatch now write a failed tool call row instead of disappearing from the log, and functions that fail with unset environment variables now say which ones are missing. (Author: @mfbx9da4)
• Platform tools work when called through a gateway #8545 - Platform tools such as Slack now run when an agent or organization gateway calls them through execute_tool, instead of failing with "platform tool requires project auth context." (Author: @mfbx9da4)

An agent's identity page now tells you whose credential is actually making each call, not just who set the connection up once. The Activity tab shows every connection grant and what a permission change actually touched, and agent owners and editors can now open an agent's sessions without full admin access. More on this in Agent identity.

Features

• Agent pages show who they're acting on behalf of #8563 - The agent page now shows, per MCP server, whose credential signed each call, or that it's a shared credential, instead of "Authorized by" the key's issuer. Tool calls made with an agent API key no longer record the key's issuer as the person the agent acted for. (Author: @mfbx9da4)
• The Activity tab shows what a permission change actually touched #8612 - An agent's Activity tab now shows when someone grants it a connection or removes it, and names what each permission change touched, for example "mcp:connect · Acme Ops" instead of only "Added direct policy grant to agent." (Author: @mfbx9da4)
• Agent owners and editors can read an agent's sessions #8564 - Members with agent:write on an agent can now list and open that agent's sessions read-only, and the dashboard shows them its Sessions panel. (Author: @mfbx9da4)
• GitHub Actions workload identity adds a pull-request-only job type #8469 - The GitHub Actions setup offers a fourth job type, Pull requests, admitting only pull-request jobs that use no environment and refusing branch, tag, and environment jobs; forked pull requests get no token. This is rolling out behind the GitHub Actions workload-platform flag. (Author: @subomi)

Bug fixes

• An assistant's sessions now show under the agent it acts as #8537 - An agent that an assistant acts as now lists the assistant's sessions on its identity Overview and Sessions tabs, and in Agent Sessions filtered to that agent, instead of showing none. (Author: @mfbx9da4)
• Agent identity pages load faster #8682 - Agent identity pages no longer send one MCP server activity request per project; a new endpoint returns recent activity for every readable project in a single request, and the agents roster stops loading people-only data it never shows. (Author: @adaam2)

The device agent can now report its own crashes back to the platform, with an admin switch to turn that off, and Claude sessions started from the unified Chat/Cowork mode are now captured the same way Claude Code sessions are. Kit assistants also got a round of reliability fixes to their built-in tools and underlying runtimes. More on this in Device Agent and Anthropic.

Features

• Device agents can report their own crashes #8171 - Device agents, including ones running on servers and CI that authenticate with an agent key, can now report fatal crashes, recovered panics, and update rollbacks to the control plane. Reports are scrubbed on arrival and forwarded to monitoring as logs and a crash count; they aren't stored. (Author: @bradcypert)
• Org admins can turn device agent crash reports off #8172 - Crash reporting is on by default. Organization admins can now turn it off for their fleet from the device agent configuration page. (Author: @bradcypert)
• The device agent can fetch your personal Claude observability plugin #8392 - Personal Claude accounts don't get the observability plugin installed automatically in Claude's cloud environment. The device agent now offers a download of your organization's plugin, keyed to your own account, for you to upload at claude.ai, so sessions in Claude's cloud environment are recorded under you instead of going unattributed. Each download replaces your previous one, and the shared org install key can't be used for it. (Author: @bradcypert)
• Claude Cowork sessions are captured the same way Claude Code sessions are #8445 - Claude sessions started from the unified Chat/Cowork mode are now captured: the observability plugin uploads new transcript lines whenever a turn finishes, and the platform stores them as the session's chat history. Policy enforcement stays specific to Claude Code; it doesn't apply inside the Cowork VM yet. (Author: @subomi)

Bug fixes

• Device agent crash reports stay apart by binary #8453 - Crash reports from the daemon and the menu bar app no longer get merged together when they share a function name, and reports can now carry the device's OS release. (Author: @bradcypert)
• Device coverage no longer borrows another machine's report #8557 - A device is no longer credited with a policy report from another machine unless that report names no other serial and comes from the same OS family, so, for example, a MacBook no longer shows "Enforcing policy" because the same person's Windows machine reported. (Author: @bradcypert)
• Kit assistants get built-in Speakeasy tools, more reliably #8459 #8475 - Kit assistants can now use built-in Speakeasy tools, including replying in Slack threads, alongside their attached MCP servers. A Kit runtime that can no longer serve turns is replaced automatically on the next message instead of refusing every turn, and slow sandbox startups no longer abort the runtime partway through. (Author: @danielkov)
• Kit picks up new conversations cleanly after a runtime swap #8430 - Kit assistants now reply to new Slack threads and to conversations that started before a runtime was replaced; a fresh session in a conversation with earlier turns is told that earlier messages are unavailable, instead of the turn failing outright. (Author: @danielkov)
• Retired Kit runtimes clean up promptly #8536 - Sandbox resources and workload credentials for a retired Kit runtime are now withdrawn within about an hour, even when the assistant stays busy. (Author: @danielkov)
• Kit assistants on GKE stop getting stuck mid-checkpoint #8440 - Idle Kit assistants on managed GKE now checkpoint and stop cleanly instead of staying stuck mid-checkpoint and refusing new turns. (Author: @danielkov)
• Kit can run without a separate authentication host #8447 - Kit assistants can now run on deployments without a separate authentication host; their workload issuer falls back to the server URL instead of refusing to start. (Author: @danielkov)
• The project home page loads faster #8684 - The project home page now makes fewer requests to load. (Author: @adaam2)

Connecting to an MCP server that offers more than one way to sign in upstream used to mean guessing which one applied. In organizations that enforce typed upstream authentication, every way of connecting now asks: the consent screen, an agent key at issue time, an assistant per trigger, and an app or workload signing in without a browser. Administrators can create credentials once and offer them on as many servers as they need, and a long list of enforcement fixes closes the gaps between how each surface checks and records the choice. More on this in Upstream credentials.

Features

• Pick an upstream credential from the consent screen — When a server offers several upstream credentials you may use, connecting now shows a choice instead of picking for you: an identity-provider sign-in, a shared credential by name, your own account, or your app's own credential, preselecting whichever you approved there last. A credential you may not use reads "No access" instead of offering a connection that cannot work. (#8038, @danielkov)
• Assistants use your own connection when they act for you — When an assistant acts for a person instead of for nobody, a server that uses that person's own account now signs in with their connection, not the assistant owner's. If you have not connected yet, the assistant sends you a private link that works only for you, while signed in, for 15 minutes. (#8044, @danielkov)
• Choose an assistant's upstream credential per server and trigger — Open an assistant's Identity settings to set which credential it uses on each MCP server it reaches, separately for turns that act for a person and turns that act for nobody. Turns already running keep the credential they started with, and every change is recorded in the audit log. (#8043, @danielkov)
• Choose the shared credential an agent key uses, per server — Creating an agent key for a server with several shared credentials now asks which one it should use there, and the key can't be issued until you choose. A rotated key keeps its choices, and service accounts now serve an agent the same way they serve a person. (#8040, @danielkov)
• Choose credentials for apps and workloads that sign in without a browser — A token request can now name the credential for each server it reaches. Without one, the session uses the credential an admin chose for that app, or the single credential the caller can use; with several candidates and no choice, the request fails clearly instead of guessing. (#8042, @danielkov)
• Create and share upstream credentials across servers — Administrators can create a personal connection, a service account, a static credential with stored headers, or a pass-through of a caller's header, then offer an existing credential on another server instead of recreating it. Rotating a credential's headers no longer requires re-entering secret values that are not changing, and every change is audited. (#8036, @danielkov)
• MCP server settings show one upstream identity surface — Organizations enforcing typed upstream authentication see the credential list under Identity; other organizations keep the legacy Identity panel, so server settings show only what applies to you. (#8371, @danielkov)

Bug fixes

• Gateway members added after you signed in work without reconnecting — A server added to a gateway after you connected now works right away when nothing is left to choose, such as no auth needed or one ready credential, instead of asking you to reconnect and pick. (#8039, @danielkov)
• Admin and Member roles include permission to use MCP auth clients — The built-in roles now grant use of MCP auth clients alongside permission to connect, and API key policies can grant use of every auth client instead of naming each one. (#8283, @danielkov)
• Upstream credential changes publish atomically — A configuration change can no longer leave a server half-updated and unusable until a later repair; credential-header and Enterprise Managed Authorization choices stay in step with normal configuration changes. (#8275, @danielkov)
• Agent gateway requests stay bound to your chosen credential — A missing, revoked, or replaced credential attachment is now refused instead of falling back to an anonymous upstream request. (#8276, @danielkov)
• Agent keys get the same credential checks on direct endpoints — An agent API key calling an MCP server's own endpoint now gets the same credential checks as through its agent gateway, so a blocked credential or missing permission is refused there too. (#8355, @danielkov)
• Admin-added static credentials are named correctly in connection choices — Connecting to a server whose only credential is an admin-added static credential now records that credential, so enforcing organizations accept the connection instead of asking you to reconnect. (#8353, @danielkov)
• Gateways report a credential-only server as not signed in — A gateway now reports a member that needs a credential, such as a static credential, as not signed in when you hold none, instead of saying no sign-in is needed. (#8365, @danielkov)
• Whether a server needs upstream sign-in now follows from its credentials — This is derived from the server's auth clients instead of a separate toggle; the old "Needs credentials / Needs none" setting is deprecated and no longer changes anything. (#8329, @danielkov)
• Legacy identity pages keep upstream credentials in step — Removing or changing a client through the older organization identity pages now updates every affected server's upstream credentials immediately, instead of waiting on a later backfill. (#8417, @danielkov)
• Agent API keys reach servers added in Edit — Agents running on an API key no longer stay stuck on their old gateway after you edit them; servers added in Edit now reach the keys they run with, as they already did for workload identity agents. (#8372, @mfbx9da4)
• Tool call logs show which credential signed in — An agent's gateway tool calls now show how Speakeasy signed in upstream: your connection, a teammate's connection, or a shared credential, instead of always crediting the key's creator. (#8370, @mfbx9da4)
• Agent MCP connections show every way an agent signs in — API keys and federated workload sign-ins now show alongside MCP sign-ins, with when a key was last used. (#8309, @mfbx9da4)
• "All servers" agent keys reach servers added later — An agent key issued with "All servers" now reaches MCP servers added after the key was issued, instead of only the servers that existed at the time. (#8341, @mfbx9da4)
• Organization admins can bind shared clients on organization-level servers — Linking or removing an organization-owned identity provider client on a server whose sign-in is organization-level used to always fail; organization admins can now save that change directly. (#8274, @daviddanialy)
• Upstream OAuth migration status reflects settled associations — A gateway member is no longer flagged as needing a client once an administrator has already associated exactly one of the gateway's clients with it. (#8352, @danielkov)

Okta issues its ID-JAG tokens without the resource claim the platform used to require, so every inbound exchange from Okta was rejected until now. Inbound EMA accepts that shape directly, organization admins can set up and inspect the trust relationship without engineering help, and Okta connections ask for a smaller set of permissions than before. More on this in Enterprise Managed Auth and Connect Okta.

Features

• Okta's ID-JAGs now sign in to MCP servers — Inbound EMA accepts ID-JAGs with no resource claim, the shape Okta issues. The token request names the MCP server directly, and the session works only for that server. An inbound-only trust link now needs an identity provider with a JWKS URL. (#8185, @daviddanialy)
• ID-JAG sign-in follows your identity provider's client policy — ID-JAG exchanges now accept only clients your issuer's existing admission settings allow; disabling admission stops the grant from being advertised at all, and every client refusal is logged and counted. On a shared authorization server, a request that names no resource is now routed by the token's own resource claim, so Codex can sign in against your organization gateway. (#8233, @daviddanialy)
• Manage inbound EMA trust from the Platform MCP — Organization admins can trust an identity provider for inbound enterprise-managed authorization, read the audience to configure, check whether directory sync is set up, and remove the trust, all without opening a ticket. Rejected ID-JAG exchanges now log their specific reason and are counted by outcome. (#8186, @daviddanialy)
• Okta connections request one scope instead of three — Speakeasy no longer requests okta.users.read or okta.groups.read, which it never used beyond verifying the connection; only okta.apps.read is requested now. (#8232, @daviddanialy)

Skills no longer have to ride along in a plugin to reach an agent. Gateways and hosted MCP servers can now serve the skills linked to them straight over the MCP Skills extension, so a connected agent lists, verifies, and loads them the same way it discovers tools, and every load is recorded as an activation. This is rolling out behind the skills-over-mcp flag. Link management and usage reporting ship alongside it, so you can see exactly what a given surface serves and when it was last loaded. More on this in Skills.

Features

• Gateways serve the skills linked to them over MCP — A stored gateway or your organization gateway now answers skills/list, skills/get, and skill reads with the skills linked to it, plus every skill linked to the member servers you reach through it. Rolling out behind the skills-over-mcp flag. (#8268, @simplesagar)
• Link skills to a server or gateway directly — New skill-links management lets you choose which skills an MCP server, a gateway, or your organization gateway serves over MCP, independent of plugin distribution. The Platform MCP gains matching link_skill_to_mcp and unlink_skill_from_mcp tools. (#7798, @simplesagar)
• Hosted MCP servers and the Platform MCP serve their own reviewed skills over MCP — Connected agents can list, verify, and load linked skills with skills/list, skills/get, and skill:// reads, and each load is recorded as an activation. Rolling out behind the skills-over-mcp flag. (#7749, @simplesagar)
• Match a loaded skill to the exact version an agent saw — Platform MCP skill version listings now include served_digest, the digest an agent sees when it loads that version over a hosted MCP server, so you can match a load in your logs to the exact version. (#7749, @simplesagar)
• Try linked skills in the dashboard playground — A chat session started from a signed-in dashboard session now sees the same skills the user does, and can list and load them from the playground. (#8269, @simplesagar)
• See when a skill was last loaded over MCP — Skills and skill distributions now report last_loaded_over_mcp_at, so a skill served only over MCP, with no plugin distribution, still shows its usage. (#7677, @simplesagar)
• Skill loads over MCP show up in your tool-usage logs — A skill read over a hosted MCP server now appears in tool-usage logs and the MCP & Tools summary, next to skills reported by hooks. (#7698, @simplesagar)

Bug fixes

• Re-linking a skill is now marked destructive — link_skill_to_mcp can change or clear the version a target serves, so it's now flagged destructive like unlink_skill_from_mcp; a link target also matches its ID regardless of letter case. (#8235, @simplesagar)

Organization admins can now create upstream credentials for an MCP server and offer the same one on several servers, instead of configuring each from scratch. When a server offers more than one, every path that connects to it now asks which to use: the consent screen a person sees, an agent key at issue time, an assistant's turns, and an app or workload signing in without a browser. The choice is checked again on every call, so a credential you're blocked from, or one that was turned off, stops working immediately rather than on the next reconnect. More on this in Upstream credentials.

Features

• Create and share upstream credentials across servers — Organization admins can add a personal connection, a service account, a static credential, or a header pass-through as a reusable credential, and offer an existing one on another server instead of recreating it. Rotating a credential's headers keeps secret values that aren't re-entered, and every change is audited. (#8036, @danielkov)
• Pick a credential on the consent screen — When a server offers several upstream credentials, the consent screen now shows the choice instead of defaulting to one, preselecting whatever you approved there last. A server you may not use on reads "No access," and one that still needs setup says so instead of offering a connection that can't work. (#8038, @danielkov)
• Agent keys can be issued with a chosen credential per server — Creating an agent key now lets you name which shared credential it uses on each server that offers more than one, and a rotated key keeps its choices. (#8040, @danielkov)
• Assistants choose their own upstream credentials — Open an assistant's Identity → Upstream credentials to set which credential its turns use on a given server, separately for turns that act for a person and turns that act for nobody. Turns already running keep the credential they started with. (#8043, @danielkov)
• An assistant acting for you now uses your own connection, not its owner's — When a server uses a person's own account, an assistant acting for that person now connects as them. If they haven't connected yet, the assistant sends a private link that works only for them, while signed in, and expires after 15 minutes. (#8044, @danielkov)
• Apps and workloads can select a credential without a browser — A token request can now name the server and credential it wants with upstream_auth_client=<server id>:<credential id>, or fall back to the credential an admin chose for that app. (#8042, @danielkov)
• Grant use of auth clients alongside connect access — The built-in Admin and Member roles, and API key policies, can now grant permission to use upstream auth clients the same way they grant permission to connect to MCP servers. (#8283, @danielkov)
• One settings surface for upstream identity — An MCP server's settings now show a single upstream identity view, listing its credentials where credential enforcement is on, instead of splitting the picture across two panels. (#8371, @danielkov)
• Trust an identity provider for inbound enterprise-managed authorization — Organization admins can trust an identity provider from the Platform MCP, see its audience and whether directory sync is set up, and remove the trust. Rejected ID-JAG exchanges now log their specific reason, and Okta's ID-JAGs, which carry no resource claim, are accepted and routed by their claim instead of being refused. (#8186, @daviddanialy)

Bug fixes

• Okta connections ask for fewer permissions — Speakeasy no longer requests okta.users.read or okta.groups.read when connecting Okta, keeping only the okta.apps.read scope it actually uses. (#8232, @daviddanialy)
• Organization admins can bind shared clients to org-level session issuers — Linking an organization-owned auth client to an MCP server's org-level user session issuer used to fail with no way around it; it now saves, and the change reaches every project that shares the issuer. (#8274, @qstearns)
• Upstream identity stays in step with the legacy provider pages — Removing a client from a server or organization, or deleting a platform client, now retires the upstream credentials those servers offered through it in the same save, instead of leaving them to show stale options. (#8417, @danielkov)
• Tool call history shows which credential actually signed in — A call made through an agent's gateway no longer reads as made on behalf of whoever issued the agent's key when a shared credential served it; it now names the credential that was used. (#8370, @mfbx9da4)
• "All servers" agent keys reach servers added later — An agent key or gateway issued with access to every server used to stay stuck on the servers that existed at issue time; both now pick up servers added afterward, including through an edit. (#8341, @mfbx9da4; #8372, @mfbx9da4)

A newly created hosted MCP server now works with credentials the moment it's created, instead of waiting on a separate enable step, and opening your organization's gateway URL in a browser shows real setup steps instead of a blank 404. Platform MCP also gets easier to live in day to day: it can use your own MCP servers without a second connection, let you use a server you just set up before sharing it with anyone else, and show inline cards in ChatGPT, Claude, and other MCP Apps clients. More on this in Organization and project gateways and Platform MCP.

Features

• New hosted MCP servers work right away — A newly created hosted server now starts private instead of disabled, so it can be used with credentials immediately instead of needing someone to enable it by hand. Only an organization's first server still joins the project's Default plugin automatically. (#7968, @speakeasyforgebot)
• Your organization's MCP gateway URL gets a landing page — Opening the gateway URL in a browser now shows the server URL and setup steps for Claude Code, Claude, Codex, Cursor, VS Code, opencode, ChatGPT, and other MCP clients, instead of a blank "404 Not Found." People outside the organization still see "Not found." (#8312, @danielkov)
• See organization gateway activity across every project — The Organization Gateway page's new Activity tab shows dispatched-call and error totals, calls over time, the discovery steps agents took, and calls by server; Platform MCP can read the same summary. (#8314, @danielkov)
• Use your own MCP servers through Platform MCP, no second connection — New tools reach the servers your organization gateway gives you, with your own upstream sign-ins, and search_my_tools finds the right tool across all of them in one call. Rolling out behind the platform-mcp-gateway-proxy flag. (#8271, @adaam2)
• Use a server you set up before sharing it — Once a server you added through Platform MCP is ready, you can use it from the same connection right away; putting it into a plugin to share with other people is now an optional last step instead of a required one. (#8310, @adaam2)
• Platform MCP shows inline cards in ChatGPT, Claude, and other MCP Apps clients — Adding a server shows the server, its project, that it stays private until added to a plugin, and the next step; connecting a sign-in provider shows a single "Sign in to <name>" button, and result cards now show the server's own logo instead of its first letter. (#8221, @adaam2)
• Turn off automatic syncing for one plugin — Each plugin now has a "Sync changes automatically" switch. While it's off, that plugin's changes wait until you click Sync changes, while every other plugin keeps syncing on its own. (#8150, @speakeasyforgebot)
• Manage a hosted server's address from Platform MCP — set_mcp_address and set_mcp_network_access now manage hosted MCP servers' endpoints under your dashboard's hosted address rules, and both return a preview of the exact change before applying it. (#8022, @daviddanialy)
• Share a captured coding session with a one-read link — Create a short-lived, one-read handoff link for one of your own captured coding sessions through an explicitly confirmed Platform MCP workflow. (#8395, @simplesagar)

Bug fixes

• Gateway tool discovery serves the members that answer — A member that's rate limited, briefly unreachable, or errors is now retried within the listing's three-second budget; a member that still can't be listed is left out instead of failing the whole listing, and the full tool inventory comes back in one response instead of paging. (#8107, @ThomasRooney)
• "Unknown" gateway member status now means not checked — Gateway instructions and list_servers now explain that "unknown" means Speakeasy hasn't checked the member yet, and point you to connection_status instead of reading as broken. (#8350, @mfbx9da4)
• Turning on the Organization Gateway takes one confirmation — Enabling the gateway now shows a single dialog recommending an access review instead of requiring the full review to load first. Organization admins can now always read a server's access rules, and the gateway page's endpoint box follows dark mode. (#7969, @chase-crumbaugh)
• Sharing a server to a plugin names the exact server — distribute_mcp_to_plugin now takes the server's ID and acts on that server, instead of whichever one your onboarding flow last selected. (#8259, @adaam2)
• Confirm before removing a server from a plugin — Platform MCP now asks you to confirm the exact project, server, and plugin before taking an MCP server out of a plugin. (#8260, @adaam2)
• Platform MCP sign-in stops asking for your organization twice — When you've already chosen an organization while signing in, or you belong to only one, Speakeasy now skips the organization picker and goes straight to the consent page. (#8405, @bflad)

Opening your Organization Gateway URL in a browser now shows who it's for and how to connect, instead of a blank 404, and admins get an Activity tab showing calls across every project. Adding a server through Platform MCP no longer requires a plugin first: it works from the connection you already have, and the step to share it is optional. More on this in Organization gateway and Platform MCP.

Features

• The Organization Gateway has a landing page — Opening the gateway's URL in a browser shows members the server address and setup steps for Claude Code, Claude, Codex, Cursor, VS Code, opencode, ChatGPT, and other MCP clients, and asks anyone signed out to sign in first. People outside the organization still see "Not found." (#8312, @danielkov)
• Turning on the Organization Gateway takes one confirmation — Enabling it now asks a single confirmation that recommends reviewing MCP assignments, instead of requiring the full assignment review to load first. Organization admins can also always read a server's access rules, so the review no longer fails for admins blocked from a server. (#7969, @chase-crumbaugh)
• The Organization Gateway gets an Activity tab — See calls dispatched through the gateway across every project: totals, errors, calls over time, discovery steps agents took, and calls by server. It's also in Command K as "Organization Gateway Activity," and Platform MCP can read the same summary. (#8314, @danielkov)
• Platform MCP no longer requires a plugin before you can use a server — Once a server you added is ready, you can use it right away from the same connection or get install steps for another app; sharing it with teammates through a plugin is now an optional last step. (#8310, @adaam2)
• Platform MCP shows an inline setup card in ChatGPT and Claude — Adding an MCP server shows the server, its project, and the next step right inside the chat, and connecting a sign-in provider shows one "Sign in to <name>" button. (#8221, @adaam2)
• OpenClaw sets up MCP and hooks from the agent install command — The install command now configures OpenClaw the same way it configures other clients: the agent gateway, the observability plugin with the agent's own key, and conversation access. (#8108, @speakeasyforgebot)
• New hosted MCP servers are usable right away — They now start private instead of disabled, so you can connect credentials and use a server as soon as it's created; only an organization's first server still joins the Default plugin automatically. Platform MCP's set_mcp_address and set_mcp_network_access can now also manage a hosted server's endpoints and network access directly, and preview the exact change before confirming it. (#7968, @speakeasyforgebot; #8022, @daviddanialy)
• Share a captured coding session with a one-read link — Platform MCP's create_session_handoff_link mints a short-lived, burn-after-read link to one of your own captured sessions, after you confirm the exact session and lifetime shown. (#8395, @simplesagar)
• Device agents report whether they're enforcing their served policy — Each active device now carries a policy state of attested, outdated, unreported, or halted, and coverage counts break devices down by that state. An agent's MCP connections also show every way it signs in, including API keys and workload federation, not only MCP sign-ins. (#8116, @bradcypert; #8117, @bradcypert; #8309, @mfbx9da4)
• Security activity gets its own audit log — The audit log shows configuration changes by default and can switch to security activity, such as an agent admitting its own workload identity, with consecutive same-day entries grouped together. (#8238, @aa-wong)
• Each plugin gets a "sync changes automatically" switch — Turn it off in a plugin's Create dialog or Settings tab to hold its changes at the last published version until you click "Sync changes," while every other plugin keeps syncing on its own. (#8150, @speakeasyforgebot)
• Agent setup commands can be run more than once — A setup command now works until its code expires 15 minutes after it was generated, instead of being spent by the first fetch. (#8278, @mfbx9da4)
• Use your own MCP servers through Platform MCP, rolling out behind a flag — list_my_servers, search_my_tools, describe_tools, and execute_tool reach the servers your organization gateway already gives you, with your own upstream sign-ins, with no second connection to set up. (#8271, @adaam2)
• MCP servers and gateways can serve their linked skills directly, rolling out behind a flag — Connected agents can list, verify, and load a server's skills with skills/list, skills/get, and skill:// reads, and each load is recorded as an activation. (#8268, @simplesagar)
• GitHub Actions workload identity, rolling out behind a flag — Where enabled, an agent's credential can be GitHub Actions: name a repository, choose which jobs may sign in as the agent (a whole repository, one branch, or one environment), and the device agent action handles the rest. Everywhere else it's listed under "Coming soon." (#8273, @subomi; #8418, @subomi)

Bug fixes

• Pay-as-you-go checkout works again — Starting pay as you go from the embedded Stripe Checkout form had stopped working; it's fixed. (#8284, @alx-xo)
• A slow gateway member no longer breaks the whole tool listing — Direct tool discovery now returns the full inventory in one response and retries a member that's rate-limited or briefly unreachable within its time budget; a member that still can't answer is left out instead of invalidating the listing. (#8107, @ThomasRooney)
• Removing a server from a plugin now asks for confirmation — Taking an MCP server out of a plugin used to happen immediately; it now confirms the exact project, server, and plugin first. (#8260, @adaam2)
• An unchecked gateway member reads as "not checked," not broken — The gateway now explains that an "unknown" member status means Speakeasy hasn't checked it yet, and points to connection status to check sign-in. (#8350, @mfbx9da4)
• OpenClaw CLI commands no longer hang after installing the plugin — The observability plugin now starts its hooks process on first use instead of when OpenClaw loads, so openclaw plugins install and other commands no longer wait on it. (#8347, @mfbx9da4)
• The agent install hooks self-test no longer leaves a stray session — The self-test used to create an empty "New Chat" session and tool call under every new agent; it now gets answered without being recorded. (#8349, @mfbx9da4)
• Kit assistants on managed GKE start and respond reliably again — Sandbox containers now request enough memory to pass the cluster's admission policy, and the server finds a sandbox's pod even when the cluster doesn't label it with its claim, instead of timing out. (#8421, @danielkov; #8425, @danielkov)
• Slack webhooks reject spoofed verification handshakes — The URL verification handshake is now treated as challenge-only and recognized solely on application/json requests, so a request that skips signature verification can no longer be ingested as a real event. (#7854, @speakeasyforgebot)
• Platform MCP's plugin tool names the server it acts on — distribute_mcp_to_plugin now takes the server's ID, so it acts on and reports the server you meant instead of whatever setup selected last. (#8259, @adaam2)
• Platform MCP sign-in no longer asks you to pick an organization twice — If you already chose an organization while signing in, or belong to only one, Speakeasy now skips the picker and goes straight to the consent page. (#8405, @bflad)
• The agent install command only asks to store the agent key when it's needed — It now prompts to save SPEAKEASY_AGENT_KEY only when it configured Claude Code or Codex, which read the key from the environment; an OpenClaw-only install no longer shows that note. (#8348, @mfbx9da4)

Starting pay as you go no longer sends you to a separate checkout page: an embedded Stripe Checkout form mounts right on the billing page. Security and IT admins get a clearer picture too, with device coverage that reports whether a device is actually enforcing the policy Speakeasy served it, and a security audit log that's now separate from configuration changes. More on this in Billing and Device Agent.

Features

• Start pay as you go from an embedded checkout — Start pay as you go without leaving the billing page: the checkout endpoint returns the client secret and publishable key an embedded Stripe Checkout form mounts with. (#8284, @alx-xo)
• Device agents report the policy they actually enforce — Each device now reports the policy version it applies, every tool's enforcement outcome, its agent version, and its update posture; Speakeasy stores the latest report per user per machine so a device's attested state can be checked against what was served to it. (#8116, @bradcypert)
• Device coverage shows whether policy is actually enforced — Every active device now carries a policy state of attested, outdated, unreported, or halted, coverage counts break down by those states, and you can filter managed devices by them. A fresh report also counts as liveness, so a halted device that stopped polling still shows as active instead of dropping out of coverage. (#8117, @bradcypert)
• Security activity gets its own audit log — The audit log shows configuration changes by default and switches to security activity, such as an agent's runtime admitting its own workload identity, with consecutive entries from the same agent grouped by day. (#8238, @aa-wong)
• The agent install command sets up OpenClaw too — The same one-line install now adds the agent gateway, installs the observability plugin with the agent's own key, and turns on conversation access, so connecting an agent to OpenClaw no longer needs separate manual steps. (#8108, @speakeasyforgebot)
• GitHub Actions is coming as a workload platform (rolling out to select organizations) — A guided setup lets a job in one repository sign in as an agent with its own GitHub token, through the Speakeasy device agent action, so CI jobs can call MCP servers and send hook events without a stored secret. It's listed under Coming soon for most organizations until a stable speakeasyd release supports it, and reaches organizations with the workload-platform-github-actions flag on first. (#8273, #8418, @subomi)

Bug fixes

• Slack webhook handshakes can no longer be forged into events — Slack trigger webhooks now treat the URL verification handshake as challenge-only: a request that skips signature verification as a handshake can never be ingested as a real event. (#7854, @speakeasyforgebot)
• Kit assistants on managed GKE respond again — The server now finds a Kit sandbox's pod through its assigned Sandbox when the cluster doesn't label pods with their claim, instead of waiting out the turn and retrying on a fresh runtime. (#8425, @danielkov)
• Kit assistants on managed GKE start again — Their sandbox containers now request enough memory to pass the cluster's admission policy, and a Kit resource budget that would be rejected now fails at startup instead of at first use. (#8421, @danielkov)
• Agent setup codes stay valid until they expire — An agent's one-line setup command can now be run more than once, up to 15 minutes after it's generated, instead of being spent by the first fetch. (#8278, @mfbx9da4)
• The agent install script only asks to store the key when needed — It now prints the note to store SPEAKEASY_AGENT_KEY only when it configured a client, such as Claude Code or Codex, that reads the key from the environment; an OpenClaw-only install skips it. (#8348, @mfbx9da4)
• OpenClaw CLI commands no longer hang after installing the plugin — The observability plugin's hooks process now starts on the first hook instead of when OpenClaw loads it, so openclaw plugins install and other CLI commands no longer stall. (#8347, @mfbx9da4)
• The install hooks self-test no longer leaves a fake session — The agent install script's hooks self-test no longer leaves an empty "New Chat" session and a tool call under every new agent. (#8349, @mfbx9da4)
• OpenClaw's Codex-harness turns capture the user's prompt — Turns that run on OpenClaw's Codex app-server harness now report the prompt that started them, which that harness doesn't otherwise fire an event for. (#8092, @mfbx9da4)
• New agent identities can send hook events right away — When its creator holds hook-ingestion permission, a new agent identity now gets it too, scoped to its project, instead of needing an admin to grant it separately afterward. (#8073, @speakeasyforgebot)

Putting several MCP servers behind one address no longer waits on a feature flag. Every organization can group servers into a gateway today, and gateways pick up two things single servers already had: a consent-screen tool picker and, for agents that need to work across a lot of tools at once, Code Mode. People connecting through a gateway can also hide the servers they don't use.

Features

• MCP gateways are available to every organization #8076 - The MCP page always lists gateways now, and Add a server always offers New gateway, so grouping servers behind one address no longer needs Speakeasy to flip a flag first. (Author: @ThomasRooney)
• Gateway consent gets the tool picker #6816 - Approving a gateway connection now offers All tools (live), All tools (frozen), or Specific tools, the same choice single MCP servers already had. Frozen and Specific selections serve from a fast cached catalog instead of refreshing every member's tools on each connection. (Author: @ThomasRooney)
• Switch a gateway to Code Mode #6978 - A gateway can expose one execute tool that runs short Python scripts with live tool search, schema lookups, and authorized calls across every hosted, remote, and tunneled member, instead of handing an agent every member's full tool catalog up front. (Author: @ThomasRooney)
• Hide the gateway servers you don't use #8139 - Hiding a server removes it from your own gateway tools without touching anyone else's access. The device agent's menu bar and a new hover icon on the consent page both read and set the same preference. (#8179, #8178, @daviddanialy)
• See which MCP servers still need sign-in #8001 - The device agent now reports your sign-in state for each MCP server in your plugins, with a link that signs in from the browser, or a link to request access when you don't have it. (Author: @bradcypert)

Bug fixes

• A gateway keeps its discovery mode until you reconnect #8095 - Changing a gateway's default discovery mode no longer swaps a connected client's tools mid-session; a tool call the current mode can't serve now says to reconnect instead of failing as an unknown tool. (Author: @ThomasRooney)

A risk policy could already flag or block a matching MCP tool call. Now it has a third option: hold the call until a named approver says yes, then let exactly one retry through. Approvers decide from Guardrails or straight from a Slack DM, and every project gets the MCP server an agent needs to ask for approval set up automatically. This is rolling out behind a feature flag; ask your account team to turn it on.

Features

• Require approval for tool calls #7726 - Guardrails gets a new policy use case: choose the tools it covers, name approvers as specific people or roles, then review held calls from a Tool approvals tab where each argument sits on its own row beside the agent's reason, with Approve and Deny. (#7712, #7713, @mfbx9da4)
• Approval requests arrive as Slack DMs #7728 - Each named approver gets a direct message from the Speakeasy app with the tool, the agent's reason, and every argument as its own field, plus Approve and Deny buttons that resolve the same request Guardrails shows. (Author: @mfbx9da4)
• Every project gets a built-in approvals server #7739 - Agents on the Default plugin can call request_approval right away. Speakeasy creates a dedicated <organization>-<project>-approvals server and adds it to the plugin automatically, so a team no longer has to wire one up by hand before approvals work. (Author: @mfbx9da4)

Bug fixes

• Held calls on proxied servers come back as a usable result #7732 - A call waiting on approval now returns as a tool result marked isError, carrying the request token and the steps to request approval, instead of a JSON-RPC error that agents treat as a plain failure. (Author: @mfbx9da4)

Setting up a new MCP server through Platform MCP now takes fewer calls and less guessing, whichever client is asking. Clients with a tight tool budget, such as Codex Agent Plugins, get a small fixed surface instead of the full catalog, and a server added by URL now gets a name and address worth reading instead of the raw URL. More on this in Platform MCP.

Features

• One-click install steps per client #8212 - get_my_install_instructions now returns a ready path for each client: a one-click Cursor link, the claude mcp add command for Claude Code, a config.toml block and codex mcp login command for Codex, an opencode.json block, and a generic JSON config for everything else, with no credentials included. (Author: @adaam2)
• A lighter tool list for budget-constrained clients #8149 - Hosts that cap how many tools or how much context a server can use, such as Codex Agent Plugins, now see a small fixed surface, catalog search, a describe tool, a call tool, and execute when Code Mode is available, instead of roughly 150 tools, selected automatically per harness. (Author: @adaam2)
• First-run tools sit next to discovery #8210 - Catalog search, candidate inspection, adding a server, find_mcp, readiness checks, install instructions, and docs search now appear directly beside the discovery tools on hosts like Codex and ChatGPT, so the first few steps take one call instead of a search, a describe, and a call. (Author: @adaam2)
• Remote MCP servers get readable names and addresses #8222 - Adding a server by URL without a display name now names it after what the server reports about itself, or its host name, and derives its slug and address from that name instead of the raw URL. (Author: @adaam2)

Bug fixes

• Chat in to connect sign-in #8213 - When a server's OAuth client can be set up automatically, the agent now offers to connect sign-in right in chat instead of only pointing to the dashboard. (Author: @adaam2)
• Adding a server twice says so #8208 - Adding a server already in the project now reports it as already there instead of claiming it was newly added. (Author: @adaam2)
• Stale readiness checks refresh themselves #8209 - An expired readiness result is rechecked automatically instead of being reported as stale until a check is forced. (Author: @adaam2)
• Clearer sign-in and tool count reporting #8211 - Catalog search results leave out tool counts that aren't known instead of reporting zero, and describe how each server signs in in plain words. (Author: @adaam2)
• Docs search gets a name that matches what it searches #8203 - The setup-guide search tool is now search_speakeasy_docs, and hosts that see only the discovery tools are told to use it for how-to and setup questions. (Author: @adaam2)

Tool Logs filters now narrow to what's actually there as you apply them, and organization administrators get a ready-made Explore dashboard for what risk policies have caught. Alongside that: agent identities can borrow a personal connection instead of needing a shared credential, hosted MCP servers move onto one settings page, and admins get a single place to manage the credentials servers use upstream.

Features

• Tool Logs filter counts narrow as you filter #8148 - Each filter group now lists only the values that still have calls under the filters already applied, while its own values stay selectable. The time range moved next to the search bar, and the summary and timeline panel takes less vertical space. (Author: @adaam2)
• See who an agent acted for #7927 - A call an agent made on someone's behalf now reads "agent ↳ on behalf of <person>" in Tool Logs, and filtering by that person includes the agent's calls made for them. (Author: @adaam2)
• Delegate your personal connection to an agent, or block one from using it #8013 - An agent identity can now use a personal OAuth connection its owner, or another authorized editor, hands it, instead of requiring a shared credential. Anyone can also block a specific agent from their own connection without managing the agent, and "All servers" is offered only when every server is actually reachable with the agent owner's and your own permissions; agent bindings stay on the current connection as it's reauthenticated. (#7944, #8017, #8168, #8225, @mfbx9da4)
• Hosted MCP servers move onto the MCP server page #7942 - Settings that used to live on the toolset page, tools, resources, prompts, and team access, are now on the server's own page like every other server kind, and old toolset links redirect automatically. (#8009, #8021, #8016, @daviddanialy)
• A Security & risk dashboard for organization admins #7908 - Explore gains a risk_findings dataset, counts only, never the matched values or the chats they came from, and a ready-made dashboard breaking findings down by category, rule, policy, agent, team, and person. (Author: @simplesagar)
• Explore gets Signal Intelligence #7693 - Query signal patterns across conversations through the same analytics API and Platform MCP tools, with exact session counts, top-session concentration, and comparisons against the previous window. (#7696, #7700, @disintegrator)
• Manage the credentials your MCP servers use upstream #7933 - Organization admins can list every upstream auth client, see which servers offer each one, rename, enable, or disable it, and decide who may use it, all from one place instead of each server's own settings. (#7934, @danielkov)
• A shared Connections view across gateways #7974 - See every upstream connection for project and Organization Gateways in one place, searchable by identity and filterable by server or provider, with authorization deadlines shown separately from token expiry. (Author: @bflad)
• Duplicate and correct remote session clients #7976 - Copy a client's settings to register a new one in one step, or fix a client's ID in place instead of deleting and recreating it; a corrected ID asks affected users to reconnect once. (#7980, @bflad)
• See the sessions your agent produced #8110 - Agent owners without chat:read can now see their own agent's sessions on the agent page's Overview and Sessions tabs, and chat.list accepts an agent_id filter. (Author: @speakeasyforgebot)
• Share an Okta org across organizations #8145 - More than one Speakeasy organization can now connect and verify the same Okta org, instead of the second one failing with "this Okta org is already connected to another organization." (Author: @qstearns)

Bug fixes

• Device agent enrollment no longer needs organization read access #8123 - Organization members can complete device-agent enrollment without also holding organization read access. (Author: @qstearns)
• Organization role changes apply even when WorkOS is early #7993 - A membership role update from WorkOS now applies within about a minute even when its webhook arrives before the event is readable, instead of waiting for the organization's next WorkOS event. (Author: @TristanSpeakEasy)

The Speakeasy Agent's menu bar can now show which MCP servers live inside each assigned plugin, with a server count per plugin that expands into the actual list and a link to a server's dashboard page when you can read it. Granting or revoking MCP access through a role, or changing which audience a server serves, now reaches devices within seconds instead of waiting for the next hourly republish. More on this in Device Agent.

Features

• The menu bar lists each plugin's MCP servers — agent.getPlugins now returns the servers inside every delivered plugin in their display order, so the Speakeasy Agent menu bar can show a server count per plugin row and expand it; a server's dashboard link appears only when you hold read access to it. (#7952, @bradcypert)
• The Speakeasy Platform MCP is listed in the official MCP registry — Agent clients and AI search that discover servers through registry.modelcontextprotocol.io can now find the Platform MCP as com.speakeasy.ai/platform. (#7597, @adaam2)
• Kit assistants can opt into a GKE-backed runtime (new assistants only) — Eligible new assistants with a persisted MCP attachment and issuer setup can run under an independent workload identity with its own inference credentials, instead of borrowing the authority of whoever started the conversation; existing assistants and conversations are not migrated. (#7711, @danielkov)

Bug fixes

• Role and audience changes reach devices in seconds, not hours — Changing a role's grants or an MCP server's audience now republishes the affected role plugins right away instead of waiting for the hourly republish sweep, so a newly granted or revoked server shows up on enrolled devices almost immediately. (#7967, @simplesagar)
• MCP tool calls that report an error now count as failed — A call that answers HTTP 200 with isError: true now counts as failed in MCP server health, Platform MCP diagnostics, and per-user error flags, instead of counting as a success. (#7778, @daviddanialy)
• The MCP servers list shows the right tool count again — The tool count on a hosted MCP server now counts only tools it still serves from the project's latest deployment, so tools from removed sources or renamed operations no longer inflate the number. (#7882, @daviddanialy)

Tool calls that answer with an in-band error inside an HTTP 200 now count as failed everywhere the platform reports on MCP health, so Tool Logs, Platform MCP diagnostics, and per-user error flags finally agree with what your agents actually saw. The MCP servers list also now counts only the tools a server still serves, so a removed source or a renamed operation no longer inflates its tool count. Plugin assignments gain an install mode per audience, so one team can be required to have a plugin while everyone else keeps it optional. More on this in Tool Logs.

Features

• Set a plugin's install mode per audience — Assignments now carry their own mode: Required, On by default, or Available, so a plugin can be mandatory for one team and optional, or off by default, for another instead of sharing one setting across every audience. (#7255, @bradcypert)
• The Speakeasy Platform MCP is listed in the official MCP registry — Any client that discovers servers through registry.modelcontextprotocol.io can now find the Platform MCP at com.speakeasy.ai/platform. (#7597, @adaam2)

Bug fixes

• Tool calls that return an in-band error now count as failed — A tool result with isError: true inside an HTTP 200 response used to read as a success; MCP server health, Platform MCP diagnostics, and per-user error flags now classify it as failed, matching how hook-observed tool errors already counted. (#7778, @daviddanialy)
• The MCP servers list shows how many tools a server actually serves — Its tool count now matches the toolset page: tools from a removed source or a renamed operation no longer inflate the number shown on server cards and table rows. (#7882, @daviddanialy)
• Role and audience changes reach devices in seconds, not hours — Changing a role's grants or an MCP server's audience now republishes the affected plugins right away, instead of waiting for the hourly republish sweep. (#7967, @simplesagar)
• The new-agent wizard no longer loses its draft on reload — Reloading the page past the first step used to open the Install step with an empty draft and a broken "Issue a key" button; it now restarts at the first step instead. (#7929, @adaam2)

Org Gateway now waits for an administrator to turn it on, and turning it on comes with a real audit trail: review every role's effective MCP access, inspect what each person can reach, and remove or block specific grants from Settings or Roles & Permissions. People who have already approved a client on one server behind a shared authorization server now skip the consent screen on another server under the same issuer, as long as nothing about their access changed. More on this in Organization gateway.

Features

• Org Gateway requires an administrator to opt in, with a full access review — Review organization-wide MCP access by role before enabling, inspect each person's effective assignments, remove server-specific grants or block role access, and open client-specific connection instructions from the Organization Gateway card or Roles & Permissions. (#7611, @chase-crumbaugh)
• Approvals carry over across servers behind a shared authorization server — An identified person's saved tool selection and session length now auto-apply to another server under the same issuer and OAuth client, with the browser checking current tools before any click; a new server, a changed tool inventory, or a missing permission still asks for full consent. (#7606, @bflad)
• Each MCP server on a shared sign-in can use its own upstream OAuth client — Servers and gateway members sign in through the client configured for them instead of one client shared by every server on the issuer, and the consent screen offers each server only its own clients. (#7653, @danielkov)
• Set up directory role mappings in bulk, and review what changed since (organization admins) — previewDirectoryRoleSetup and applyDirectoryRoleSetup map every directory group and attribute value to a role in one pass, and a new review queue raises directory changes that need a decision, a group with no role, a changed attribute value, or a mapped group that has gone from the directory, with email and webhook notifications once items have waited 15 minutes. (#7722, #7725, #7781, @TristanSpeakEasy)
• Directory mapping and member pages show more about where access comes from (organization admins) — Mappings report whether their source is still active or missing, and members list their directory groups and which mappings currently grant them a role, so a role reached through two groups shows both. (#7715, #7826, @TristanSpeakEasy)
• Search chats from the Platform MCP — search_chats and read_chat search messages by text, owner, or participant and read surrounding context, gated by chat:read and audit logged. (#7734, @ThomasRooney)
• Preview and confirm a deployment redeploy or rollback from the Platform MCP — redeploy_deployment retries or rolls back a whole project deployment with the existing authorization and audit workflow, and reuses the same deployment on a retried request instead of creating a duplicate. (#7900, @simplesagar)
• OAuth connection failures name the real reason — A failed login now shows the identity provider's standard OAuth error code, or says the provider was unreachable, instead of a generic "upstream token exchange failed"; a provider outage now answers with a retryable error instead of a flat failure. (#7618, @daviddanialy)
• Tunnel agent status reaches the dashboard (network administrators) — Connected tunnel agents, target network checks, and MCP request history now show in the dashboard; agents report aggregate HTTP progress without collecting payloads or making MCP calls. (#6874, @ThomasRooney)
• An MCP server's Identity settings flag a shared OAuth client — If a server's OAuth client also signs in other MCP servers, its User Identity settings now say so, since changing or rotating that client changes sign-in for all of them. (#7644, @danielkov)

Bug fixes

• Legacy Claude Code hook requests stop timing out — The endpoint now answers within five seconds using the organization's fail-open or fail-closed setting when a policy check runs long, instead of letting older curl-based hook scripts block with "HTTP 000"; the slower check still finishes in the background. (#7135, @mfbx9da4)
• A configured MCP server header can no longer read your Speakeasy credential — Creating or updating a header that sources from the caller's Authorization request header is now refused, since that header can carry the Speakeasy session credential and must not be forwarded to an upstream server under another name. (#7821, @daviddanialy)
• An MCP server's own URL is rejected as its OAuth client_id — The request now fails fast with a hint to check the client ID setting, instead of retrying and failing with a retryable error after fetching that URL as a metadata document. (#7862, @bflad)
• Risk policy checks look at only the latest exchange again — Anthropic inference hook verdicts no longer re-check a whole conversation, so long conversations stop timing out and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Directory role mappings can't exceed 20 roles per source, and inactive directories stop granting roles — Saving more than 20 roles on one group or attribute value now fails clearly, and roles mapped through a deleted directory no longer contribute to anyone's access. (#7829, #7313, @TristanSpeakEasy)
• A session moved between organization hosts keeps the right organization selected — Opening the dashboard on the legacy host no longer resets the organization you picked on your organization's own host. (#7915, @adaam2)
• Deleting a server no longer breaks a multi-server risk policy — Deleting an MCP server or gateway now removes it from the scope of every risk policy that also targets other servers, so those policies can still be saved; a policy left with no target is deleted, as before. (#7902, @daviddanialy)
• A custom domain that isn't verified and activated no longer breaks an MCP server's issued URLs — The Playground URL and the issuer of dashboard-minted session tokens now fall back to the server's platform endpoint, or to /mcp/{slug}, until the custom domain is ready. (#7753, @daviddanialy)
• The device agent's Windows installer link works again — The stable installer links moved from /v1/install/ to /rpc/install/, since production never routed the old path to the server and the Windows setup step was saving the dashboard's HTML instead of the installer. (#7916, @mfbx9da4)
• Hosted MCP servers list correctly again when their toolset is gone — Listing MCP servers no longer returns servers backed by a deleted toolset, the hosted server summary now includes the toolset's description, and server reads report whether any endpoint, including a custom domain still activating, actually routes to it. (#7754, @daviddanialy)