Changelog

Every organization with one organization-wide sign-in now has a single MCP URL that gives each person every server they can reach, across every project, instead of adding servers to a client one at a time. Approving the gateway no longer waits on connecting every service behind it, and admins can withhold it without touching the sign-in it depends on.

Features

• One MCP URL connects every server you can reach — The MCP Servers page shows a Connect all servers button with your organization's gateway URL, /mcp/gateway/<organization-slug>. People sign in with their organization account, and the servers they see follow their access, so a server you're granted or lose shows up or disappears on your next request. Each server keeps its own sign-in. (#7521, @danielkov)
• Approve the gateway first, connect each server on its own page — The gateway's consent page now approves the gateway itself, showing how many of its servers are connected, with a Give access button that works before anything is connected. Each server gets its own page to connect, with no separate approval, since connecting is all it needs. A tool call to a server you haven't connected yet now links straight to that server's page. (#7565, @danielkov)
• Turn the organization gateway off (admin only) — Organization admins can withhold the organization gateway without deleting the sign-in it depends on, from a new Gateway page in organization settings. Turning it off answers every gateway route, including the MCP endpoint and connect pages, with a 404 starting from the next request. (#7582, @danielkov)

With directory sync on, a role's page now shows exactly which directory groups and attribute values grant it, and MCP servers reachable only from a tailnet, VPN, or other private address can finally be added. More on this in Directory sync and roles.

Features

• See which directory groups and attribute values grant a role — With directory sync on, a role's page now lists the directory groups and attribute values that give it out, with member counts and links to the mappings on IDP and SSO, in place of a read-only member list. A role nothing is mapped to says so, with a shortcut to map one. (#7508, @qstearns)
• Add MCP servers that only resolve on your own network — Creating an MCP server whose clients connect to it directly no longer requires Speakeasy to resolve or reach its URL, so a server on a tailnet, VPN, or other private address now saves instead of failing with "invalid server url". (#7505, @qstearns)
• A warning before changing a shared sign-in (admin facing) — MCP server settings now confirm before replacing, attaching, or detaching a user session issuer that other servers share, naming which servers and clients would need to sign in again. (#7485, @bflad)
• Shadow AI is folding into Guardrails, Watchdog, and Risk Events (rolling out behind a flag) — Shadow AI becomes a policy type inside Guardrails with its own Access, Scope, and Review flow, a Watchdog tile, and a Risk Events category filter, instead of its own sidebar section. The relabeling of Watchdog's existing Shadow MCP tile to Shadow AI is live for everyone today. (#7425, @subomi)
• Google Antigravity joins the known-client catalog — Antigravity's desktop app and CLI are now recognized by client ID metadata presets and Shadow AI scanning, so organizations using CIMD presets don't need to add a custom client URL for it. (#7534, @bflad)

A batch of reliability and security fixes: organizations signing in from another Speakeasy product now get their trial instead of a demo gate, Directory Sync and SSO setup failures explain themselves, and agent and workload permissions are re-checked live instead of trusting a stale snapshot.

Bug fixes

• Signing in to an existing organization starts your platform trial — An organization admin who signs in to an organization that already exists from another Speakeasy product now gets the same 14-day enterprise trial a new signup gets, instead of landing on the book-a-demo gate. A member signing in doesn't start a trial, and an organization that already has one, is on a paid plan, or was created as a prospect is left as it is. (#7455, @alx-xo)
• Clearer errors when Directory Sync or SSO setup fails — Instead of one generic "failed to generate WorkOS admin portal link" message, setup failures now name a next step: wait and retry, verify a domain, or contact support. The setup wizard also says when it couldn't check your setup status, rather than showing every step as not done. (#6767, @alx-xo)
• Remote MCP server scopes are requested exactly as set — Speakeasy no longer appends standard scopes (openid, email, profile, offline_access) to the scopes an operator configured, so providers that advertise those scopes but refuse them for a given app no longer fail sign-in with invalid_scope. (#7496, @daviddanialy)
• Gateway sign-ins request the right server's scopes — Signing in through a gateway now discovers scopes from the specific MCP server the connection is for, instead of falling back to the identity provider's whole scope catalogue. (#7488, @daviddanialy)
• Prompt injection detection stays on the production model in the LLM risk engine mode — Switching an organization's risk engine to the llm mode no longer swaps out the dedicated prompt-injection detector; it keeps enforcing everywhere, while the fine-tuned model's verdict is recorded for comparison only. (#7511, @dennnis-ez)
• Clearer consent copy for identity-chained connections — A service that connects automatically once you give access now says so, instead of showing a bare "Retry" link that read like an error. (#7579, @daviddanialy)
• install --toolset picks up the right MCP URL — The CLI now reads a toolset's MCP URL from its server endpoint when the toolset itself reports no slug, instead of writing an unroutable URL or crashing when the toolset has no default environment. (#7486, @daviddanialy)
• Hosted MCP server address changes save correctly — Changing a hosted MCP server's slug or custom domain from its settings page now saves, instead of silently failing. (#7490, @daviddanialy)
• Agent policies can't exceed what you or the agent's owner can access — Saving or updating an agent's policy is now checked against both the configuring admin's and the agent's owner's own permissions, so an agent can no longer be granted access neither of them actually has. (#7513, @tgmendes)
• Workload sessions re-check the owner's current permissions — An agent's workload session and API keys now stop reaching a resource the moment its owner loses permission to it, rather than keeping the access the owner had when the session started. (#7561, @tgmendes)

Agent Identity, agent API keys, and workload sessions are no longer behind a rollout flag: every organization can create and authorize its own agents today. Uploading a new version of an OpenAPI source also gets a safety check, with a review of what it breaks before anything deploys. More on this in Agent identity and Sources.

Features

• Agent Identity is on for every organization — Agent Identity management, agent API keys, agent selection during MCP authorization, workload sessions, and assistant workload identity no longer sit behind rollout flags. Every organization can create agent identities, mint their API keys, and attach workload sessions today. (#7471, @danielkov)
• Review what an OpenAPI update changes before it deploys — Uploading a new version of an OpenAPI source now opens with a summary of breaking and warning changes, such as removed tools, new required inputs, and changed credentials, plus which MCP servers and how many of their tools are affected, all before anything ships. (#7439, @simplesagar)
• Start a risk policy from a use case or a plain-language description — Pick a ready-made use case, such as protecting customer data or blocking destructive actions in production, or describe the risk and review a drafted policy before the wizard opens prefilled. Prompt-based presets are still rolling out behind a flag. (#6796, @AshGodfrey)
• Identity chaining for MCP servers that share a sign-in with an identity provider client (admin only, rolling out behind a flag) — Enable identity chaining on a remote MCP server whose user session issuer trusts an IdP sign-in client, choose the scopes it requests, and disable it with a warning that everyone falls back to interactive sign-in. (#7344, @daviddanialy)

Bug fixes

• Project Assistants describe the platform by its current name — Existing Project Assistants created before the product's rename now run with the latest built-in instructions, so they refer to the platform as Speakeasy instead of its old name. Instructions a project has edited by hand are left as they are. (#7417, @adaam2)

Explore gets its first Speakeasy-built dashboard, two chart types for showing what made up a total instead of just how it moved, and the ability for agents to read, build, and lay out dashboards and widgets on your behalf. Opening a risk policy's details is also noticeably faster.

Features

• A built-in MCP & Tools dashboard — The Dashboards page now lists dashboards Speakeasy ships with the product, marked Speakeasy-built, alongside the project's own. MCP & Tools is the first: eight cards covering tool calls, failures, and the busiest servers, tools, clients, and people. It opens read-only; Duplicate copies it into an editable project dashboard with a saved widget per card. (#7260, @subomi)
• Stacked bar and stacked area charts — Explore and widgets can now draw a breakdown as a stack, answering what made up a total rather than how each series moved. A stack needs a Group by and one measure that adds up, a count or a sum; when a breakdown has more series than fit, the smallest are folded into one Other band so the height still reads as the true total. (#7256, @subomi)
• Agents can manage Explore widgets through Platform MCP — list_widgets, get_widget, save_widget, duplicate_widget, and delete_widget let an agent read and maintain a project's saved widgets with the same permissions as the dashboard. Every write previews first and commits only on confirmation, naming the version it read, so an edit made in the dashboard meanwhile is never overwritten. (#7419, @subomi)
• Agents can manage dashboards through Platform MCP — list_dashboards, get_dashboard, save_dashboard, duplicate_dashboard, delete_dashboard, edit_dashboard_layout, and save_dashboard_filters give an agent the same read, layout, and filter controls as the Dashboards page. Speakeasy-built dashboards stay read-only, so an agent duplicates one to change it. (#7420, @subomi)

Bug fixes

• Risk policy details load instantly — Every single-policy read used to count all of a project's chat messages to report stale analysis progress, which could take 25 seconds or more on busy projects. That counting, and the "View Progress" panel it powered, are gone. (#7422, @vishalg0wda)

Federated sign-in now works with identity providers that don't return an RFC 9207 iss parameter, including Okta's org authorization server, so Okta can sign people into the platform directly. A new Okta sign-in card in the dashboard walks through linking the agent and registering its public key, the consent screen now says when a service is already managed by your identity provider instead of showing it as disconnected, and every identity chaining change is now audited. More on this in Enterprise Managed Auth.

Features

• Federated sign-in works with Okta — Every federated sign-in now uses a per-client callback URL, /mcp/idp_callback/{clientID}, which binds the authorization response to its issuer and no longer requires the identity provider to return an iss parameter. This makes federated sign-in possible with Okta's org authorization server, which doesn't return one. Remote session clients now report the callback URL to register with the identity provider. (#7341, @daviddanialy)
• Set up Okta sign-in from the dashboard — A new Okta sign-in card registers the AI agent's linked app as the organization's sign-in client, shows the public key to paste into Okta and the redirect URI to register, and lists every sign-in issuer and whether it trusts Okta sign-in. The setup checklist walks through adding the agent's public key and activating the linked app in the order Okta requires. (#7343, @daviddanialy)
• The consent screen and readiness checks understand identity chaining — A service that identity chaining already serves now shows "Managed by your identity provider" on the consent screen instead of looking disconnected, with a secondary option to connect manually. Identity chaining changes (enabling, scope updates, disabling) are now audited on the remote session client, and the Platform MCP's get_xaa_readiness tool reports each server's chaining bindings and the callback URL to register. (#7342, @daviddanialy)

A long-standing bug blocked editing a block-all Shadow MCP policy to soften it from denying to warning; that's fixed, along with a gap that let kill switches and risk policies skip traffic served through the legacy MCP slug path. An administrator distributing an MCP server by URL now has their own write recorded as the Shadow MCP approval instead of needing a separate review. More on this in Shadow MCP allow and block lists.

Features

• An administrator's own write can stand as Shadow MCP approval — When an organization administrator puts a server added by URL into a plugin, or widens a plugin's audience, under a project's block policy, that write is now recorded as the Shadow MCP approval for exactly the audience it reaches, with the admin as requester. The project's enabled block policy is always enforced for user-supplied servers now, with no rollout flag gating it. (#7355, @simplesagar)

Bug fixes

• Editing a block-all Shadow MCP policy works again — A block-all policy, the default and what every policy the dashboard creates stores, can once again turn off its Shadow MCP detector or move off the Deny action, exactly as it always could before the disposition field shipped; the previous "cannot change the sources or action" error is gone. (#6921, @dennnis-ez)
• Kill switches and risk policies reach the legacy MCP slug path — Hosted MCP requests served through the legacy toolset-slug lookup now carry the toolset's canonical server when it has one, so kill switches and server-scoped risk policies on prompts/get and resources/read apply to them the same way they do on the endpoint path. (#7387, @daviddanialy)
• The Playground connects to a toolset's working server — A toolset now resolves to an enabled MCP server before a disabled canonical wrapper, so the Playground, session minting, and session management target a server that actually serves instead of 404ing on a disabled wrapper. (#7388, @daviddanialy)
• The role editor shows a blocked-only permission as blocked — A permission a role only blocks now shows a Blocked badge naming the server, instead of looking like a grant. Adding that permission from the picker now grants it next to the block instead of silently deleting the block. (#7412, @adaam2)
• Identity providers with many scopes or a logo read cleanly — Scope lists render as chips instead of one comma-joined string, providers with long URL-style scopes show only what follows the shared base, and logos keep their shape instead of stretching. (#7409, @qstearns)
• Saving a remote session client with no audience no longer fails — An empty audience field used to send an empty string, which the API rejected with a regexp error on every save. It's now omitted instead, leaving the stored value unchanged. (#7431, @daviddanialy)
• Hosted MCP server links open the toolset page — Links to a hosted server from audit logs, assistant entity links, and the server list now open its toolset page instead of the generic server page, which showed controls the server doesn't support. (#7386, @daviddanialy)
• Hosted server health charts exclude gateway member traffic — A hosted toolset's own server and the gateway members fronting the same toolset are now kept apart in Platform MCP diagnostics, health charts, and overview metrics, so a canonical server's numbers no longer include its members' calls. (#7390, @daviddanialy)
• The private network setup sheet suggests a Speakeasy hostname — The Tailscale setup sheet's example organization private hostname is now acme-speakeasy, replacing an older placeholder that referenced the product's previous name. (#7398, @bradcypert)

A dashboard's cards can now share one filter bar instead of each carrying its own: pick a date range and the fields a card can be filtered by, and every card on the page answers within it. Save filters stores what you picked as what the dashboard opens on for everyone, and Reset filters returns to that. Adding a widget to a dashboard now works from wherever that widget lives, not just from the dashboard itself. Explore's catalog gains a count_distinct aggregation and a skills dataset for ranking skill usage, and the same query engine is now available to Platform MCP once Explore is on for your organization.

Features

• Save a dashboard's filters as what it opens on for everyone — The shared filter bar sits above a dashboard's cards, offering a date range and the fields some card can be filtered by (user, agent, model, MCP server, status); every card answers within it. A dashboard opens on its saved filters, or the past seven days, until Save filters changes what it opens on next. (#7179, @subomi)
• Add a widget to a dashboard from wherever it lives — Add to dashboard joins the actions on a Widgets tab row or card and in the widget bar, picking one of the dashboards you can change or starting a new one with that widget as its first card. Saving the widget builder gets an Advanced section to place the new widget on a dashboard right away. (#7181, @subomi)
• Count the distinct values of a dimension in Explore — A count_distinct aggregation answers how many different tools, servers, sessions, or people were involved, wherever the analytics catalog, Explore, or a saved widget uses it. (#7252, @subomi)
• A skills dataset for ranking skill usage — A new dataset holds one row per skill invocation, so Explore, saved widgets, and dashboards can rank skills and count how many distinct skills were used, alongside the existing tool-call datasets. (#7257, @subomi)
• MCP server names in Explore match your Hooks display names — When two reported server names share one display name under Hooks settings, Explore now groups, filters, and counts them as one server instead of two. (#7258, @subomi)
• Platform MCP can run the same analytics queries Explore does — describe_analytics_catalog, list_analytics_dimension_values, and run_analytics_query let an agent ask the same questions Explore answers, in the same vocabulary; the three tools are switched on by the same flag as Explore. (#7261, @subomi)
• Plugin assignments gain an install mode for the device agent — An assignment can now be Required (installed, can't be turned off), Default (installed, can be turned off), or Available (off until the user turns it on); the observability plugin is always Required. (#7254, @bradcypert)
• Page a large tool-exposure read from Platform MCP — get_mcp now pages a server's tool list, returning the exposure version only on the page that completes the read, so a tool change can no longer be confirmed against a partly read list. (Organization admins, via Platform MCP.) (#7226, @simplesagar)
• Configure reusable signals and sensors for message classification — Organizations Speakeasy has enabled it for can define reusable signals and sensors, with multi-label, exclusive-choice, and ordered-score modes, from the dashboard or through Platform MCP. Classification itself doesn't run yet, so what you configure here doesn't classify anything today. (#6693, @disintegrator; #7239, @disintegrator; #6727, @disintegrator)

Bug fixes

• Risk findings in a prompt attachment show their context — The risk-only transcript now windows around the prompt an attachment was sent with, instead of returning nothing for findings that belong to the attachment rather than a message. (#7351, @bradcypert)
• A toolset containing platform tools is no longer auto-distributed as a plugin — Toolsets with platform tools, including MCP-backed wrappers, are now excluded from automatic role-plugin delivery; manual memberships, MCP access, and assistant execution are preserved. (#7347, @alx-xo)
• Mapping a custom domain root to a hosted server no longer adds a second endpoint — The root picker now offers a hosted server only when it's already served on that domain. (#7295, @daviddanialy)
• A hosted server's own wrapper takes precedence over a gateway member built from the same toolset — Publishing plugins no longer fails as ambiguous for a hosted server whose toolset also backs a gateway member, and legacy /mcp/<slug> calls now attribute correctly to that server. (#7294, @daviddanialy)
• Saving a legacy toolset no longer fails over an address already in use — The toolset now saves and stays in its legacy state instead of conflicting with another server over a hosted address or slug it isn't trying to claim. (#7359, @daviddanialy)
• A retried Platform MCP write no longer spends your rate limit twice — Retrying a write that already committed now returns its stored result for free, and expired idempotency receipts are swept hourly instead of kept forever. (#7224, @simplesagar)
• Platform MCP tool errors fail safely instead of leaking internals — An unrecognized tool error is now logged with its full cause and answered with a generic refusal instead of raw database or internal error text. (#7221, @simplesagar)
• The MCP page keeps your search term when you navigate back — Going back from a server no longer clears the search you had on the MCP list. (#7397, @qstearns)
• Toasts follow the dashboard's own theme — Toasts now match the dashboard's light or dark setting instead of the operating system's, so text like the repository link after adding marketplace collaborators stays readable. (#7381, @bradcypert)
• Plugin manifests with a token or API-key prompt pass validation again — Claude plugin user settings now include the required type and title fields the manifest needs, so these plugins pass Claude Code's validation. (#7350, @alx-xo)

A remote MCP server's upstream credential no longer has to come from each person who connects. Create a remote session client with a shared credential, and every caller reaches the upstream through it, obtained through an OAuth client credentials grant, with no per-user connect step; if the upstream rejects the token, the platform gets a new one and retries once before naming the server administrator. In the Access Hub, Claude Tag's guided setup drops its "not ready yet" note now that workload sign-in works end to end, and the Team Access tab shows the scopes a remote MCP server's connected clients actually request. More on the two credential models in Upstream credentials and on reading a server's access in Team Access.

Features

• Give a remote MCP server one shared upstream credential for every caller — Remote session clients can now be created with a single credential the client holds for itself, entered by hand as a client secret or key set with an issuer token endpoint, no metadata discovery required. Using that credential at request time obtains the upstream token through the OAuth client credentials grant for every caller, so nobody connects their own account; a rejected token gets one retry before the error names the server administrator instead of asking the caller to reauthorize. (#7335, @bflad; #7333, @bflad)
• Claude Tag's guided setup works end to end — Shared authorization servers for issuers on the dedicated authentication host now serve their own token endpoint, off the host that carries MCP traffic, and accept a workload grant that names no resource, exactly as Claude Tag sends when its Resource field is left empty; the token it issues works at every MCP server the issuer covers. The guided setup's "not ready yet" note is gone. (#7334, @bflad; #7348, @bflad)
• See the scopes a remote MCP server's clients actually request — The Team Access tab now shows each connected client's identity provider, issuer, and the scopes a login would request today, with a read-only summary for members who can view but not edit the server. (#7293, @daviddanialy)
• Register a platform outside the catalog with the same guided setup as Claude Tag — The Access Hub's forms for registering a custom platform, and for allowing and editing access under one, now come from the same definitions the catalog's guided setups use, with the same fields, checks, and wording. (#7297, @aa-wong; #7299, @aa-wong)
• Team Access rows show their matching plugin — A role row on an MCP server's Team Access tab now links to the plugin that distributes that server to the role, where one exists. (#7306, @alx-xo)
• The remote session client page leads with the identity provider — Settings folds into Overview, which now shows the identity provider's endpoints, registration methods, and supported scopes above the client's own editable settings. (#7353, @daviddanialy)

Bug fixes

• Stop forwarding Speakeasy's own credentials to remote MCP servers — Requests proxied to a remote MCP server no longer copy Speakeasy's own session, project, or tunnel headers upstream, and a remote header can no longer read its value from one of them; Authorization stays allowed as a source, since forwarding the caller's own upstream credential is what pass-through identity is for. (#7366, @ThomasRooney)
• Identity providers keep their discovered grant profiles — Creating or refreshing an identity provider from discovered metadata now keeps the authorization grant profiles it advertises, so identity chaining no longer reports a provider as unsupported right after it was discovered. (#7340, @daviddanialy)
• Block the Admin role's use or management of a server again — Setting the Admin role's use or manage line to "No access" on a server's Team Access tab no longer fails; only a block on viewing the server is still refused, since that would hide the Team Access tab from every administrator. (#7345, @adaam2)
• The people directory no longer repeats a person and stalls — A next-page cursor now carries the exact activity timestamp a page ended on, so a person whose most recent activity was excluded usage no longer shows on every page while the rest of the list stays out of reach. (#7217, @simplesagar)
• Chat search pagination no longer repeats or skips chats — A next-page cursor now carries the exact start time a page ended on, fixing both a chat that showed on every page and a list that stopped early. (#7222, @simplesagar)

The role editor's MCP access tab is now a per-server picker: choose Specific servers or All servers, then pick from every MCP server in the project with fuzzy search, Select all/Clear all, and a side sheet to scope a server to specific tools or forbid it outright. mcp:read and mcp:write move to Platform access, so MCP access now holds only mcp:connect. In the Access Hub, connecting Claude Tag is now a guided setup instead of a manual runbook: enter your Anthropic organization ID, pick an agent and optional tags (admission through the catalog rule itself lands in a follow-up release). More on managing trust in the Access Hub in Workload identity, and on risk policy scope in Guardrails.

Features

• The role editor's MCP access tab is a per-server picker — Choose Specific servers or All servers, then pick from every MCP server grouped by project with fuzzy search, Select all/Clear all, and a side sheet to scope a server to specific tools or forbid it outright. mcp:read and mcp:write move to Platform access, so MCP access now holds only mcp:connect. (#7317, @qstearns)
• The Access Hub catalog gains a guided Claude Tag setup — Connecting Claude Tag from the Access Hub catalog now walks through an Anthropic organization ID, an agent, and optional tags instead of a manual runbook. Admission through a catalog rule doesn't take effect yet; that lands in a follow-up. (Organization admins; setup only, admission pending.) (#7164, @aa-wong)
• Risk policies ask client sessions or specific MCP servers up front — The policy Scope step now opens with two option cards, Client sessions and Specific MCP servers, each naming what it covers and what it needs, instead of starting on the detector matrix. Client sessions only appears once hooks are configured for the project; without them the step explains why and links straight to hooks setup. (#7231, @dennnis-ez)
• Okta Integration Network installs authenticate with a client secret — An Okta identity provider installed from the Okta Integration Network can now authenticate to the customer's Okta org with the client ID and secret the install issues, instead of requiring the custom-app private key flow. A pending connection can switch between the two methods until its client ID is submitted. (#6942, @daviddanialy)
• Remote identity providers can send no scope when nothing else decides one — An organization admin can now set a remote identity provider to send no scope parameter instead of its whole supported list, for sign-ins with no scope from the client or the resource. The provider's Overview and Settings pages show the new fallback choice. (Organization admins managing remote identity providers.) (#7198, @daviddanialy)
• A remote MCP server's login scopes can be pinned and traced to their source — A server's Identity settings can now pin the scopes its logins request, and the platform resolves a login's scopes from the protected resource's own advertised and challenged list before falling back to the identity provider's catalogue. Rolling out behind a flag to Speakeasy's own organizations first; every other organization keeps today's behavior. (Organization admins; rolling out.) (#7196, @daviddanialy; #7272, @daviddanialy)
• Speakeasy-AI headers and environment variables are now canonical — Speakeasy-AI-* request headers and SPEAKEASY_AI_* environment variables are now the names to set and copy everywhere, continuing what the CLI and Functions SDK already switched to. Every Gram-* header and GRAM_* variable keeps working as a deprecated alias. (#7321, @adaam2)
• The dashboard, admin console, and CLI read Speakeasy throughout — User-facing text across the dashboard, admin dashboard, CLI help and output, server error messages, consent pages, MCP server info, and API descriptions now names the product Speakeasy. Header names, environment variables, package names, and code identifiers are unchanged. (#7265, @adaam2)
• The "No Identity" option is now called "Manual" — The third Remote MCP identity option, and the warnings that name it, now read "Manual"; the description is unchanged. (#7296, @qstearns)

Bug fixes

• The Inspect tab can list tools on a custom domain again — The remote MCP relay no longer copies an upstream server's own CORS headers onto its response, which had been blocking the browser from loading the Inspect tab's tool list for custom-domain servers that send their own CORS headers. (#7268, @danielkov)
• Claude Code plugin installs now auto-update — The install snippet registers the marketplace under its exact name with auto-update on, instead of leaving plugins pinned to their first version with no error. The snippet, the hooks setup dialog, and the generated marketplace README now agree. (#7134, @mfbx9da4)
• The Anthropic Compliance import no longer misses new messages in old chats — The importer now walks the organization's chat list ordered by last update instead of relying on an activity type Anthropic never records for new messages, so chats that only gained messages after their first import are picked up again. Existing integrations restart from a 24-hour window on their next poll. (#7322, @subomi)
• The import keeps going when one Claude chat can't be retrieved — A chat Anthropic has hard-deleted or retired through retention, but that still appears in the chat list or activity feed, is now skipped and reported as unavailable instead of stalling the whole poll. (#7326, @subomi)
• One oversized message no longer fails its whole risk scan batch — Batch risk scan inputs are now bounded to 50 KiB when they're loaded, so a single large message can't take down the rest of the batch's analysis. (#7193, @vishalg0wda)

An assistant session in Agent Sessions used to show only the assistant's name. Now the name links to the agent identity the session ran as, and a muted "for" next to it names and links to the person it acted on behalf of, in the session list, the session header, and the Details popover. Session owners on every other row are clickable too. Building custom tools gets a naming cleanup: the functions SDK now publishes under Speakeasy names, with every existing import, environment variable, and config file still working as a deprecated alias. More on this in Agent Sessions and Add tools with TypeScript.

Features

• See who an assistant session ran as and acted for — The assistant name in an agent session links to the agent identity it ran as (or to the assistant itself when it has no agent identity), and the member it acted on behalf of is named and linked right next to it, in the session list, the session header, and the Details popover. Non-assistant session owners are now clickable too. (#7232, @danielkov)
• Build functions with the Speakeasy-named SDK — The functions SDK now publishes as @speakeasy-api/functions, with its Functions class and fromFunctions/withFunctions MCP helpers. Every existing import, config file, deploy file, build output, environment variable, and CLI profile path keeps working as a deprecated alias, so no existing project needs to change. (#7235, @adaam2)

The command-line tool is now called speakeasy. Install it with brew install speakeasy-api/tap/cli or npm i -g @speakeasy-api/cli; the old gram binary keeps working as a deprecated alias, so nothing breaks today. The functions SDK's build and deploy steps move into the CLI too: speakeasy functions init|build|dev|push|stage replace the standalone gf tool and the create-function scaffolder, which now print a notice pointing at the new commands. More on this in CLI overview and speakeasy stage function.

Features

• Install and run the CLI as speakeasy — The CLI's command name, help text, and install instructions now say speakeasy. Running it as gram still works and prints a one-line deprecation notice; profiles stay in ~/.gram/profile.json, so there's nothing to re-authenticate. https://ai.speakeasy.com/cli.sh and /cli.ps1 now redirect to the install scripts on every platform host. (#7130, @adaam2; #7187, @adaam2)
• Build and deploy functions with speakeasy functions — speakeasy functions init scaffolds a project from a built-in template (--template functions or --template mcp), build compiles it, dev runs its dev script, and push builds, stages, and deploys it using your speakeasy auth profile. The old gf build/gf push commands keep working but print a notice pointing at the replacements, and speakeasy push now deploys to the API URL from your profile instead of always targeting https://app.getgram.ai. (#7130, @adaam2)

An assistant's tool calls and audit trail used to be attributed to whoever set it up or talked to it. In organizations with agent identity credentials enabled, a new assistant now gets its own dedicated agent, so its activity shows up under its own name, with its own policy, and can be suspended or transferred independently of any person. Existing assistants keep working exactly as before until an admin explicitly upgrades them. Assistant access also moves onto its own assistant:read/assistant:write permissions instead of riding along with project:*, and the Team Access tab can now explain, for any member, exactly why they can or can't reach a given MCP server. More on this in Agent identity and Roles and permissions.

Features

• Give an assistant its own agent identity — An assistant's Identity tab can set it up with a new agent you name or an existing agent of the project you own or can authorize, starting with access to every MCP server and skill in the assistant's project. The agent can be renamed, transferred, or narrowed like any other agent, and deleting the assistant withdraws its trigger workload identities while leaving the agent in place. The upgrade endpoint and the Platform MCP upgrade tool accept the same choice. (#7107, @danielkov; #7079, @danielkov)
• Assistant access gets its own permissions — Dedicated assistant:read and assistant:write scopes replace the old reliance on project:*, which no longer opens assistants on its own. Grants can cover every assistant, every assistant in selected projects, or a single assistant, and agent policies can hold them too. Admins keep full access and members keep read access by default. (#4899, @danielkov)
• See exactly why a member can or can't reach a server — The MCP server Team Access tab gains a Check access section: pick a member to see whether they can connect to, view, and manage the server, and which rule decides it, including the directory role mapping behind a role for organization admins. (#7095, @bflad)
• A blocked server no longer blocks every server — Fixed a bug where blocking one MCP server for an agent-backed assistant turn removed access to every MCP server on that turn instead of just the blocked one. (#7202, @danielkov)

Some organizations now have a recorded home among the platform's hosts, such as ai.speakeasy.com instead of app.getgram.ai. When that applies, signing in, opening an old bookmark, or clicking an emailed link now lands you on your organization's own host automatically, with the browser carrying your session across in one hop instead of asking you to sign in again. Everything that points at a server, an agent gateway, or an install page, including gateway install pages and agent network allowlists, keeps working through the move. More on the allowlist side in Device agent.

Features

• Your organization's links all lead to its own host — Invitations, setup and access-request emails, trial and billing emails, weekly usage summaries, and custom-domain health alerts now build their links from the organization's recorded host instead of the shared site URL, so an org's emails and its dashboard always agree. The block page link and risk policy links a hook denial returns follow the same rule. (#7084, @adaam2; #7128, @adaam2)
• Moving hosts no longer asks you to sign in again — When your organization lives on a different platform host from the one you're using, the dashboard and the login page now hand your session over to that host through a one-time code and open the same page there, instead of bouncing you to a second login. (#7131, @adaam2; #7146, @adaam2)
• Agent network allowlists list every platform host — Device-agent "Remote network access" and the Cowork allowed-domains step now list every platform host for the environment, so an allowlist set up before an org moved hosts keeps working after it moves. (#7127, @adaam2)

Bug fixes

• A redirect loop guard no longer traps you on the old host — Going back to the old platform host in the same tab now moves you to your organization's host again; the guard against redirect loops lasts 15 seconds instead of the life of the tab. (#7176, @adaam2)
• A gateway's install page no longer says "Server Not Found" — Gateways with private network access enabled now render their public install page, and a gateway on a custom domain opens its install page on the host you're signed in to, with the custom-domain URL in the instructions. (#7148, @daviddanialy)
• Opening a shared MCP install page while signed in now opens it — Previously it landed you on your organization's home page instead. (#7167, @simplesagar)
• A retried checkout now replays the same success and cancel URLs — Stripe Checkout now records its return URLs on every intent, including ones created on the shared site host, so a retried checkout still works after an organization's host changes. (#7126, @adaam2)

Explore's Widgets tab now has a companion Dashboards tab: lay saved widgets out on a shared 12-column grid that everyone in the project sees the same way. Any member can create a dashboard and add the project's saved widgets to it (the same widget can be placed more than once, and editing it updates every placement); its creator or anyone with project write access can drag and resize cards. A dashboard can be renamed, duplicated with its own independent copies of its widgets, and deleted. Widgets also gained a Cards view, the dashboard's own date presets, and a shared filter bar that every widget on a page answers within.

Features

• Lay saved widgets out on a dashboard — Create a dashboard from the project's saved widgets, drag and resize its cards on a 12-column grid, and share it with everyone in the project. Duplicating a dashboard copies its widgets too, so the copy is fully independent, and every change autosaves as it lands. (#7175, @subomi; #7173, @subomi)
• A shared filter bar and time range for everything on a page — Widgets and Explore now share the dashboard's date presets (15 minutes to 90 days), and a page's date range and filters apply to every widget placed on it: the page's range replaces each widget's own window, page filters are ANDed with each widget's own filters, and dragging across a time chart narrows the page. (#7122, @subomi; #7121, @subomi)
• A Cards view for the Widgets tab — Toggle between List and Cards to see every saved widget drawn as a card, answering its own question, with the same actions as its row. Each card runs its query only once it scrolls into view. (#7133, @subomi)
• See where a widget is used before you change it — The Widgets tab gets a Dashboards column counting the dashboards a widget is on and naming them on hover; saving edits to a widget on a dashboard, or deleting it, now says which dashboards that reaches. (#7177, @subomi; #7174, @subomi)

Clicking a Risk Events row now opens a detail drawer for every finding kind, including the call path and, with the right permission, the full scanned tool-call payload. Okta admins can paste the Admin Console URL directly, and the setup walkthrough matches Okta's current console. The gateway now speaks MCP protocol revision 2026-07-28 on every hosted and gateway surface, and the Platform MCP picks up a round of admin tools for creating projects, plugins, and MCP servers without leaving the chat. The rest of this release is smaller fixes across sign-in, plugins, and billing. More on this in Risk Events, Okta, and Platform MCP.

Features

• Investigate any finding from one drawer — Clicking a Risk Events row opens a detail drawer for every finding kind, including MCP findings, showing the call path from client to gateway to server. With the chat:read permission, the drawer can reveal the full scanned tool-call payload with each finding highlighted in place; every reveal is audited. (#7071, @vishalg0wda)
• Paste your Okta Admin Console URL directly — The Okta connection form now accepts a pasted Admin Console address instead of requiring the bare organization URL, and the setup instructions and Cross App Access checklist match Okta's current console, including each server's issuer. (#7149, @daviddanialy)
• The gateway now speaks MCP protocol revision 2026-07-28 — Hosted MCP servers, gateways, agent gateways, and platform toolsets now serve the 2026-07-28 protocol revision alongside earlier ones. A client that declares it gets that revision's behavior (server/discover, spec-mandated HTTP statuses, no session IDs); clients on an earlier revision see no change. (#7184, @bflad; #7155, @bflad)
• Claude Tag conversations show who's really talking — Agent Sessions now attributes a Claude Tag session's participants through the Slack directory independently of session ownership, shows their session rollup, and displays parent and subagent relationships and Slack channels. (#7103, @chase-crumbaugh)
• One shared authorization server for user session issuers — A user session issuer in shared mode now serves a single OAuth authorization server for every MCP server it covers, with clients naming the server they want and each access token bound to that one server. (Organization admins managing remote identity providers.) (#7140, @bflad)
• Platform MCP can create and rename projects and plugins — An agent can now make an empty project from a display name, and create or rename a plugin, so setting up an MCP server no longer has to stop to send an admin to the dashboard. (Organization admins, via Platform MCP.) (#7115, @simplesagar; #7114, @simplesagar)
• Platform MCP can turn your deployed functions into an MCP server — create_mcp_from_functions creates a server and tool list from a project's already-deployed function tools, through the same path the dashboard uses. (Organization admins, via Platform MCP.) (#7118, @simplesagar)
• Plugins stay current automatically, and admins can force a republish — A new skill version, a skill rename or archive, and MCP server or sign-in changes now republish the plugins that carry them promptly instead of within the hour. republish_plugin lets an admin catch a stale plugin up on demand, and get_plugin now shows the status of the latest publish attempt. (Organization admins, via Platform MCP.) (#7111, @simplesagar; #7112, @simplesagar; #7113, @simplesagar)
• Platform MCP can pause and resume a data export route — Turn one data export route off and on without touching its destination; data produced while paused is dropped, not delivered later. (Organization admins, via Platform MCP.) (#7117, @simplesagar)
• Platform MCP sets up sign-in automatically for more MCP servers — Providers that support Client ID Metadata Documents but not dynamic client registration are now classified and connected automatically instead of being sent to manual setup, and inspection now supports MCP 2026-07-28-only servers. (Organization admins, via Platform MCP.) (#7156, @simplesagar; #7096, @bflad)

Bug fixes

• A project's marketplace name no longer changes under you — Renaming the organization, changing the project slug, or deleting the organization's oldest project no longer renames an already-published plugin marketplace, which would otherwise break every config that references it by name. (#7138, @mfbx9da4)
• Sign-in to some remote MCP servers no longer fails on a trailing slash — The RFC 8707 resource indicator is now sent exactly as the server is registered, trailing slash included, so providers that match it exactly against their published metadata no longer reject sign-in. (#7153, @simplesagar)
• The MCP connect page shows the right name and logo — A card whose own identity provider entry has no name or logo now borrows the catalog's, instead of showing an internal identifier with no logo. (#7092, @daviddanialy)
• PII findings on JSON content point at the right text — Matches found in JSON tool-call content now point at the matched text in the original content instead of an internal rewrite. (#7070, @vishalg0wda)
• Billing's spend caps load even with a disabled inference key — The billing page's spend caps no longer 500 for an organization with a disabled platform key; usage for a disabled key is now read through the provisioning key instead of the key's own rejected credentials. (#7093, @bradcypert)
• Tool rankings link straight into Tool Logs — Clicking a tool under an MCP server's Top tools rankings now opens Tool Logs already filtered to that server and tool, keeping the active time range, instead of requiring the filters to be rebuilt by hand. (#7168, @simplesagar)
• The tunneled MCP setup no longer shows a CLI command that never existed — The tunneled setup snippets drop the CLI tab, which told people to run a tunnel run command the CLI never had; Kubernetes and Docker remain. (#7230, @adaam2)
• The Dashboard/Headless switch animation no longer glitches — Switching between Dashboard and Headless no longer leaves stray starfield streaks or an empty strip beside the scrollbar, and the two cards now lay out within the visible viewport. (#7030, @alx-xo)
• Vercel Connect and Conductor are recognized automatically — Both are now admitted to the Client ID Metadata Document catalog, so Vercel Connect's per-connector clients authenticate automatically and Conductor's desktop app is detected for Shadow AI scanning. (#7152, @bflad; #7150, @bflad)

ChatGPT Desktop is now one of the clients an MCP server's install page sets up, with the Developer mode and custom connector steps written out and the right authentication step for the server in question. An install page shared into a document, a wiki, or a chat also opens instead of returning 403, so the link you send someone works where they click it. More on installing a server into a client in speakeasy install.

Features

• ChatGPT Desktop on the install page and in the CLI — The hosted install page gains a ChatGPT Desktop card and an Add to Client entry, with a modal covering the Developer mode and custom connector steps. The authentication step follows the server: OAuth for an OAuth-gated server, a token for a private one, an explanation for a public server that expects user-provided headers ChatGPT cannot send, and nothing for a plain public server. speakeasy install chatgpt-desktop prints the MCP URL and the same steps, and rejects a non-HTTPS URL. (#5320, @speakeasyforgebot)

Bug fixes

• An install page opened from another site no longer returns 403 — A browser GET to /mcp/{slug} that accepts HTML keeps safe-method semantics in the Origin check, so an install link shared anywhere renders the page. Cross-site SSE GETs are still rejected. (#7076, @ThomasRooney)

Clicking a person and reading their violations no longer means a trip to Risk Events with a substring filter. Each identity has a Findings page under Security that lists every risk finding for that person, newest first, filterable by category or rule, with a row expanding to the flagged message. Counts on the Security tab link into it pre-filtered, and matching now covers every identifier the identity reports rather than only the first. More on this in Identities and Risk events.

Features

• A Findings page on every identity — The Security section of an identity gains a Findings page listing the person's risk findings newest first, filtered by category or rule, with each row expanding to the flagged message. Clicking a category or rule on the Security tab opens Findings already filtered, and the Open in Risk Events link filters on every identifier the identity reports. Viewing the page needs org:admin; the session link and the flagged message need chat:read on that session, and a match locked without it now says which permission is missing, in Risk Events and the Watchdog drawer too. (#6639, @AshGodfrey)

An agent connected to the Platform MCP can now run the investigation an administrator would otherwise do by hand in the dashboard: search a project's tool calls across every MCP server, find the people behind them by partial identity, and read one person's call volume, failures, and most-failing tools, all with masked identities and no tool inputs or outputs. The same connection reviews proposed skill improvements end to end, including a guided workflow that walks the queue, and puts a newly pushed tool onto an existing MCP server. Per-endpoint MCP access tokens are also bound to the host that minted them, so a token minted elsewhere is refused with the usual challenge. More on this in Platform MCP and Improving skills with agent feedback.

Features

• Search a project's tool calls from Platform MCP — search_tool_calls lists one project's tool calls across every MCP server over up to 30 days, narrowed by tool name text, error text, outcome, configured server, person reference, and custom attribute filters, with opaque cursors and masked identities. list_attribute_keys reports the custom @-prefixed and filterable system keys present in the window. System attributes carrying tool content, an HTTP header, or a person's identity are refused as filters and withheld from key discovery, and paging holds the window fixed at the interval the first page read. (#6853, @simplesagar)
• Find a person and read their metrics without their raw identity — search_users finds the people observed in one project's telemetry by partial identity over up to 30 days, returning masked identities, categorical activity evidence, last-seen times, and short-lived project-scoped references. get_user_metrics_summary takes one of those references and returns the person's call volume, failures, the servers their tools name, and their most-failing tools. Both are organization-admin reads, metered on the sensitive diagnostics budget, and audited as attribution reads. (#6856, @simplesagar)
• Put a newly pushed tool onto an existing MCP server — list_project_tools reports the tools a project produces and the function or API document each came from, get_mcp reports the tool list a hosted server exposes, and add_tools_to_mcp and remove_tools_from_mcp change that list one tool at a time under confirmation, an expected version, and an idempotency key. The change is computed inside the transaction that reads the current list, so a concurrent edit can no longer silently drop tools, and the result names the plugins the change republishes. (#6896, @simplesagar)
• Approve or dismiss a proposed skill improvement from Platform MCP — approve_skill_suggestion and dismiss_skill_suggestion carry out the same review the dashboard offers. Approving records the reviewed changes, or a corrected SKILL.md, as the skill's new version and closes the suggestion; changes proposed after the review are never taken. (#7097, @simplesagar)
• A guided workflow for working through the suggestion queue — The Platform MCP plugin ships a review-skill-suggestions workflow skill that walks an administrator through a project's suggested skill improvements: reading the queue and the evidence behind each change, deciding per change, then approving, correcting, or dismissing it with explicit confirmation, and checking the skill's new version. (#7099, @simplesagar)
• Triage a large suggestion queue before reading any diff — list_skill_suggestions accepts omit_diffs to return each proposed change's ID, rationale, and evidence counts without its diff, so an agent can rank a long queue first. Diffs are still returned by default. (#7098, @simplesagar)
• Per-endpoint MCP access tokens are bound to the host that minted them — A token whose iss names another host, whether the server URL, an extra platform host, or a custom domain, is refused with the usual 401 challenge, so the client refreshes or reauthorizes on the host it is actually using, and the rejection is counted with an issuer_mismatch reason. Dashboard-minted tokens, tokens without iss, private network ingress, and internal callers keep their current behavior. (#7080, @adaam2)
• Registered callback URLs no longer move when a server URL changes — GRAM_OUTBOUND_CALLBACK_URL fixes the redirect origin for existing remote session clients, and GRAM_REGISTRATION_CALLBACK_URL records a new origin on organization-owned clients created from now on. Remote session clients report their callback_url, and the dashboard shows the redirect URI a new client will register instead of deriving it from the server URL. (#6984, @adaam2)
• The remaining stored callback URLs are pinned too — The MCP login identity provider callbacks, including the federated callback sent to customer providers, the Platform MCP callback, and the assistant MCP auth client identity and redirect URI all follow the outbound callback origin rather than the server URL. A federated login's callback uses its trusted client's recorded origin where it has one. With the default configuration nothing changes. (#7082, @adaam2)

Bug fixes

• Agent sessions are named again — Sessions captured through hook ingest kept the truncated first prompt they were seeded with, and archived inference conversations all read the same stand-in title. Both paths now schedule title generation, which recognizes those stand-in titles and replaces them while leaving manually chosen names and channel labels alone. Titles are generated over a bounded slice of the transcript, so a session with multi-kilobyte turns no longer times out before it is named. (#6797, @speakeasyforgebot)
• Inference transcripts without a session id continue one conversation — A transcript delivered with no session id now continues the conversation that already holds its history instead of starting a new one on every request. Products that omit the session id previously produced one chat per inference call with the full transcript copied into each, multiplying stored messages, risk scans, and model calls by the length of the conversation. (#7086, @dennnis-ez)
• Slack previews of platform links show the logo — The preview now uses the opaque sticker logo, which Slack can decode and which stays visible in dark mode, in place of a broken image. (#7072, @simplesagar)
• Project favorites survive a bounce to the login page — The session-expiry cleanup snapshots theme and favorites after auth confirms there is no session, instead of deleting them because the document was never classified. (#7073, @simplesagar)

A finding raised by an MCP tool call can now be opened to see the content that triggered it, the same as a finding raised in a chat. Reveal used to fail outright on those findings, so an investigation that started in Risk Events or the Watchdog drawer stalled at a masked value with nothing behind it. Risk policies scoped to an MCP server also stop over-reaching: a policy aimed at named users, roles, or agents no longer fires for every other caller of a matching tool. More on this in Risk events and Guardrails.

Features

• Evidence behind an MCP tool-call finding can be revealed — Reveal a masked match on a finding that came from a tool call and see the content that matched, under the same chat:read check and the same audit entry as a chat finding. Findings recorded before this change read "Evidence not stored" rather than failing with an error. (#6946, @vishalg0wda)

Bug fixes

• An MCP-scoped risk policy applies only to its audience — A policy targeted at specific users, roles, or agents no longer applies to other callers of a matching MCP tool, so a narrow policy stops producing findings for people it was never aimed at. (#7035, @vishalg0wda)
• Prompt-based guardrails keep judging when provider credit runs low — The prompt-injection and prompt-policy judges are capped at 8192 completion tokens, so a model provider no longer refuses them outright when the remaining credit on a key sits below the model's full output ceiling. A credit refusal or a truncated completion now reports itself as such instead of a generic error. (#6999, @bradcypert)

Where a remote or tunneled MCP server is bound to your identity provider for enterprise-managed authorization, its upstream token now comes from the signed-in user's provider rather than from a connection the user has to establish server by server. The platform exchanges the user's retained ID token for an identity assertion, redeems it at the server's authorization server, and reuses the result until shortly before it expires. Readiness reflects what those exchanges actually observe, so a server that looks confirmed but refuses real traffic says so. Organization administrators with an Okta connection also get MCP servers suggested from their synced Okta applications, rolling out behind the okta-connections flag. More on connecting providers and registering their clients in Remote identity providers.

Features

• Upstream tokens obtained from the signed-in user's identity provider — A remote or tunneled server with a ready identity chaining binding obtains its downstream access token by exchanging the user's retained ID token at the server's authorization server, so users are not asked to connect those servers one at a time. An interactive connection still takes precedence, and a server without a binding keeps its existing sign-in behavior. (#6902, @bflad)
• Readiness reflects what exchanges observe — A confirmed server reads Verified once an exchange succeeds, returns to Not confirmed when the provider rejects the target, and reads Not working when scopes, the agent app's authentication, or the server's own authorization server refuses. A confirmation whose issuer URL does not match the server's authorization server now reads Not working until the mismatch is corrected, including existing confirmations. Result changes are recorded in the audit log, and confirming again clears an earlier result. (#6926, @daviddanialy)
• MCP servers suggested from your synced Okta applications — Organization administrators with an Okta connection can list the MCP servers their synced Okta applications point to, then dismiss or restore each suggestion. A suggestion flags an app instance whose sign-on mode cannot support Cross App Access and marks a server the organization already runs. Rolling out behind the okta-connections flag. (#7003, @daviddanialy)
• Add a suggested server straight from the Okta Applications tab — Suggested catalog servers appear on the Okta Applications tab with add, dismiss, and restore actions, so a server observed in the directory becomes a configured one without leaving the page. (#7038, @daviddanialy)
• Identity providers get their own tab — The IDP and SSO page now opens on an Identity providers tab in place of Enterprise Managed Auth, matching the order of the work: a provider such as Okta is connected first, and enterprise-managed authorization is one use of that connection. The Okta page's Setup tab keeps only the connection itself. (#7032, @daviddanialy)
• Pick client scopes from a multi-select — Choosing scopes for a manually configured identity provider client lists the scopes the server and the provider advertise, and a scope that is not listed can still be typed in and added. (#7068, @daviddanialy)

Workload trust belongs to the organization, so the Access Hub now lives at the organization level, in the organization sidebar under Secure, for anyone holding workload:read or workload:write. Old project URLs redirect there. A trusted platform and each machine allowed under it can also be edited in place instead of being removed and re-registered, with every edit recorded in the audit log alongside the state before and after. Note the breaking change below if you call the saved-query API. More on how roles map to scopes in Roles and permissions.

Breaking changes

• The explore saved-query service is removed — explore.listQueries, createQuery, updateQuery, and deleteQuery are gone; Explore saves through the new widgets service instead. The query:* audit actions and the audit_log.query_event_v1 webhook event are retired rather than removed: nothing emits them any more, but audit entries already written keep their labels and existing webhook subscriptions stay valid. (#7060, @subomi)

Features

• The Access Hub is one organization-wide page — The Hub is at /<org>/access-hub, listed in the organization sidebar under Secure for anyone holding workload:read or workload:write, and old project URLs, including a trusted platform's page, redirect there keeping the issuer, query, and hash. The workloadIdentities API no longer needs a project when called from a dashboard session, which reads and writes the organization tier; API-key callers still name a project. (#7010, @aa-wong)
• Edit a machine's allowed access in place — Each machine on a platform's page has an Edit action that opens the access form prefilled, so its label, tags, and assigned agent can be changed without removing and re-allowing it. The subject and its match kind stay fixed once access is allowed, reassigning the agent also applies to the same subject's access at the other tier, and each edit is recorded in the audit log with the machine's state before and after. (#7007, @aa-wong)
• Edit a trusted platform in place — A platform's page has an Edit action that opens the registration form prefilled, where its name, description, tags, and JWKS URI can be changed. The issuer URL and the wildcard admission setting stay fixed once a platform is registered, and each edit is audited with the platform's state before and after. (#7005, @aa-wong)
• The Access Hub reads more plainly — The page opens with a one-line summary of what it is for, each platform card shows only its name, description or issuer URL, and tags, and on a platform's page the issuer and keys URLs sit on labeled lines of their own. (#7004, @aa-wong)
• Tailscale private access works on any plan once enabled — An organization enabled for Tailscale private access keeps it on any plan, instead of the dashboard warning that private access is no longer available after a move off Enterprise. (#7014, @TristanSpeakEasy)
• List a project's chats from Platform MCP — A metadata-only list_chats tool lists one project's chats over a bounded window with masked participants, whether risk was present, timestamps, message counts, and opaque cursors. It never returns titles, message content, or raw identities, so an agent can find the conversation worth investigating without reading it. (#6857, @simplesagar)
• Explore's saved questions become widgets — A widget keeps a question together with the chart that draws it, and the chart is checked against the question on save and again on read, so an impossible pairing fails visibly instead of rendering an empty frame. Any member can list, get, save, update, and duplicate a widget, and duplicating is how a widget is shared, giving the caller their own copy. Deleting someone else's widget needs project write access, and every change is audited. (#7058, @subomi)
• Role plugins are prepared automatically for new organizations — A new organization gets a plugin created or reused for each application role, ready to configure for distribution rather than assembled by hand. An auto-created plugin is empty and non-default, exposes its origin, and never replaces an existing plugin's name, contents, or audiences. (#7041, @alx-xo)

Bug fixes

• Plugin assignments follow a deleted role out — Deleting an organization or global role, including a directory-synced one, removes its plugin assignments, while assignments for other roles and organizations are left alone. (#7043, @alx-xo)
• The catalog install's Guardrails step loses a redundant button — Switching the recommended policy off and adding the server already installs it without a guardrail, so the Skip for now button is gone. (#7012, @dennnis-ez)
• Long toolset slugs resolve again — A stored slug longer than 40 characters is now accepted on lookup instead of being rejected as invalid. (#7066, @simplesagar)

Adding MCP servers through the Platform MCP no longer stops at five per project, so an assistant migrating a large client's servers can finish in one pass. Workload identity management also gets a dedicated home: the Access Hub replaces the Workload Identities page with a card grid of trusted platforms and their allowed machines, where a wildcard admission's reach is stated where it's written instead of asked about up front.

Features

• Platform MCP keeps adding servers past five per project — Registering MCP servers through the Platform MCP no longer stops at five per project, including projects where some servers were later deleted. (#6964, @qstearns)
• The Access Hub replaces the Workload Identities page — Trusted platforms and their allowed machines now live in a card grid with side-pane forms, full-width search, and typed confirmation for destructive actions. Registering a platform no longer asks whether wildcard admission is allowed; the admit form infers a rule's match kind from a trailing * and states which subjects it would admit and which agent they'd inherit at the point it's written. Platforms and machines can also carry a description and tags, shown on their cards and included in search. (#6948, #6820, @aa-wong)
• Rotate the Observability plugin's ingest credential from the dashboard — Organization admins can mint a replacement hooks-scoped key from the Plugins page, shown once in plaintext, and choose whether the previous key is revoked immediately or kept valid for a 7-day grace window. Installed plugin copies and consumer MCP keys are left untouched. (#6831, @bradcypert)
• A Ranked chart type joins Explore — Whole-window results can now draw as horizontal bars, one per group and ranked largest first, the same style already used on MCP & Tools. (#6961, @subomi)
• Managing an agent's upstream connections no longer needs a second login — Agent connection management now reuses the authentication already established by the OAuth consent flow, including on custom MCP domains, instead of requiring a separate dashboard session. (#6944, @danielkov)
• Guardrails scoped to specific MCP servers (rolling out) — Risk policies can target individual MCP servers, built-in Platform MCP toolsets, and tools, with flag and block actions, and findings now show the server, tool, and outcome instead of an untitled session. The MCP server filter is live now on Risk Events; the rest is rolling out behind the gram-mcp-scoped-policies flag. (#6935, #6937, #6923, #6938, #6947, @vishalg0wda)
• Platform MCP ranks a project's skills by impact — get_skill_insights ranks skills by activations, sampled efficacy, session cost, and estimated time saved, or compares one skill's versions against each other. (#6858, @simplesagar)
• Copy device agent org values straight from setup — The Device Agent Setup tab gains an Organization values card with copy buttons for org_slug and org_token, and the token button now reads "Re-generate token" once a token exists, minting an additional token rather than rotating the deployed one. (#6966, @svadrutk)
• A remote identity provider's scope override is easier to find before it bites — The provider's Overview and Settings tabs now show the scope override directly, and a warning with a link to the provider's settings appears everywhere a client's scopes are edited, since the override makes those edits inert. Platform admins can additionally see and migrate clients still running in legacy callback compatibility mode. (#6813, @qstearns)

Bug fixes

• The identity provider picker works at any catalog size — Remote MCP server settings no longer show an attached identity provider as missing once the platform catalog grows large: the picker now searches on the server, loads more on demand, and lists each tier (project, organization, platform) with its own "more" row. (#6969, #6974, @qstearns)
• Blocked private network cleanup tells you what to do next — When Tailscale rejects a saved OAuth client, cleanup now shows "Cleanup blocked" with next steps instead of staying on "Cleaning up" indefinitely, and keeps retrying through longer outages. (#6959, @TristanSpeakEasy)
• Risk Events stop going empty when every policy is disabled — Findings from disabled (but not deleted) policies now keep showing, marked inactive, so turning a policy off no longer hides its history. (#6924, @vishalg0wda)
• Sessions minted from the dashboard are labeled "Dashboard" — The connections list now shows a name for sessions Inspect mints to call an issuer-gated remote MCP, instead of a blank client name. (#6985, @simplesagar)
• Logins, billing, and Slack links stay on the platform host you're using — Platform MCP, the install page, the Stripe billing portal, Polar checkout, and Slack unfurls now all return to the platform host a request arrived on, such as ai.speakeasy.com, instead of falling back to the default. (#6838, #6842, @adaam2)
• The "Request access" link lands you somewhere you're already signed in — MCP server and Platform MCP access-denied errors now point the "Request access" link at the platform host the request came in on. (#6979, @adaam2)
• Device agent fleet config saves again after admin-only release controls are set — Organization admins can save their fleet configuration again once a Speakeasy admin has set the update channel or blocked versions, instead of hitting a permissions error. (#6982, @adaam2)
• Unproxied remote MCP servers save without a connectivity check — Servers that clients connect to directly can now be saved without first passing a reachability check, since those servers are often unreachable from our infrastructure. (#6963, @qstearns)

Administrators can now block an MCP server for a role, including a directory-synced one, and still give individual members of that role access to it by name, without restructuring role membership. The command palette also gets faster to use: reversible actions apply on the first Enter with an Undo in the toast, and directory-mapped roles are now visible everywhere the dashboard lists who holds what. More on this in Identity provider setup and User sessions.

Features

• A direct grant now outranks an inherited role block — A grant made directly to a person for a specific resource outranks a block they inherit from a role or from everyone, so an admin can block a server for a whole role and still hand access to one member by name. The MCP server access page shows who keeps access through their own rules before a role or everyone is removed from a server. (#6887, @bflad)
• The command palette's reversible actions run in one keystroke — Enabling or disabling a server from the ⌘K palette now applies on the first Enter, with an Undo in the toast that restores exactly the visibility the server had. Actions render under their own heading, separated from navigation matches, and only irreversible actions such as publishing the plugin marketplace still ask twice. (#6882, @simplesagar)
• Choose when a Slack assistant replies — Set a trigger to reply only when @-mentioned, to join a thread after an @-mention and keep replying there until it steps out, or to any message in its channels. An assistant following a thread catches up on what it missed when an @-mention brings it back, and it never replies to its own messages. (#6847, @danielkov)
• A remote MCP server's User Identity client is easier to read and change — A connected client now reads as "Connected" with how many people are signed in and its scopes, with an Advanced link to the client. Clearing it offers an existing client, Auto-Configure, or Manual credentials, and Auto-Configure can choose between CIMD and DCR when a provider supports both. remoteSessions.count reports how many distinct people hold a live session through the client. (#6906, @qstearns)
• Directory-mapped roles show up everywhere roles do — Members who get a role through a directory group or attribute mapping already had its permissions; now the Team page, Roles & Permissions, role filters, and plugin reach all show them too, marked as coming from the directory since they can't be removed there directly. (#6904, @qstearns)
• AI integration credentials are checked before they're saved — Saving a new or changed API key now probes the provider first, so a key missing the entitlement its provider requires is never stored and never starts polling that was always going to fail. See AI Integrations. (#6611, @speakeasyforgebot)
• Migrate existing client MCP servers into the platform from any agent client — The Platform MCP add-existing-mcp-servers workflow now works from any agent client, reports local servers unchanged, and can optionally move migrated servers onto the organization's private Tailscale network. (#6894, @TristanSpeakEasy)
• Tunneled MCP servers carry a verifiable caller identity — Signed caller assertions now use the tunneled server's saved resource identifier as their audience, shown on the server's settings alongside the organization ID the assertions carry. (#6723, @ThomasRooney)
• Platform MCP gains six tools for risk, usage, skills, and access — list_risk_findings, list_risk_findings_by_chat, and get_risk_rule_breakdown read the same data as Risk Events; get_tool_usage_summary breaks tool calls down by what they reached; mark_risk_findings_false_positive and unmark_risk_findings_false_positive dismiss or restore Watchdog findings; and list_skill_distributions and undistribute_skill manage which plugins carry which skills. The project's managed assistant can also list and inspect its own plugins and look up organization members by name. (#6850, #6852, #6855, #6861, #6854, #6851, @simplesagar)

Bug fixes

• Remote MCP servers verify on protocol version 2026-07-28 — The verification probe now asks a server to describe itself with server/discover and falls back to the initialize handshake, so servers that only implement 2026-07-28 are recognized as MCP servers instead of being rejected. (#6871, #6872, @bflad)
• MCP clients are prompted to reconnect instead of retrying a dead upstream session — When an issuer-gated server's upstream connection can no longer refresh, clients now get a 401 that explains the upstream needs reauthorization instead of a silently repeated rejection. (#6876, @bflad)
• The MCP scope picker keeps focus after you narrow a server — Unchecking every tool on a server's scope now normalizes to "every tool on this server" instead of being rejected, and the picker no longer jumps to the first server in the list after you deselect one with many tools. (#6878, @dennnis-ez)
• Okta setup checklist follows the order the Okta console expects — The public-key steps now run save-key-URL-first, then switch client authentication, with required API scopes and admin roles listed one per line. (#6877, @daviddanialy)
• Meta MCP connections clean up reliably — Member calls and consent verification now use the official MCP SDK client, preserving tool result precision and cleaning up legacy sessions even after a failed connection. (#6870, @bflad)
• Remote MCP readiness checks stop retrying a failure five times over — A failed readiness check now logs why and checks once instead of retrying its connection repeatedly. (#6890, @simplesagar)
• Removing yourself from a risk policy's audience fails safely — Self-removal from a policy's audience now fails closed instead of risking a table-wide grant lock, while administrator-requested audience changes still go through. (#6888, @svadrutk)
• New organizations keep working through a control-plane outage — Hook enforcement now fails open by default for newly created organizations; existing organizations keep whatever fail-open or fail-closed setting they already chose. (#6913, @mfbx9da4)