Changelog

The MCP catalog on the MCP page, editable gateway instructions, and a usage explorer backed by exact meter readings

The MCP catalog is now a tab on the MCP page next to MCP Servers, Sources, and Deployments, and catalog entries show up in the command palette as you type, in their own group so a server you could add is never mistaken for one the project already runs. Gateway instructions, the guidance every connected client receives, are editable from the gateway's settings. The billing explorer reads exact daily meter totals for stored-message tokens, MCP ingress and egress bytes, and risk-scanning volume, separate from invoice estimates. Remote sessions also become more self-healing: expired dynamic client registrations are re-registered in place, idle credentials are re-checked on a keepalive sweep, and drifted issuer metadata is refreshed as soon as an upstream answer reveals it.

Features

• MCP catalog on the MCP page and in the command palette #6411 - The catalog lives at /mcp/catalog as a tab beside MCP Servers, Sources, and Deployments, with the same add-from-catalog flow. The old /catalog, /sources/add-from-catalog, and /mcp/add/catalog routes redirect there, and "From the catalog" on the Add MCP server page still leads to it. Typing in the command palette surfaces catalog entries in an "MCP Catalog" group kept separate from "MCP Servers". (Author: @simplesagar)
• Usage explorer backed by exact meter readings #6370 - The billing explorer reports stored-message tokens, MCP ingress and egress bytes, and risk-scanning volume from the additive usage.getMeterUsage API, which returns exact integer daily totals and bounded facet breakdowns for UTC-midnight windows up to three calendar months, ordinary usage only. Totals, daily averages, chart axes, and breakdowns use compact KTok, MTok, and BTok or binary KiB, MiB, and GiB units with full values on hover, project breakdowns show slugs where available, and contract-position and invoice estimates stay independent. Self-hosted API deployments must configure the dedicated CLICKHOUSE_READ_* connection with a SELECT-only reader before rolling this out; meter reporting never falls back to the writer connection. Existing readings are not backfilled. (Author: @disintegrator)
• Editable gateway instructions #6410 - The gateway settings tab gains an Instructions section pre-filled with the built-in drill-down guidance. Custom text replaces those defaults, saving it blank restores them, and the metaMcp update endpoint accepts the same instructions field. Connected clients pick up the new text after reconnecting. (Author: @daviddanialy)
• Expired dynamic client registrations recover on their own #6341 - Remote session clients record the expiry the identity provider reported at registration. When a provider stops recognizing a client, the platform confirms it against the token endpoint and re-registers the client in place before the next login, revoking sessions bound to the old client. Organization admins can also rotate a client on demand from its settings page. (Author: @bflad)
• Idle remote sessions re-checked on a keepalive sweep #6348 - A grant with no refresh token or refresh expiry is re-verified once its last verdict, or its connection when it has none, is older than the re-check interval, so a revoked credential reads rejected or inactive without anyone opening the consent page. The sweep is paced per issuer host, skips tunneled members whose tunnel is down, and reports under the keepalive trigger on gram.remote_session.validation. --remote-session-recheck-interval (GRAM_REMOTE_SESSION_RECHECK_INTERVAL) defaults to 24h; zero or negative disables it. A partial index on the re-check population keeps the claim query off a sequential scan (#6418). (Author: @daviddanialy)
• Identity from verified JWT access tokens #6288 - When neither the exchange nor userinfo names an identity, an RFC 9068 JWT access token signed by the issuer's published keys supplies the subject, email, and scopes. JWKS consumers now honor an explicit key_ops, keeping a key only when it names verify. (Author: @daviddanialy)
• Issuer metadata refreshed when upstream endpoints drift #6337 - A token endpoint answering 404 or 410 on refresh or code exchange, or an ID token signed under a key the issuer's published set lacks, triggers a metadata refresh outside the daily cadence, at most once per issuer every ten minutes. The same applies when a stored userinfo or introspection endpoint answers 404 or 410 without an OAuth error body (#6419). A 404 or 410 carrying an OAuth error body is the endpoint answering, not drift, and an issuer whose last refresh failed definitively waits for the hourly retry. The gram.remote_session_issuer.metadata_refresh metric carries the trigger reason. (Author: @daviddanialy)

Shadow MCP approvals now bound distribution, trusted issuer links for enterprise authorization, and a fail-open fix in realtime enforcement

A Shadow MCP approval granted for one audience can no longer be used to distribute the same direct-remote MCP server to a wider one. Every path that expands an audience, from plugin assignment and attachment to remote URL edits, backend changes, publication retries, and re-enabling, re-checks the current approval, while narrowing, removal, and disabling stay open. Organization admins can also link a user session issuer to a trusted remote session issuer through the API, giving enterprise-managed authorization an explicit trust anchor instead of a database edit. This release also fixes realtime risk enforcement failing open when an operation id was not a UUID.

Features

• Shadow MCP approvals enforced across distribution #6197 - Distribution and publication retry through Platform MCP, assignment expansion in the dashboard and Platform MCP, plugin attachment, remote URL edits, MCP backend changes, first-endpoint auto-attachment, and re-enable all require an approval that covers the whole target audience. Enforcement rolls out through legacy, report, and enforce modes with a direct-remote distribution kill switch, and an invalid or unavailable rollout state fails closed for expanding writes. (Author: @TristanSpeakEasy)
• Distribution admission reported from Platform MCP #6240 - Reading a plugin or a Shadow MCP review now includes a distribution_admission projection with the rollout mode, whether coverage is complete, and bounded counts of missing audiences, so an agent can tell whether an existing plugin is covered and what repair is needed before it acts. A reviewed Shadow MCP workflow skill keeps approval, registration, assignment, distribution, and browser authorization as separate confirmed steps. (Author: @TristanSpeakEasy)
• Link user session issuers to trusted remote session issuers #6336 - Organization admins can set trusted_remote_session_issuer_id on a user session issuer to point it at an active organization-level or global trusted issuer. Deleting, moving, or migrating an issuer fails safely while active trust links reference it, with the references listed in the preflight, and metadata refreshes persist and revalidate the trusted issuer's public JWK Set atomically. (Author: @bflad)
• Documentation, policy, and terms links on the consent card #6232 - The RFC 9728 protected-resource display metadata a remote MCP server publishes, its resource name, documentation, policy, and terms of service, is stored on the issuer a direct-remote Platform MCP attachment creates, re-probed when the server is updated, exposed on remoteMcp.discoverProtectedResourceMetadata, and linked from the consent card. (Author: @daviddanialy)
• Private network access for hosted MCP servers #6236 - An admin-only Network Access page configures Tailscale private ingress and chooses how each hosted MCP server is exposed. Behind the gram-network-ingress-rollout flag and dormant until the supporting infrastructure rolls out, so the custom-domain page is unchanged for everyone else. (Author: @TristanSpeakEasy)

Bug fixes

• Realtime risk enforcement no longer fails open on opaque operation ids #6384 - Enforcement dispatched over pub/sub accepts operation ids that are not UUIDs instead of letting the operation through unchecked. (Author: @vishalg0wda)
• Directory syncs defer to the running replacement #6398 - An identity map sync that loses the single-writer lock now steps aside for the sync that holds it instead of failing and retrying. (Author: @vishalg0wda)

Know whether a remote session's stored credential still works before anyone dispatches a tool call

A remote session's card now carries a verdict on the credential it holds. The platform verifies a grant automatically the moment it is connected or reconnected, and a Verify action on the consent page re-checks it on demand by presenting the stored credential to the upstream MCP server in a dry run of dispatch: connect and list tools, nothing else. The result, valid, rejected by the member, or unknown, is recorded on the session and shown on the card. Sessions are also enriched from the issuer's userinfo and introspection endpoints, so a login that returned no ID token still shows who it belongs to, and a token the provider reports as dead marks the grant inactive.

Features

• Automatic verification on connect #6295 - Connecting or reconnecting a grant kicks off a verification immediately. The card reads "Verifying" until the verdict lands, and in-flight verifications are drained cleanly on shutdown. (Author: @daviddanialy)
• Verify from the consent page #6175 - The consent card gains a Verify action that presents the stored credential to the member the runtime would dispatch to, routed the same way real traffic is, and records whether the member accepted it. (Author: @daviddanialy)
• Identity from userinfo and liveness from introspection #6231 - When the token exchange returns no ID token, the issuer's userinfo endpoint supplies the identity shown on the card. Verify also consults the introspection endpoint and marks a grant inactive when the provider says its token is dead. (Author: @daviddanialy)
• Issuer metadata refreshed as sessions use it #6220 - Stale or never-fetched issuer metadata is re-fetched off the request path whenever a session flow touches the issuer, and stored capability documents are re-projected onto their typed fields. These refreshes are audited under a new system: principal type that audit feeds display and that can never hold grants. (Author: @daviddanialy)

Risk policies scope only through detection scopes, and MCP requests no longer trigger toolset indexing

Risk policy writes drop three legacy policy-level scope fields in favor of detection scopes. That is a breaking change for API callers and Platform MCP tools, described below. Dynamic MCP toolsets are now indexed by a scheduled background sweep, so an MCP request never has to kick off indexing work, and the AI scan target config directory check accepts any path the device agent can resolve. Setup gains temporary Session Auditor access for confirming inference hook traffic, and the linear wizard returns alongside the board.

Breaking changes

• Risk policies no longer accept policy-level scope fields #6260 - The risk policy create and update endpoints reject message_types, scope_include, and scope_exempt. New policies leave those legacy columns empty and updates carry stored values forward unchanged, so scope every policy through detection_scopes instead. The fields stay readable until the legacy scope migration folds them, and the secrets guide in the dashboard now scopes its default policy through a detection scope. The same change applies to the Platform MCP risk policy tools, where a stored policy still narrowed by legacy message_types is reported as raw_scope (#6257). (Author: @vishalg0wda)

Features

• Session Auditor access granted and taken back during setup #6304 - The Enable logging step explains that an admin sees only their own agent sessions by default, offers to create a Session Auditor role carrying chat:read and add the admin to it so the Confirm traffic step can see the conversation an Anthropic inference hook delivers, then offers to remove them again once traffic is confirmed. Directory-synced organizations create the role and map it from a directory group instead. (Author: @qstearns)
• The linear setup wizard is back #6296 - /setup/wizard walks the board's cards in order again, and a header button swaps between the board and the wizard. (Author: @simplesagar)
• Set up LiteLLM card on the setup board #6297 - The card creates a LiteLLM instance in place, shows its proxy environment, guardrail fragment, and verification requests exactly as the AI Integrations page does, and confirms traffic from the instance's connection diagnostics. LiteLLM guardrail events no longer count toward the other-platforms card. Hidden by default: a platform admin has to reveal it on the board. (Author: @simplesagar)

Bug fixes

• MCP requests no longer trigger toolset indexing #6324 - Dynamic MCP toolsets are indexed by a scheduled background sweep, so an MCP request never has to initiate indexing work. The sweep's discovery query was also sped up so it no longer times out on projects with many HTTP tools (#6342). (Author: @bflad)
• Any resolvable AI scan target directory is accepted #6289 - Scan target config directories are no longer checked for a particular shape. Any path the device agent can resolve works, including one written with a trailing slash such as ~/Library/Application Support/com.openai.chat/. (Author: @subomi)
• Killswitch picker shows project names #6254 - Choosing MCP servers for a killswitch lists project names instead of project IDs. (Author: @speakeasyforgebot)
• Trial conversions land on pay-as-you-go #6335 - An organization converting through Stripe Checkout at the end of a trial now switches to the pay-as-you-go plan instead of staying on enterprise. (Author: @alx-xo)
• Wizard rail rows settle quietly #6313 - Setup wizard rail rows are no longer focusable or announced as buttons while a card's completion is settling. (Author: @simplesagar)

Edit an MCP server's access one scope at a time, and manage user session issuers for the whole organization

The Access tab on an MCP server is now a single list with a row per principal, and each row shows separately whether that person, role, or everyone can connect to, view, and manage the server. Each of the three can be changed on its own, so a role that reaches a server through an organization-wide rule can be narrowed for that one server without touching the role anywhere else, and taking connect away no longer strips view and manage with it. Organization admins also gain an API for user session issuers that every project inherits, with deletion guarded while a live MCP server or toolset still depends on the issuer, and agents working through Platform MCP can read a bounded summary of Shadow MCP policy decisions.

Features

• Per-scope access editing on an MCP server #6246 - The People and Roles tabs and the single "can connect, view, or manage" choice are replaced by one list where each principal has its own line for connect, view, and manage. Blocked scopes are now independent of one another, so "cannot connect but still administers" is expressible for the first time, and a role reaching a server through an organization-wide rule can be narrowed or closed for that server alone. (Author: @adaam2)
• Organization-level user session issuers #6200 - Organization admins can create, update, and delete user session issuers and their CIMD clients at the organization level, inherited by every project, through the management API. Deletion runs a preflight and is blocked while a live MCP server or toolset still references the issuer, and project-level mutations are restricted to issuers the project owns. (Author: @bflad)
• Shadow MCP policy decisions summarized from Platform MCP #6235 - Agents working through Platform MCP can read a bounded summary of Shadow MCP policy decisions without the summary exposing principal identities. (Author: @TristanSpeakEasy)
• Anthropic inference hooks from the setup board #6239 - A new setup card turns on Anthropic inference hooks in one pass: it mints the endpoint Claude posts each conversation to, walks through pasting it into the Claude.ai inference hook settings, switching on enforcement and starting the rollout in Shadow mode, and saves the signing secret Claude reveals. Traffic is confirmed from the conversations the hook delivers. The webhook URL and signing secret controls are shared with the integrations sheet, and the previous Anthropic card lives on as "Set up Anthropic admin controls", hidden by default. (Author: @qstearns)
• Setup board reorganized around outcomes #6202 - "Connect identity provider" and "Directory sync" merge into one "Set up identity provider" card, publishing the plugin marketplace becomes a section at the front of the cards that need it, and coding assistants split into an Anthropic card for Claude Code and Claude Cowork and an "other platforms" card for everything the device agent covers. Each platform's instructions sit inline in its own step, and confirming traffic is the last section of both cards. The linear wizard at /setup/wizard was removed in this release and returns in 1.23.0. (Author: @qstearns)

Bug fixes

• Beta badges removed from Risk Events and Shadow MCP #6234 - The page headers now match the sidebar entries, which dropped their Beta label earlier. (Author: @simplesagar)

Decide who can use each MCP server from its own Access page, and manage killswitches beside the person they restrict

Access control now starts from the thing you are protecting. Every MCP server has an Access page that answers "who can use this server": grant people or roles, set what each one can do, and narrow a rule to particular tools or to tools carrying an annotation. The organization-wide role editor is rebuilt on the same model. Killswitches move onto the Access tab of the person they restrict, so listing, creating, lifting, and the full version history all happen on that person's page. API keys can be bound to a single project at creation, and RBAC-filtered tool inventories are now marked private so a shared cache can never serve one person's tool list to another.

Features

• Per-server Access page and rebuilt role editor #6156 - The read-only Team Access tab on each MCP server becomes an Access page where you grant a person or a role access to that server alone. Each rule reads as a sentence, and narrowing to specific tools or to an annotation such as read-only is a dropdown away. Direct rules are editable in place, inherited organization rules link back to the role that owns them, and a "People this reaches" panel resolves every rule to the members it covers. Role authoring moves onto its own page where permissions are picked from one searchable menu and narrowed on their own row. A guardrail refuses to write a block that would lock the caller out. (Author: @adaam2)
• Killswitches managed from the identity's Access tab #6210 - The separate organization-wide Killswitch screen is retired. Team, connection, and session entry points now open the restricted person's Access tab, where you list, create, edit, and lift killswitches and read their version history. The mark beside a person's name is an icon whose hover text says what the state stops. Old Killswitch addresses redirect, with a single record opening on its subject's Access tab so audit-log links still land on the exact record, in the project and time period the link was read from. (Author: @danielkov)
• API keys bound to one project #6116 - The API key form gains an optional project selector. Omitting it still creates an organization-wide key, and a bound key's project shows separately from its permission scopes in the result and the key list, so a restriction is never confused with a scope. A follow-up restores hosted MCP project context for organization-wide keys executing platform tools while rejecting conflicting bindings (#6115). (Author: @danielkov)
• Filtered tool inventories are never cached across people #5955 - Remote MCP proxy tools/list results that pass through the per-tool RBAC filter are labelled cacheScope: "private" with ttlMs: 0. The MCP 2026-07-28 revision reads an absent scope as public, which would have let a shared cache serve one principal's tool inventory to another, or let a client keep an inventory after the grants that shaped it were revoked. The label applies whether or not anything was filtered, so it never reveals that a caller was. (Author: @bflad)

Agents become first-class identities with their own credentials, policies, and owners

An AI agent no longer has to borrow a person's API key. The platform can now hold an agent as a principal in its own right: a human owner creates it, grants it an allow-only runtime policy narrower than their own, issues it API keys with a required expiry, and can suspend, rotate, transfer, or revoke it. Every request an agent makes is admitted against three live policies at once, the immutable grant it was delegated, its own direct policy, and its current owner's policy, so an agent can never do more than the person accountable for it. If that owner leaves the organization, the agent is blocked until an admin explicitly reassigns it. Agent credential issuance is rolling out per organization behind the gram-agent-credentials-m2 flag.

Features

• Create and manage agent principals #6047 - Human-only APIs and a setup page for creating, renaming, suspending, resuming, revoking, and deleting first-class agents. Owners manage identity and lifecycle without extra grants, other people are checked against exact agent:* permissions, and every transition writes its before-and-after audit event in the same transaction. (Author: @danielkov)
• Agent API keys with delegated grants and bounded expiry #6071 - Issue, list, rotate, and revoke API keys for an agent through the existing keys API. Each key carries an immutable delegated policy, the identity of the human who authorized it, a required expiry, and a one-time secret. Issuance, listing, and rotation are behind the per-organization gram-agent-credentials-m2 flag; revocation always works. (Author: @danielkov)
• Every agent request is admitted against live policy #6068 - Agent credentials are checked on every call against the delegated grant, the agent's direct policy, and the current owner's policy together, and malformed, expired, inactive-parent, or owner-ineligible requests are rejected. Telemetry and audit records name the agent as the actor while keeping its authorizer and owner as separate provenance. (Author: @danielkov)
• MCP sessions for agent subjects #6072 - Agents can hold MCP sessions using the same challenge, token, refresh, and revocation machinery people use. The live parent and delegated policy are re-checked on every access and refresh, and a replayed refresh is denied once its successor session has been revoked. (Author: @danielkov)
• Direct agent policies, allow-only by design #6051 - Owners and people holding agent:write can create, update, and delete an agent's direct runtime policy. Only allow rules from the agent-safe scope registry are accepted, so this surface cannot write a deny rule, a reusable role, or another principal's grants. (Author: @danielkov)
• Owner loss blocks the agent until it is reassigned #6053 - When an owner is deleted, deactivated, or removed from the organization, the agent latches into a blocked state that survives the owner regaining eligibility. Explicit transfer by the current owner, or reassignment by an admin, is the only way out, and both preserve the agent's identity and direct policy. (Author: @danielkov)
• Agent management capabilities in custom roles #6041 - Four new capabilities, agent:read, agent:write, agent:authorize, and agent:transfer, are added to new organization-admin roles and exposed in the custom role editor under an Agents group, kept separate from the runtime scopes an agent itself may hold. (Author: @danielkov)

Bug fixes

• Typed agent policy selectors #6077 - Create and update request bodies preserve typed policy selectors, and the dashboard API client contracts are regenerated to match. (Author: @danielkov)

Choose which AI tools your device agents scan for, export risk findings over OTLP, and a sharper prompt injection judge

The Shadow AI scan list is yours to edit. From the Device Agent configuration tab, organization admins add their own targets, switch a built-in default off and back on, and edit or delete what they added, with no agent release needed for a change to reach devices. Risk findings join the data export sources, delivering new findings to your SIEM or observability stack as privacy-safe OTLP log events. Prompt injection detection is rebuilt around a typed judge, and every prompt-based risk policy now runs on one benchmarked model that catches more and misfires less at lower latency.

Features

• Manage Shadow AI scan targets per organization #6171 - The list of AI tools device agents probe for is served per organization: the built-in defaults overlaid with the targets you add or customize through the new agent.listAiScanTargets, agent.upsertAiScanTarget, and agent.deleteAiScanTarget endpoints. Every change lands in the audit log, and the served list version is echoed on scan receipts. The Device Agent Configuration tab gains a section where targets are entered as tags (#6173). (Author: @subomi)
• Risk findings as an OTLP data export #6018 - Add Risk Findings as a project-scoped source in Data exports and new, non-excluded findings are relayed to your configured OTLP log destinations. The log carries a stable finding ID plus policy, rule, source, and confidence for filtering and deduplication, never the matched content. Exclusions are re-evaluated immediately before each delivery and fail closed. (Author: @tgmendes)
• One benchmarked judge model for prompt-based risk policies #6024 - The per-policy model picker is gone and every prompt-based policy runs on Gemini 3.5 Flash Lite. On the risk judge benchmark the new model improves accuracy, precision, latency, and token usage over the previous default while keeping perfect recall. Policies keep their temperature and fail-open settings. (Author: @vishalg0wda)
• Typed prompt injection detection #4479 - The prompt injection judge now makes one call per event with bounded session context and returns a typed finding: the kind of directive, its target, whether it is operational, and a privacy-safe rationale. Your risk policies decide block versus surface exactly as before. (Author: @vishalg0wda)
• Turn off the observability plugin per project #6161 - Org admins can disable a project's observability plugin from the Observability card on the Plugins page. A disabled plugin is omitted from the published marketplace, is not installed by the device agent, and rejects direct downloads, and a connected marketplace is republished automatically. Marketplace settings changes are recorded in the audit log. The backing column shipped separately as a schema-only migration (#6170). (Author: @speakeasyforgebot)
• Gateway calls classified as the gateway, not shadow MCP #6180 - A hook-observed call whose server URL is a gateway endpoint now shows as that gateway in Tool Logs and insights instead of falling through to shadow MCP. Gateway activity hides members no longer on the gateway, and the activity charts link to the tool logs and insights pages filtered to that gateway. (Author: @daviddanialy)
• Clearer Watchdog exposure bar #6129 - Hovering a category dims the other slices so one reads at a time, and Custom Rules gets its own color so no category looks inactive. (Author: @adaam2)

Bug fixes

• Policy scopes saved as the scanner reads them #6092 - Policy setup saves message type selections as category detection scopes, so the "Applies to" value in Policy Center matches the scanner's effective scope and the scopes a policy's other categories relied on are preserved. (Author: @vishalg0wda)
• Imported chats with NUL bytes no longer fail the sync #6103 - AI provider chat messages and titles containing NUL bytes are stored with the byte dropped instead of failing the compliance sync for that window. (Author: @subomi)

Point an MCP server at your identity provider's issuer and see who each connection belongs to

External OAuth configuration now works the way identity providers publish it. Choose provider-hosted or platform-hosted OAuth metadata, review the live discovery result before saving, and switch an existing configuration safely. Discovery probes every well-known location and merges the OpenID Connect and RFC 8414 documents, so fields a provider publishes in only one of them are captured. Remote logins request the scopes a provider actually advertises, retry once without a resource indicator when an issuer rejects it, and validate the RFC 9207 iss parameter. When an issuer returns an ID token, the platform verifies it and shows the connection as "Connected as" that person. The Authentication settings for an MCP server are reorganized into three rows with one table for allowed clients.

Features

• Issuer-backed external OAuth configuration #6049 - Choose whether an MCP server advertises provider-hosted or platform-hosted OAuth metadata, and switch an existing configuration after reviewing live discovery results. The server side ships in two halves so the change rolls out without a flag: every server first learns to read and advertise issuer-only records (#6045), then the create, update, and clear operations land with an SSRF-safe discovery step that requires an exact issuer match (#6085). (Author: @walker-tx)
• Discovery merges every well-known document #6094 - Issuer discovery probes every well-known candidate and merges same-issuer OpenID Connect and RFC 8414 documents, capturing jwks_uri, claims_supported, and ID token signing algorithms wherever the provider publishes them. Discovery and refresh also record the userinfo and introspection endpoints, back-channel logout, and RFC 9207 support, and the create forms accept the same fields. (Author: @daviddanialy)
• Spec-aligned scopes, resource indicator retry, and iss validation #6109 - Remote logins request openid, email, profile, and offline_access whenever the issuer advertises them, and operators can pin a verbatim scope request per issuer with scope_override. A login or refresh answered with invalid_target is retried once without the RFC 8707 resource parameter, and resource_indicator_supported can be set to false on an issuer that never accepts it. Issuers advertising RFC 9207 have iss validated on the callback, and the consent page offers a reconnect when a live grant lacks openid. (Author: @daviddanialy)
• "Connected as" from the issuer's ID token #6104 - When code exchange or refresh returns an ID token, it is verified against the issuer's published keys and reduced to its claims, and the consent card shows who the upstream grant belongs to. Non-standard token response members are kept alongside, minus anything credential-shaped; the raw token is never stored. (Author: @daviddanialy)
• Reorganized MCP Authentication settings #6132 - Session length, client access, and connected services each get their own row with a one-line hint, terminology moves behind "What is this?" modals, and the verified client catalog and your own allowed client URLs become one table behind a "Manage allowed clients" link. Dashboard only, no API change. (Author: @adaam2)

Bug fixes

• Dead refresh grants reported on a 2xx are cleared #6088 - OAuth error bodies on successful upstream token responses are read, so a dead refresh grant reported that way, such as GitHub's bad_refresh_token, clears the stored token instead of being retried forever. (Author: @daviddanialy)

Review shadow MCP, assign access roles, and read the event feed from Platform MCP

Admin work that used to require the dashboard can now be done from the Platform MCP server inside your coding agent. Ask for the last events in your organization's Event Feed, list unsanctioned MCP usage in a project and approve or deny a reviewed target, create or update custom MCP access roles and assign them to members, and drill into masked tool and skill usage by user. Every read is privacy-safe: raw URLs, hosts, person-level details, and evidence documents never reach the model, and every mutation is confirmed, idempotent, and budgeted so an agent retry cannot double-apply a decision.

Features

• Event Feed from Platform MCP #6136 - The new list_organization_events tool returns the most recent Event Feed entries for an organization admin, newest first, over the last day by default and up to seven. Results are summaries with a dashboard link to the full feed; attributes, trace IDs, and user identities are never returned. (Author: @simplesagar)
• Inspect and decide shadow MCP access #6117 - The list_shadow_mcp_inventory and get_shadow_mcp_review tools show unsanctioned MCP usage in a project with its review and enforcement state using generic target labels and exact event counts. The decide_shadow_mcp_access tool then approves or denies a reviewed target with a bounded rationale and an idempotency key, reusing the dashboard's own approval transaction (#6118). Available for projects on the MCP approval rollout. (Author: @TristanSpeakEasy)
• Manage and assign MCP access roles #6113 - Confirmed, idempotent tools create and update custom MCP access roles, and a follow-up assigns them to members without replacing the roles those members already hold (#6127). Privacy-safe reads of role, member, and configured MCP access back both (#6075). (Author: @TristanSpeakEasy)
• Usage attribution by user #6181 - Drill-downs for masked MCP tool and skill usage by user, with tool and error attribution scoped to the selected server at call level. (Author: @TristanSpeakEasy)
• Plugin assignment reads #6062 - Privacy-safe reads for plugin assignments and assignment versions, so an agent can check what is assigned before proposing a change. Optional subject counts may be integers, suppression labels, or null (#6153). (Author: @TristanSpeakEasy)
• Clearer inventory and setup failures #6054 - The MCP inventory names each server's backend kind and the management operations it supports, and setup failures are classified into privacy-safe categories with actionable next steps (#6056). (Author: @TristanSpeakEasy)
• Platform MCP setup lives in headless mode #6144 - The separate Platform MCP settings page is gone; setup happens from headless mode, and old /platform-mcp links redirect there with their entry source preserved. (Author: @adaam2)

Bug fixes

• Catalogue servers alongside legacy servers #6182 - Reviewed catalogue MCP servers can be registered in projects that also contain legacy toolset-backed servers. (Author: @TristanSpeakEasy)

One flow for adding MCP servers, whatever kind they are

The MCP page is now the inventory and the only place a server is added. One "Add new" button offers the catalog, a remotely hosted server, a tunneled one, and an Advanced group for OpenAPI documents, functions, and building a server from a source the project already has. Servers are named for how they are reached rather than the backend behind them, remote servers verify connectivity before they can be saved, and breadcrumbs lead back up from every step. Sources move under MCP instead of going away, with a page per source showing its file, the tools it produced, and the deployments it is versioned by. Old source and catalog links redirect. Further down, project admins can rename a project, Legacy Pro organizations receive the enterprise feature bundle, organization setup gets its logging step back, and a run of fixes covers logout, sign-up, and plugin rollout.

Features

• One flow for adding MCP servers #6012 - The MCP page becomes the inventory and the only place a server is added. Remote servers must verify connectivity before they can be saved, sources live at /mcp/sources with a page per source, deploying a function offers the flow that builds a server from it, and old /sources and /catalog URLs redirect. A follow-up restores the grid and table toggle on the servers and sources lists and the plugin skills section, adds a search box to Environments, and brings back the source page's MCP servers list, document viewer, and function runtime details (#6142). (Author: @adaam2)
• Legacy Pro organizations get enterprise feature access #5912 - An operator-run, dry-run-by-default backfill grants Legacy Pro organizations the enterprise-access entitlement bundle while preserving any entitlement an admin explicitly disabled. Billing and resource limits are unchanged. (Author: @simplesagar)
• Rename a project from Settings #5880 - Project settings show the display name and slug, and project admins can update the display name. The new projects.update endpoint validates and audits the change, and the dashboard refreshes its project cache so the new name appears everywhere. (Author: @alx-xo)
• Unsupported MCP protocol versions rejected before auth #6201 - Hosted, platform, and gateway MCP surfaces answer an unsupported protocol version with error code -32022 and the requested and supported versions, so a client can retry with a compatible one instead of being served under legacy semantics. Proxied backends still relay to their upstream. (Author: @bflad)
• Gateway install page and clearer tool-call keys #6157 - MCP gateway endpoints serve an installation page instead of a not-found page. The execute_tool description, gateway instructions, and missing-name error now name the name and arguments keys so clients stop guessing a tool key (#6087). (Author: @daviddanialy)
• Organization setup gets its logging step back #6219 - Both the wizard and the board regain an "Enable logging" step with a single switch that turns on Enable Logs, Record Tool I/O, and Agent Session Capture together. The board marks the task done once all three are on, the wizard resumes past it, and the "enterprise rollout" card on the organization home opens the wizard it describes. New organizations still start with the bundle enabled. (Author: @simplesagar)
• Setup wizard and board, side by side #6098 - The Wizard/Board switcher returns, so the linear wizard at /setup/wizard is available alongside the board. Setup task assignees are notified by email, assigned owners can verify onboarding traffic, and the header and footer are expanded with support escalation and a responsive layout (#6063). The Cowork manual setup callout is restored in the same change. (Author: @simplesagar)
• Setup reminder moves to the sidebar #6148 - The full-width setup banner on every organization page is replaced by a persistent "Finish organization setup" entry in the sidebar footer, and the organization home headline fits on one line. (Author: @adaam2)

Bug fixes

• Logout returns you to the login page #6042 - Logging out from the account menu now redirects to login. The page still navigates if the logout call rejects or stalls. (Author: @alx-xo)
• Signing up again after a WorkOS deletion #6046 - Signing up with an email that was deleted in WorkOS reactivates the user, restores RBAC access, and keeps sign-up off the book-a-demo gate. (Author: @alx-xo)
• Legacy register flow removed #5921 - The session-aware /register compatibility flow is gone; stale links redirect to /sign-up. (Author: @alx-xo)
• Identity pages keep their place in the sidebar #6199 - The Observability group stays open on identity pages, a breadcrumb leads back to the roster, and roster cells are evened out. (Author: @adaam2)
• Plugin rollout keys auth can find #6149 - The plugin rollout sweep no longer mints API keys under the system placeholder creator, and existing orphaned keys are rewritten onto a real organization member. (Author: @speakeasyforgebot)
• Audit log attributes background work and spend-cap changes correctly #6140 - Scheduled jobs are recorded as the system acting surface instead of unknown, so an unknown surface once again means an unattributed request. Spend-cap changes carry the surface they came through into the workflow, so your own change is no longer recorded as an unattributed write (#6141). (Author: @simplesagar)

Kanban board for enterprise onboarding

Rolling out an organization no longer funnels through a single-person wizard. Setup is now a four-column board where each task can be assigned to a member or an email address, blocked tasks show what they are waiting on, and admins can invite a team to take their share. Every status and ownership change is recorded in the audit log and surfaced as a webhook event, so the rollout is visible outside the dashboard too. The board is rolling out behind a flag and the wizard remains reachable through a switcher on both views.

Features

• Multi-owner setup board #6031 - Setup tasks now live on a board with durable status and ownership, dependency blockers, and dialogs that guard against a task being completed twice. Assign tasks to members or email addresses, invite a team optionally, and switch between the board and the linear wizard from either view. The setup-task API is organization-authorized, and task events appear in the audit log and webhook surfaces. Platform admins can reveal hidden tasks. Rolling out behind the gram-setup-board flag. (Author: @svadrutk)

One page for every person and agent your organization has seen

The new Identities section gives each person and agent a single page that gathers their access, usage, security findings, cost, devices, and activity from every subsystem, whether or not they have an account on the platform. Every place the dashboard names a person now links there. The same release fixes per-user usage, which showed zero tokens and zero spend for anyone working through Claude Code or Codex while the cost dashboard billed them in full.

Features

• Identities: a page per person and agent #5949 - Each project gains an Identities index of everyone the organization has seen, replacing Employee Enrollment (its old URL redirects). Each identity page answers one question per tab: Overview flags anyone working through a personal AI account rather than the team one, Usage filters by team or personal account class, Cost shows where the tokens went and what came from cache, Connections groups live MCP connections and the data-flow graph by server, and Activity plots the rhythm a row list cannot. Figures rank against peers for the same window. Names on budgets tables, project home top-user cards, chat transcripts, and killswitch detail are now real links to the identity, so they support cmd+click and copy-link. (Author: @adaam2)

Bug fixes

• Per-user usage counts Claude Code and Codex #5949 - The per-user metrics summary read only the generic usage attributes, so anyone working through Claude Code or Codex showed zero tokens and zero spend. Both now count. Audit log actors resolve to names in the feed, its actor filter, and the admin activity list instead of reading as columns of email addresses, and resolution goes through the organization's memberships so an actor ID from another tenant never names a stranger. (Author: @adaam2)
• Identity widgets honor the time range and admit failure #5949 - The audit trail, authorization challenges, and per-person shadow MCP servers now respect the selected time range instead of reading their whole history, with managed devices deliberately left outside it as a current inventory. A panel whose request failed says so and offers a retry instead of reporting "no roles assigned" or "not enrolled" off data that never arrived, and the Cost and Usage tiles show a dash rather than $0 when metrics fail to load. Authorization challenges now key on the identifier the authorization engine records, so the panel no longer reports a clean history for people who may not have one. (Author: @adaam2)

Export agent telemetry to your own observability stack from the dashboard

Data exports are now self-serve. Under the organization's Data section, beside the Event Feed, org admins can route each project's normalized OpenTelemetry logs, metrics, and traces to an OTLP destination of their own, creating the destination inline or reusing one, with no support ticket in the loop. See the data export docs for how routes and destinations fit together.

Features

• Configure data exports from the Data section #5811 - The new Data exports page lists every configured project route in one organization-level topology and offers a single New export workflow: pick an eligible project, its data source, and an existing or inline-created OTLP destination. Enable, configure, and delete controls sit on each source card. Viewing needs org:read and changes need org:admin. The former Event Feed URL under Data redirects to its new home. (Author: @tgmendes)
• Manage export destinations through the API #5792 - A project-scoped data exports service adds list, create, update, and delete operations for destinations alongside route management, with the same organization-level permissions as the dashboard. Each destination carries a destination_type discriminator with transport-specific configuration, so SIEM and object storage destinations can join OTLP without changing the shape of existing ones. (Author: @tgmendes)

MCP endpoints refuse cross-origin browsers, and a role grant can now scope to a single server

Every MCP endpoint the platform serves now validates the Origin header and rejects cross-origin browser requests, as the MCP specification requires, with native MCP clients unaffected. Access control gets finer too: a role grant scoped to one MCP server now unlocks managing exactly that server. Tunneled servers can record a resource identifier so user credentials route to them by exact match and an unmatched credential is never forwarded.

Features

• Cross-origin browser requests are rejected #5899 - MCP endpoints answer cross-origin browser requests with 403 and reject POSTs that are not Content-Type: application/json with 415. Native MCP clients send neither Sec-Fetch-Site nor Origin, so they are unaffected, and embedded chat keeps working through its session token's audience claim. A follow-up exempts the OAuth callback routes that share the MCP path prefix, which were briefly answered with 403 when a browser followed an identity provider's redirect back (#5913). (Author: @bflad)
• Role grants scoped to one MCP server #5909 - Get, update, delete, and tool-filter reads on an MCP server now check mcp:read and mcp:write against that server's own grant resource, aligned with the serving path, and listing returns only the servers the caller holds a grant for. Project-wide and wildcard grants behave as before. (Author: @daviddanialy)
• Tunneled servers route credentials by resource identifier #5905 - Tunneled MCP source settings gain a Resource Identifier section for the server's RFC 9728 protected resource identifier. Gateway consent stamps it as the RFC 8707 resource on the grants members mint, and the tunneled backend accepts a credential only when it is unqualified or names that identifier. The lone-token fallback is gone on every surface, so an unmatched credential is never forwarded. Updating a tunneled server no longer requires resending its name, so saving one setting can never revert a rename that landed in between. (Author: @daviddanialy)
• One slug namespace for hosted servers and endpoints #5917 - Slug availability checks now span both hosted MCP servers and MCP endpoints, so an endpoint can no longer take a slug a live hosted server still resolves under, and vice versa. (Author: @daviddanialy)
• Internal #5918 - Groundwork with no change to production traffic: hosted MCP servers resolved through an endpoint will take their visibility, issuer gating, and RBAC resource from the endpoint's server record rather than the toolset (#5919), and test fixtures stop sharing one toolset across live server records (#5954). (Author: @daviddanialy)

Logging on by default for new organizations, OpenClaw joins the agent sources, and MCP collections are removed

This release removes MCP collections, so read the Breaking changes section below if your organization used them. New organizations now start with logs, tool I/O recording, and agent session capture switched on, so the first session is visible without a setup step. OpenClaw becomes a named agent source whose sessions count toward usage and cost, skill improvements are recommended passively from efficacy analysis, and the remote MCP connect page asks for fewer clicks.

Breaking changes

• MCP collections are removed #5938 - The collections service and its /rpc/collections.* endpoints are gone, along with the Collections pages and sidebar entry, the Publishing section on MCP server settings, the collection group panel in access grant rules, the "Catalog kind" filter on Sources, and the Collection origin label on catalog sources. Collection audit actions are no longer recorded; the audit_log.mcp_collection_event_v1 webhook event stays registered but deprecated so subscriber event lists keep working. The backing tables are dropped in a follow-up migration. (Author: @adaam2)

Features

• New organizations log from the first session #5948 - Enable Logs, Record Tool I/O, and Agent Session Capture are on at creation for every new organization, and the enterprise setup wizard drops its logging opt-in step. Trial expiry no longer disables logging. Existing organizations are unchanged, and org admins can still turn each setting off under Logging & Telemetry. (Author: @simplesagar)
• OpenClaw is a first-class agent source #5929 - OpenClaw appears as a single entry in the agent-type filter, and its sessions take part in prompt-to-response turn correlation using OpenClaw's own per-run identifier. Its sessions now contribute to token, cost, and tool-call summaries, which previously counted only Codex, Cursor, and OpenCode (#5932), from deployment onward. The generated plugin package includes OpenClaw install instructions, including the conversation-access setting that prompt and usage capture depends on (#5933). (Author: @bradcypert)
• Skill improvements are recommended without asking the agent #5838 - High-confidence, transcript-grounded skill recommendations are now generated during efficacy analysis and flow into the existing edit-suggestion workflow. New plugin packages and managed assistants no longer expose the skill-feedback tool; previously installed clients can keep submitting through the retained endpoint. (Author: @danielkov)
• The remote MCP connect page asks for less #5861 - A server whose single required service is not yet linked sends you straight to that provider instead of an interstitial with one button, while a server fronting several providers keeps Connect as its own step. The header names the requesting client and the server side by side, tool access leads with "All tools" and reveals the picker only when narrowed, and the page now shares the dashboard's design system. (Author: @adaam2)
• Watchdog explains the org risk score #5988 - An info tooltip spells out that each signal inherits its score from its policy and that the overall score weights the most severe signal, the average of the top signals, and the total number of findings rather than a plain average. (Author: @simplesagar)
• The demo organization stays one click away #5958 - The account menu keeps an Explore demo org entry after the trial welcome banner stops showing it. (Author: @simplesagar)
• Gateway endpoints, rolling out behind a flag #5836 - Behind the gram-gateway-endpoints rollout flag, calls dispatched through a gateway are now attributed to it in telemetry and billing events, the observability overview can filter to one gateway, and the gateway's Overview tab shows usage scoped to it, the discovery funnel, and calls by member, with activity markers on gateway cards in the MCP listing (#5837, #5986). Gateway cards show their members' logos and a status dot, member management moves onto the Overview tab, and team-access rows on gateways and MCP servers alike click through to a pre-filled grant dialog (#5883). Production end-to-end testing fixes follow: removing a member unbinds its provider from the consent screen, malformed JSON-RPC bodies return the spec's parse-error code, and the add-member sheet no longer implies unproxied servers can be added (#5962). (Author: @daviddanialy)

Bug fixes

• Ingestion keeps up under heavy challenge volume #5829 - Authorization challenge logging now writes in batches instead of one insert per event, which had held pooled connections and let challenge, event feed, and risk finding ingestion fall behind a growing backlog. (Author: @bradcypert)
• Deleting a tunneled source no longer hangs #5962 - The confirm dialog closes and navigates on success instead of sticking on "Deleting…". (Author: @daviddanialy)
• Internal #5834 - Telemetry tables gain gateway attribution columns ahead of emission, with no customer-visible surface. (Author: @daviddanialy)

One feed for every signal your agents emit

The new Data section shows every OpenTelemetry log and span ingested through the platform in one org-level Event Feed, in preview. Search it, filter by kind, source, and name, watch volume over time, and open any event for a parsed or raw view. The same ingest surface now accepts OTLP metric exports and relays them to your configured OpenTelemetry destinations, so agent telemetry can flow into the observability stack you already run.

Features

• An event feed for every OTel signal, in preview #5641 - The org-level Data section shows every OpenTelemetry log and span ingested through the platform: search, kind/source/name filters, a stacked volume chart, an infinite-scrolling table, and a detail sheet with parsed and raw views. New org-scoped read endpoints back the page (#5640) over per-signal ClickHouse tables (#5639). (Author: @subomi)
• OpenTelemetry metrics relay to your destinations #5758 - The public API now accepts authenticated OTLP metric exports and relays them to configured OpenTelemetry destinations, preserving producer resources, instrumentation scopes, and schema URLs. (Author: @tgmendes)

Bug fixes

• The Event Feed description names Speakeasy's endpoints #5669 - Copy on the page now matches product branding. (Author: @svadrutk)

Serve MCP at the apex of your own domain

Custom domains now work at the root, so your MCP servers can live at company.com, not just a subdomain. The setup wizard offers A-record instructions with a CNAME/A toggle, DNS verification waits out slow propagation instead of failing fast, and a default MCP server can be staged before DNS cuts over, so a migration from another MCP host configures everything up front. The OAuth surface serving those domains gets stricter and steadier in the same release.

Features

• Custom domains work at the apex #5690 - Root domains that cannot carry a CNAME record are now supported: the setup wizard offers A-record instructions with a CNAME/A toggle, DNS verification polls for up to 24 hours instead of failing fast on slow propagation, and "Check now" wakes a pending check immediately. A default MCP server can be staged while the domain is still configuring, with cutover converging on its own once DNS lands. Health checks flag stray A or AAAA records, and a domain can no longer activate without its TXT ownership proof. (Author: @ThomasRooney)
• MCP sign-in gets stricter and steadier #5782 - The OAuth surface now validates the RFC 8707 resource parameter on both the authorize and token legs, rejecting values that name the wrong endpoint while leaving clients that omit the parameter untouched. The comparison target is built from the address each request arrived on, so a server reachable under both a custom domain and the platform origin validates correctly under either. (Author: @aa-wong)
• One shared connection per agent and upstream #5572 - A remote-session credential is now one shared grant per subject and client, so status, refresh, and disconnect act on the same credential from every bound surface, and revoking it anywhere destroys it globally with a best-effort upstream revocation. (Author: @daviddanialy)

Quarantine an agent session the moment it violates policy

Enforcement gains teeth. Risk policies can now freeze an entire agent session on violation until an org admin releases it, and MCP tool-call killswitches are enforced on every path, including private remote and tunneled servers, with a management API and a dashboard rolling out for creating and lifting them.

Features

• Quarantine an agent session on violation #5561 - Risk policies gain a quarantine action: a violation denies the triggering event and freezes the whole agent session, with prompts and tool calls refused by a message naming the policy, until an org admin releases it from the new Quarantines tab. Opens and releases are audit-logged. (Author: @vishalg0wda)
• Killswitches enforced on every tool-call path #5839 - Active MCP tool-call killswitches now stop calls before they reach private remote and tunneled servers, not just hosted ones. A management API lets org admins create, edit, and lift killswitches with schedules, server scope, overlap previews, and history (#5855), and a Killswitch dashboard with principal-first workflows is rolling out to a limited cohort of organizations (#5863). (Author: @danielkov)

Bug fixes

• Guardrail policies only offer supported detections #5862 - The policy editor no longer lists detection types the engine cannot actually enforce. (Author: @vishalg0wda)

GitHub Copilot joins observability, billing lands on one page, and gateway endpoints start rolling out

If your organization uses GitHub Copilot, its sessions now show up in the same timelines, spend gates, and policy checks as the other four platforms. Billing consolidates into one usage view for every plan, with promotion codes accepted at checkout, and cost analytics now report the tokens people actually used. Captured sessions can be recalled from inside any connected agent, and gateway endpoints, one MCP endpoint fronting a curated set of servers, begin rolling out behind a flag.

Features

• GitHub Copilot becomes the fifth observability platform #5376 - Copilot hook events land on the same ingest path as the other platforms, so Copilot sessions appear in the same timelines, spend gates, and policy checks. The dashboard offers a downloadable Copilot plugin package with a hooks-scoped key already embedded. Hooks fire in Copilot CLI only; MCP servers and skills from the same plugin load in VS Code and the Copilot app, but those surfaces report no telemetry. (Author: @svadrutk)
• One billing page for every plan #5827 - Pay-as-you-go organizations get the same token usage view as enterprise, with the invoice estimate at its head and an explicit empty state before any usage is recorded. Checkout now accepts Stripe promotion codes (#5722). (Author: @danielkov)
• Cost analytics report what people actually used #5824 - Token numbers on the costs page and project overview now show plain LLM tokens (input plus output), matching the employee pages, with cache-creation tokens visible as their own labeled metric. Employee views fold a person's full identity, including linked personal-account emails, so their usage no longer splits into an unattributed duplicate row (#5780). (Author: @daviddanialy)
• See how each connected agent authenticates #5736 - The MCP connections list now derives each registration's credential kind server-side and badges the two worth interrupting a scan for: key-authenticated and cannot-authenticate. The registration detail sheet states the kind for every client and is reachable again from the agent row's menu. (Author: @bflad)
• Client admission defaults to an honest open mode #5807 - Issuers that never configured client admission now rest at an explicit open policy instead of an internal mode nothing displayed, so enforcement becomes something an operator opts into rather than a default anyone lands on. No client that authenticates today stops authenticating, and catalog-gap measurement survives the change. (Author: @bflad)
• Recall a captured session from any connected agent #5719 - Two new Platform MCP tools bring session recall without the device agent: list your own captured coding-agent sessions and continue one as a redacted handoff digest inside the current conversation, with each recall audit-logged and linked by lineage. (Author: @simplesagar)
• Antigravity joins the install options #5732 - The hosted MCP install page replaces Gemini CLI with Antigravity CLI and adds Antigravity IDE, both using Antigravity's mcp_config.json format. (Author: @speakeasyforgebot)
• Platform MCP installs from a public marketplace #5801 - The first-party Platform MCP package now publishes from a public plugin marketplace instead of being injected into each organization's private plugin repository, so installs become the same two commands for everyone and OpenCode gains an install route it never had. Access still fails closed on the same entitlement. The connect flow adds a catch-all "Other agent" option for agents outside the certified set (#5795). (Author: @adaam2)
• Gateway endpoints, rolling out behind a flag #5664 - Behind the gram-gateway-endpoints rollout flag, a gateway is one MCP endpoint fronting a curated, ordered set of MCP servers, managed from the dashboard with Overview, Members, Inspect, Clients and Sessions, and Settings pages. The Inspect tab reads the endpoint live over MCP and shows exactly what a client receives. This release adds drill-down into hosted members (#5604), dispatch to remote and tunneled members with per-member credential routing (#5781), default auth wiring on creation (#5853), and sessions that degrade per member instead of rejecting outright when a provider is unconnected (#5882), on the control plane and protocol groundwork from 1.17.0. (Author: @daviddanialy)
• Manage signing keys from the dashboard #5679 - For organizations with the customer-managed encryption keys entitlement, a new Signing Keys section on the Encryption Keys page creates JSON Web Key Sets from a GCP KMS key and manages the publish, activate, retire, and revoke lifecycle of their published keys, on the management API introduced in 1.17.0. (Author: @bflad)
• Resolve one person across every subsystem #5793 - The new identity.resolve endpoint takes an identity URN in any form the platform stores activity under, such as a user ID, email, API key, or agent-reported external ID, and returns every identifier for the same subject plus their directory attributes, so any surface can link with whichever identifier it holds. (Author: @adaam2)
• Platform operators only #5731 - Visible to platform operators, not customer organizations. The admin dashboard gains an organization Activity view over cursor-loaded audit history (#5730), live and completed trial details on the organization overview (#5714, #5713, #5715) with legacy trial fields removed (#5716), a customers-only stat strip (#5650), an S-token calculator page (#5668), and audit rows that keep the staff name privately while customers see Speakeasy Team (#5728). (Author: @walker-tx)

Bug fixes

• Assistants see their directly attached servers #5830 - Assistant surfaces now count MCP servers attached directly to the assistant, not only those reached through a toolset, and the composer's @-picker explains an empty Tools section instead of hiding it. (Author: @alx-xo)
• The Skills list loads its insights faster #5791 - Activation, efficacy, and savings metrics now load without computing unused cost and regression signals. (Author: @tgmendes)
• Transcripts hide OpenClaw's message envelope #5822 - Session transcripts, titles, and summaries no longer render OpenClaw's inbound metadata framing; stored messages are unchanged. (Author: @bradcypert)
• Small fixes across the dashboard #5790 - The browser tab icon follows the browser's own light/dark setting so it no longer disappears (@adaam2). The login page links to sign-up (#5616, @alx-xo). Deleting a project returns you to the organization home instead of the deleted project's settings (#5841, @alx-xo). (Author: @adaam2)
• Internal #5765 - Groundwork with no customer-visible surface: MCP servers record and index their upstream authorization server (@daviddanialy); new metrics count upstream session refreshes and rejected MCP requests (#5681, @bflad). (Author: @daviddanialy)

The Shadow MCP inventory tells the truth about enforcement, and the stop button really stops

Every row in the Shadow MCP inventory now reports what enforcement actually delivers, from one server-computed verdict, and policy edits that would silently override recorded access decisions require explicit confirmation. The assistant's stop button now actually ends the turn server-side instead of letting it keep generating and spending in the background, and Windows machines install the device agent from a signed MSI.

Features

• Enforcement reported truthfully, row by row #5564 - Each inventory row renders from one server-computed access summary instead of re-deriving enforcement in the browser. A server approved for part of an audience reads Restricted rather than Allowed, and a decision nothing enforces or the current rules contradict says so, naming what displaced it. (Author: @daviddanialy)
• Policy edits can't silently override decisions #5571 - Editing a blocking policy's allow or block list now checks the change against recorded access decisions. Contradicting one requires explicit confirmation in a dialog that lists the affected servers, and a confirmed save marks each displaced review as superseded, actor-attributed and audit-logged, with decision history preserved. (Author: @daviddanialy)
• A detail page that answers instead of repeats #5531 - The Shadow MCP server detail page is reworked around a summary strip of status, calls, people, and last-called, dropping the fact list that restated the traffic table beneath it. Long user lists collapse, and the unreviewed badge says Unreviewed instead of contradicting the notice under it. (Author: @daviddanialy)
• The stop button now stops the assistant #5614 - Pressing stop previously only aborted the browser's view of the turn: the reply kept generating server-side, kept calling tools, kept spending, and reappeared on reload. Stop now cancels queued turns and interrupts the one in flight. The partial reply stays in the transcript, and every tab watching the chat settles instead of tailing a turn that has ended. (Author: @adaam2)
• Windows installs from a signed MSI #5607 - The Windows device-agent walkthrough now installs from a signed MSI that registers the machine-wide service itself, with a stable download link that always resolves to the current signed version and an Intune note for fleet deployment. (Author: @bradcypert)
• A management API for signing keys #5593 - For organizations with the customer-managed encryption keys entitlement, the new jsonWebKeySets API offers org-scoped CRUD of JSON Web Key Sets backed by customer KMS keys, plus the publish, activate, retire, and revoke lifecycle of their published keys. (Author: @bflad)
• Sign-in surfaces harden #5505 - Remote session issuers now capture the upstream's advertised PKCE support and warn when an identity provider does not advertise S256. Client documents may register redirect URIs on a different origin than the client ID, with exact-match validation still enforced (#5608). (Author: @bflad)
• The Secure section reorganizes #5558 - Navigation is now Watchdog, Guardrails, and Shadow MCP: the Risk Policies page becomes Guardrails and absorbs Detection Rules as a tab, with old URLs redirecting, Risk Events returns below Watchdog (#5597), and one Suppress dropdown replaces the separate suppression buttons (#5551). (Author: @dennnis-ez)
• Groundwork for gateway endpoints #5569 - Not yet customer-visible: the control plane for meta MCP servers with ordered member sets, and the gateway protocol surface serving the fixed tool contract on the canonical MCP path (#5573). The dashboard experience ships in 1.18.0 behind a rollout flag. Session portability also gains a per-organization toggle on the admin features pages (#5557, @simplesagar). (Author: @daviddanialy)
• Platform operators only #5601 - Visible to platform operators, not customer organizations: per-key inference limits on the billing admin page, and complete monthly inference spend history with a graph (#5627). (Author: @danielkov)

Bug fixes

• Concurrent token refreshes stop racing each other #5293 - MCP clients with several open sessions now share one refresh-token rotation with a short grace period instead of racing into an invalid_grant error, and the consent page shows a connected upstream grant even when a different identity provider originally created it (#5565). (Author: @danielkov)
• Watchdog suppression works past the time window #5609 - Suppressing a signal now collects its findings without the page's time window, fixing a silent no-op for findings older than the view, and an empty collection shows an error instead of doing nothing. (Author: @dennnis-ez)
• Per-user telemetry stops counting platform-side inference #5556 - Risk-analysis judges and other platform-side completions no longer count as the session owner's usage on employee surfaces. (Author: @daviddanialy)
• OTel forwarding keeps retained header values #5598 - Adding or removing one forwarding header no longer clears the encrypted values of the headers you kept. (Author: @disintegrator)
• Assistant onboarding no longer crashes on refresh #5592 - Loading the assistant onboarding page directly tripped React's hook-order invariant once permission grants finished loading; each frontend tool now renders as its own element. (Author: @bradcypert)
• The command palette finds every MCP server #5456 - Remote, tunneled, and unproxied servers now appear in the MCP Servers group alongside toolset-backed ones instead of being reachable only from the list page. (Author: @aa-wong)
• Enrollment refuses impersonated sessions #5545 - Manual device-agent enrollment is refused while impersonating an organization or user, or without membership in the active organization. (Author: @bradcypert)
• Roles can be created without a description #5330 - The Create Role dialog accepts an empty description field and omits it from the request. (Author: @qstearns)
• Internal #5625 - Skill insight queries avoid scanning unrelated session telemetry (@tgmendes); local dashboard dev proxies session-handoff URLs correctly (#5590, @simplesagar). (Author: @tgmendes)

Approvals survive new policies, moved sessions stay linked, and suppressed findings get one list

An MCP server approved before any blocking policy existed used to end up blocked anyway when a policy arrived later. Creating a blocking policy now replays the project's recorded decisions onto it, so an approval means what it said, and servers blocked only for some users read Restricted instead of Blocked. Sessions that move between agents now stay linked in both directions, suppressed Watchdog findings gather in one list with the provenance behind each, and the device agent gains a walkthrough for Claude Code on the web.

Features

• Standing approvals are honored when a blocking policy is created #5322 - Creating a blocking shadow MCP policy, or turning one blocking, now replays recorded approval decisions onto it in the same transaction: approvals get their bypass audience, denials get block rules, and a policy that cannot express a scoped approval refuses creation and names the servers instead of silently widening what was recorded. The inventory also distinguishes a server blocked for everyone from one blocked only for some, with a new Restricted state and reasons that name a denied review explicitly. (Author: @daviddanialy)
• Moved sessions stay linked #5459 - When a session moves between agents, a lineage edge now links the original to its continuation, and the Agent Sessions panel shows both directions with navigation between them. (Author: @simplesagar)
• Suppressed findings live on the Watchdog page #5528 - Every suppressed finding, whether by exclusion rule, manual dismissal, or automated sweep, now sits in one collapsible section with the provenance behind it, a restore action, and a link to the rule behind rule-based suppressions. The listings API covers rule exclusions it previously missed (#5521), and risk results carry converged suppression fields (#5513). (Author: @dennnis-ez)
• See what the research agent actually did #5452 - For organizations on the MCP approval rollout, a research run's review page now shows its per-action trace: every search and page fetch in order, with the outcome, the injection judge's verdict, and a bounded preview of the untrusted text it saw. Only previews are stored, and no new inference runs. (Author: @daviddanialy)
• The device agent reaches Claude Code on the web #5489 - A new walkthrough covers Anthropic-hosted Claude Code on the web, with a self-contained script and a SessionStart hook that revives the daemon each session. The platform tiles also stack their labels so all four fit a row (#5548). (Author: @subomi)
• Author and distribute skills over Platform MCP #5544 - OAuth-authenticated clients can list, read, create, and re-version skills in a project and distribute one to an exact plugin or assistant, with conflict-safe versioning so concurrent authors cannot silently overwrite each other. (Author: @adaam2)
• Pay-as-you-go bills reflect everything that ran #5515 - Invoices now bill platform-initiated inference alongside customer-facing spend. (Author: @danielkov)

Bug fixes

• Internal #5467 - Groundwork with no customer-visible surface: product-feature APIs gain explicit organization scoping and authorization (#5466, #5469, #5468, @walker-tx); demo organization sessions align enforced scopes with reported grants (#5535, @adaam2). (Author: @walker-tx)

See and control your pay-as-you-go bill, read MCP connections end to end, and stay connected to Platform MCP

Pay-as-you-go organizations can now watch the bill take shape instead of waiting for the invoice. Billing shows the current cycle as it accrues, with the estimated total, subscription controls, separate spend caps for Security and Other inference, and a billing contact alongside. MCP Connections becomes a graph you can read in either direction, a person's agents or an agent's people, split into active and inactive rows with a status dot on each. Platform MCP connections now survive token expiry without a fresh sign-in, and the assistant answers setup questions from reviewed guides with citations. For organizations on the MCP approval rollout, a research agent investigates a server on request, and approved servers are re-checked daily for permission changes.

Features

• Your pay-as-you-go bill, before it arrives #5371 - Billing shows the current cycle for pay-as-you-go organizations: tokens under management and their flat-rate cost, Other inference spend through the last completed day, and the estimated invoice total once Stripe billing has started. The monthly Other inference meter now says plainly that it runs on the calendar month. Behind it, tokens-under-management usage reports to Stripe from durable hourly snapshots (#5345), Other inference spend bills through durable invoice allocations that freeze after 48 hours and carry corrections forward after a 72-hour observation window (#5351), and billing cycles align to UTC midnight (#5340). (Author: @danielkov)
• Manage the subscription yourself #5370 - Organization admins see live subscription status on Billing, open a controlled customer portal, and cancel or resume at the end of the period. If the subscription lapses, pay-as-you-go admission closes and the Other inference key is disabled, with later billing events reconciled against the organization's current state (#5363). (Author: @danielkov)
• Billing problems surface where they're felt #5372 - A failed payment now heads the billing page with a direct link into the Stripe portal, and an organization that has reached a monthly inference cap gets a banner on every page naming what stopped, with a link straight to that cap's control. (Author: @danielkov)
• Separate caps for Security and Other inference #5368 - Pay-as-you-go admins view and set an independent monthly cap for each platform-managed inference key. Each change updates only the selected key, survives lifecycle reconciliation, and records a per-key audit event. Spend alerts re-arm after an explicit cap change while still deduplicating when reconciled provider limits fluctuate (#5369). (Author: @danielkov)
• A billing contact and the emails that reach it #5366 - Pay-as-you-go admins can set or clear a billing notification email. When none is set, weekly usage summaries and spend alerts go to every organization admin. Activating pay as you go sends a confirmation that states the metered rate, which inference is billed at provider cost, and which is funded by Speakeasy (#5445). A reminder goes out three days before an eligible trial ends, and billing contacts hear when subscription loss or a trial demotion pauses access (#5367). (Author: @danielkov)
• MCP Connections reads as a graph #5392 - A row names a person, provider, or agent, and opening it shows the nodes on the other side, a person's agents or an agent's people, on the same columns. Rows are ordered by when they last carried traffic and split into active and inactive connections (dormant for over a week, or no longer usable), and inactive ones stay visible and revocable instead of being filtered away. The same list renders on the MCP server detail tab and the employee page. Each row leads with a status dot, green live, amber expiring, red needs re-auth, grey idle or revoked, and the OAuth client on the other side is now called an agent throughout; the organization page moves from /user-sessions to /mcp-sessions (#5441). For API consumers, userSessions.listUserSessions now returns each session's last_used_at and its upstreams, the remote sessions the platform holds for the same subject and issuer, so both legs of a brokered connection come back from one call (#5390). (Author: @adaam2)
• Platform MCP stays connected #5373 - Platform MCP clients no longer send you back through authorization every time a short-lived access token expires. One-hour access tokens rotate through refresh tokens with a 30-day sliding idle window and a 90-day authorization cap, and the dashboard shows clear reconnect guidance when an authorization expires or is revoked. (Author: @TristanSpeakEasy)
• Setup guides and cited docs search in Platform MCP #5490 - Reviewed provider setup guides are served as Platform MCP resources, and a new search_gram_docs tool answers from that pinned corpus with cited excerpts and links back to the full guide. Content past its revalidation date is flagged, then withheld, and a question nothing reviewed can answer returns guide_unavailable instead of invented steps. Citations render in the assistant as passages with resource links. Organizations that haven't enabled Platform MCP now see a dismissible setup recommendation in empty states and organization navigation, routed into the resumable setup flow (#5380, @TristanSpeakEasy). (Author: @adaam2)
• Catalog servers keep their icons #5042 - Installing a server from the catalog now stores the registry's icon and shows it in the server detail sidebar and collection listings instead of a generic placeholder. Remote servers with no catalog icon get the vendor's favicon by default. (Author: @AshGodfrey)
• Assign plugins to directory groups and attribute values #5488 - Organization admins can target active directory groups and exact directory attribute values as plugin assignment audiences, listed alongside Everyone and organization roles from one plugins.listAudiences call. (Author: @tgmendes)
• Requesters say why they need a server #5198 - A blocked employee's request page now redeems the block link into a short form instead of filing the ask the moment it loads, and the justification carries onto the review as the requester's note. Previously every note was the policy's block reason, so "who asked, and why" told a reviewer nothing about any individual ask. Rolling out with the approval feature. (Author: @daviddanialy)
• Approved MCP servers are re-checked daily #5198 - A daily sweep re-gathers evidence for approved servers and compares the permission-relevant slice (OAuth scopes, authority mode, demanded credentials, published advisories) against the snapshot the approval rested on. Drift sets a changed-since-approval flag that only a new decision clears, announces once per distinct change through the audit-log webhook channel, and shows as a diff banner on the review page and a badge on the inventory (#5196). The review page is also condensed so a full dossier fits in far less scrolling, with observed traffic joining the evidence as "Who is currently using it?". Rolling out with the approval feature. (Author: @daviddanialy)
• Research an MCP server on request #5158 - A Run Research button on the approval page starts a bounded agent run over cited web search and page fetch (#5147) and renders the report: a summary, an independent-coverage level, and tiered claims where every web-sourced claim carries its citations or is dropped. Every fetched page passes through a prompt-injection judge, and a page that tries to steer the reviewer is recorded as a finding on the report rather than only defended against. At most one run per request is in flight, and research spend is not billed to your organization today. Rolling out with the approval feature. (Author: @daviddanialy)
• Per-user device, risk, and shadow MCP lookups #5499 - The lookups an identity view needs: deviceIntegrations.listManagedDevices takes user_ids and user_emails, risk.listResults takes external_user_ids matched whole rather than as a substring, and access.listShadowMCPInventoryServersForUser returns the shadow MCP servers one person reached, with work and personal addresses resolving to the same subject. (Author: @adaam2)
• Identity providers link to their detail page #5463 - Remote identity providers listed on an MCP server's Authentication settings are now links, so reaching a provider no longer means finding it again from the Remote Identity Providers page. (Author: @aa-wong)
• MCP 2026-07-28 protocol revision #5408 - Every result the hosted and platform MCP surfaces return now carries the resultType field the revision requires and identifies the responding server under io.modelcontextprotocol/serverInfo in _meta, filled only when an upstream server hasn't already supplied them. MCP observability keys on each request instead of the initialize handshake the revision removes, and the MCP-Protocol-Version header no longer leaks into tool environment variables (#5396). (Author: @bflad)
• Platform admin: MCP server counts and reworked organization views #5426 - Visible to platform operators only. The admin projects list reports how many MCP servers each project has, and the organization record's Projects and Members views gain counts, monograms, and a "Never" for members who haven't signed in (#5428). Staff-only chat analysis settings are scoped to the organization selected in each request (#5461). (Author: @walker-tx)
• Internal #5425 - Privacy-safe telemetry for durable Platform MCP authorization, with the operational dashboard, monitor, and revocation-probe contract documented (@TristanSpeakEasy). Stripe webhook events from newer API versions are accepted within the compatible release train (#5364, @danielkov). Function templates use newer MCP SDK and Inspector versions (#5417, @dependabot). (Author: @TristanSpeakEasy)

Bug fixes

• Sign-in redirects stay on the dashboard #5244 - Post-login redirect targets that a browser could read as another origin are rejected and fall back to the default sign-in destination. (Author: @qstearns)
• Trial limits end when the trial does #5424 - The trial credit cap holds until the trial is demoted rather than the moment its window closes, so a first key minted in the gap no longer receives the enterprise ceiling. Session capture, logs, tool I/O logs, and Platform MCP now stop when a trial is demoted and return when it's re-armed or converted to pay as you go (#5454). (Author: @alx-xo)
• Resource reads attribute to the right server #5448 - MCP resources/read requests record the server URL in billing telemetry and logs instead of the session id, so the MCP URL filter is no longer polluted with random UUIDs. (Author: @bflad)
• Tool call annotations no longer flash as chat prose #5491 - The short activity phrase the assistant emits before a batch of tool calls is held until the tool group opens instead of rendering as a paragraph and then jumping into the heading. (Author: @adaam2)

Approve or deny MCP servers with gathered evidence, and pause risk policies without deleting them

Deciding whether your organization should trust an MCP server no longer means researching it yourself. The Shadow MCP page becomes one servers table where every row carries its review state, and opening a server shows an evidence dossier gathered for you: who publishes it, what it asks for, what it declares it can do, whether it's real and maintained, and whether your teams already talk to it. Decisions enforce the moment they're recorded. The workflow is rolling out to organizations with the approval feature enabled. Separately, risk policies can now be paused and resumed instead of deleted.

Features

• One review surface for every MCP server #5079 - The inventory and access requests merge into a single servers table, with pending decisions sorted first. A blocked employee's ask attaches as a requester on the server's single review instead of minting a per-user bypass, decisions are made in place with a required rationale, and an approval or denial enforces through the same policy machinery the allow and block controls used, in the same transaction that records it. Rolling out with the approval feature. (Author: @daviddanialy)
• Evidence gathered for you #5144 - Dossiers consult the code host for repository health, OSV.dev for published vulnerability advisories, and the domain registry for registration records, alongside the server's own OAuth metadata and tool declarations probed without credentials (#5078). Your organization's own exposure, meaning who already calls the server and how often, is the one observed signal in the set. A source that can't be read records a gap, never a clean empty section. (Author: @daviddanialy)
• Anyone can request a review #5074 - Members name a server by URL or launch command and say why, no permission grant needed. Repeat asks attach to the existing review, a denied review reopens with its history intact, and reviewing the queue is granted separately from committing the organization to a decision (#5072). (Author: @daviddanialy)
• Pause risk policies without deleting them #5303 - Policy Center and policy detail pages gain disable and re-enable controls, and the delete confirmation offers "Disable instead", so enforcement can stop temporarily without losing the policy or its history. (Author: @simplesagar)
• Canonical identities in analytics, behind a flag #5256 - Cost analytics, employee detail pages, enrollment, and billing breakdowns can fold one person's directory, personal, and case-variant emails into a single canonical identity (#5257). Off by default behind a rollout flag with a shadow-compare mode validating the fold on live traffic first. The identity map syncing behind it landed as internal infrastructure (#5248, #5252, #5264). (Author: @daviddanialy)
• Platform admin: full trial and organization lifecycle #5297 - Visible to platform operators only. Operators can now create an organization without leaving the admin app, disable and re-enable one (#5290), extend a running enterprise trial (#5294), restart a demoted one with the restart recorded in the activity log (#5301, #5327), set account types in bulk (#5342, #5352), peek at an organization beside the list (#5284), and read platform-wide counts above the list (#5331). (Author: @walker-tx)

Bug fixes

• Running sessions stay in date-filtered lists #5274 - A session that logged a message after the page's frozen range bound vanished from the Agent Sessions list until the range was re-selected. The filter now tests interval overlap, so active sessions stay visible. (Author: @daviddanialy)
• Failing integration syncs back off and explain themselves #5285 - A chronically failing AI integration poll now backs off exponentially instead of ringing failure monitors forever, and its visible status carries an actionable error without exposing provider payloads. A success or config save makes it due again immediately. (Author: @daviddanialy)
• Trial reminder emails stop when they should #5275 - Converting or expiring a trial now clears its reminder sequences, so paying and expired organizations stop receiving countdown emails. (Author: @alx-xo)