Changelog

Putting several MCP servers behind one address no longer waits on a feature flag. Every organization can group servers into a gateway today, and gateways pick up two things single servers already had: a consent-screen tool picker and, for agents that need to work across a lot of tools at once, Code Mode. People connecting through a gateway can also hide the servers they don't use.

Features

• MCP gateways are available to every organization #8076 - The MCP page always lists gateways now, and Add a server always offers New gateway, so grouping servers behind one address no longer needs Speakeasy to flip a flag first. (Author: @ThomasRooney)
• Gateway consent gets the tool picker #6816 - Approving a gateway connection now offers All tools (live), All tools (frozen), or Specific tools, the same choice single MCP servers already had. Frozen and Specific selections serve from a fast cached catalog instead of refreshing every member's tools on each connection. (Author: @ThomasRooney)
• Switch a gateway to Code Mode #6978 - A gateway can expose one execute tool that runs short Python scripts with live tool search, schema lookups, and authorized calls across every hosted, remote, and tunneled member, instead of handing an agent every member's full tool catalog up front. (Author: @ThomasRooney)
• Hide the gateway servers you don't use #8139 - Hiding a server removes it from your own gateway tools without touching anyone else's access. The device agent's menu bar and a new hover icon on the consent page both read and set the same preference. (#8179, #8178, @daviddanialy)
• See which MCP servers still need sign-in #8001 - The device agent now reports your sign-in state for each MCP server in your plugins, with a link that signs in from the browser, or a link to request access when you don't have it. (Author: @bradcypert)

Bug fixes

• A gateway keeps its discovery mode until you reconnect #8095 - Changing a gateway's default discovery mode no longer swaps a connected client's tools mid-session; a tool call the current mode can't serve now says to reconnect instead of failing as an unknown tool. (Author: @ThomasRooney)

A risk policy could already flag or block a matching MCP tool call. Now it has a third option: hold the call until a named approver says yes, then let exactly one retry through. Approvers decide from Guardrails or straight from a Slack DM, and every project gets the MCP server an agent needs to ask for approval set up automatically. This is rolling out behind a feature flag; ask your account team to turn it on.

Features

• Require approval for tool calls #7726 - Guardrails gets a new policy use case: choose the tools it covers, name approvers as specific people or roles, then review held calls from a Tool approvals tab where each argument sits on its own row beside the agent's reason, with Approve and Deny. (#7712, #7713, @mfbx9da4)
• Approval requests arrive as Slack DMs #7728 - Each named approver gets a direct message from the Speakeasy app with the tool, the agent's reason, and every argument as its own field, plus Approve and Deny buttons that resolve the same request Guardrails shows. (Author: @mfbx9da4)
• Every project gets a built-in approvals server #7739 - Agents on the Default plugin can call request_approval right away. Speakeasy creates a dedicated <organization>-<project>-approvals server and adds it to the plugin automatically, so a team no longer has to wire one up by hand before approvals work. (Author: @mfbx9da4)

Bug fixes

• Held calls on proxied servers come back as a usable result #7732 - A call waiting on approval now returns as a tool result marked isError, carrying the request token and the steps to request approval, instead of a JSON-RPC error that agents treat as a plain failure. (Author: @mfbx9da4)

Setting up a new MCP server through Platform MCP now takes fewer calls and less guessing, whichever client is asking. Clients with a tight tool budget, such as Codex Agent Plugins, get a small fixed surface instead of the full catalog, and a server added by URL now gets a name and address worth reading instead of the raw URL. More on this in Platform MCP.

Features

• One-click install steps per client #8212 - get_my_install_instructions now returns a ready path for each client: a one-click Cursor link, the claude mcp add command for Claude Code, a config.toml block and codex mcp login command for Codex, an opencode.json block, and a generic JSON config for everything else, with no credentials included. (Author: @adaam2)
• A lighter tool list for budget-constrained clients #8149 - Hosts that cap how many tools or how much context a server can use, such as Codex Agent Plugins, now see a small fixed surface, catalog search, a describe tool, a call tool, and execute when Code Mode is available, instead of roughly 150 tools, selected automatically per harness. (Author: @adaam2)
• First-run tools sit next to discovery #8210 - Catalog search, candidate inspection, adding a server, find_mcp, readiness checks, install instructions, and docs search now appear directly beside the discovery tools on hosts like Codex and ChatGPT, so the first few steps take one call instead of a search, a describe, and a call. (Author: @adaam2)
• Remote MCP servers get readable names and addresses #8222 - Adding a server by URL without a display name now names it after what the server reports about itself, or its host name, and derives its slug and address from that name instead of the raw URL. (Author: @adaam2)

Bug fixes

• Chat in to connect sign-in #8213 - When a server's OAuth client can be set up automatically, the agent now offers to connect sign-in right in chat instead of only pointing to the dashboard. (Author: @adaam2)
• Adding a server twice says so #8208 - Adding a server already in the project now reports it as already there instead of claiming it was newly added. (Author: @adaam2)
• Stale readiness checks refresh themselves #8209 - An expired readiness result is rechecked automatically instead of being reported as stale until a check is forced. (Author: @adaam2)
• Clearer sign-in and tool count reporting #8211 - Catalog search results leave out tool counts that aren't known instead of reporting zero, and describe how each server signs in in plain words. (Author: @adaam2)
• Docs search gets a name that matches what it searches #8203 - The setup-guide search tool is now search_speakeasy_docs, and hosts that see only the discovery tools are told to use it for how-to and setup questions. (Author: @adaam2)

Tool Logs filters now narrow to what's actually there as you apply them, and organization administrators get a ready-made Explore dashboard for what risk policies have caught. Alongside that: agent identities can borrow a personal connection instead of needing a shared credential, hosted MCP servers move onto one settings page, and admins get a single place to manage the credentials servers use upstream.

Features

• Tool Logs filter counts narrow as you filter #8148 - Each filter group now lists only the values that still have calls under the filters already applied, while its own values stay selectable. The time range moved next to the search bar, and the summary and timeline panel takes less vertical space. (Author: @adaam2)
• See who an agent acted for #7927 - A call an agent made on someone's behalf now reads "agent ↳ on behalf of <person>" in Tool Logs, and filtering by that person includes the agent's calls made for them. (Author: @adaam2)
• Delegate your personal connection to an agent, or block one from using it #8013 - An agent identity can now use a personal OAuth connection its owner, or another authorized editor, hands it, instead of requiring a shared credential. Anyone can also block a specific agent from their own connection without managing the agent, and "All servers" is offered only when every server is actually reachable with the agent owner's and your own permissions; agent bindings stay on the current connection as it's reauthenticated. (#7944, #8017, #8168, #8225, @mfbx9da4)
• Hosted MCP servers move onto the MCP server page #7942 - Settings that used to live on the toolset page, tools, resources, prompts, and team access, are now on the server's own page like every other server kind, and old toolset links redirect automatically. (#8009, #8021, #8016, @daviddanialy)
• A Security & risk dashboard for organization admins #7908 - Explore gains a risk_findings dataset, counts only, never the matched values or the chats they came from, and a ready-made dashboard breaking findings down by category, rule, policy, agent, team, and person. (Author: @simplesagar)
• Explore gets Signal Intelligence #7693 - Query signal patterns across conversations through the same analytics API and Platform MCP tools, with exact session counts, top-session concentration, and comparisons against the previous window. (#7696, #7700, @disintegrator)
• Manage the credentials your MCP servers use upstream #7933 - Organization admins can list every upstream auth client, see which servers offer each one, rename, enable, or disable it, and decide who may use it, all from one place instead of each server's own settings. (#7934, @danielkov)
• A shared Connections view across gateways #7974 - See every upstream connection for project and Organization Gateways in one place, searchable by identity and filterable by server or provider, with authorization deadlines shown separately from token expiry. (Author: @bflad)
• Duplicate and correct remote session clients #7976 - Copy a client's settings to register a new one in one step, or fix a client's ID in place instead of deleting and recreating it; a corrected ID asks affected users to reconnect once. (#7980, @bflad)
• See the sessions your agent produced #8110 - Agent owners without chat:read can now see their own agent's sessions on the agent page's Overview and Sessions tabs, and chat.list accepts an agent_id filter. (Author: @speakeasyforgebot)
• Share an Okta org across organizations #8145 - More than one Speakeasy organization can now connect and verify the same Okta org, instead of the second one failing with "this Okta org is already connected to another organization." (Author: @qstearns)

Bug fixes

• Device agent enrollment no longer needs organization read access #8123 - Organization members can complete device-agent enrollment without also holding organization read access. (Author: @qstearns)
• Organization role changes apply even when WorkOS is early #7993 - A membership role update from WorkOS now applies within about a minute even when its webhook arrives before the event is readable, instead of waiting for the organization's next WorkOS event. (Author: @TristanSpeakEasy)

The Speakeasy Agent's menu bar can now show which MCP servers live inside each assigned plugin, with a server count per plugin that expands into the actual list and a link to a server's dashboard page when you can read it. Granting or revoking MCP access through a role, or changing which audience a server serves, now reaches devices within seconds instead of waiting for the next hourly republish. More on this in Device Agent.

Features

• The menu bar lists each plugin's MCP servers — agent.getPlugins now returns the servers inside every delivered plugin in their display order, so the Speakeasy Agent menu bar can show a server count per plugin row and expand it; a server's dashboard link appears only when you hold read access to it. (#7952, @bradcypert)
• The Speakeasy Platform MCP is listed in the official MCP registry — Agent clients and AI search that discover servers through registry.modelcontextprotocol.io can now find the Platform MCP as com.speakeasy.ai/platform. (#7597, @adaam2)
• Kit assistants can opt into a GKE-backed runtime (new assistants only) — Eligible new assistants with a persisted MCP attachment and issuer setup can run under an independent workload identity with its own inference credentials, instead of borrowing the authority of whoever started the conversation; existing assistants and conversations are not migrated. (#7711, @danielkov)

Bug fixes

• Role and audience changes reach devices in seconds, not hours — Changing a role's grants or an MCP server's audience now republishes the affected role plugins right away instead of waiting for the hourly republish sweep, so a newly granted or revoked server shows up on enrolled devices almost immediately. (#7967, @simplesagar)
• MCP tool calls that report an error now count as failed — A call that answers HTTP 200 with isError: true now counts as failed in MCP server health, Platform MCP diagnostics, and per-user error flags, instead of counting as a success. (#7778, @daviddanialy)
• The MCP servers list shows the right tool count again — The tool count on a hosted MCP server now counts only tools it still serves from the project's latest deployment, so tools from removed sources or renamed operations no longer inflate the number. (#7882, @daviddanialy)

Tool calls that answer with an in-band error inside an HTTP 200 now count as failed everywhere the platform reports on MCP health, so Tool Logs, Platform MCP diagnostics, and per-user error flags finally agree with what your agents actually saw. The MCP servers list also now counts only the tools a server still serves, so a removed source or a renamed operation no longer inflates its tool count. Plugin assignments gain an install mode per audience, so one team can be required to have a plugin while everyone else keeps it optional. More on this in Tool Logs.

Features

• Set a plugin's install mode per audience — Assignments now carry their own mode: Required, On by default, or Available, so a plugin can be mandatory for one team and optional, or off by default, for another instead of sharing one setting across every audience. (#7255, @bradcypert)
• The Speakeasy Platform MCP is listed in the official MCP registry — Any client that discovers servers through registry.modelcontextprotocol.io can now find the Platform MCP at com.speakeasy.ai/platform. (#7597, @adaam2)

Bug fixes

• Tool calls that return an in-band error now count as failed — A tool result with isError: true inside an HTTP 200 response used to read as a success; MCP server health, Platform MCP diagnostics, and per-user error flags now classify it as failed, matching how hook-observed tool errors already counted. (#7778, @daviddanialy)
• The MCP servers list shows how many tools a server actually serves — Its tool count now matches the toolset page: tools from a removed source or a renamed operation no longer inflate the number shown on server cards and table rows. (#7882, @daviddanialy)
• Role and audience changes reach devices in seconds, not hours — Changing a role's grants or an MCP server's audience now republishes the affected plugins right away, instead of waiting for the hourly republish sweep. (#7967, @simplesagar)
• The new-agent wizard no longer loses its draft on reload — Reloading the page past the first step used to open the Install step with an empty draft and a broken "Issue a key" button; it now restarts at the first step instead. (#7929, @adaam2)

Org Gateway now waits for an administrator to turn it on, and turning it on comes with a real audit trail: review every role's effective MCP access, inspect what each person can reach, and remove or block specific grants from Settings or Roles & Permissions. People who have already approved a client on one server behind a shared authorization server now skip the consent screen on another server under the same issuer, as long as nothing about their access changed. More on this in Organization gateway.

Features

• Org Gateway requires an administrator to opt in, with a full access review — Review organization-wide MCP access by role before enabling, inspect each person's effective assignments, remove server-specific grants or block role access, and open client-specific connection instructions from the Organization Gateway card or Roles & Permissions. (#7611, @chase-crumbaugh)
• Approvals carry over across servers behind a shared authorization server — An identified person's saved tool selection and session length now auto-apply to another server under the same issuer and OAuth client, with the browser checking current tools before any click; a new server, a changed tool inventory, or a missing permission still asks for full consent. (#7606, @bflad)
• Each MCP server on a shared sign-in can use its own upstream OAuth client — Servers and gateway members sign in through the client configured for them instead of one client shared by every server on the issuer, and the consent screen offers each server only its own clients. (#7653, @danielkov)
• Set up directory role mappings in bulk, and review what changed since (organization admins) — previewDirectoryRoleSetup and applyDirectoryRoleSetup map every directory group and attribute value to a role in one pass, and a new review queue raises directory changes that need a decision, a group with no role, a changed attribute value, or a mapped group that has gone from the directory, with email and webhook notifications once items have waited 15 minutes. (#7722, #7725, #7781, @TristanSpeakEasy)
• Directory mapping and member pages show more about where access comes from (organization admins) — Mappings report whether their source is still active or missing, and members list their directory groups and which mappings currently grant them a role, so a role reached through two groups shows both. (#7715, #7826, @TristanSpeakEasy)
• Search chats from the Platform MCP — search_chats and read_chat search messages by text, owner, or participant and read surrounding context, gated by chat:read and audit logged. (#7734, @ThomasRooney)
• Preview and confirm a deployment redeploy or rollback from the Platform MCP — redeploy_deployment retries or rolls back a whole project deployment with the existing authorization and audit workflow, and reuses the same deployment on a retried request instead of creating a duplicate. (#7900, @simplesagar)
• OAuth connection failures name the real reason — A failed login now shows the identity provider's standard OAuth error code, or says the provider was unreachable, instead of a generic "upstream token exchange failed"; a provider outage now answers with a retryable error instead of a flat failure. (#7618, @daviddanialy)
• Tunnel agent status reaches the dashboard (network administrators) — Connected tunnel agents, target network checks, and MCP request history now show in the dashboard; agents report aggregate HTTP progress without collecting payloads or making MCP calls. (#6874, @ThomasRooney)
• An MCP server's Identity settings flag a shared OAuth client — If a server's OAuth client also signs in other MCP servers, its User Identity settings now say so, since changing or rotating that client changes sign-in for all of them. (#7644, @danielkov)

Bug fixes

• Legacy Claude Code hook requests stop timing out — The endpoint now answers within five seconds using the organization's fail-open or fail-closed setting when a policy check runs long, instead of letting older curl-based hook scripts block with "HTTP 000"; the slower check still finishes in the background. (#7135, @mfbx9da4)
• A configured MCP server header can no longer read your Speakeasy credential — Creating or updating a header that sources from the caller's Authorization request header is now refused, since that header can carry the Speakeasy session credential and must not be forwarded to an upstream server under another name. (#7821, @daviddanialy)
• An MCP server's own URL is rejected as its OAuth client_id — The request now fails fast with a hint to check the client ID setting, instead of retrying and failing with a retryable error after fetching that URL as a metadata document. (#7862, @bflad)
• Risk policy checks look at only the latest exchange again — Anthropic inference hook verdicts no longer re-check a whole conversation, so long conversations stop timing out and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Directory role mappings can't exceed 20 roles per source, and inactive directories stop granting roles — Saving more than 20 roles on one group or attribute value now fails clearly, and roles mapped through a deleted directory no longer contribute to anyone's access. (#7829, #7313, @TristanSpeakEasy)
• A session moved between organization hosts keeps the right organization selected — Opening the dashboard on the legacy host no longer resets the organization you picked on your organization's own host. (#7915, @adaam2)
• Deleting a server no longer breaks a multi-server risk policy — Deleting an MCP server or gateway now removes it from the scope of every risk policy that also targets other servers, so those policies can still be saved; a policy left with no target is deleted, as before. (#7902, @daviddanialy)
• A custom domain that isn't verified and activated no longer breaks an MCP server's issued URLs — The Playground URL and the issuer of dashboard-minted session tokens now fall back to the server's platform endpoint, or to /mcp/{slug}, until the custom domain is ready. (#7753, @daviddanialy)
• The device agent's Windows installer link works again — The stable installer links moved from /v1/install/ to /rpc/install/, since production never routed the old path to the server and the Windows setup step was saving the dashboard's HTML instead of the installer. (#7916, @mfbx9da4)
• Hosted MCP servers list correctly again when their toolset is gone — Listing MCP servers no longer returns servers backed by a deleted toolset, the hosted server summary now includes the toolset's description, and server reads report whether any endpoint, including a custom domain still activating, actually routes to it. (#7754, @daviddanialy)

Approving an MCP server under a shared authorization server no longer means approving it again on your next visit: an unchanged approval is now reused automatically, and only a changed tool list, upstream permission, or a server you haven't seen yet brings back the full consent screen. Organizations with directory sync get a review queue for the changes that actually need a decision: a new group with no role, a new attribute value, or a mapping whose source has disappeared from the directory, plus a bulk setup flow for mapping everything else in one pass. More on this in Shared authorization servers.

Features

• Skip repeat consent for MCP servers you've already approved — Reconnecting a client to a server under a shared authorization server now reuses your saved approval and its tool selection automatically, instead of showing the consent screen again. A new server, a changed tool inventory, or a missing upstream connection still asks for approval, and withdrawing consent clears every saved approval for that server. (#7606, @bflad)
• MCP servers that share a sign-in can each use their own upstream OAuth client — Servers behind the same shared authorization server, including gateway members, now sign in through the upstream client configured for each one individually instead of a client shared by the whole issuer, so one server's credentials no longer leak into another's. (#7653, @danielkov)
• Review directory changes that need a role, and map the rest in bulk — The SSO tab now lists directory groups and attribute values that showed up with no role, and mappings whose group or value has disappeared from the directory, so admins decide instead of just noticing them in the table. "Set up in bulk" maps every remaining unmapped group and attribute value in one reviewed step, reusing an existing role with the same name where one exists. Admins can also turn on email reminders for pending reviews. (#7725, #7722, #7781, @TristanSpeakEasy)
• See where the directory hands out a role from the server's own Team Access list — An MCP server's Team Access list now shows which directory groups and attribute values grant each role, including a link back to the review queue when one of them has been removed from the directory. (#7830, @TristanSpeakEasy)
• Org Gateway now requires an administrator to opt in — Turning on the organization-wide MCP gateway now walks admins through a role-by-role access review first, with one shared view for inspecting and adjusting effective access by role or by person, available from both the gateway settings and Roles & Permissions. (#7611, @chase-crumbaugh)
• Every kind of MCP server now shows in one list — The MCP Servers page and command palette list hosted, remote, tunneled, and unproxied servers together instead of fetching and filtering them separately, so a server no longer goes missing from search because of how it's backed. (#7754, @daviddanialy)
• Find skills and agent identities from Command K — Searching the command palette by name now also surfaces skills and registered agent identities, opening straight to their overview page instead of requiring a trip through the sidebar. (#7887, @simplesagar)
• Headless devices can enroll and authenticate as workloads — An admin can issue a single-use join token so a headless box, such as a one-off VPS, registers its own key and enrolls as a workload, then polls for its assigned plugins' MCP servers and sends hooks with a short-lived workload token instead of holding a long-lived agent API key. (#7450, #7451, #7404, @bradcypert)

Bug fixes

• OAuth sign-in errors now say why — A failed MCP connection login now names the identity provider's actual OAuth error, such as invalid_grant or invalid_client, instead of a generic "upstream token exchange failed" that required a support round-trip into server logs. (#7618, @daviddanialy)
• Legacy Claude Code hook requests no longer time out — A slow risk scan could leave an older curl-based hook script waiting past its own timeout and blocked with HTTP 000, even in fail-open organizations. The check now answers within a 5-second budget and falls back to the organization's fail-open or fail-closed setting if it needs more time. (#7135, @mfbx9da4)
• Long conversations no longer slow down Anthropic inference hook checks — Risk verdicts on Anthropic inference now scan only the latest exchange instead of rescanning the whole transcript, so scan time stays flat as a conversation grows and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Deleting an MCP server or gateway no longer blocks saving policies that also cover other servers — A risk policy that targeted several servers kept the deleted one's ID, so the next save failed with "MCP server does not belong to the project." Deleting a server or gateway now removes it from every policy's scope at the same time. (#7902, @daviddanialy)
• Device agent installer links on Windows now download the real installer — The stable installer link returned the dashboard's HTML instead of the .msi, so the Windows setup step saved a web page under the installer's filename. (#7916, @mfbx9da4)
• MCP server headers can no longer be configured to leak your session token upstream — A configured header can no longer read the inbound Authorization header as its source, which could forward your Speakeasy credential to an upstream server under another name. Reading an upstream credential from a separate header still works. (#7821, @daviddanialy)

Gateway owners can now pick how agents discover tools behind a gateway, and every organization gets the consent screen's tool picker instead of only the ones it was rolled out to. Directory-synced organizations can also give a group or attribute value more than one role at once.

Features

• Choose Direct or Progressive tool discovery for a gateway — Direct lists every qualified member's tools in one bounded page instead of discovering them one call at a time, which suits MCP clients that can't use progressive discovery reliably. A connection can override the gateway's default from consent or Inspect, and the organization gateway offers the same choice across every project a person can reach. Available to every organization. (#6812, @ThomasRooney)
• The consent screen's tool picker is available to every organization — Narrowing an approval to specific tools from the consent screen no longer needs an admin to find and turn on a separate setting first; it works wherever the screen is eligible. Tool selections already saved from earlier approvals keep being enforced. (#7589, @ThomasRooney)
• Give a directory group or attribute value more than one role at once — Directory-synced organizations can add or remove roles on a mapping independently instead of replacing a single choice, with chips that collapse into a "+N more" popover when a row is full and a save that cannot silently overwrite a set changed elsewhere. (#7307, #7311, @TristanSpeakEasy)
• Add several MCP servers to a plugin at once from a searchable sheet — Plugin setup now uses the same server picker as the organization gateway: search by name or slug, see each server's logo and kind, and add many at once instead of one <select> submission at a time. Servers whose MCP is turned off show as unavailable instead of failing after selection. (#7662, @qstearns)
• Find a member by their complete email through the Platform MCP — Organization admins checking a named colleague's MCP access can now search by their exact email address and get a match even when fewer than five members would otherwise match, so the lookup no longer comes up empty for a small organization. (#7623, @simplesagar)
• Create gateways and set their members from the Platform MCP — An admin can now ask an agent to put a set of MCP servers behind one gateway endpoint, instead of doing it from the dashboard; the new tools create a gateway with its members in order or replace a gateway's membership outright, all or nothing. (#7510, @qstearns)
• Agent Hooks Protocol clients can block unsafe content, not just observe it (for harnesses that speak AHP) — A compatible client sending tool calls, prompts, and model responses through POST /ahp can now have a policy deny or replace unsafe content before it reaches the model, and can upload text attachments for the same scanning, instead of only capturing events after the fact. (#7300, #7672, #7679, @danielkov)

Bug fixes

• The MCP & Tools dashboard loads again on high-traffic projects — Its charts used to sort every event in a 7-day window, which could exhaust the analytics database's memory and take other dashboards down with it; they now read from a table that already holds one row per call. (#7626, @subomi)
• Assistants stop going silent in Slack for people with many permissions — A large permission set could grow an assistant's authorization token past the request header limit, so the turn silently failed to start. Permissions are now checked live instead of carried in the token, which also means a permission someone loses stops applying to their in-flight turns immediately. (#7661, @danielkov)
• The organization gateway lists only servers you can actually use — Servers whose authentication the gateway can't supply, or that are built for assistants rather than general use, no longer show up on the consent screen or in list_servers only to fail when called. (#7594, #7648, @danielkov)
• Risk findings consistently honor disabled rules and policy scopes — Findings written for the upcoming findings store could skip a policy's disabled rules and category scopes, and a transient scan failure could be dropped instead of retried; both now match the rules the existing findings pipeline already applies. (#7660, @vishalg0wda)
• Long conversations stop timing out on every turn under Anthropic-based risk checks — The verdict budget assumed a 10-second timeout while Anthropic's default is 5 seconds, so once a conversation's unscanned history grew past what fit in that window, every later message re-scanned it all and timed out again, failing open. Verdicts now scan only what's new plus a bounded backlog. (#7731, @vishalg0wda)
• Attaching a toolset to an assistant can no longer turn on its MCP server without write access — Attaching a toolset whose hosted server is off now requires mcp:write on the toolset, closing a path where a caller who could only connect to a toolset was able to turn its server on. (#7607, @daviddanialy)
• The Platform MCP's Claude Code install leads with the quick commands again — Setup starts with /plugin marketplace add and /plugin install instead of a settings file edit, with the auto-update settings snippet shown as the next step instead of the only option. (#7621, @simplesagar)
• MCP sessions served through identity chaining stop asking for a reconnect every hour — Refreshing a grant on a server with no interactive upstream session used to always report that a reconnect was needed; refresh now asks identity chaining directly and only falls back to a reconnect when one would actually fix it. (#7572, @daviddanialy)

The tool picker on MCP consent screens is no longer something an admin has to turn on: every organization now gets it by default, so anyone approving a connection can scope it to the tools they actually want. The dashboard also retires the old "Remote Identity Providers" name. Wherever an upstream OAuth issuer shows up, from the organization page to an MCP server's Authentication tab, it is now called an Authorization Server, matching what it has always done. More on this in Authorization servers.

Features

• Every organization now gets the consent screen's tool picker — The "Tool filtering on consent screens" setting is gone, so the tool picker on third-party consent screens is on for everyone with no per-organization opt-in; tool selections already saved under the old setting keep being enforced. (#7589, @ThomasRooney)
• Remote identity providers are now called Authorization Servers — The rename reaches the organization page, an MCP server's Authentication tab (formerly "Connected services"), the attach and modify sheets, and Platform MCP's setup guidance, so the name matches what the upstream OAuth issuer actually does. (#7384, @adaam2)
• Gateways choose Direct or Progressive tool discovery — Gateway owners pick a default discovery mode, and a connection can override it from consent or Inspect; Direct lists member tools in bounded, concurrent pages so one slow member can't block the rest. (#6812, @ThomasRooney)
• MCP server reads now summarize their backing toolset — Reading an MCP server now includes its toolset's tool count, selection mode, and primary endpoint in one response, so integrations no longer need a second call to show that context. (#7610, @daviddanialy)
• Compatible harnesses can send tool calls and prompts through the Agent Hooks Protocol — A new /ahp endpoint accepts tool calls, user prompts, and session events from harnesses that speak the protocol, using a hooks API key, and Speakeasy policies can deny what it intercepts; attachment uploads and content-replacement enforcement extend the same path. (#7300, #7679, #7672, @danielkov)
• Create gateways and manage their members from the Platform MCP — create_gateway creates a private gateway with an ordered member list in one step, and set_gateway_members replaces the whole list atomically, naming any server that can't sit behind a gateway. (#7510, @qstearns)
• Find an organization member by their full email through the Platform MCP (organization admins) — A complete email address now finds a member even when a partial search would have matched too many people to show. (#7623, @simplesagar)
• Directory role mappings move to a full role set, deleted roles included (organization admins) — A directory group or attribute value's role mapping now replaces its complete role set atomically instead of upserting one role at a time, and a mapping can keep pointing at a role that has since been deleted without blocking new mappings to the same source. (#7307, #7311, @TristanSpeakEasy)
• Enterprise Managed Authorization reports which services trust each identity provider, and the consent page checks live (Enterprise Managed Authorization customers) — listEMAServices lists every service an organization's workload identities reach with the providers each accepts, identity chaining now records the exact OAuth scopes a server connection requests so a later request can't quietly ask for more, and the consent page runs the real identity-chaining exchange before approval instead of waiting for the first tool call. (#7614, #7581, #7580, @daviddanialy)

Bug fixes

• The organization gateway lists only servers you can actually use — Servers whose authentication the gateway can't provide no longer appear on the consent screen or in list_servers, and gateways no longer list servers built on toolsets that carry platform-only tools, such as the tools assistants use. (#7594, #7648, @danielkov)
• MCP grants served by identity chaining stop asking for an unnecessary reconnect — Refreshing a grant whose upstream is served by identity chaining no longer fails once the access token expires; it only asks for a reconnect when chaining genuinely can't serve the upstream anymore. (#7572, @daviddanialy)
• Assistants stop failing to respond in Slack over stale permissions — An assistant's permissions are now checked live against the assistant, its owner, and the person it's acting for on every turn, so a permission someone lost stops applying to a response already in progress. (#7661, @danielkov)
• Risk policy checks stay inside Anthropic's response window — Inference-hook verdicts now fit Anthropic's default five-second timeout, so long conversations no longer time out on every turn while earlier content is rescanned. (#7731, @vishalg0wda)
• The Risk Overview page is retired — Old links to it now open Watchdog instead of a dead page. (#7635, @vishalg0wda)
• The sessions dataset is removed from the analytics catalog — Explore, widgets, and the Platform MCP's analytics tools now ask about tool calls and skills instead. (#7633, @subomi)

Tool Logs no longer requires full org admin: a new project-scoped log:read role scope lets admins hand out tool-call log access without handing out the whole organization. Sensors in Signals intelligence can now judge a message against up to ten prior messages instead of only the message itself, configurable per sensor, which sharpens classification that depends on what came before. More on this in Roles and permissions and Signals intelligence.

Features

• Grant tool-call log access without full org admin — A new project-scoped log:read scope covers Tool Logs, the Playground's logs panel, a session's Tool calls view, and the matching Platform MCP and assistant tools, so organization admins can hand it to a custom role instead of making someone an org admin just to see their own project's call history. (#7472, @bflad)
• Sensors can weigh a message against its recent history, not just itself — Set a sliding window of two to ten prior messages per sensor, or keep judging the current message alone; the chosen setting shows in both the sensor list and the sensor editor. (#7556, #7557, @disintegrator)
• Consolidate or relocate shared authorization servers (rolling out behind a flag, organization admins only) — Organization settings now list every organization-wide and project authorization server with its issuer, token endpoint, and the MCP servers signing in through it, and admins can promote a project's authorization server to organization-wide, merge one into another, or move it onto or off the deployment's authentication host, after previewing who it affects. (#7497, #7503, @bflad)

Bug fixes

• Explore dashboard filters stopped crashing on busy projects — Filter dropdowns were sorting a full week of events in memory and running the analytics database out of memory on high-traffic projects, taking the MCP & Tools dashboard down with them; dropdown values now come from a plain scan instead. (#7593, @subomi)
• MCP errors raised before the request loads are protocol-compliant again — A missing or inaccessible MCP target now returns an error encoded for the request's actual protocol revision, with a readable request ID, instead of a response that could predate protocol negotiation. (#7392, @bflad)
• The consent approve button no longer flashes enabled before a blocking error shows — Its disabled state now updates in the same render as the panel content, closing a one-frame gap where the button could look clickable while the screen already said a required service couldn't connect. (#7591, @disintegrator)
• The service account panel drops its non-functional client ID option — The disabled "Speakeasy-created" client ID choice never worked against any tested identity provider and is gone; service account clients keep creating an app in the provider and pasting its client ID. (#7604, @bflad)

Every organization with one organization-wide sign-in now has a single MCP URL that gives each person every server they can reach, across every project, instead of adding servers to a client one at a time. Approving the gateway no longer waits on connecting every service behind it, and admins can withhold it without touching the sign-in it depends on.

Features

• One MCP URL connects every server you can reach — The MCP Servers page shows a Connect all servers button with your organization's gateway URL, /mcp/gateway/<organization-slug>. People sign in with their organization account, and the servers they see follow their access, so a server you're granted or lose shows up or disappears on your next request. Each server keeps its own sign-in. (#7521, @danielkov)
• Approve the gateway first, connect each server on its own page — The gateway's consent page now approves the gateway itself, showing how many of its servers are connected, with a Give access button that works before anything is connected. Each server gets its own page to connect, with no separate approval, since connecting is all it needs. A tool call to a server you haven't connected yet now links straight to that server's page. (#7565, @danielkov)
• Turn the organization gateway off (admin only) — Organization admins can withhold the organization gateway without deleting the sign-in it depends on, from a new Gateway page in organization settings. Turning it off answers every gateway route, including the MCP endpoint and connect pages, with a 404 starting from the next request. (#7582, @danielkov)

With directory sync on, a role's page now shows exactly which directory groups and attribute values grant it, and MCP servers reachable only from a tailnet, VPN, or other private address can finally be added. More on this in Directory sync and roles.

Features

• See which directory groups and attribute values grant a role — With directory sync on, a role's page now lists the directory groups and attribute values that give it out, with member counts and links to the mappings on IDP and SSO, in place of a read-only member list. A role nothing is mapped to says so, with a shortcut to map one. (#7508, @qstearns)
• Add MCP servers that only resolve on your own network — Creating an MCP server whose clients connect to it directly no longer requires Speakeasy to resolve or reach its URL, so a server on a tailnet, VPN, or other private address now saves instead of failing with "invalid server url". (#7505, @qstearns)
• A warning before changing a shared sign-in (admin facing) — MCP server settings now confirm before replacing, attaching, or detaching a user session issuer that other servers share, naming which servers and clients would need to sign in again. (#7485, @bflad)
• Shadow AI is folding into Guardrails, Watchdog, and Risk Events (rolling out behind a flag) — Shadow AI becomes a policy type inside Guardrails with its own Access, Scope, and Review flow, a Watchdog tile, and a Risk Events category filter, instead of its own sidebar section. The relabeling of Watchdog's existing Shadow MCP tile to Shadow AI is live for everyone today. (#7425, @subomi)
• Google Antigravity joins the known-client catalog — Antigravity's desktop app and CLI are now recognized by client ID metadata presets and Shadow AI scanning, so organizations using CIMD presets don't need to add a custom client URL for it. (#7534, @bflad)

A batch of reliability and security fixes: organizations signing in from another Speakeasy product now get their trial instead of a demo gate, Directory Sync and SSO setup failures explain themselves, and agent and workload permissions are re-checked live instead of trusting a stale snapshot.

Bug fixes

• Signing in to an existing organization starts your platform trial — An organization admin who signs in to an organization that already exists from another Speakeasy product now gets the same 14-day enterprise trial a new signup gets, instead of landing on the book-a-demo gate. A member signing in doesn't start a trial, and an organization that already has one, is on a paid plan, or was created as a prospect is left as it is. (#7455, @alx-xo)
• Clearer errors when Directory Sync or SSO setup fails — Instead of one generic "failed to generate WorkOS admin portal link" message, setup failures now name a next step: wait and retry, verify a domain, or contact support. The setup wizard also says when it couldn't check your setup status, rather than showing every step as not done. (#6767, @alx-xo)
• Remote MCP server scopes are requested exactly as set — Speakeasy no longer appends standard scopes (openid, email, profile, offline_access) to the scopes an operator configured, so providers that advertise those scopes but refuse them for a given app no longer fail sign-in with invalid_scope. (#7496, @daviddanialy)
• Gateway sign-ins request the right server's scopes — Signing in through a gateway now discovers scopes from the specific MCP server the connection is for, instead of falling back to the identity provider's whole scope catalogue. (#7488, @daviddanialy)
• Prompt injection detection stays on the production model in the LLM risk engine mode — Switching an organization's risk engine to the llm mode no longer swaps out the dedicated prompt-injection detector; it keeps enforcing everywhere, while the fine-tuned model's verdict is recorded for comparison only. (#7511, @dennnis-ez)
• Clearer consent copy for identity-chained connections — A service that connects automatically once you give access now says so, instead of showing a bare "Retry" link that read like an error. (#7579, @daviddanialy)
• install --toolset picks up the right MCP URL — The CLI now reads a toolset's MCP URL from its server endpoint when the toolset itself reports no slug, instead of writing an unroutable URL or crashing when the toolset has no default environment. (#7486, @daviddanialy)
• Hosted MCP server address changes save correctly — Changing a hosted MCP server's slug or custom domain from its settings page now saves, instead of silently failing. (#7490, @daviddanialy)
• Agent policies can't exceed what you or the agent's owner can access — Saving or updating an agent's policy is now checked against both the configuring admin's and the agent's owner's own permissions, so an agent can no longer be granted access neither of them actually has. (#7513, @tgmendes)
• Workload sessions re-check the owner's current permissions — An agent's workload session and API keys now stop reaching a resource the moment its owner loses permission to it, rather than keeping the access the owner had when the session started. (#7561, @tgmendes)

Agent Identity, agent API keys, and workload sessions are no longer behind a rollout flag: every organization can create and authorize its own agents today. Uploading a new version of an OpenAPI source also gets a safety check, with a review of what it breaks before anything deploys. More on this in Agent identity and Sources.

Features

• Agent Identity is on for every organization — Agent Identity management, agent API keys, agent selection during MCP authorization, workload sessions, and assistant workload identity no longer sit behind rollout flags. Every organization can create agent identities, mint their API keys, and attach workload sessions today. (#7471, @danielkov)
• Review what an OpenAPI update changes before it deploys — Uploading a new version of an OpenAPI source now opens with a summary of breaking and warning changes, such as removed tools, new required inputs, and changed credentials, plus which MCP servers and how many of their tools are affected, all before anything ships. (#7439, @simplesagar)
• Start a risk policy from a use case or a plain-language description — Pick a ready-made use case, such as protecting customer data or blocking destructive actions in production, or describe the risk and review a drafted policy before the wizard opens prefilled. Prompt-based presets are still rolling out behind a flag. (#6796, @AshGodfrey)
• Identity chaining for MCP servers that share a sign-in with an identity provider client (admin only, rolling out behind a flag) — Enable identity chaining on a remote MCP server whose user session issuer trusts an IdP sign-in client, choose the scopes it requests, and disable it with a warning that everyone falls back to interactive sign-in. (#7344, @daviddanialy)

Bug fixes

• Project Assistants describe the platform by its current name — Existing Project Assistants created before the product's rename now run with the latest built-in instructions, so they refer to the platform as Speakeasy instead of its old name. Instructions a project has edited by hand are left as they are. (#7417, @adaam2)

Explore gets its first Speakeasy-built dashboard, two chart types for showing what made up a total instead of just how it moved, and the ability for agents to read, build, and lay out dashboards and widgets on your behalf. Opening a risk policy's details is also noticeably faster.

Features

• A built-in MCP & Tools dashboard — The Dashboards page now lists dashboards Speakeasy ships with the product, marked Speakeasy-built, alongside the project's own. MCP & Tools is the first: eight cards covering tool calls, failures, and the busiest servers, tools, clients, and people. It opens read-only; Duplicate copies it into an editable project dashboard with a saved widget per card. (#7260, @subomi)
• Stacked bar and stacked area charts — Explore and widgets can now draw a breakdown as a stack, answering what made up a total rather than how each series moved. A stack needs a Group by and one measure that adds up, a count or a sum; when a breakdown has more series than fit, the smallest are folded into one Other band so the height still reads as the true total. (#7256, @subomi)
• Agents can manage Explore widgets through Platform MCP — list_widgets, get_widget, save_widget, duplicate_widget, and delete_widget let an agent read and maintain a project's saved widgets with the same permissions as the dashboard. Every write previews first and commits only on confirmation, naming the version it read, so an edit made in the dashboard meanwhile is never overwritten. (#7419, @subomi)
• Agents can manage dashboards through Platform MCP — list_dashboards, get_dashboard, save_dashboard, duplicate_dashboard, delete_dashboard, edit_dashboard_layout, and save_dashboard_filters give an agent the same read, layout, and filter controls as the Dashboards page. Speakeasy-built dashboards stay read-only, so an agent duplicates one to change it. (#7420, @subomi)

Bug fixes

• Risk policy details load instantly — Every single-policy read used to count all of a project's chat messages to report stale analysis progress, which could take 25 seconds or more on busy projects. That counting, and the "View Progress" panel it powered, are gone. (#7422, @vishalg0wda)

Federated sign-in now works with identity providers that don't return an RFC 9207 iss parameter, including Okta's org authorization server, so Okta can sign people into the platform directly. A new Okta sign-in card in the dashboard walks through linking the agent and registering its public key, the consent screen now says when a service is already managed by your identity provider instead of showing it as disconnected, and every identity chaining change is now audited. More on this in Enterprise Managed Auth.

Features

• Federated sign-in works with Okta — Every federated sign-in now uses a per-client callback URL, /mcp/idp_callback/{clientID}, which binds the authorization response to its issuer and no longer requires the identity provider to return an iss parameter. This makes federated sign-in possible with Okta's org authorization server, which doesn't return one. Remote session clients now report the callback URL to register with the identity provider. (#7341, @daviddanialy)
• Set up Okta sign-in from the dashboard — A new Okta sign-in card registers the AI agent's linked app as the organization's sign-in client, shows the public key to paste into Okta and the redirect URI to register, and lists every sign-in issuer and whether it trusts Okta sign-in. The setup checklist walks through adding the agent's public key and activating the linked app in the order Okta requires. (#7343, @daviddanialy)
• The consent screen and readiness checks understand identity chaining — A service that identity chaining already serves now shows "Managed by your identity provider" on the consent screen instead of looking disconnected, with a secondary option to connect manually. Identity chaining changes (enabling, scope updates, disabling) are now audited on the remote session client, and the Platform MCP's get_xaa_readiness tool reports each server's chaining bindings and the callback URL to register. (#7342, @daviddanialy)

A long-standing bug blocked editing a block-all Shadow MCP policy to soften it from denying to warning; that's fixed, along with a gap that let kill switches and risk policies skip traffic served through the legacy MCP slug path. An administrator distributing an MCP server by URL now has their own write recorded as the Shadow MCP approval instead of needing a separate review. More on this in Shadow MCP allow and block lists.

Features

• An administrator's own write can stand as Shadow MCP approval — When an organization administrator puts a server added by URL into a plugin, or widens a plugin's audience, under a project's block policy, that write is now recorded as the Shadow MCP approval for exactly the audience it reaches, with the admin as requester. The project's enabled block policy is always enforced for user-supplied servers now, with no rollout flag gating it. (#7355, @simplesagar)

Bug fixes

• Editing a block-all Shadow MCP policy works again — A block-all policy, the default and what every policy the dashboard creates stores, can once again turn off its Shadow MCP detector or move off the Deny action, exactly as it always could before the disposition field shipped; the previous "cannot change the sources or action" error is gone. (#6921, @dennnis-ez)
• Kill switches and risk policies reach the legacy MCP slug path — Hosted MCP requests served through the legacy toolset-slug lookup now carry the toolset's canonical server when it has one, so kill switches and server-scoped risk policies on prompts/get and resources/read apply to them the same way they do on the endpoint path. (#7387, @daviddanialy)
• The Playground connects to a toolset's working server — A toolset now resolves to an enabled MCP server before a disabled canonical wrapper, so the Playground, session minting, and session management target a server that actually serves instead of 404ing on a disabled wrapper. (#7388, @daviddanialy)
• The role editor shows a blocked-only permission as blocked — A permission a role only blocks now shows a Blocked badge naming the server, instead of looking like a grant. Adding that permission from the picker now grants it next to the block instead of silently deleting the block. (#7412, @adaam2)
• Identity providers with many scopes or a logo read cleanly — Scope lists render as chips instead of one comma-joined string, providers with long URL-style scopes show only what follows the shared base, and logos keep their shape instead of stretching. (#7409, @qstearns)
• Saving a remote session client with no audience no longer fails — An empty audience field used to send an empty string, which the API rejected with a regexp error on every save. It's now omitted instead, leaving the stored value unchanged. (#7431, @daviddanialy)
• Hosted MCP server links open the toolset page — Links to a hosted server from audit logs, assistant entity links, and the server list now open its toolset page instead of the generic server page, which showed controls the server doesn't support. (#7386, @daviddanialy)
• Hosted server health charts exclude gateway member traffic — A hosted toolset's own server and the gateway members fronting the same toolset are now kept apart in Platform MCP diagnostics, health charts, and overview metrics, so a canonical server's numbers no longer include its members' calls. (#7390, @daviddanialy)
• The private network setup sheet suggests a Speakeasy hostname — The Tailscale setup sheet's example organization private hostname is now acme-speakeasy, replacing an older placeholder that referenced the product's previous name. (#7398, @bradcypert)

A dashboard's cards can now share one filter bar instead of each carrying its own: pick a date range and the fields a card can be filtered by, and every card on the page answers within it. Save filters stores what you picked as what the dashboard opens on for everyone, and Reset filters returns to that. Adding a widget to a dashboard now works from wherever that widget lives, not just from the dashboard itself. Explore's catalog gains a count_distinct aggregation and a skills dataset for ranking skill usage, and the same query engine is now available to Platform MCP once Explore is on for your organization.

Features

• Save a dashboard's filters as what it opens on for everyone — The shared filter bar sits above a dashboard's cards, offering a date range and the fields some card can be filtered by (user, agent, model, MCP server, status); every card answers within it. A dashboard opens on its saved filters, or the past seven days, until Save filters changes what it opens on next. (#7179, @subomi)
• Add a widget to a dashboard from wherever it lives — Add to dashboard joins the actions on a Widgets tab row or card and in the widget bar, picking one of the dashboards you can change or starting a new one with that widget as its first card. Saving the widget builder gets an Advanced section to place the new widget on a dashboard right away. (#7181, @subomi)
• Count the distinct values of a dimension in Explore — A count_distinct aggregation answers how many different tools, servers, sessions, or people were involved, wherever the analytics catalog, Explore, or a saved widget uses it. (#7252, @subomi)
• A skills dataset for ranking skill usage — A new dataset holds one row per skill invocation, so Explore, saved widgets, and dashboards can rank skills and count how many distinct skills were used, alongside the existing tool-call datasets. (#7257, @subomi)
• MCP server names in Explore match your Hooks display names — When two reported server names share one display name under Hooks settings, Explore now groups, filters, and counts them as one server instead of two. (#7258, @subomi)
• Platform MCP can run the same analytics queries Explore does — describe_analytics_catalog, list_analytics_dimension_values, and run_analytics_query let an agent ask the same questions Explore answers, in the same vocabulary; the three tools are switched on by the same flag as Explore. (#7261, @subomi)
• Plugin assignments gain an install mode for the device agent — An assignment can now be Required (installed, can't be turned off), Default (installed, can be turned off), or Available (off until the user turns it on); the observability plugin is always Required. (#7254, @bradcypert)
• Page a large tool-exposure read from Platform MCP — get_mcp now pages a server's tool list, returning the exposure version only on the page that completes the read, so a tool change can no longer be confirmed against a partly read list. (Organization admins, via Platform MCP.) (#7226, @simplesagar)
• Configure reusable signals and sensors for message classification — Organizations Speakeasy has enabled it for can define reusable signals and sensors, with multi-label, exclusive-choice, and ordered-score modes, from the dashboard or through Platform MCP. Classification itself doesn't run yet, so what you configure here doesn't classify anything today. (#6693, @disintegrator; #7239, @disintegrator; #6727, @disintegrator)

Bug fixes

• Risk findings in a prompt attachment show their context — The risk-only transcript now windows around the prompt an attachment was sent with, instead of returning nothing for findings that belong to the attachment rather than a message. (#7351, @bradcypert)
• A toolset containing platform tools is no longer auto-distributed as a plugin — Toolsets with platform tools, including MCP-backed wrappers, are now excluded from automatic role-plugin delivery; manual memberships, MCP access, and assistant execution are preserved. (#7347, @alx-xo)
• Mapping a custom domain root to a hosted server no longer adds a second endpoint — The root picker now offers a hosted server only when it's already served on that domain. (#7295, @daviddanialy)
• A hosted server's own wrapper takes precedence over a gateway member built from the same toolset — Publishing plugins no longer fails as ambiguous for a hosted server whose toolset also backs a gateway member, and legacy /mcp/<slug> calls now attribute correctly to that server. (#7294, @daviddanialy)
• Saving a legacy toolset no longer fails over an address already in use — The toolset now saves and stays in its legacy state instead of conflicting with another server over a hosted address or slug it isn't trying to claim. (#7359, @daviddanialy)
• A retried Platform MCP write no longer spends your rate limit twice — Retrying a write that already committed now returns its stored result for free, and expired idempotency receipts are swept hourly instead of kept forever. (#7224, @simplesagar)
• Platform MCP tool errors fail safely instead of leaking internals — An unrecognized tool error is now logged with its full cause and answered with a generic refusal instead of raw database or internal error text. (#7221, @simplesagar)
• The MCP page keeps your search term when you navigate back — Going back from a server no longer clears the search you had on the MCP list. (#7397, @qstearns)
• Toasts follow the dashboard's own theme — Toasts now match the dashboard's light or dark setting instead of the operating system's, so text like the repository link after adding marketplace collaborators stays readable. (#7381, @bradcypert)
• Plugin manifests with a token or API-key prompt pass validation again — Claude plugin user settings now include the required type and title fields the manifest needs, so these plugins pass Claude Code's validation. (#7350, @alx-xo)

A remote MCP server's upstream credential no longer has to come from each person who connects. Create a remote session client with a shared credential, and every caller reaches the upstream through it, obtained through an OAuth client credentials grant, with no per-user connect step; if the upstream rejects the token, the platform gets a new one and retries once before naming the server administrator. In the Access Hub, Claude Tag's guided setup drops its "not ready yet" note now that workload sign-in works end to end, and the Team Access tab shows the scopes a remote MCP server's connected clients actually request. More on the two credential models in Upstream credentials and on reading a server's access in Team Access.

Features

• Give a remote MCP server one shared upstream credential for every caller — Remote session clients can now be created with a single credential the client holds for itself, entered by hand as a client secret or key set with an issuer token endpoint, no metadata discovery required. Using that credential at request time obtains the upstream token through the OAuth client credentials grant for every caller, so nobody connects their own account; a rejected token gets one retry before the error names the server administrator instead of asking the caller to reauthorize. (#7335, @bflad; #7333, @bflad)
• Claude Tag's guided setup works end to end — Shared authorization servers for issuers on the dedicated authentication host now serve their own token endpoint, off the host that carries MCP traffic, and accept a workload grant that names no resource, exactly as Claude Tag sends when its Resource field is left empty; the token it issues works at every MCP server the issuer covers. The guided setup's "not ready yet" note is gone. (#7334, @bflad; #7348, @bflad)
• See the scopes a remote MCP server's clients actually request — The Team Access tab now shows each connected client's identity provider, issuer, and the scopes a login would request today, with a read-only summary for members who can view but not edit the server. (#7293, @daviddanialy)
• Register a platform outside the catalog with the same guided setup as Claude Tag — The Access Hub's forms for registering a custom platform, and for allowing and editing access under one, now come from the same definitions the catalog's guided setups use, with the same fields, checks, and wording. (#7297, @aa-wong; #7299, @aa-wong)
• Team Access rows show their matching plugin — A role row on an MCP server's Team Access tab now links to the plugin that distributes that server to the role, where one exists. (#7306, @alx-xo)
• The remote session client page leads with the identity provider — Settings folds into Overview, which now shows the identity provider's endpoints, registration methods, and supported scopes above the client's own editable settings. (#7353, @daviddanialy)

Bug fixes

• Stop forwarding Speakeasy's own credentials to remote MCP servers — Requests proxied to a remote MCP server no longer copy Speakeasy's own session, project, or tunnel headers upstream, and a remote header can no longer read its value from one of them; Authorization stays allowed as a source, since forwarding the caller's own upstream credential is what pass-through identity is for. (#7366, @ThomasRooney)
• Identity providers keep their discovered grant profiles — Creating or refreshing an identity provider from discovered metadata now keeps the authorization grant profiles it advertises, so identity chaining no longer reports a provider as unsupported right after it was discovered. (#7340, @daviddanialy)
• Block the Admin role's use or management of a server again — Setting the Admin role's use or manage line to "No access" on a server's Team Access tab no longer fails; only a block on viewing the server is still refused, since that would hide the Team Access tab from every administrator. (#7345, @adaam2)
• The people directory no longer repeats a person and stalls — A next-page cursor now carries the exact activity timestamp a page ended on, so a person whose most recent activity was excluded usage no longer shows on every page while the rest of the list stays out of reach. (#7217, @simplesagar)
• Chat search pagination no longer repeats or skips chats — A next-page cursor now carries the exact start time a page ended on, fixing both a chat that showed on every page and a list that stopped early. (#7222, @simplesagar)

The role editor's MCP access tab is now a per-server picker: choose Specific servers or All servers, then pick from every MCP server in the project with fuzzy search, Select all/Clear all, and a side sheet to scope a server to specific tools or forbid it outright. mcp:read and mcp:write move to Platform access, so MCP access now holds only mcp:connect. In the Access Hub, connecting Claude Tag is now a guided setup instead of a manual runbook: enter your Anthropic organization ID, pick an agent and optional tags (admission through the catalog rule itself lands in a follow-up release). More on managing trust in the Access Hub in Workload identity, and on risk policy scope in Guardrails.

Features

• The role editor's MCP access tab is a per-server picker — Choose Specific servers or All servers, then pick from every MCP server grouped by project with fuzzy search, Select all/Clear all, and a side sheet to scope a server to specific tools or forbid it outright. mcp:read and mcp:write move to Platform access, so MCP access now holds only mcp:connect. (#7317, @qstearns)
• The Access Hub catalog gains a guided Claude Tag setup — Connecting Claude Tag from the Access Hub catalog now walks through an Anthropic organization ID, an agent, and optional tags instead of a manual runbook. Admission through a catalog rule doesn't take effect yet; that lands in a follow-up. (Organization admins; setup only, admission pending.) (#7164, @aa-wong)
• Risk policies ask client sessions or specific MCP servers up front — The policy Scope step now opens with two option cards, Client sessions and Specific MCP servers, each naming what it covers and what it needs, instead of starting on the detector matrix. Client sessions only appears once hooks are configured for the project; without them the step explains why and links straight to hooks setup. (#7231, @dennnis-ez)
• Okta Integration Network installs authenticate with a client secret — An Okta identity provider installed from the Okta Integration Network can now authenticate to the customer's Okta org with the client ID and secret the install issues, instead of requiring the custom-app private key flow. A pending connection can switch between the two methods until its client ID is submitted. (#6942, @daviddanialy)
• Remote identity providers can send no scope when nothing else decides one — An organization admin can now set a remote identity provider to send no scope parameter instead of its whole supported list, for sign-ins with no scope from the client or the resource. The provider's Overview and Settings pages show the new fallback choice. (Organization admins managing remote identity providers.) (#7198, @daviddanialy)
• A remote MCP server's login scopes can be pinned and traced to their source — A server's Identity settings can now pin the scopes its logins request, and the platform resolves a login's scopes from the protected resource's own advertised and challenged list before falling back to the identity provider's catalogue. Rolling out behind a flag to Speakeasy's own organizations first; every other organization keeps today's behavior. (Organization admins; rolling out.) (#7196, @daviddanialy; #7272, @daviddanialy)
• Speakeasy-AI headers and environment variables are now canonical — Speakeasy-AI-* request headers and SPEAKEASY_AI_* environment variables are now the names to set and copy everywhere, continuing what the CLI and Functions SDK already switched to. Every Gram-* header and GRAM_* variable keeps working as a deprecated alias. (#7321, @adaam2)
• The dashboard, admin console, and CLI read Speakeasy throughout — User-facing text across the dashboard, admin dashboard, CLI help and output, server error messages, consent pages, MCP server info, and API descriptions now names the product Speakeasy. Header names, environment variables, package names, and code identifiers are unchanged. (#7265, @adaam2)
• The "No Identity" option is now called "Manual" — The third Remote MCP identity option, and the warnings that name it, now read "Manual"; the description is unchanged. (#7296, @qstearns)

Bug fixes

• The Inspect tab can list tools on a custom domain again — The remote MCP relay no longer copies an upstream server's own CORS headers onto its response, which had been blocking the browser from loading the Inspect tab's tool list for custom-domain servers that send their own CORS headers. (#7268, @danielkov)
• Claude Code plugin installs now auto-update — The install snippet registers the marketplace under its exact name with auto-update on, instead of leaving plugins pinned to their first version with no error. The snippet, the hooks setup dialog, and the generated marketplace README now agree. (#7134, @mfbx9da4)
• The Anthropic Compliance import no longer misses new messages in old chats — The importer now walks the organization's chat list ordered by last update instead of relying on an activity type Anthropic never records for new messages, so chats that only gained messages after their first import are picked up again. Existing integrations restart from a 24-hour window on their next poll. (#7322, @subomi)
• The import keeps going when one Claude chat can't be retrieved — A chat Anthropic has hard-deleted or retired through retention, but that still appears in the chat list or activity feed, is now skipped and reported as unavailable instead of stalling the whole poll. (#7326, @subomi)
• One oversized message no longer fails its whole risk scan batch — Batch risk scan inputs are now bounded to 50 KiB when they're loaded, so a single large message can't take down the rest of the batch's analysis. (#7193, @vishalg0wda)

An assistant session in Agent Sessions used to show only the assistant's name. Now the name links to the agent identity the session ran as, and a muted "for" next to it names and links to the person it acted on behalf of, in the session list, the session header, and the Details popover. Session owners on every other row are clickable too. Building custom tools gets a naming cleanup: the functions SDK now publishes under Speakeasy names, with every existing import, environment variable, and config file still working as a deprecated alias. More on this in Agent Sessions and Add tools with TypeScript.

Features

• See who an assistant session ran as and acted for — The assistant name in an agent session links to the agent identity it ran as (or to the assistant itself when it has no agent identity), and the member it acted on behalf of is named and linked right next to it, in the session list, the session header, and the Details popover. Non-assistant session owners are now clickable too. (#7232, @danielkov)
• Build functions with the Speakeasy-named SDK — The functions SDK now publishes as @speakeasy-api/functions, with its Functions class and fromFunctions/withFunctions MCP helpers. Every existing import, config file, deploy file, build output, environment variable, and CLI profile path keeps working as a deprecated alias, so no existing project needs to change. (#7235, @adaam2)

The command-line tool is now called speakeasy. Install it with brew install speakeasy-api/tap/cli or npm i -g @speakeasy-api/cli; the old gram binary keeps working as a deprecated alias, so nothing breaks today. The functions SDK's build and deploy steps move into the CLI too: speakeasy functions init|build|dev|push|stage replace the standalone gf tool and the create-function scaffolder, which now print a notice pointing at the new commands. More on this in CLI overview and speakeasy stage function.

Features

• Install and run the CLI as speakeasy — The CLI's command name, help text, and install instructions now say speakeasy. Running it as gram still works and prints a one-line deprecation notice; profiles stay in ~/.gram/profile.json, so there's nothing to re-authenticate. https://ai.speakeasy.com/cli.sh and /cli.ps1 now redirect to the install scripts on every platform host. (#7130, @adaam2; #7187, @adaam2)
• Build and deploy functions with speakeasy functions — speakeasy functions init scaffolds a project from a built-in template (--template functions or --template mcp), build compiles it, dev runs its dev script, and push builds, stages, and deploys it using your speakeasy auth profile. The old gf build/gf push commands keep working but print a notice pointing at the replacements, and speakeasy push now deploys to the API URL from your profile instead of always targeting https://app.getgram.ai. (#7130, @adaam2)

An assistant's tool calls and audit trail used to be attributed to whoever set it up or talked to it. In organizations with agent identity credentials enabled, a new assistant now gets its own dedicated agent, so its activity shows up under its own name, with its own policy, and can be suspended or transferred independently of any person. Existing assistants keep working exactly as before until an admin explicitly upgrades them. Assistant access also moves onto its own assistant:read/assistant:write permissions instead of riding along with project:*, and the Team Access tab can now explain, for any member, exactly why they can or can't reach a given MCP server. More on this in Agent identity and Roles and permissions.

Features

• Give an assistant its own agent identity — An assistant's Identity tab can set it up with a new agent you name or an existing agent of the project you own or can authorize, starting with access to every MCP server and skill in the assistant's project. The agent can be renamed, transferred, or narrowed like any other agent, and deleting the assistant withdraws its trigger workload identities while leaving the agent in place. The upgrade endpoint and the Platform MCP upgrade tool accept the same choice. (#7107, @danielkov; #7079, @danielkov)
• Assistant access gets its own permissions — Dedicated assistant:read and assistant:write scopes replace the old reliance on project:*, which no longer opens assistants on its own. Grants can cover every assistant, every assistant in selected projects, or a single assistant, and agent policies can hold them too. Admins keep full access and members keep read access by default. (#4899, @danielkov)
• See exactly why a member can or can't reach a server — The MCP server Team Access tab gains a Check access section: pick a member to see whether they can connect to, view, and manage the server, and which rule decides it, including the directory role mapping behind a role for organization admins. (#7095, @bflad)
• A blocked server no longer blocks every server — Fixed a bug where blocking one MCP server for an agent-backed assistant turn removed access to every MCP server on that turn instead of just the blocked one. (#7202, @danielkov)