Changelog

Signing in through your company's identity provider used to mean a fresh login every time the connection hit a blip: a rate limit, a temporary outage, or a refresh the provider rejected for a reason that had nothing to do with your token being dead. None of those force a new sign-in anymore. The platform keeps your saved connection and retries quietly in the background, so access comes back on its own once the underlying problem clears. More on this in Session length and refresh.

Features

• Company sign-in rides out transient refresh failures #8391 - A refresh rejection that doesn't say your token is dead, such as a misconfigured client or a temporary provider fault, no longer forces a new sign-in. The platform keeps your saved connection and retries every five minutes, so access returns on its own once the problem clears, or after 72 hours if the provider never gives a clear answer. (Author: @daviddanialy)

Bug fixes

• A dropped connection no longer breaks an in-progress token refresh #8454 - If a client disconnects while the platform is refreshing its provider token, the refresh now finishes and saves the new token, so you don't have to reconnect. (Author: @daviddanialy)
• Temporary provider outages no longer look like sign-in failures #8399 - Affected routes now answer with a retryable error, and sign-in, connect, and gateway pages say the problem should clear, instead of asking you to re-authenticate. (Author: @daviddanialy)
• Public MCP servers now ask you to reconnect instead of failing silently #8455 - If you're using a public MCP server without signing in and your provider connection can no longer be renewed, you're now asked to reconnect. Before, every request failed until you removed and re-added the connection. (Author: @daviddanialy)
• Sign-in refresh waits out provider rate limits #8555 - When an identity provider rate-limits a refresh, the platform now waits as long as its Retry-After header asks, up to five minutes, before trying again, instead of failing right away. (Author: @daviddanialy)
• Sign-in with Zoom and similar providers no longer fails on a metadata quirk #8648 - Providers whose OAuth metadata doesn't advertise RFC 9207 iss support, but whose OpenID metadata does, no longer fail with an unexpected-issuer error. (Author: @bflad)
• A zero or unreadable token lifetime no longer shows as expired #8385 - A sign-in where the provider reports a zero, negative, or unreadable token lifetime now works instead of appearing expired the moment you connect. (Author: @daviddanialy)
• The consent tool picker now loads for company sign-ins #8556 - People who connect through their company's identity provider can now see and choose a server's tools on the consent screen before giving access, the same as everyone else. (Author: @daviddanialy)
• Changing one MCP server's sign-in no longer breaks another server's #8672 - Saving a server's User Identity no longer removes the sign-in client that other servers on the same issuer use. Turning User Identity off now fully removes only that server's own clients, in every case. (Author: @bflad)
• An invited role now applies even to an existing membership #8647 - If your identity provider returns someone who's already a member but without the role they were invited with, the platform now applies that role instead of leaving it unchanged. (Author: @svadrutk)
• New organizations no longer get an org-wide sign-in they didn't set up #8644 - New organizations used to get an organization-wide sign-in at signup, which tied every new MCP server's upstream client to it and could show one server another's client. An admin now sets this up deliberately, and the Organization Gateway isn't available until they do. (Author: @daviddanialy)
• Upstream-auth enforcement resolves credentials and consent correctly #8615 #8643 - In organizations that enforce upstream auth, every caller now gets its upstream credential from what the server actually offers, instead of from whatever its sign-in happens to link; people whose credential had outdated header copies, or who could previously only fall back to company sign-in, now keep working. Gateway consent is decided the same way, so you can connect a server whose personal sign-in isn't linked to the gateway. (Author: @danielkov)
• A stale "no sign-in needed" gateway now explains what to do #8390 - If a gateway server starts requiring sign-in after you approved it as needing none, calling it now tells you to reconnect the gateway in your AI app, or ask an administrator, instead of failing without explanation. (Author: @daviddanialy)
• Signing out everywhere also revokes your chat tokens #8174 - Chat tokens derived from earlier dashboard sessions, including access to chat attachments and signed attachment URLs, are now revoked when you sign out everywhere. (Author: @bflad)

Two changes close real exposure paths this release: speakeasy auth can no longer be tricked into accepting a key for another organization through its local callback, and a chat attachment can no longer run as script inside your dashboard. On the access side, granting a sensitive permission now gets a review step that says exactly what the new holders gain, and administrators can hand out a scope for a few hours without touching anyone's role. More on this in speakeasy auth and Roles and Permissions.

Features

• CLI sign-in no longer accepts a swapped-in API key #7856 - speakeasy auth now exchanges a short-lived, single-use code for your API key instead of receiving the key directly on its local callback, so a key for another organization can no longer be substituted through that callback, and a process that reads the callback gets nothing usable. The callback also carries a single-use state token, so a stray or forged callback is rejected without ending your real login. (Author: @speakeasyforgebot)
• Chat attachments can no longer run script in your dashboard #7866 - Opening an HTML, SVG, XML, or other active attachment in chat now downloads it instead of opening it in a new tab, and every attachment is now served with a strict content-security policy and a nosniff header. Viewing an image or playing back audio you attached works exactly as before. (Author: @speakeasyforgebot)
• Sensitive permission grants now get a review step #8463 - Adding a permission to a role, or adding members or agents to a role that already grants a sensitive one, opens a review listing what's added, what the new holders gain, and a confirmation when any of it exposes other members' activity or allows destructive changes. Manage Roles and Grant Access show the same preview before you assign a role to someone. (Author: @dennnis-ez)
• Grant a scope for a few hours without changing anyone's role #8416 - Administrators can give a member, a role, an agent, or everyone a scope for between five minutes and 24 hours, such as an hour of chat:read for an investigation. The grant expires on its own, with no role change to undo and no sign-out required. This ships as an API (access.createTemporaryGrant and related calls); there's no dashboard UI for it yet. (Author: @tgmendes)

Bug fixes

• Removing assistant permissions from a built-in role now actually revokes access #7857 - Removing every assistant permission from the built-in Admin or Member role now revokes assistant access for its members, instead of leaving earlier access in place. (Author: @speakeasyforgebot)
• Reading an environment's values now requires its own permission #7863 - Selecting an environment whose values reach tool code, whether for direct tool invocation, a toolset's default environment, or an assistant's per-server environment, now requires environment:read on that specific environment, not just project or MCP write access. (Author: @speakeasyforgebot)
• Team Access saves no longer fail over a deleted agent #8596 - Saving a server's Team Access or an auth client's access no longer fails with "unknown principal" when a rule names an agent that was deleted. Rules for deleted agents are removed automatically, and deleting an agent now removes its rules everywhere. (Author: @adaam2)

Before you delete, disable, or reconfigure an MCP server, the confirmation now shows who's actively connected and when they last used it, so a routine change doesn't quietly cut someone off. Setting one up got clearer too: Platform MCP's setup banner and catalog card now name the exact step left instead of a generic "Finish setup." More on this in MCP Catalog and Tool Logs.

Features

• See who's connected before a breaking MCP server change #8432 - Deleting a server, turning it off, changing its sign-in, removing its upstream authorization server, or changing one of its addresses now shows a confirmation listing who holds an active connection and when each one last used it, with shared sign-ins called out, before you commit. (Author: @chase-crumbaugh)
• Setup banners and the catalog card name the exact step left #8676 #8607 - The Platform MCP card's setup link, and a banner on the MCP server's settings page, now say precisely what's left: add an API key, set up the OAuth client your team signs in with, or just sign in. Once it's done, the banner says the server is ready to use instead of always saying "Finish setup." (Author: @adaam2)
• Tool names read in plain language in Codex and other clients #8595 - MCP clients such as Codex now show plain-language titles for tool search, tool details, run, and code-mode tools, for catalog tools that used to say "Reviewed," and for the feedback tool, instead of raw internal names. The underlying tool names are unchanged. (Author: @adaam2)
• Gateway instructions tell an agent what it can reach before it searches #8654 - Gateway instructions now open with one line naming the servers the caller can use, so agents that load tools on demand, such as Codex, know what the gateway reaches up front. The line stays under 250 characters and ends with a count when servers don't fit; gateways with their own custom instructions keep them as written. (Author: @daviddanialy)
• Tool Logs names and links the real gateway behind a call #8565 #8608 - A tool call that reached an agent gateway or the organization gateway now shows that gateway's actual name and links to its own page (the agent's Permissions tab, or the Organization Gateway page) instead of a raw ID or a stored-gateway page with nothing on it. Tool Logs now names every gateway a call went through, including ones in other projects. (Author: @mfbx9da4)
• MCP client names can be forwarded to the provider, opt-in #8629 #8628 - Remote session clients can now send the connecting MCP client's self-reported name to the provider as speakeasy_client_name during authorization. It's off by default, and only sent for anonymous sessions. (Author: @daviddanialy)

Bug fixes

• Inspect now lists every tool, including ones you can't use #8600 - The Inspect tab now shows a server's whole tool catalog, split into Available and "Not available," instead of silently filtering to only what your own access includes. Viewing or syncing the tab no longer adds or removes recorded tools based on one person's access. (Author: @danielkov)
• Tool-blocking policies now cover tools the platform hasn't seen yet #8599 - Rules that block MCP tools by type, like "block destructive tools," now apply to tools on remote MCP servers that haven't been recorded yet, instead of depending on someone first opening the server in the dashboard. A call is refused if the tool can't be checked. (Author: @danielkov)
• Large tool inventories get a clear size error instead of a retry loop #8673 - Consent capture, gateway serving, explicit selections, and related paths now share one 10,000-tool budget. An inventory over that limit shows an actionable administrator-facing error instead of asking you to retry. (Author: @adaam2)
• OpenClaw calls through a gateway are classified correctly #8585 #8569 - OpenClaw's MCP tool calls now show as Shadow MCP calls in Tool Logs, named after the server they reached, instead of as local tools; and calls that actually reached a Speakeasy gateway now show as Gateway calls instead of Shadow MCP calls, so a gateway named "speakeasy" no longer looks like an unrelated third-party server. (Author: @mfbx9da4)
• OpenClaw and Kit prompt events no longer inflate tool-call counts #8559 - Prompt and session events from hook-based agents such as OpenClaw and Kit no longer count as tool calls, including rows stored before this change. (Author: @mfbx9da4)
• OpenClaw cron sessions get a readable title #8561 - OpenClaw cron sessions are now titled "Cron: <job name>" instead of showing the raw cron envelope, including sessions stored before this change. (Author: @mfbx9da4)
• Failed gateway tool calls are now logged, with clearer errors #8558 - Gateway tool calls that fail before dispatch now write a failed tool call row instead of disappearing from the log, and functions that fail with unset environment variables now say which ones are missing. (Author: @mfbx9da4)
• Platform tools work when called through a gateway #8545 - Platform tools such as Slack now run when an agent or organization gateway calls them through execute_tool, instead of failing with "platform tool requires project auth context." (Author: @mfbx9da4)

An agent's identity page now tells you whose credential is actually making each call, not just who set the connection up once. The Activity tab shows every connection grant and what a permission change actually touched, and agent owners and editors can now open an agent's sessions without full admin access. More on this in Agent identity.

Features

• Agent pages show who they're acting on behalf of #8563 - The agent page now shows, per MCP server, whose credential signed each call, or that it's a shared credential, instead of "Authorized by" the key's issuer. Tool calls made with an agent API key no longer record the key's issuer as the person the agent acted for. (Author: @mfbx9da4)
• The Activity tab shows what a permission change actually touched #8612 - An agent's Activity tab now shows when someone grants it a connection or removes it, and names what each permission change touched, for example "mcp:connect · Acme Ops" instead of only "Added direct policy grant to agent." (Author: @mfbx9da4)
• Agent owners and editors can read an agent's sessions #8564 - Members with agent:write on an agent can now list and open that agent's sessions read-only, and the dashboard shows them its Sessions panel. (Author: @mfbx9da4)
• GitHub Actions workload identity adds a pull-request-only job type #8469 - The GitHub Actions setup offers a fourth job type, Pull requests, admitting only pull-request jobs that use no environment and refusing branch, tag, and environment jobs; forked pull requests get no token. This is rolling out behind the GitHub Actions workload-platform flag. (Author: @subomi)

Bug fixes

• An assistant's sessions now show under the agent it acts as #8537 - An agent that an assistant acts as now lists the assistant's sessions on its identity Overview and Sessions tabs, and in Agent Sessions filtered to that agent, instead of showing none. (Author: @mfbx9da4)
• Agent identity pages load faster #8682 - Agent identity pages no longer send one MCP server activity request per project; a new endpoint returns recent activity for every readable project in a single request, and the agents roster stops loading people-only data it never shows. (Author: @adaam2)

The device agent can now report its own crashes back to the platform, with an admin switch to turn that off, and Claude sessions started from the unified Chat/Cowork mode are now captured the same way Claude Code sessions are. Kit assistants also got a round of reliability fixes to their built-in tools and underlying runtimes. More on this in Device Agent and Anthropic.

Features

• Device agents can report their own crashes #8171 - Device agents, including ones running on servers and CI that authenticate with an agent key, can now report fatal crashes, recovered panics, and update rollbacks to the control plane. Reports are scrubbed on arrival and forwarded to monitoring as logs and a crash count; they aren't stored. (Author: @bradcypert)
• Org admins can turn device agent crash reports off #8172 - Crash reporting is on by default. Organization admins can now turn it off for their fleet from the device agent configuration page. (Author: @bradcypert)
• The device agent can fetch your personal Claude observability plugin #8392 - Personal Claude accounts don't get the observability plugin installed automatically in Claude's cloud environment. The device agent now offers a download of your organization's plugin, keyed to your own account, for you to upload at claude.ai, so sessions in Claude's cloud environment are recorded under you instead of going unattributed. Each download replaces your previous one, and the shared org install key can't be used for it. (Author: @bradcypert)
• Claude Cowork sessions are captured the same way Claude Code sessions are #8445 - Claude sessions started from the unified Chat/Cowork mode are now captured: the observability plugin uploads new transcript lines whenever a turn finishes, and the platform stores them as the session's chat history. Policy enforcement stays specific to Claude Code; it doesn't apply inside the Cowork VM yet. (Author: @subomi)

Bug fixes

• Device agent crash reports stay apart by binary #8453 - Crash reports from the daemon and the menu bar app no longer get merged together when they share a function name, and reports can now carry the device's OS release. (Author: @bradcypert)
• Device coverage no longer borrows another machine's report #8557 - A device is no longer credited with a policy report from another machine unless that report names no other serial and comes from the same OS family, so, for example, a MacBook no longer shows "Enforcing policy" because the same person's Windows machine reported. (Author: @bradcypert)
• Kit assistants get built-in Speakeasy tools, more reliably #8459 #8475 - Kit assistants can now use built-in Speakeasy tools, including replying in Slack threads, alongside their attached MCP servers. A Kit runtime that can no longer serve turns is replaced automatically on the next message instead of refusing every turn, and slow sandbox startups no longer abort the runtime partway through. (Author: @danielkov)
• Kit picks up new conversations cleanly after a runtime swap #8430 - Kit assistants now reply to new Slack threads and to conversations that started before a runtime was replaced; a fresh session in a conversation with earlier turns is told that earlier messages are unavailable, instead of the turn failing outright. (Author: @danielkov)
• Retired Kit runtimes clean up promptly #8536 - Sandbox resources and workload credentials for a retired Kit runtime are now withdrawn within about an hour, even when the assistant stays busy. (Author: @danielkov)
• Kit assistants on GKE stop getting stuck mid-checkpoint #8440 - Idle Kit assistants on managed GKE now checkpoint and stop cleanly instead of staying stuck mid-checkpoint and refusing new turns. (Author: @danielkov)
• Kit can run without a separate authentication host #8447 - Kit assistants can now run on deployments without a separate authentication host; their workload issuer falls back to the server URL instead of refusing to start. (Author: @danielkov)
• The project home page loads faster #8684 - The project home page now makes fewer requests to load. (Author: @adaam2)

Connecting to an MCP server that offers more than one way to sign in upstream used to mean guessing which one applied. In organizations that enforce typed upstream authentication, every way of connecting now asks: the consent screen, an agent key at issue time, an assistant per trigger, and an app or workload signing in without a browser. Administrators can create credentials once and offer them on as many servers as they need, and a long list of enforcement fixes closes the gaps between how each surface checks and records the choice. More on this in Upstream credentials.

Features

• Pick an upstream credential from the consent screen — When a server offers several upstream credentials you may use, connecting now shows a choice instead of picking for you: an identity-provider sign-in, a shared credential by name, your own account, or your app's own credential, preselecting whichever you approved there last. A credential you may not use reads "No access" instead of offering a connection that cannot work. (#8038, @danielkov)
• Assistants use your own connection when they act for you — When an assistant acts for a person instead of for nobody, a server that uses that person's own account now signs in with their connection, not the assistant owner's. If you have not connected yet, the assistant sends you a private link that works only for you, while signed in, for 15 minutes. (#8044, @danielkov)
• Choose an assistant's upstream credential per server and trigger — Open an assistant's Identity settings to set which credential it uses on each MCP server it reaches, separately for turns that act for a person and turns that act for nobody. Turns already running keep the credential they started with, and every change is recorded in the audit log. (#8043, @danielkov)
• Choose the shared credential an agent key uses, per server — Creating an agent key for a server with several shared credentials now asks which one it should use there, and the key can't be issued until you choose. A rotated key keeps its choices, and service accounts now serve an agent the same way they serve a person. (#8040, @danielkov)
• Choose credentials for apps and workloads that sign in without a browser — A token request can now name the credential for each server it reaches. Without one, the session uses the credential an admin chose for that app, or the single credential the caller can use; with several candidates and no choice, the request fails clearly instead of guessing. (#8042, @danielkov)
• Create and share upstream credentials across servers — Administrators can create a personal connection, a service account, a static credential with stored headers, or a pass-through of a caller's header, then offer an existing credential on another server instead of recreating it. Rotating a credential's headers no longer requires re-entering secret values that are not changing, and every change is audited. (#8036, @danielkov)
• MCP server settings show one upstream identity surface — Organizations enforcing typed upstream authentication see the credential list under Identity; other organizations keep the legacy Identity panel, so server settings show only what applies to you. (#8371, @danielkov)

Bug fixes

• Gateway members added after you signed in work without reconnecting — A server added to a gateway after you connected now works right away when nothing is left to choose, such as no auth needed or one ready credential, instead of asking you to reconnect and pick. (#8039, @danielkov)
• Admin and Member roles include permission to use MCP auth clients — The built-in roles now grant use of MCP auth clients alongside permission to connect, and API key policies can grant use of every auth client instead of naming each one. (#8283, @danielkov)
• Upstream credential changes publish atomically — A configuration change can no longer leave a server half-updated and unusable until a later repair; credential-header and Enterprise Managed Authorization choices stay in step with normal configuration changes. (#8275, @danielkov)
• Agent gateway requests stay bound to your chosen credential — A missing, revoked, or replaced credential attachment is now refused instead of falling back to an anonymous upstream request. (#8276, @danielkov)
• Agent keys get the same credential checks on direct endpoints — An agent API key calling an MCP server's own endpoint now gets the same credential checks as through its agent gateway, so a blocked credential or missing permission is refused there too. (#8355, @danielkov)
• Admin-added static credentials are named correctly in connection choices — Connecting to a server whose only credential is an admin-added static credential now records that credential, so enforcing organizations accept the connection instead of asking you to reconnect. (#8353, @danielkov)
• Gateways report a credential-only server as not signed in — A gateway now reports a member that needs a credential, such as a static credential, as not signed in when you hold none, instead of saying no sign-in is needed. (#8365, @danielkov)
• Whether a server needs upstream sign-in now follows from its credentials — This is derived from the server's auth clients instead of a separate toggle; the old "Needs credentials / Needs none" setting is deprecated and no longer changes anything. (#8329, @danielkov)
• Legacy identity pages keep upstream credentials in step — Removing or changing a client through the older organization identity pages now updates every affected server's upstream credentials immediately, instead of waiting on a later backfill. (#8417, @danielkov)
• Agent API keys reach servers added in Edit — Agents running on an API key no longer stay stuck on their old gateway after you edit them; servers added in Edit now reach the keys they run with, as they already did for workload identity agents. (#8372, @mfbx9da4)
• Tool call logs show which credential signed in — An agent's gateway tool calls now show how Speakeasy signed in upstream: your connection, a teammate's connection, or a shared credential, instead of always crediting the key's creator. (#8370, @mfbx9da4)
• Agent MCP connections show every way an agent signs in — API keys and federated workload sign-ins now show alongside MCP sign-ins, with when a key was last used. (#8309, @mfbx9da4)
• "All servers" agent keys reach servers added later — An agent key issued with "All servers" now reaches MCP servers added after the key was issued, instead of only the servers that existed at the time. (#8341, @mfbx9da4)
• Organization admins can bind shared clients on organization-level servers — Linking or removing an organization-owned identity provider client on a server whose sign-in is organization-level used to always fail; organization admins can now save that change directly. (#8274, @daviddanialy)
• Upstream OAuth migration status reflects settled associations — A gateway member is no longer flagged as needing a client once an administrator has already associated exactly one of the gateway's clients with it. (#8352, @danielkov)

Okta issues its ID-JAG tokens without the resource claim the platform used to require, so every inbound exchange from Okta was rejected until now. Inbound EMA accepts that shape directly, organization admins can set up and inspect the trust relationship without engineering help, and Okta connections ask for a smaller set of permissions than before. More on this in Enterprise Managed Auth and Connect Okta.

Features

• Okta's ID-JAGs now sign in to MCP servers — Inbound EMA accepts ID-JAGs with no resource claim, the shape Okta issues. The token request names the MCP server directly, and the session works only for that server. An inbound-only trust link now needs an identity provider with a JWKS URL. (#8185, @daviddanialy)
• ID-JAG sign-in follows your identity provider's client policy — ID-JAG exchanges now accept only clients your issuer's existing admission settings allow; disabling admission stops the grant from being advertised at all, and every client refusal is logged and counted. On a shared authorization server, a request that names no resource is now routed by the token's own resource claim, so Codex can sign in against your organization gateway. (#8233, @daviddanialy)
• Manage inbound EMA trust from the Platform MCP — Organization admins can trust an identity provider for inbound enterprise-managed authorization, read the audience to configure, check whether directory sync is set up, and remove the trust, all without opening a ticket. Rejected ID-JAG exchanges now log their specific reason and are counted by outcome. (#8186, @daviddanialy)
• Okta connections request one scope instead of three — Speakeasy no longer requests okta.users.read or okta.groups.read, which it never used beyond verifying the connection; only okta.apps.read is requested now. (#8232, @daviddanialy)

Skills no longer have to ride along in a plugin to reach an agent. Gateways and hosted MCP servers can now serve the skills linked to them straight over the MCP Skills extension, so a connected agent lists, verifies, and loads them the same way it discovers tools, and every load is recorded as an activation. This is rolling out behind the skills-over-mcp flag. Link management and usage reporting ship alongside it, so you can see exactly what a given surface serves and when it was last loaded. More on this in Skills.

Features

• Gateways serve the skills linked to them over MCP — A stored gateway or your organization gateway now answers skills/list, skills/get, and skill reads with the skills linked to it, plus every skill linked to the member servers you reach through it. Rolling out behind the skills-over-mcp flag. (#8268, @simplesagar)
• Link skills to a server or gateway directly — New skill-links management lets you choose which skills an MCP server, a gateway, or your organization gateway serves over MCP, independent of plugin distribution. The Platform MCP gains matching link_skill_to_mcp and unlink_skill_from_mcp tools. (#7798, @simplesagar)
• Hosted MCP servers and the Platform MCP serve their own reviewed skills over MCP — Connected agents can list, verify, and load linked skills with skills/list, skills/get, and skill:// reads, and each load is recorded as an activation. Rolling out behind the skills-over-mcp flag. (#7749, @simplesagar)
• Match a loaded skill to the exact version an agent saw — Platform MCP skill version listings now include served_digest, the digest an agent sees when it loads that version over a hosted MCP server, so you can match a load in your logs to the exact version. (#7749, @simplesagar)
• Try linked skills in the dashboard playground — A chat session started from a signed-in dashboard session now sees the same skills the user does, and can list and load them from the playground. (#8269, @simplesagar)
• See when a skill was last loaded over MCP — Skills and skill distributions now report last_loaded_over_mcp_at, so a skill served only over MCP, with no plugin distribution, still shows its usage. (#7677, @simplesagar)
• Skill loads over MCP show up in your tool-usage logs — A skill read over a hosted MCP server now appears in tool-usage logs and the MCP & Tools summary, next to skills reported by hooks. (#7698, @simplesagar)

Bug fixes

• Re-linking a skill is now marked destructive — link_skill_to_mcp can change or clear the version a target serves, so it's now flagged destructive like unlink_skill_from_mcp; a link target also matches its ID regardless of letter case. (#8235, @simplesagar)

Organization admins can now create upstream credentials for an MCP server and offer the same one on several servers, instead of configuring each from scratch. When a server offers more than one, every path that connects to it now asks which to use: the consent screen a person sees, an agent key at issue time, an assistant's turns, and an app or workload signing in without a browser. The choice is checked again on every call, so a credential you're blocked from, or one that was turned off, stops working immediately rather than on the next reconnect. More on this in Upstream credentials.

Features

• Create and share upstream credentials across servers — Organization admins can add a personal connection, a service account, a static credential, or a header pass-through as a reusable credential, and offer an existing one on another server instead of recreating it. Rotating a credential's headers keeps secret values that aren't re-entered, and every change is audited. (#8036, @danielkov)
• Pick a credential on the consent screen — When a server offers several upstream credentials, the consent screen now shows the choice instead of defaulting to one, preselecting whatever you approved there last. A server you may not use on reads "No access," and one that still needs setup says so instead of offering a connection that can't work. (#8038, @danielkov)
• Agent keys can be issued with a chosen credential per server — Creating an agent key now lets you name which shared credential it uses on each server that offers more than one, and a rotated key keeps its choices. (#8040, @danielkov)
• Assistants choose their own upstream credentials — Open an assistant's Identity → Upstream credentials to set which credential its turns use on a given server, separately for turns that act for a person and turns that act for nobody. Turns already running keep the credential they started with. (#8043, @danielkov)
• An assistant acting for you now uses your own connection, not its owner's — When a server uses a person's own account, an assistant acting for that person now connects as them. If they haven't connected yet, the assistant sends a private link that works only for them, while signed in, and expires after 15 minutes. (#8044, @danielkov)
• Apps and workloads can select a credential without a browser — A token request can now name the server and credential it wants with upstream_auth_client=<server id>:<credential id>, or fall back to the credential an admin chose for that app. (#8042, @danielkov)
• Grant use of auth clients alongside connect access — The built-in Admin and Member roles, and API key policies, can now grant permission to use upstream auth clients the same way they grant permission to connect to MCP servers. (#8283, @danielkov)
• One settings surface for upstream identity — An MCP server's settings now show a single upstream identity view, listing its credentials where credential enforcement is on, instead of splitting the picture across two panels. (#8371, @danielkov)
• Trust an identity provider for inbound enterprise-managed authorization — Organization admins can trust an identity provider from the Platform MCP, see its audience and whether directory sync is set up, and remove the trust. Rejected ID-JAG exchanges now log their specific reason, and Okta's ID-JAGs, which carry no resource claim, are accepted and routed by their claim instead of being refused. (#8186, @daviddanialy)

Bug fixes

• Okta connections ask for fewer permissions — Speakeasy no longer requests okta.users.read or okta.groups.read when connecting Okta, keeping only the okta.apps.read scope it actually uses. (#8232, @daviddanialy)
• Organization admins can bind shared clients to org-level session issuers — Linking an organization-owned auth client to an MCP server's org-level user session issuer used to fail with no way around it; it now saves, and the change reaches every project that shares the issuer. (#8274, @qstearns)
• Upstream identity stays in step with the legacy provider pages — Removing a client from a server or organization, or deleting a platform client, now retires the upstream credentials those servers offered through it in the same save, instead of leaving them to show stale options. (#8417, @danielkov)
• Tool call history shows which credential actually signed in — A call made through an agent's gateway no longer reads as made on behalf of whoever issued the agent's key when a shared credential served it; it now names the credential that was used. (#8370, @mfbx9da4)
• "All servers" agent keys reach servers added later — An agent key or gateway issued with access to every server used to stay stuck on the servers that existed at issue time; both now pick up servers added afterward, including through an edit. (#8341, @mfbx9da4; #8372, @mfbx9da4)

A newly created hosted MCP server now works with credentials the moment it's created, instead of waiting on a separate enable step, and opening your organization's gateway URL in a browser shows real setup steps instead of a blank 404. Platform MCP also gets easier to live in day to day: it can use your own MCP servers without a second connection, let you use a server you just set up before sharing it with anyone else, and show inline cards in ChatGPT, Claude, and other MCP Apps clients. More on this in Organization and project gateways and Platform MCP.

Features

• New hosted MCP servers work right away — A newly created hosted server now starts private instead of disabled, so it can be used with credentials immediately instead of needing someone to enable it by hand. Only an organization's first server still joins the project's Default plugin automatically. (#7968, @speakeasyforgebot)
• Your organization's MCP gateway URL gets a landing page — Opening the gateway URL in a browser now shows the server URL and setup steps for Claude Code, Claude, Codex, Cursor, VS Code, opencode, ChatGPT, and other MCP clients, instead of a blank "404 Not Found." People outside the organization still see "Not found." (#8312, @danielkov)
• See organization gateway activity across every project — The Organization Gateway page's new Activity tab shows dispatched-call and error totals, calls over time, the discovery steps agents took, and calls by server; Platform MCP can read the same summary. (#8314, @danielkov)
• Use your own MCP servers through Platform MCP, no second connection — New tools reach the servers your organization gateway gives you, with your own upstream sign-ins, and search_my_tools finds the right tool across all of them in one call. Rolling out behind the platform-mcp-gateway-proxy flag. (#8271, @adaam2)
• Use a server you set up before sharing it — Once a server you added through Platform MCP is ready, you can use it from the same connection right away; putting it into a plugin to share with other people is now an optional last step instead of a required one. (#8310, @adaam2)
• Platform MCP shows inline cards in ChatGPT, Claude, and other MCP Apps clients — Adding a server shows the server, its project, that it stays private until added to a plugin, and the next step; connecting a sign-in provider shows a single "Sign in to <name>" button, and result cards now show the server's own logo instead of its first letter. (#8221, @adaam2)
• Turn off automatic syncing for one plugin — Each plugin now has a "Sync changes automatically" switch. While it's off, that plugin's changes wait until you click Sync changes, while every other plugin keeps syncing on its own. (#8150, @speakeasyforgebot)
• Manage a hosted server's address from Platform MCP — set_mcp_address and set_mcp_network_access now manage hosted MCP servers' endpoints under your dashboard's hosted address rules, and both return a preview of the exact change before applying it. (#8022, @daviddanialy)
• Share a captured coding session with a one-read link — Create a short-lived, one-read handoff link for one of your own captured coding sessions through an explicitly confirmed Platform MCP workflow. (#8395, @simplesagar)

Bug fixes

• Gateway tool discovery serves the members that answer — A member that's rate limited, briefly unreachable, or errors is now retried within the listing's three-second budget; a member that still can't be listed is left out instead of failing the whole listing, and the full tool inventory comes back in one response instead of paging. (#8107, @ThomasRooney)
• "Unknown" gateway member status now means not checked — Gateway instructions and list_servers now explain that "unknown" means Speakeasy hasn't checked the member yet, and point you to connection_status instead of reading as broken. (#8350, @mfbx9da4)
• Turning on the Organization Gateway takes one confirmation — Enabling the gateway now shows a single dialog recommending an access review instead of requiring the full review to load first. Organization admins can now always read a server's access rules, and the gateway page's endpoint box follows dark mode. (#7969, @chase-crumbaugh)
• Sharing a server to a plugin names the exact server — distribute_mcp_to_plugin now takes the server's ID and acts on that server, instead of whichever one your onboarding flow last selected. (#8259, @adaam2)
• Confirm before removing a server from a plugin — Platform MCP now asks you to confirm the exact project, server, and plugin before taking an MCP server out of a plugin. (#8260, @adaam2)
• Platform MCP sign-in stops asking for your organization twice — When you've already chosen an organization while signing in, or you belong to only one, Speakeasy now skips the organization picker and goes straight to the consent page. (#8405, @bflad)

Opening your Organization Gateway URL in a browser now shows who it's for and how to connect, instead of a blank 404, and admins get an Activity tab showing calls across every project. Adding a server through Platform MCP no longer requires a plugin first: it works from the connection you already have, and the step to share it is optional. More on this in Organization gateway and Platform MCP.

Features

• The Organization Gateway has a landing page — Opening the gateway's URL in a browser shows members the server address and setup steps for Claude Code, Claude, Codex, Cursor, VS Code, opencode, ChatGPT, and other MCP clients, and asks anyone signed out to sign in first. People outside the organization still see "Not found." (#8312, @danielkov)
• Turning on the Organization Gateway takes one confirmation — Enabling it now asks a single confirmation that recommends reviewing MCP assignments, instead of requiring the full assignment review to load first. Organization admins can also always read a server's access rules, so the review no longer fails for admins blocked from a server. (#7969, @chase-crumbaugh)
• The Organization Gateway gets an Activity tab — See calls dispatched through the gateway across every project: totals, errors, calls over time, discovery steps agents took, and calls by server. It's also in Command K as "Organization Gateway Activity," and Platform MCP can read the same summary. (#8314, @danielkov)
• Platform MCP no longer requires a plugin before you can use a server — Once a server you added is ready, you can use it right away from the same connection or get install steps for another app; sharing it with teammates through a plugin is now an optional last step. (#8310, @adaam2)
• Platform MCP shows an inline setup card in ChatGPT and Claude — Adding an MCP server shows the server, its project, and the next step right inside the chat, and connecting a sign-in provider shows one "Sign in to <name>" button. (#8221, @adaam2)
• OpenClaw sets up MCP and hooks from the agent install command — The install command now configures OpenClaw the same way it configures other clients: the agent gateway, the observability plugin with the agent's own key, and conversation access. (#8108, @speakeasyforgebot)
• New hosted MCP servers are usable right away — They now start private instead of disabled, so you can connect credentials and use a server as soon as it's created; only an organization's first server still joins the Default plugin automatically. Platform MCP's set_mcp_address and set_mcp_network_access can now also manage a hosted server's endpoints and network access directly, and preview the exact change before confirming it. (#7968, @speakeasyforgebot; #8022, @daviddanialy)
• Share a captured coding session with a one-read link — Platform MCP's create_session_handoff_link mints a short-lived, burn-after-read link to one of your own captured sessions, after you confirm the exact session and lifetime shown. (#8395, @simplesagar)
• Device agents report whether they're enforcing their served policy — Each active device now carries a policy state of attested, outdated, unreported, or halted, and coverage counts break devices down by that state. An agent's MCP connections also show every way it signs in, including API keys and workload federation, not only MCP sign-ins. (#8116, @bradcypert; #8117, @bradcypert; #8309, @mfbx9da4)
• Security activity gets its own audit log — The audit log shows configuration changes by default and can switch to security activity, such as an agent admitting its own workload identity, with consecutive same-day entries grouped together. (#8238, @aa-wong)
• Each plugin gets a "sync changes automatically" switch — Turn it off in a plugin's Create dialog or Settings tab to hold its changes at the last published version until you click "Sync changes," while every other plugin keeps syncing on its own. (#8150, @speakeasyforgebot)
• Agent setup commands can be run more than once — A setup command now works until its code expires 15 minutes after it was generated, instead of being spent by the first fetch. (#8278, @mfbx9da4)
• Use your own MCP servers through Platform MCP, rolling out behind a flag — list_my_servers, search_my_tools, describe_tools, and execute_tool reach the servers your organization gateway already gives you, with your own upstream sign-ins, with no second connection to set up. (#8271, @adaam2)
• MCP servers and gateways can serve their linked skills directly, rolling out behind a flag — Connected agents can list, verify, and load a server's skills with skills/list, skills/get, and skill:// reads, and each load is recorded as an activation. (#8268, @simplesagar)
• GitHub Actions workload identity, rolling out behind a flag — Where enabled, an agent's credential can be GitHub Actions: name a repository, choose which jobs may sign in as the agent (a whole repository, one branch, or one environment), and the device agent action handles the rest. Everywhere else it's listed under "Coming soon." (#8273, @subomi; #8418, @subomi)

Bug fixes

• Pay-as-you-go checkout works again — Starting pay as you go from the embedded Stripe Checkout form had stopped working; it's fixed. (#8284, @alx-xo)
• A slow gateway member no longer breaks the whole tool listing — Direct tool discovery now returns the full inventory in one response and retries a member that's rate-limited or briefly unreachable within its time budget; a member that still can't answer is left out instead of invalidating the listing. (#8107, @ThomasRooney)
• Removing a server from a plugin now asks for confirmation — Taking an MCP server out of a plugin used to happen immediately; it now confirms the exact project, server, and plugin first. (#8260, @adaam2)
• An unchecked gateway member reads as "not checked," not broken — The gateway now explains that an "unknown" member status means Speakeasy hasn't checked it yet, and points to connection status to check sign-in. (#8350, @mfbx9da4)
• OpenClaw CLI commands no longer hang after installing the plugin — The observability plugin now starts its hooks process on first use instead of when OpenClaw loads, so openclaw plugins install and other commands no longer wait on it. (#8347, @mfbx9da4)
• The agent install hooks self-test no longer leaves a stray session — The self-test used to create an empty "New Chat" session and tool call under every new agent; it now gets answered without being recorded. (#8349, @mfbx9da4)
• Kit assistants on managed GKE start and respond reliably again — Sandbox containers now request enough memory to pass the cluster's admission policy, and the server finds a sandbox's pod even when the cluster doesn't label it with its claim, instead of timing out. (#8421, @danielkov; #8425, @danielkov)
• Slack webhooks reject spoofed verification handshakes — The URL verification handshake is now treated as challenge-only and recognized solely on application/json requests, so a request that skips signature verification can no longer be ingested as a real event. (#7854, @speakeasyforgebot)
• Platform MCP's plugin tool names the server it acts on — distribute_mcp_to_plugin now takes the server's ID, so it acts on and reports the server you meant instead of whatever setup selected last. (#8259, @adaam2)
• Platform MCP sign-in no longer asks you to pick an organization twice — If you already chose an organization while signing in, or belong to only one, Speakeasy now skips the picker and goes straight to the consent page. (#8405, @bflad)
• The agent install command only asks to store the agent key when it's needed — It now prompts to save SPEAKEASY_AGENT_KEY only when it configured Claude Code or Codex, which read the key from the environment; an OpenClaw-only install no longer shows that note. (#8348, @mfbx9da4)

Starting pay as you go no longer sends you to a separate checkout page: an embedded Stripe Checkout form mounts right on the billing page. Security and IT admins get a clearer picture too, with device coverage that reports whether a device is actually enforcing the policy Speakeasy served it, and a security audit log that's now separate from configuration changes. More on this in Billing and Device Agent.

Features

• Start pay as you go from an embedded checkout — Start pay as you go without leaving the billing page: the checkout endpoint returns the client secret and publishable key an embedded Stripe Checkout form mounts with. (#8284, @alx-xo)
• Device agents report the policy they actually enforce — Each device now reports the policy version it applies, every tool's enforcement outcome, its agent version, and its update posture; Speakeasy stores the latest report per user per machine so a device's attested state can be checked against what was served to it. (#8116, @bradcypert)
• Device coverage shows whether policy is actually enforced — Every active device now carries a policy state of attested, outdated, unreported, or halted, coverage counts break down by those states, and you can filter managed devices by them. A fresh report also counts as liveness, so a halted device that stopped polling still shows as active instead of dropping out of coverage. (#8117, @bradcypert)
• Security activity gets its own audit log — The audit log shows configuration changes by default and switches to security activity, such as an agent's runtime admitting its own workload identity, with consecutive entries from the same agent grouped by day. (#8238, @aa-wong)
• The agent install command sets up OpenClaw too — The same one-line install now adds the agent gateway, installs the observability plugin with the agent's own key, and turns on conversation access, so connecting an agent to OpenClaw no longer needs separate manual steps. (#8108, @speakeasyforgebot)
• GitHub Actions is coming as a workload platform (rolling out to select organizations) — A guided setup lets a job in one repository sign in as an agent with its own GitHub token, through the Speakeasy device agent action, so CI jobs can call MCP servers and send hook events without a stored secret. It's listed under Coming soon for most organizations until a stable speakeasyd release supports it, and reaches organizations with the workload-platform-github-actions flag on first. (#8273, #8418, @subomi)

Bug fixes

• Slack webhook handshakes can no longer be forged into events — Slack trigger webhooks now treat the URL verification handshake as challenge-only: a request that skips signature verification as a handshake can never be ingested as a real event. (#7854, @speakeasyforgebot)
• Kit assistants on managed GKE respond again — The server now finds a Kit sandbox's pod through its assigned Sandbox when the cluster doesn't label pods with their claim, instead of waiting out the turn and retrying on a fresh runtime. (#8425, @danielkov)
• Kit assistants on managed GKE start again — Their sandbox containers now request enough memory to pass the cluster's admission policy, and a Kit resource budget that would be rejected now fails at startup instead of at first use. (#8421, @danielkov)
• Agent setup codes stay valid until they expire — An agent's one-line setup command can now be run more than once, up to 15 minutes after it's generated, instead of being spent by the first fetch. (#8278, @mfbx9da4)
• The agent install script only asks to store the key when needed — It now prints the note to store SPEAKEASY_AGENT_KEY only when it configured a client, such as Claude Code or Codex, that reads the key from the environment; an OpenClaw-only install skips it. (#8348, @mfbx9da4)
• OpenClaw CLI commands no longer hang after installing the plugin — The observability plugin's hooks process now starts on the first hook instead of when OpenClaw loads it, so openclaw plugins install and other CLI commands no longer stall. (#8347, @mfbx9da4)
• The install hooks self-test no longer leaves a fake session — The agent install script's hooks self-test no longer leaves an empty "New Chat" session and a tool call under every new agent. (#8349, @mfbx9da4)
• OpenClaw's Codex-harness turns capture the user's prompt — Turns that run on OpenClaw's Codex app-server harness now report the prompt that started them, which that harness doesn't otherwise fire an event for. (#8092, @mfbx9da4)
• New agent identities can send hook events right away — When its creator holds hook-ingestion permission, a new agent identity now gets it too, scoped to its project, instead of needing an admin to grant it separately afterward. (#8073, @speakeasyforgebot)

Putting several MCP servers behind one address no longer waits on a feature flag. Every organization can group servers into a gateway today, and gateways pick up two things single servers already had: a consent-screen tool picker and, for agents that need to work across a lot of tools at once, Code Mode. People connecting through a gateway can also hide the servers they don't use.

Features

• MCP gateways are available to every organization #8076 - The MCP page always lists gateways now, and Add a server always offers New gateway, so grouping servers behind one address no longer needs Speakeasy to flip a flag first. (Author: @ThomasRooney)
• Gateway consent gets the tool picker #6816 - Approving a gateway connection now offers All tools (live), All tools (frozen), or Specific tools, the same choice single MCP servers already had. Frozen and Specific selections serve from a fast cached catalog instead of refreshing every member's tools on each connection. (Author: @ThomasRooney)
• Switch a gateway to Code Mode #6978 - A gateway can expose one execute tool that runs short Python scripts with live tool search, schema lookups, and authorized calls across every hosted, remote, and tunneled member, instead of handing an agent every member's full tool catalog up front. (Author: @ThomasRooney)
• Hide the gateway servers you don't use #8139 - Hiding a server removes it from your own gateway tools without touching anyone else's access. The device agent's menu bar and a new hover icon on the consent page both read and set the same preference. (#8179, #8178, @daviddanialy)
• See which MCP servers still need sign-in #8001 - The device agent now reports your sign-in state for each MCP server in your plugins, with a link that signs in from the browser, or a link to request access when you don't have it. (Author: @bradcypert)

Bug fixes

• A gateway keeps its discovery mode until you reconnect #8095 - Changing a gateway's default discovery mode no longer swaps a connected client's tools mid-session; a tool call the current mode can't serve now says to reconnect instead of failing as an unknown tool. (Author: @ThomasRooney)

A risk policy could already flag or block a matching MCP tool call. Now it has a third option: hold the call until a named approver says yes, then let exactly one retry through. Approvers decide from Guardrails or straight from a Slack DM, and every project gets the MCP server an agent needs to ask for approval set up automatically. This is rolling out behind a feature flag; ask your account team to turn it on.

Features

• Require approval for tool calls #7726 - Guardrails gets a new policy use case: choose the tools it covers, name approvers as specific people or roles, then review held calls from a Tool approvals tab where each argument sits on its own row beside the agent's reason, with Approve and Deny. (#7712, #7713, @mfbx9da4)
• Approval requests arrive as Slack DMs #7728 - Each named approver gets a direct message from the Speakeasy app with the tool, the agent's reason, and every argument as its own field, plus Approve and Deny buttons that resolve the same request Guardrails shows. (Author: @mfbx9da4)
• Every project gets a built-in approvals server #7739 - Agents on the Default plugin can call request_approval right away. Speakeasy creates a dedicated <organization>-<project>-approvals server and adds it to the plugin automatically, so a team no longer has to wire one up by hand before approvals work. (Author: @mfbx9da4)

Bug fixes

• Held calls on proxied servers come back as a usable result #7732 - A call waiting on approval now returns as a tool result marked isError, carrying the request token and the steps to request approval, instead of a JSON-RPC error that agents treat as a plain failure. (Author: @mfbx9da4)

Setting up a new MCP server through Platform MCP now takes fewer calls and less guessing, whichever client is asking. Clients with a tight tool budget, such as Codex Agent Plugins, get a small fixed surface instead of the full catalog, and a server added by URL now gets a name and address worth reading instead of the raw URL. More on this in Platform MCP.

Features

• One-click install steps per client #8212 - get_my_install_instructions now returns a ready path for each client: a one-click Cursor link, the claude mcp add command for Claude Code, a config.toml block and codex mcp login command for Codex, an opencode.json block, and a generic JSON config for everything else, with no credentials included. (Author: @adaam2)
• A lighter tool list for budget-constrained clients #8149 - Hosts that cap how many tools or how much context a server can use, such as Codex Agent Plugins, now see a small fixed surface, catalog search, a describe tool, a call tool, and execute when Code Mode is available, instead of roughly 150 tools, selected automatically per harness. (Author: @adaam2)
• First-run tools sit next to discovery #8210 - Catalog search, candidate inspection, adding a server, find_mcp, readiness checks, install instructions, and docs search now appear directly beside the discovery tools on hosts like Codex and ChatGPT, so the first few steps take one call instead of a search, a describe, and a call. (Author: @adaam2)
• Remote MCP servers get readable names and addresses #8222 - Adding a server by URL without a display name now names it after what the server reports about itself, or its host name, and derives its slug and address from that name instead of the raw URL. (Author: @adaam2)

Bug fixes

• Chat in to connect sign-in #8213 - When a server's OAuth client can be set up automatically, the agent now offers to connect sign-in right in chat instead of only pointing to the dashboard. (Author: @adaam2)
• Adding a server twice says so #8208 - Adding a server already in the project now reports it as already there instead of claiming it was newly added. (Author: @adaam2)
• Stale readiness checks refresh themselves #8209 - An expired readiness result is rechecked automatically instead of being reported as stale until a check is forced. (Author: @adaam2)
• Clearer sign-in and tool count reporting #8211 - Catalog search results leave out tool counts that aren't known instead of reporting zero, and describe how each server signs in in plain words. (Author: @adaam2)
• Docs search gets a name that matches what it searches #8203 - The setup-guide search tool is now search_speakeasy_docs, and hosts that see only the discovery tools are told to use it for how-to and setup questions. (Author: @adaam2)

Tool Logs filters now narrow to what's actually there as you apply them, and organization administrators get a ready-made Explore dashboard for what risk policies have caught. Alongside that: agent identities can borrow a personal connection instead of needing a shared credential, hosted MCP servers move onto one settings page, and admins get a single place to manage the credentials servers use upstream.

Features

• Tool Logs filter counts narrow as you filter #8148 - Each filter group now lists only the values that still have calls under the filters already applied, while its own values stay selectable. The time range moved next to the search bar, and the summary and timeline panel takes less vertical space. (Author: @adaam2)
• See who an agent acted for #7927 - A call an agent made on someone's behalf now reads "agent ↳ on behalf of <person>" in Tool Logs, and filtering by that person includes the agent's calls made for them. (Author: @adaam2)
• Delegate your personal connection to an agent, or block one from using it #8013 - An agent identity can now use a personal OAuth connection its owner, or another authorized editor, hands it, instead of requiring a shared credential. Anyone can also block a specific agent from their own connection without managing the agent, and "All servers" is offered only when every server is actually reachable with the agent owner's and your own permissions; agent bindings stay on the current connection as it's reauthenticated. (#7944, #8017, #8168, #8225, @mfbx9da4)
• Hosted MCP servers move onto the MCP server page #7942 - Settings that used to live on the toolset page, tools, resources, prompts, and team access, are now on the server's own page like every other server kind, and old toolset links redirect automatically. (#8009, #8021, #8016, @daviddanialy)
• A Security & risk dashboard for organization admins #7908 - Explore gains a risk_findings dataset, counts only, never the matched values or the chats they came from, and a ready-made dashboard breaking findings down by category, rule, policy, agent, team, and person. (Author: @simplesagar)
• Explore gets Signal Intelligence #7693 - Query signal patterns across conversations through the same analytics API and Platform MCP tools, with exact session counts, top-session concentration, and comparisons against the previous window. (#7696, #7700, @disintegrator)
• Manage the credentials your MCP servers use upstream #7933 - Organization admins can list every upstream auth client, see which servers offer each one, rename, enable, or disable it, and decide who may use it, all from one place instead of each server's own settings. (#7934, @danielkov)
• A shared Connections view across gateways #7974 - See every upstream connection for project and Organization Gateways in one place, searchable by identity and filterable by server or provider, with authorization deadlines shown separately from token expiry. (Author: @bflad)
• Duplicate and correct remote session clients #7976 - Copy a client's settings to register a new one in one step, or fix a client's ID in place instead of deleting and recreating it; a corrected ID asks affected users to reconnect once. (#7980, @bflad)
• See the sessions your agent produced #8110 - Agent owners without chat:read can now see their own agent's sessions on the agent page's Overview and Sessions tabs, and chat.list accepts an agent_id filter. (Author: @speakeasyforgebot)
• Share an Okta org across organizations #8145 - More than one Speakeasy organization can now connect and verify the same Okta org, instead of the second one failing with "this Okta org is already connected to another organization." (Author: @qstearns)

Bug fixes

• Device agent enrollment no longer needs organization read access #8123 - Organization members can complete device-agent enrollment without also holding organization read access. (Author: @qstearns)
• Organization role changes apply even when WorkOS is early #7993 - A membership role update from WorkOS now applies within about a minute even when its webhook arrives before the event is readable, instead of waiting for the organization's next WorkOS event. (Author: @TristanSpeakEasy)

The Speakeasy Agent's menu bar can now show which MCP servers live inside each assigned plugin, with a server count per plugin that expands into the actual list and a link to a server's dashboard page when you can read it. Granting or revoking MCP access through a role, or changing which audience a server serves, now reaches devices within seconds instead of waiting for the next hourly republish. More on this in Device Agent.

Features

• The menu bar lists each plugin's MCP servers — agent.getPlugins now returns the servers inside every delivered plugin in their display order, so the Speakeasy Agent menu bar can show a server count per plugin row and expand it; a server's dashboard link appears only when you hold read access to it. (#7952, @bradcypert)
• The Speakeasy Platform MCP is listed in the official MCP registry — Agent clients and AI search that discover servers through registry.modelcontextprotocol.io can now find the Platform MCP as com.speakeasy.ai/platform. (#7597, @adaam2)
• Kit assistants can opt into a GKE-backed runtime (new assistants only) — Eligible new assistants with a persisted MCP attachment and issuer setup can run under an independent workload identity with its own inference credentials, instead of borrowing the authority of whoever started the conversation; existing assistants and conversations are not migrated. (#7711, @danielkov)

Bug fixes

• Role and audience changes reach devices in seconds, not hours — Changing a role's grants or an MCP server's audience now republishes the affected role plugins right away instead of waiting for the hourly republish sweep, so a newly granted or revoked server shows up on enrolled devices almost immediately. (#7967, @simplesagar)
• MCP tool calls that report an error now count as failed — A call that answers HTTP 200 with isError: true now counts as failed in MCP server health, Platform MCP diagnostics, and per-user error flags, instead of counting as a success. (#7778, @daviddanialy)
• The MCP servers list shows the right tool count again — The tool count on a hosted MCP server now counts only tools it still serves from the project's latest deployment, so tools from removed sources or renamed operations no longer inflate the number. (#7882, @daviddanialy)

Tool calls that answer with an in-band error inside an HTTP 200 now count as failed everywhere the platform reports on MCP health, so Tool Logs, Platform MCP diagnostics, and per-user error flags finally agree with what your agents actually saw. The MCP servers list also now counts only the tools a server still serves, so a removed source or a renamed operation no longer inflates its tool count. Plugin assignments gain an install mode per audience, so one team can be required to have a plugin while everyone else keeps it optional. More on this in Tool Logs.

Features

• Set a plugin's install mode per audience — Assignments now carry their own mode: Required, On by default, or Available, so a plugin can be mandatory for one team and optional, or off by default, for another instead of sharing one setting across every audience. (#7255, @bradcypert)
• The Speakeasy Platform MCP is listed in the official MCP registry — Any client that discovers servers through registry.modelcontextprotocol.io can now find the Platform MCP at com.speakeasy.ai/platform. (#7597, @adaam2)

Bug fixes

• Tool calls that return an in-band error now count as failed — A tool result with isError: true inside an HTTP 200 response used to read as a success; MCP server health, Platform MCP diagnostics, and per-user error flags now classify it as failed, matching how hook-observed tool errors already counted. (#7778, @daviddanialy)
• The MCP servers list shows how many tools a server actually serves — Its tool count now matches the toolset page: tools from a removed source or a renamed operation no longer inflate the number shown on server cards and table rows. (#7882, @daviddanialy)
• Role and audience changes reach devices in seconds, not hours — Changing a role's grants or an MCP server's audience now republishes the affected plugins right away, instead of waiting for the hourly republish sweep. (#7967, @simplesagar)
• The new-agent wizard no longer loses its draft on reload — Reloading the page past the first step used to open the Install step with an empty draft and a broken "Issue a key" button; it now restarts at the first step instead. (#7929, @adaam2)

Org Gateway now waits for an administrator to turn it on, and turning it on comes with a real audit trail: review every role's effective MCP access, inspect what each person can reach, and remove or block specific grants from Settings or Roles & Permissions. People who have already approved a client on one server behind a shared authorization server now skip the consent screen on another server under the same issuer, as long as nothing about their access changed. More on this in Organization gateway.

Features

• Org Gateway requires an administrator to opt in, with a full access review — Review organization-wide MCP access by role before enabling, inspect each person's effective assignments, remove server-specific grants or block role access, and open client-specific connection instructions from the Organization Gateway card or Roles & Permissions. (#7611, @chase-crumbaugh)
• Approvals carry over across servers behind a shared authorization server — An identified person's saved tool selection and session length now auto-apply to another server under the same issuer and OAuth client, with the browser checking current tools before any click; a new server, a changed tool inventory, or a missing permission still asks for full consent. (#7606, @bflad)
• Each MCP server on a shared sign-in can use its own upstream OAuth client — Servers and gateway members sign in through the client configured for them instead of one client shared by every server on the issuer, and the consent screen offers each server only its own clients. (#7653, @danielkov)
• Set up directory role mappings in bulk, and review what changed since (organization admins) — previewDirectoryRoleSetup and applyDirectoryRoleSetup map every directory group and attribute value to a role in one pass, and a new review queue raises directory changes that need a decision, a group with no role, a changed attribute value, or a mapped group that has gone from the directory, with email and webhook notifications once items have waited 15 minutes. (#7722, #7725, #7781, @TristanSpeakEasy)
• Directory mapping and member pages show more about where access comes from (organization admins) — Mappings report whether their source is still active or missing, and members list their directory groups and which mappings currently grant them a role, so a role reached through two groups shows both. (#7715, #7826, @TristanSpeakEasy)
• Search chats from the Platform MCP — search_chats and read_chat search messages by text, owner, or participant and read surrounding context, gated by chat:read and audit logged. (#7734, @ThomasRooney)
• Preview and confirm a deployment redeploy or rollback from the Platform MCP — redeploy_deployment retries or rolls back a whole project deployment with the existing authorization and audit workflow, and reuses the same deployment on a retried request instead of creating a duplicate. (#7900, @simplesagar)
• OAuth connection failures name the real reason — A failed login now shows the identity provider's standard OAuth error code, or says the provider was unreachable, instead of a generic "upstream token exchange failed"; a provider outage now answers with a retryable error instead of a flat failure. (#7618, @daviddanialy)
• Tunnel agent status reaches the dashboard (network administrators) — Connected tunnel agents, target network checks, and MCP request history now show in the dashboard; agents report aggregate HTTP progress without collecting payloads or making MCP calls. (#6874, @ThomasRooney)
• An MCP server's Identity settings flag a shared OAuth client — If a server's OAuth client also signs in other MCP servers, its User Identity settings now say so, since changing or rotating that client changes sign-in for all of them. (#7644, @danielkov)

Bug fixes

• Legacy Claude Code hook requests stop timing out — The endpoint now answers within five seconds using the organization's fail-open or fail-closed setting when a policy check runs long, instead of letting older curl-based hook scripts block with "HTTP 000"; the slower check still finishes in the background. (#7135, @mfbx9da4)
• A configured MCP server header can no longer read your Speakeasy credential — Creating or updating a header that sources from the caller's Authorization request header is now refused, since that header can carry the Speakeasy session credential and must not be forwarded to an upstream server under another name. (#7821, @daviddanialy)
• An MCP server's own URL is rejected as its OAuth client_id — The request now fails fast with a hint to check the client ID setting, instead of retrying and failing with a retryable error after fetching that URL as a metadata document. (#7862, @bflad)
• Risk policy checks look at only the latest exchange again — Anthropic inference hook verdicts no longer re-check a whole conversation, so long conversations stop timing out and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Directory role mappings can't exceed 20 roles per source, and inactive directories stop granting roles — Saving more than 20 roles on one group or attribute value now fails clearly, and roles mapped through a deleted directory no longer contribute to anyone's access. (#7829, #7313, @TristanSpeakEasy)
• A session moved between organization hosts keeps the right organization selected — Opening the dashboard on the legacy host no longer resets the organization you picked on your organization's own host. (#7915, @adaam2)
• Deleting a server no longer breaks a multi-server risk policy — Deleting an MCP server or gateway now removes it from the scope of every risk policy that also targets other servers, so those policies can still be saved; a policy left with no target is deleted, as before. (#7902, @daviddanialy)
• A custom domain that isn't verified and activated no longer breaks an MCP server's issued URLs — The Playground URL and the issuer of dashboard-minted session tokens now fall back to the server's platform endpoint, or to /mcp/{slug}, until the custom domain is ready. (#7753, @daviddanialy)
• The device agent's Windows installer link works again — The stable installer links moved from /v1/install/ to /rpc/install/, since production never routed the old path to the server and the Windows setup step was saving the dashboard's HTML instead of the installer. (#7916, @mfbx9da4)
• Hosted MCP servers list correctly again when their toolset is gone — Listing MCP servers no longer returns servers backed by a deleted toolset, the hosted server summary now includes the toolset's description, and server reads report whether any endpoint, including a custom domain still activating, actually routes to it. (#7754, @daviddanialy)

Approving an MCP server under a shared authorization server no longer means approving it again on your next visit: an unchanged approval is now reused automatically, and only a changed tool list, upstream permission, or a server you haven't seen yet brings back the full consent screen. Organizations with directory sync get a review queue for the changes that actually need a decision: a new group with no role, a new attribute value, or a mapping whose source has disappeared from the directory, plus a bulk setup flow for mapping everything else in one pass. More on this in Shared authorization servers.

Features

• Skip repeat consent for MCP servers you've already approved — Reconnecting a client to a server under a shared authorization server now reuses your saved approval and its tool selection automatically, instead of showing the consent screen again. A new server, a changed tool inventory, or a missing upstream connection still asks for approval, and withdrawing consent clears every saved approval for that server. (#7606, @bflad)
• MCP servers that share a sign-in can each use their own upstream OAuth client — Servers behind the same shared authorization server, including gateway members, now sign in through the upstream client configured for each one individually instead of a client shared by the whole issuer, so one server's credentials no longer leak into another's. (#7653, @danielkov)
• Review directory changes that need a role, and map the rest in bulk — The SSO tab now lists directory groups and attribute values that showed up with no role, and mappings whose group or value has disappeared from the directory, so admins decide instead of just noticing them in the table. "Set up in bulk" maps every remaining unmapped group and attribute value in one reviewed step, reusing an existing role with the same name where one exists. Admins can also turn on email reminders for pending reviews. (#7725, #7722, #7781, @TristanSpeakEasy)
• See where the directory hands out a role from the server's own Team Access list — An MCP server's Team Access list now shows which directory groups and attribute values grant each role, including a link back to the review queue when one of them has been removed from the directory. (#7830, @TristanSpeakEasy)
• Org Gateway now requires an administrator to opt in — Turning on the organization-wide MCP gateway now walks admins through a role-by-role access review first, with one shared view for inspecting and adjusting effective access by role or by person, available from both the gateway settings and Roles & Permissions. (#7611, @chase-crumbaugh)
• Every kind of MCP server now shows in one list — The MCP Servers page and command palette list hosted, remote, tunneled, and unproxied servers together instead of fetching and filtering them separately, so a server no longer goes missing from search because of how it's backed. (#7754, @daviddanialy)
• Find skills and agent identities from Command K — Searching the command palette by name now also surfaces skills and registered agent identities, opening straight to their overview page instead of requiring a trip through the sidebar. (#7887, @simplesagar)
• Headless devices can enroll and authenticate as workloads — An admin can issue a single-use join token so a headless box, such as a one-off VPS, registers its own key and enrolls as a workload, then polls for its assigned plugins' MCP servers and sends hooks with a short-lived workload token instead of holding a long-lived agent API key. (#7450, #7451, #7404, @bradcypert)

Bug fixes

• OAuth sign-in errors now say why — A failed MCP connection login now names the identity provider's actual OAuth error, such as invalid_grant or invalid_client, instead of a generic "upstream token exchange failed" that required a support round-trip into server logs. (#7618, @daviddanialy)
• Legacy Claude Code hook requests no longer time out — A slow risk scan could leave an older curl-based hook script waiting past its own timeout and blocked with HTTP 000, even in fail-open organizations. The check now answers within a 5-second budget and falls back to the organization's fail-open or fail-closed setting if it needs more time. (#7135, @mfbx9da4)
• Long conversations no longer slow down Anthropic inference hook checks — Risk verdicts on Anthropic inference now scan only the latest exchange instead of rescanning the whole transcript, so scan time stays flat as a conversation grows and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Deleting an MCP server or gateway no longer blocks saving policies that also cover other servers — A risk policy that targeted several servers kept the deleted one's ID, so the next save failed with "MCP server does not belong to the project." Deleting a server or gateway now removes it from every policy's scope at the same time. (#7902, @daviddanialy)
• Device agent installer links on Windows now download the real installer — The stable installer link returned the dashboard's HTML instead of the .msi, so the Windows setup step saved a web page under the installer's filename. (#7916, @mfbx9da4)
• MCP server headers can no longer be configured to leak your session token upstream — A configured header can no longer read the inbound Authorization header as its source, which could forward your Speakeasy credential to an upstream server under another name. Reading an upstream credential from a separate header still works. (#7821, @daviddanialy)

Gateway owners can now pick how agents discover tools behind a gateway, and every organization gets the consent screen's tool picker instead of only the ones it was rolled out to. Directory-synced organizations can also give a group or attribute value more than one role at once.

Features

• Choose Direct or Progressive tool discovery for a gateway — Direct lists every qualified member's tools in one bounded page instead of discovering them one call at a time, which suits MCP clients that can't use progressive discovery reliably. A connection can override the gateway's default from consent or Inspect, and the organization gateway offers the same choice across every project a person can reach. Available to every organization. (#6812, @ThomasRooney)
• The consent screen's tool picker is available to every organization — Narrowing an approval to specific tools from the consent screen no longer needs an admin to find and turn on a separate setting first; it works wherever the screen is eligible. Tool selections already saved from earlier approvals keep being enforced. (#7589, @ThomasRooney)
• Give a directory group or attribute value more than one role at once — Directory-synced organizations can add or remove roles on a mapping independently instead of replacing a single choice, with chips that collapse into a "+N more" popover when a row is full and a save that cannot silently overwrite a set changed elsewhere. (#7307, #7311, @TristanSpeakEasy)
• Add several MCP servers to a plugin at once from a searchable sheet — Plugin setup now uses the same server picker as the organization gateway: search by name or slug, see each server's logo and kind, and add many at once instead of one <select> submission at a time. Servers whose MCP is turned off show as unavailable instead of failing after selection. (#7662, @qstearns)
• Find a member by their complete email through the Platform MCP — Organization admins checking a named colleague's MCP access can now search by their exact email address and get a match even when fewer than five members would otherwise match, so the lookup no longer comes up empty for a small organization. (#7623, @simplesagar)
• Create gateways and set their members from the Platform MCP — An admin can now ask an agent to put a set of MCP servers behind one gateway endpoint, instead of doing it from the dashboard; the new tools create a gateway with its members in order or replace a gateway's membership outright, all or nothing. (#7510, @qstearns)
• Agent Hooks Protocol clients can block unsafe content, not just observe it (for harnesses that speak AHP) — A compatible client sending tool calls, prompts, and model responses through POST /ahp can now have a policy deny or replace unsafe content before it reaches the model, and can upload text attachments for the same scanning, instead of only capturing events after the fact. (#7300, #7672, #7679, @danielkov)

Bug fixes

• The MCP & Tools dashboard loads again on high-traffic projects — Its charts used to sort every event in a 7-day window, which could exhaust the analytics database's memory and take other dashboards down with it; they now read from a table that already holds one row per call. (#7626, @subomi)
• Assistants stop going silent in Slack for people with many permissions — A large permission set could grow an assistant's authorization token past the request header limit, so the turn silently failed to start. Permissions are now checked live instead of carried in the token, which also means a permission someone loses stops applying to their in-flight turns immediately. (#7661, @danielkov)
• The organization gateway lists only servers you can actually use — Servers whose authentication the gateway can't supply, or that are built for assistants rather than general use, no longer show up on the consent screen or in list_servers only to fail when called. (#7594, #7648, @danielkov)
• Risk findings consistently honor disabled rules and policy scopes — Findings written for the upcoming findings store could skip a policy's disabled rules and category scopes, and a transient scan failure could be dropped instead of retried; both now match the rules the existing findings pipeline already applies. (#7660, @vishalg0wda)
• Long conversations stop timing out on every turn under Anthropic-based risk checks — The verdict budget assumed a 10-second timeout while Anthropic's default is 5 seconds, so once a conversation's unscanned history grew past what fit in that window, every later message re-scanned it all and timed out again, failing open. Verdicts now scan only what's new plus a bounded backlog. (#7731, @vishalg0wda)
• Attaching a toolset to an assistant can no longer turn on its MCP server without write access — Attaching a toolset whose hosted server is off now requires mcp:write on the toolset, closing a path where a caller who could only connect to a toolset was able to turn its server on. (#7607, @daviddanialy)
• The Platform MCP's Claude Code install leads with the quick commands again — Setup starts with /plugin marketplace add and /plugin install instead of a settings file edit, with the auto-update settings snippet shown as the next step instead of the only option. (#7621, @simplesagar)
• MCP sessions served through identity chaining stop asking for a reconnect every hour — Refreshing a grant on a server with no interactive upstream session used to always report that a reconnect was needed; refresh now asks identity chaining directly and only falls back to a reconnect when one would actually fix it. (#7572, @daviddanialy)

The tool picker on MCP consent screens is no longer something an admin has to turn on: every organization now gets it by default, so anyone approving a connection can scope it to the tools they actually want. The dashboard also retires the old "Remote Identity Providers" name. Wherever an upstream OAuth issuer shows up, from the organization page to an MCP server's Authentication tab, it is now called an Authorization Server, matching what it has always done. More on this in Authorization servers.

Features

• Every organization now gets the consent screen's tool picker — The "Tool filtering on consent screens" setting is gone, so the tool picker on third-party consent screens is on for everyone with no per-organization opt-in; tool selections already saved under the old setting keep being enforced. (#7589, @ThomasRooney)
• Remote identity providers are now called Authorization Servers — The rename reaches the organization page, an MCP server's Authentication tab (formerly "Connected services"), the attach and modify sheets, and Platform MCP's setup guidance, so the name matches what the upstream OAuth issuer actually does. (#7384, @adaam2)
• Gateways choose Direct or Progressive tool discovery — Gateway owners pick a default discovery mode, and a connection can override it from consent or Inspect; Direct lists member tools in bounded, concurrent pages so one slow member can't block the rest. (#6812, @ThomasRooney)
• MCP server reads now summarize their backing toolset — Reading an MCP server now includes its toolset's tool count, selection mode, and primary endpoint in one response, so integrations no longer need a second call to show that context. (#7610, @daviddanialy)
• Compatible harnesses can send tool calls and prompts through the Agent Hooks Protocol — A new /ahp endpoint accepts tool calls, user prompts, and session events from harnesses that speak the protocol, using a hooks API key, and Speakeasy policies can deny what it intercepts; attachment uploads and content-replacement enforcement extend the same path. (#7300, #7679, #7672, @danielkov)
• Create gateways and manage their members from the Platform MCP — create_gateway creates a private gateway with an ordered member list in one step, and set_gateway_members replaces the whole list atomically, naming any server that can't sit behind a gateway. (#7510, @qstearns)
• Find an organization member by their full email through the Platform MCP (organization admins) — A complete email address now finds a member even when a partial search would have matched too many people to show. (#7623, @simplesagar)
• Directory role mappings move to a full role set, deleted roles included (organization admins) — A directory group or attribute value's role mapping now replaces its complete role set atomically instead of upserting one role at a time, and a mapping can keep pointing at a role that has since been deleted without blocking new mappings to the same source. (#7307, #7311, @TristanSpeakEasy)
• Enterprise Managed Authorization reports which services trust each identity provider, and the consent page checks live (Enterprise Managed Authorization customers) — listEMAServices lists every service an organization's workload identities reach with the providers each accepts, identity chaining now records the exact OAuth scopes a server connection requests so a later request can't quietly ask for more, and the consent page runs the real identity-chaining exchange before approval instead of waiting for the first tool call. (#7614, #7581, #7580, @daviddanialy)

Bug fixes

• The organization gateway lists only servers you can actually use — Servers whose authentication the gateway can't provide no longer appear on the consent screen or in list_servers, and gateways no longer list servers built on toolsets that carry platform-only tools, such as the tools assistants use. (#7594, #7648, @danielkov)
• MCP grants served by identity chaining stop asking for an unnecessary reconnect — Refreshing a grant whose upstream is served by identity chaining no longer fails once the access token expires; it only asks for a reconnect when chaining genuinely can't serve the upstream anymore. (#7572, @daviddanialy)
• Assistants stop failing to respond in Slack over stale permissions — An assistant's permissions are now checked live against the assistant, its owner, and the person it's acting for on every turn, so a permission someone lost stops applying to a response already in progress. (#7661, @danielkov)
• Risk policy checks stay inside Anthropic's response window — Inference-hook verdicts now fit Anthropic's default five-second timeout, so long conversations no longer time out on every turn while earlier content is rescanned. (#7731, @vishalg0wda)
• The Risk Overview page is retired — Old links to it now open Watchdog instead of a dead page. (#7635, @vishalg0wda)
• The sessions dataset is removed from the analytics catalog — Explore, widgets, and the Platform MCP's analytics tools now ask about tool calls and skills instead. (#7633, @subomi)

Tool Logs no longer requires full org admin: a new project-scoped log:read role scope lets admins hand out tool-call log access without handing out the whole organization. Sensors in Signals intelligence can now judge a message against up to ten prior messages instead of only the message itself, configurable per sensor, which sharpens classification that depends on what came before. More on this in Roles and permissions and Signals intelligence.

Features

• Grant tool-call log access without full org admin — A new project-scoped log:read scope covers Tool Logs, the Playground's logs panel, a session's Tool calls view, and the matching Platform MCP and assistant tools, so organization admins can hand it to a custom role instead of making someone an org admin just to see their own project's call history. (#7472, @bflad)
• Sensors can weigh a message against its recent history, not just itself — Set a sliding window of two to ten prior messages per sensor, or keep judging the current message alone; the chosen setting shows in both the sensor list and the sensor editor. (#7556, #7557, @disintegrator)
• Consolidate or relocate shared authorization servers (rolling out behind a flag, organization admins only) — Organization settings now list every organization-wide and project authorization server with its issuer, token endpoint, and the MCP servers signing in through it, and admins can promote a project's authorization server to organization-wide, merge one into another, or move it onto or off the deployment's authentication host, after previewing who it affects. (#7497, #7503, @bflad)

Bug fixes

• Explore dashboard filters stopped crashing on busy projects — Filter dropdowns were sorting a full week of events in memory and running the analytics database out of memory on high-traffic projects, taking the MCP & Tools dashboard down with them; dropdown values now come from a plain scan instead. (#7593, @subomi)
• MCP errors raised before the request loads are protocol-compliant again — A missing or inaccessible MCP target now returns an error encoded for the request's actual protocol revision, with a readable request ID, instead of a response that could predate protocol negotiation. (#7392, @bflad)
• The consent approve button no longer flashes enabled before a blocking error shows — Its disabled state now updates in the same render as the panel content, closing a one-frame gap where the button could look clickable while the screen already said a required service couldn't connect. (#7591, @disintegrator)
• The service account panel drops its non-functional client ID option — The disabled "Speakeasy-created" client ID choice never worked against any tested identity provider and is gone; service account clients keep creating an app in the provider and pasting its client ID. (#7604, @bflad)

Every organization with one organization-wide sign-in now has a single MCP URL that gives each person every server they can reach, across every project, instead of adding servers to a client one at a time. Approving the gateway no longer waits on connecting every service behind it, and admins can withhold it without touching the sign-in it depends on.

Features

• One MCP URL connects every server you can reach — The MCP Servers page shows a Connect all servers button with your organization's gateway URL, /mcp/gateway/<organization-slug>. People sign in with their organization account, and the servers they see follow their access, so a server you're granted or lose shows up or disappears on your next request. Each server keeps its own sign-in. (#7521, @danielkov)
• Approve the gateway first, connect each server on its own page — The gateway's consent page now approves the gateway itself, showing how many of its servers are connected, with a Give access button that works before anything is connected. Each server gets its own page to connect, with no separate approval, since connecting is all it needs. A tool call to a server you haven't connected yet now links straight to that server's page. (#7565, @danielkov)
• Turn the organization gateway off (admin only) — Organization admins can withhold the organization gateway without deleting the sign-in it depends on, from a new Gateway page in organization settings. Turning it off answers every gateway route, including the MCP endpoint and connect pages, with a 404 starting from the next request. (#7582, @danielkov)