Changelog

Approve or deny MCP servers with gathered evidence, and pause risk policies without deleting them

Deciding whether your organization should trust an MCP server no longer means researching it yourself. The Shadow MCP page becomes one servers table where every row carries its review state, and opening a server shows an evidence dossier gathered for you: who publishes it, what it asks for, what it declares it can do, whether it's real and maintained, and whether your teams already talk to it. Decisions enforce the moment they're recorded. The workflow is rolling out to organizations with the approval feature enabled. Separately, risk policies can now be paused and resumed instead of deleted.

Features

• One review surface for every MCP server #5079 - The inventory and access requests merge into a single servers table, with pending decisions sorted first. A blocked employee's ask attaches as a requester on the server's single review instead of minting a per-user bypass, decisions are made in place with a required rationale, and an approval or denial enforces through the same policy machinery the allow and block controls used, in the same transaction that records it. Rolling out with the approval feature. (Author: @daviddanialy)
• Evidence gathered for you #5144 - Dossiers consult the code host for repository health, OSV.dev for published vulnerability advisories, and the domain registry for registration records, alongside the server's own OAuth metadata and tool declarations probed without credentials (#5078). Your organization's own exposure, meaning who already calls the server and how often, is the one observed signal in the set. A source that can't be read records a gap, never a clean empty section. (Author: @daviddanialy)
• Anyone can request a review #5074 - Members name a server by URL or launch command and say why, no permission grant needed. Repeat asks attach to the existing review, a denied review reopens with its history intact, and reviewing the queue is granted separately from committing the organization to a decision (#5072). (Author: @daviddanialy)
• Pause risk policies without deleting them #5303 - Policy Center and policy detail pages gain disable and re-enable controls, and the delete confirmation offers "Disable instead", so enforcement can stop temporarily without losing the policy or its history. (Author: @simplesagar)
• Canonical identities in analytics, behind a flag #5256 - Cost analytics, employee detail pages, enrollment, and billing breakdowns can fold one person's directory, personal, and case-variant emails into a single canonical identity (#5257). Off by default behind a rollout flag with a shadow-compare mode validating the fold on live traffic first. The identity map syncing behind it landed as internal infrastructure (#5248, #5252, #5264). (Author: @daviddanialy)
• Platform admin: full trial and organization lifecycle #5297 - Visible to platform operators only. Operators can now create an organization without leaving the admin app, disable and re-enable one (#5290), extend a running enterprise trial (#5294), restart a demoted one with the restart recorded in the activity log (#5301, #5327), set account types in bulk (#5342, #5352), peek at an organization beside the list (#5284), and read platform-wide counts above the list (#5331). (Author: @walker-tx)

Bug fixes

• Running sessions stay in date-filtered lists #5274 - A session that logged a message after the page's frozen range bound vanished from the Agent Sessions list until the range was re-selected. The filter now tests interval overlap, so active sessions stay visible. (Author: @daviddanialy)
• Failing integration syncs back off and explain themselves #5285 - A chronically failing AI integration poll now backs off exponentially instead of ringing failure monitors forever, and its visible status carries an actionable error without exposing provider payloads. A success or config save makes it due again immediately. (Author: @daviddanialy)
• Trial reminder emails stop when they should #5275 - Converting or expiring a trial now clears its reminder sequences, so paying and expired organizations stop receiving countdown emails. (Author: @alx-xo)

Exact assistant session totals and a hardened dashboard

Assistant session listings now report exact range-bounded activity totals with pagination that no longer distorts the numbers, and the dashboard ships three browser hardening headers a penetration test flagged as missing. Device-agent fleet configuration is also scoped to organization admins, matching who could already change it.

Features

• Exact assistant session totals #5265 - Activity totals are computed exactly for the selected range, independent of pagination, so the summary numbers stop shifting as pages load. (Author: @danielkov)
• Stronger browser isolation #5269 - Dashboard responses now carry cross-origin resource, opener, and cross-domain policy headers, closing three findings from a penetration test without breaking cross-origin asset loads. (Author: @walker-tx)
• Device-agent configuration is admin-only #5101 - Viewing fleet configuration now requires organization admin, matching the existing requirement on changing it, and the tab hides from non-admins while Setup stays available to everyone. (Author: @speakeasyforgebot)
• Platform admin: operator tooling #5266 - Visible to platform operators only. The organizations list keeps its search and filters in the URL so a view can be pasted to a colleague, a login URL contract opens the customer dashboard already scoped to a chosen organization (#5277), and organization rows report real trial state instead of a defaulted date that made every row look like a trial (#5276). (Author: @walker-tx)

Bug fixes

• AI-suggested exclusions save #5258 - Suggested exclusion patterns were validated with a different regex engine than the one the platform matches with, so valid suggestions failed as invalid. The form now validates with the matching engine, surfaces server-side errors, and retries a failed suggestion once with corrective feedback. (Author: @dennnis-ez)
• Demo visitors land on sample data #5250 - Entering the demo organization lands on its default project instead of an empty organization home. (Author: @alx-xo)
• Publish status no longer stuck on needs syncing #5260 - Organizations on the phased hooks rollout saw a permanent "needs syncing" after every hooks version bump they weren't eligible for yet. Freshness now runs the same eligibility check as publishing, so only changes that would actually apply count. Hook installations are also served an updated binary (#5148). (Author: @daviddanialy)

Configure and observe assistants from one panel, and see one person behind many accounts

The assistant detail panel is now the one place to run an assistant: name, model, concurrency, and warm TTL are editable in place, the Sessions tab shows cost and token stats over a selectable range, and triggers expand to show their recent traffic with each event linking to the conversation it routed to. Cost analytics also starts folding a person's work and personal AI accounts into one identity, so drill-downs report a whole person rather than a slice.

Features

• Assistant detail panel: edit in place, observe in place #5230 - Overview settings are editable behind an explicit edit mode, the Sessions tab aggregates sessions, messages, cost, and tokens over a selectable time range with per-session cost in the list, and each trigger expands to its recent dispatches. (Author: @danielkov)
• Work and personal accounts roll up to one person #5221 - Cost analytics email filters and user drill-down pages now include an employee's directory email and linked AI account emails, so the same totals appear whichever identity the telemetry arrived under. (Author: @daviddanialy)
• LiteLLM sessions keep their label #5187 - A session routed through LiteLLM stays matched to the LiteLLM filter and displays as its client via LiteLLM, even when the agent's own hook stream captures the transcript. (Author: @danielkov)
• Composer references become chips #5236 - Tool and skill references render as colored inline chips in the assistant composer, deleting a skill's token detaches it, and hyphenated tool names now match in autocomplete. (Author: @adaam2)
• Platform admin: model keys encrypted at rest #5201 - Visible to platform operators only. Platform OpenRouter keys are encrypted at rest, with an admin page listing each organization's keys, limits, live usage, and encryption state, and enable and disable actions audit-logged against the owning organization. (Author: @bflad)

Bug fixes

• LiteLLM-proxied sessions no longer duplicate turns #5152 - The proxy and the agent's own hook stream both reported the same assistant turn, and both rows survived. The duplicate is now dropped for sessions a hook stream already captured, and bare Claude adapter sessions resolve to the Claude Code surface instead of colliding with Claude desktop imports. (Author: @speakeasyforgebot)
• URL imports hardened against SSRF #5231 - OpenAPI-from-URL and image-from-URL fetches reject non-HTTPS targets and private address space, with redirects capped and re-checked so a hostile target can't chain into internal networks. (Author: @speakeasyforgebot)
• Typed dates work in the time range picker #5225 - Natural-language date parsing silently failed on most pages because the request was missing its project header. The picker now injects it everywhere, fixing the project home, security, and billing pages in one place. (Author: @simplesagar)

Faster assistants, file attachments in chat, and organization names in every language

Assistants no longer send every MCP tool schema to the model on every call: tools are discovered on demand, servers connect on first use, and dropped connections reseat themselves, which keeps prompt caching effective for large toolsets and takes MCP handshakes out of cold-start latency. The Project Assistant accepts file attachments, and organization names now accept punctuation and every script, so "Acme, Inc." and a company named in Japanese both get through the door. One breaking change below on external key management.

Breaking changes

• External key updates can no longer change what a key is #4971 - The AWS KMS and GCP KMS update methods drop the fields that defined key identity (key_arn, resource_name, algorithm); changing those now means deleting the key and creating a new one. Deleting a key is refused while a key set or published key still references it, and creating a GCP key requires a fully qualified crypto key version path. (Author: @bflad)

Features

• Assistants respond faster and cache better #4121 - MCP tools are found through a search tool instead of being advertised wholesale, servers connect on first use rather than at startup, and dropped connections reseat automatically. The same release adds a local runtime provider so assistant runtimes run in Docker for local development. (Author: @danielkov)
• Attach files to the Project Assistant #5139 - Drop files anywhere on the chat or use the paperclip. Images and text-like files, including OpenAPI documents, travel with the turn; anything unreadable inline arrives as a short-lived download link. The composer also recalls past prompts terminal-style with the arrow keys (#5178), merges skills and tool mentions into one "Add context" picker (#5142, #5177), and hides its example prompts once a file is attached (#5176). (Author: @adaam2)
• Organization names in every language #5203 - Names accept punctuation and every script, so "Bob's Bakery", "Café Zoë", and companies named in Japanese, Arabic, or Cyrillic all pass validation. Invisible formatting and control characters are still rejected, and URL slugs are unaffected. (Author: @alx-xo)
• Choose accepted OAuth clients from the dashboard #5027 - An MCP server's authentication settings now offer the verified client catalog, any spec-valid client, or none, plus your own document URLs, each verifiable before it's added. Client metadata documents are also cached with proper revalidation instead of refetched on every authorization (#5154). (Author: @bflad)
• Revoking a session revokes it upstream too #5118 - Revoking a remote session now posts the stored token to the issuer's RFC 7009 revocation endpoint, so the upstream provider drops it instead of leaving a live token working elsewhere until it expires. This covers every path that ends a session, including the end-user "Disconnect" on the consent screen. (Author: @aa-wong)
• Set a session refresh policy for the whole organization #5066 - Admins choose Disabled, User controlled, or Required from the MCP Connections page, and end users see the effective policy on the consent screen. Required keeps every eligible connection refreshed; Disabled says plainly that idle connections will lapse. (Author: @speakeasyforgebot)
• Tool calls summarized at a glance #5209 - Agent session views gain compact tool-call rows with persisted two-sentence summaries and risk-first detail expansion, so scanning a long session no longer means expanding every call. (Author: @chase-crumbaugh)
• Watchdog: ranked risk signals, rolling out #5124 - A new Watchdog page clusters live findings into ranked signals with severity scores, trends, and a drawer that turns a signal into an exclusion in one action (#5143, #5207). Rolling out behind a feature flag; it replaces Risk Overview and Risk Events where enabled. (Author: @dennnis-ez)
• Skill details split into focused pages #5159 - Content, usage, feedback, versions, and settings each get their own page instead of one long scroll. (Author: @alx-xo)
• LiteLLM sessions show their originating client #5140 - An agent session routed through LiteLLM displays the supported client that produced it while still matching the LiteLLM filter. (Author: @danielkov)
• Registry evidence on catalog entries #5076 - Catalog entries from external MCP registries now carry the registry's declared source repository and published packages, feeding the approval evidence surface. The API descriptions note these are declarations, not observations. (Author: @daviddanialy)
• Warnings for duplicate identity provider URLs #5136 - Creating or editing a provider that duplicates an existing issuer URL now warns, without blocking the write, since duplication has legitimate uses. (Author: @bflad)
• Logging out clears everything #5131 - Logout now instructs the browser to drop cookies and storage across the whole domain, closing the gaps a plain expiring cookie leaves. Theme preference and project favorites survive. (Author: @disintegrator)
• Exclusion changes apply retroactively everywhere #5204 - Creating, updating, disabling, or deleting a risk exclusion now rewrites the affected findings' state in the analytics store as well as the primary database. (Author: @dennnis-ez)
• MCP protocol version telemetry #4957 - All five inbound MCP paths emit requested and negotiated protocol versions, so client adoption can be measured and version-specific failures diagnosed. (Author: @bflad)
• Platform admin and internal groundwork #5069 - Groundwork for the MCP approval workflow landed without user-facing behavior: summarizing what a tool declares it can do and resolving observed servers to stable artifact identities (#5036). Authorization challenge logging moved to a queue-backed pipeline (#5070) and challenge log pages now serve from pre-aggregated summaries (#5185). Platform operators gained a pay-as-you-go rate adjustment input on the contract estimator (#5145). (Author: @daviddanialy)

Bug fixes

• Employee usage pages no longer under-report #5199 - The rows that carry tokens and cost identify people by provider account email, while hook events carry a resolved user id, and per-employee queries only matched one shape. Employee pages now scope to a person's whole identity set, so someone on a personal AI account stops showing sessions next to zero cost. (Author: @daviddanialy)
• Codex hooks no longer fail with exit 127 #5103 - A background plugin refresh could delete the directory a running Codex session's hook command pointed at. The bootstrap now persists itself in a version-independent location, and a hash-computation bug that silently dropped hooks whose commands contained shell metacharacters is fixed. (Author: @speakeasyforgebot)
• Cursor events attribute to their sessions #5011 - Cursor usage events now decode the conversation id into the standard conversation attribute, tying usage to the session that produced it. (Author: @bradcypert)
• Misconfigured Slack clients no longer mask real alerts #5015 - Slack refusals a caller has to fix, such as a channel the bot was never invited to, are now caller-attributed warnings instead of server errors, so one noisy client can't hold an error monitor at threshold and hide a genuine regression. (Author: @bradcypert)
• Block pages and challenge rows link where you'd expect #5137 - Durable block pages link to the owning project's risk event log, and skill and environment rows on the access challenges page link to their pages instead of showing a bare id (#5134). (Author: @danielkov)
• "Continue chat" only offers your own sessions #5133 - The assistant dock's continue option now lists only sessions the viewer started from the dashboard, backed by a new user filter on chat listing. (Author: @danielkov)
• Audit entries name actors without an organization #5202 - Actions taken from organization-less sessions, such as self-signup provisioning, now record the actor's email instead of a bare id. (Author: @alx-xo)
• Platform admin: organization list paging #5218 - The admin organizations list no longer returns a cursor to an empty page when results are an exact multiple of the page size. Hook installations are also served an updated binary (#5135). (Author: @walker-tx)

Assistants can see images from Slack, and skills are scanned for prompt injection

An assistant triggered from Slack now reads the images attached to the message, and can fetch images referenced later in a thread, so screenshots stop being dead weight in a conversation. Skill manifests are scanned for prompt injection the moment they're captured, with findings shown on skill details, and an organization whose trial ends lands on a page that says so instead of a generic gate.

Features

• Assistants see images shared in Slack #4361 - Images attached to a triggering message travel with the turn as vision content, validated against an image allowlist, and a new asset inspection tool lets the assistant fetch an image referenced later in the thread through a short-lived sealed download URL. Image bytes live only in the live inference path and are never persisted at rest. (Author: @claude[bot])
• Slack attachments are visible to triggers #4358 - Messages that share files surface each attachment's name, type, and size in the turn context, and the file list is addressable from trigger filters, so a trigger can route on "message with a file" without fetching contents. (Author: @claude[bot])
• Skills are scanned for prompt injection #5031 - Captured skill manifests are judged against your Prompt Injection policy at capture time, current-version findings appear on skill details, and admins can configure the policy from the Skills page. Scanning never fails an upload, and an unavailable judgement retries later rather than passing as clean. (Author: @svadrutk)
• Ended trials land on an upgrade page #5108 - An organization whose enterprise trial has ended sees a page that says so and books an upgrade call, and anyone still inside a trial can reach it early from the sidebar countdown. Admins also receive lifecycle emails when a trial starts and as it approaches expiration (#5043). (Author: @alx-xo)
• Internal: groundwork and dashboard scaffolding #4360 - The assistant runtime's message representation widened to structured content parts, which is what the Slack image support above builds on. A signals endpoint landed backing a risk monitoring page that ships behind a flag in the next release (#5104), and the dashboard gained a shared page-template layer with about 34 pages migrated onto it (#5094). (Author: @claude[bot])

Bug fixes

• Assistants pick up runtime updates automatically #5120 - A regularly used assistant could keep its admission-time runtime image forever. Deploys now recycle stale runtimes lazily at turn admission, so assistants roll onto the current image without waiting for an idle window. (Author: @danielkov)
• Skill share pages resolve on custom domains #5088 - Custom domain routing now covers shared skill pages, which previously returned an edge 404. Existing domains pick up the route on their next settings save. (Author: @simplesagar)

Search and filter every client and session connected to an MCP server

The Clients and Sessions tab on MCP server pages now leads with live counts and renders both listings as searchable, sortable tables, so answering "who is connected to this server right now" takes one click instead of a scroll. MCP OAuth responses also meet the newest authorization spec, protecting clients that hold flows against several servers at once.

Features

• Searchable client and session tables #5077 - Both listings are searchable, filterable, and sortable, with member avatars and creation dates on sessions. Each client row reports how many active sessions it holds, and clicking that count narrows both listings to that client. (Author: @bflad)
• OAuth responses defend against mix-up attacks #4956 - The authorization server now emits the RFC 9207 issuer parameter on every response and advertises it in metadata, satisfying the MCP 2026-07-28 authorization response validation requirement. (Author: @bflad)

Bug fixes

• Shadow MCP finding descriptions stay generic #5056 - Risk finding descriptions no longer name the specific tool that was called. (Author: @disintegrator)
• Onboarding covers Claude Cowork and shows conversations #5057 - Choosing Device Agent during onboarding now notes that Claude Cowork's cloud sandbox needs its own manual setup step and links to it. Conversation events also reach the confirm-traffic feed, so it shows prompts and replies rather than only tool calls, and MDM vendor wording follows the Iru rebrand. (Author: @mfbx9da4)

Device Agent is out of preview, with a one-step signed macOS installer

Device Agent leaves preview. macOS installs from a single signed, notarized package, so rolling it out to a fleet is one installer run or a normal MDM push instead of a download-and-chmod sequence. MCP server pages also gain a Clients and Sessions tab showing who is connected, and public skill share links now use your custom domain. One breaking change below: the legacy OAuth proxy system is removed.

Breaking changes

• The legacy OAuth proxy system is removed #3465 - Toolsets have migrated to user session issuers, so the proxy serving path, its management endpoints, and its migration helpers are gone. Clients still holding proxy refresh tokens receive invalid_grant and re-authorize against their session issuer instead of exchanging stale tokens indefinitely. The "Configure OAuth" wizard keeps its structure but now provisions a session issuer on the custom path. (Author: @qstearns)

Features

• Device Agent is out of preview #4888 - macOS now installs from a single signed, notarized package that sets up the daemon, CLI, and menu-bar UI together, so setup is one installer run or a normal MDM push instead of a download-and-chmod sequence. Device Agent is also the default choice on the instrumentation onboarding step. (Author: @mfbx9da4)
• See the clients and sessions connected to an MCP server #4797 - MCP server detail pages gain a Clients and Sessions tab listing the OAuth clients registered against the server alongside its active sessions, with catalog-resolved clients distinguished from dynamically registered ones. (Author: @bflad)
• Skill share links use your custom domain #5023 - Public skill share pages and raw SKILL.md downloads are served from your verified custom domain, and the dashboard copies links with that domain automatically. (Author: @simplesagar)
• One plugin package for Cursor and Codex #5063 - Compatible Cursor and Codex plugins publish from a shared Agent Plugins 1.0 package, with compatibility status and portable ZIP downloads shown on plugin pages (#5071) while marketplace entries keep their native formats (#5075). (Author: @danielkov)
• opencode joins the managed tools list #5054 - The device-agent fleet configuration page now offers opencode with the same off, user, and managed enforcement options as the other supported tools. (Author: @bradcypert)
• A 14-day enterprise trial on every signup #4881 - A new organization gets the enterprise feature set for 14 days, with $50 of chat credits and the same ceiling applied to inference the platform runs on your behalf (#5073). The billing page shows your organization's credit ceiling. Trials that end without converting return to the free plan automatically, with every demotion audit-logged (#4983). (Author: @svadrutk)
• A redesigned dashboard #5046 - The whole dashboard moves to a new editorial design language: flat square surfaces with hairline borders, serif display titles with area micro-labels, unified table headers, colorized metric tiles, and a restrained chart palette with a proper dark-mode ramp. (Author: @adaam2)
• Opt-in automatic session refresh (hidden until enabled) #4705 - Users can opt in to automatic remote session token refresh. The organization settings for it stay hidden until the capability is enabled for your organization. (Author: @ThomasRooney)
• Platform admin: consolidate duplicate identity providers #5060 - Visible to platform operators only. A Convergence tab lists organizations running their own provider for the same upstream and re-points their clients onto the shared catalog entry without anyone signing in again. (Author: @bflad)

Bug fixes

• Codex and ChatGPT costs no longer double count #5021 - The compliance cost feed repeats event ids across log files, and each repeat was imported as its own row, inflating every token and cost aggregate downstream. Repeats are now dropped, and re-polling a window is idempotent. (Author: @daviddanialy)
• Organization names that produce an empty URL are rejected #5039 - A name made entirely of punctuation previously passed validation and produced an organization with an empty URL slug. Names now need at least two letters or numbers. (Author: @alx-xo)
• Marketplace Git installs accept compressed requests #5080 - Compressed Git upload-pack requests through marketplace URLs are now supported. (Author: @danielkov)
• Integration poll labels match reality #5064 - AI integration cards now state their actual sync cadence, such as every five minutes for the Anthropic compliance feed rather than the "every 10m" it claimed. (Author: @mfbx9da4)
• Sessions without an organization no longer fail #5009 - Organization-less login sessions no longer trip access-control grant preparation. (Author: @tgmendes)
• Trigger delivery telemetry carries real identifiers #4694 - Delivery logs record a proper trigger-instance URN and the active trace context instead of an empty placeholder. (Author: @danielkov)
• Tables work from the keyboard #4989 - Clickable table rows are focusable and activate with Enter or Space. Smaller polish landed alongside: a cleaner bulk-actions toolbar on risk tables (#4783), Policy Center rows that stop repeating themselves (#4970), and the brand-mesh treatment extended to the chat landing page (#5087). (Author: @alx-xo)
• Internal cleanups #5045 - Legacy deny-effect access grants are removed in favor of allow-only rows with explicit exclusion scopes, the badge marking staff-only UI now reads "Internal Admin" instead of "Dev" (#5068), and hook installations are served an updated binary (#5038). (Author: @tgmendes)

ChatGPT conversations become agent sessions, and spend limits now stop Codex and Cursor

ChatGPT workspace conversations now import from the OpenAI Compliance Logs Platform and appear as agent sessions alongside your Claude traffic, so the assistant most of your company already uses stops being a blind spot. Spend limits that already denied over-budget Claude usage now deny Codex and Cursor at parity, Codex cloud surfaces like GitHub code review are metered for the first time, and webhooks are open to every organization. Prospects can also reach the platform on their own now, through a self-serve sign-up page and a live read-only demo organization.

Features

• ChatGPT conversations appear as agent sessions #4860 - A new ChatGPT Conversations integration polls your workspace's compliance conversation logs and lands them in the same Agent Sessions surface as the Anthropic compliance import, configured from a card in organization settings. (Author: @daviddanialy)
• Spend limits now enforce on Codex and Cursor #4870 - Over-budget actors are denied on Codex and Cursor exactly as they are on Claude, on both the legacy hook endpoints and the unified ingest path. Denies link to a durable block page, and the gate keeps failing open on infrastructure errors so an outage never locks anyone out. (Author: @daviddanialy)
• Codex cloud usage is metered and its transcripts imported #4908 - Codex surfaces with no telemetry stream of their own, such as GitHub code review and cloud web tasks, now count toward tokens under management from the compliance cost feed, and cloud task prompts and responses import as agent sessions for post-hoc review (#4910). Codex sessions also carry an account type (team or personal) and the billing mode declared on your integration (#4876). (Author: @daviddanialy)
• Webhooks are available to every organization #5000 - The design-partner preview gate is gone. Webhooks are marked Beta, and delivery is controlled solely by your organization's own webhooks toggle. (Author: @disintegrator)
• Sign up without talking to sales #4990 - A new sign-up page collects a company name and work email, hands off to the identity provider with the email pre-filled, and creates the organization the moment authentication completes. A company name never travels through a redirect or the address bar. (Author: @alx-xo)
• Explore a live demo organization #4952 - Any authenticated user can switch into a shared read-only demo organization to see the product working on real-looking data, then exit back to their own organization without logging out. The book-a-demo gate links straight into it. (Author: @adaam2)
• Role-based access control is on for every organization #4780 - New organizations are provisioned with built-in roles and grants, and the first user is assigned the Admin role. (Author: @tgmendes)
• Control which OAuth clients an MCP server accepts #4901 - Session issuers can admit a curated catalog of verified MCP clients (Claude Code, Claude, VS Code, Zed, ChatGPT, Codex CLI, and more) plus your own URLs, admit any spec-valid client, or admit none. Issuers that haven't chosen a mode record what the curated policy would have decided without enforcing it yet. Clients whose metadata omits an auth method, including ChatGPT and Codex CLI, are now accepted as public clients per the spec. (Author: @bflad)
• Trigger assistants from Microsoft Teams #4855 - Bot Framework activities posted to a trigger webhook are verified against Microsoft's signing keys and dispatched to assistants with the same event filtering as other webhook triggers. (Author: @danielkov)
• Provision and monitor LiteLLM integrations #4830 - Project-scoped LiteLLM provisioning with key rotation and revocation, authenticated OTLP trace ingestion (#4819), opt-in operational metrics that never touch usage billing (#4826), and health and attribution diagnostics (#4841). (Author: @danielkov)
• Search agent sessions by email #4887 - Session search now matches resolved member and AI account email addresses, so finding one person's sessions no longer depends on knowing their user id. (Author: @danielkov)
• One stable link to the macOS device-agent installer #4897 - A stable URL redirects to the current signed installer package, so IT instructions link one address instead of a version that goes stale every release. (Author: @mfbx9da4)
• Configure the device-agent fleet remotely #4693 - Organization admins can set per-tool enforcement layers, release policy, and reconciliation cadence from a new configuration tab, with versioning, validation, and audit logging behind it. (Author: @speakeasyforgebot)
• Figma connects directly from the catalog #4967 - Adding Figma now points your project at Figma's official server instead of routing through a proxy, so there is nothing extra to authorize or allowlist. (Author: @mfbx9da4)
• Setup guides fill in your OAuth callback URL #4907 - Wherever a setup guide asks you to register a redirect URI on an upstream provider, the guide now shows the deployment's real callback URL ready to paste. (Author: @walker-tx)
• See your trial status in the sidebar #4994 - Organizations on an active trial see the current trial day, remaining days, and a link to sales in the navigation. (Author: @alx-xo)
• Bring-your-own cloud credentials move to organization settings #4714 - Requires the customer-managed encryption keys entitlement. Organization admins register how the platform authenticates into their cloud account, and new verification calls confirm service-account impersonation actually works before anything depends on it. (Author: @bflad)
• Platform admin: curate the shared identity provider catalog #4775 - Visible to platform operators only. The providers every organization inherits can be listed, created, edited, and deleted from the dashboard, with client counts that say up front which delete blockers belong to whom. (Author: @bflad)
• Internal: model key lockdown and groundwork #4986 - A locked-down platform model key now fails with a distinct error rather than an upstream rejection, protecting shared capacity. Internal changes to risk finding storage (#4839) and hook binary serving (#4895) also landed. (Author: @walker-tx)

Bug fixes

• API keys no longer leak to unproxied MCP servers #4958 - A server whose URL points directly at a vendor could have your organization's API key attached as a static header, sending it to the third party. Unproxied servers now carry no platform-managed credential in any generated client config, and no longer prompt for an API key during install. (Author: @mfbx9da4)
• Shadow MCP policies now cover Codex's resource meta-tools #4923 - Codex reaches MCP servers through three meta-tools that carry no MCP prefix, so a block-all policy didn't stop a Codex session from reading any server's resources. The gate now recognizes them, resolves the named server against the session's inventory, and denies what it cannot clear. An inventory that could not be read is no longer treated as proof of an empty one (#4978), and explicit empty snapshots are accepted and cached (#5034). (Author: @daviddanialy)
• Codex telemetry is attributed to Codex #4913 - Headless runs, the TUI, MCP mode, and the unified ChatGPT desktop app each report a different service name, and only the interactive CLI matched, so the rest was persisted as Claude traffic and never metered as Codex. Every Codex client mode now routes correctly, per telemetry resource rather than per batch. (Author: @daviddanialy)
• The Codex plugin installs on the unified ChatGPT app #4912 - The installer now probes the merged ChatGPT desktop app's bundled Codex binary first, keeping the legacy path for pre-merge installs. The renamed Codex MCP client user agent passes the Figma allowlist again (#4915), and the Codex setup copy reflects the merged app (#4916). (Author: @daviddanialy)
• Enforcement block pages always exist #4972 - A block early in a session could race its own chat row and silently fail to write, leaving the blocked user opening a page that didn't exist. The write now drops unresolvable links and retries, so the block always lands. (Author: @daviddanialy)
• Quiet MCP streams no longer log spurious errors #4968 - A proxied SSE stream ending on the 60-second idle bound is now a clean close instead of one fake 500 per minute per connected client. (Author: @danielkov)
• Unreachable MCP servers fail the tools probe in seconds #4996 - Two compounding retry layers could stretch a live tool-listing probe past a minute against a dead vendor server. The probe is now time-boxed to its intended ~10-second bound. (Author: @mfbx9da4)
• Chat analysis no longer exhausts shared model capacity #4911 - The shared LLM judge rate limiter now buckets by the key a call actually spends, so platform-key traffic can't starve a model and fail with 429s. (Author: @danielkov)

Integrate and govern every model call that runs through a LiteLLM

LiteLLM is now a first-class source. Point a proxy at the platform and each call is checked against your prompt policies before it reaches the model, so a prompt that violates policy is stopped at the proxy rather than caught after inference and billed for. The model's reply comes back through the same ingestion path and lands in the same session, attributed to the same person, which means risk analysis reads a complete exchange instead of half of one. Because the enforcement sits at the proxy, this covers every model your LiteLLM deployment fronts without changes to the applications calling it. Identity is resolved from the virtual key's organization-scoped email, so an integration key or a client-supplied end-user field can never stand in for a real actor, and LiteLLM's own call, trace, user, team, and end-user IDs travel through as telemetry dimensions you can pivot on later.

Features

• Prompt policies are enforced before inference #4812 - An authenticated LiteLLM Generic Guardrail endpoint evaluates each prompt against your policies on the pre-call hook and records blocked prompts as durable findings. Non-interactive calls are blocked outright rather than issued an acknowledgement link no one is there to click. (Author: @danielkov)
• Responses are captured into the session that produced them #4815 - Post-call responses are stored as assistant messages through the same ingestion path every other source uses, and a per-call attribution cache keeps the pre-call actor and session attached so a prompt and its reply never split across two identities. On a cache miss, attribution falls back to trusted response metadata and never to the integration key. Tool calls in the model output are retained as metadata rather than turned into execution records, and captured responses feed asynchronous risk analysis. (Author: @danielkov)
• Internal: trusted in-process hook ingestion #4808 - The groundwork the two features above are built on. A trusted entry point lets an in-process caller ingest with a pre-authenticated organization and project identity, mirroring the enforcement, idempotency, telemetry, and conversation capture of the public path without a network hop, and stripping transport credentials before applying the supplied identity. No user-visible change on its own. (Author: @danielkov)

Run an allow-by-default shadow MCP policy end to end

Allow-all shadow MCP policies are now operable from the surfaces you actually work in. The inventory shows which servers are allowed by default and which a rule blocks, the per-server action becomes Block Server or Unblock Server, and approving a bypass request unblocks the server for everyone in the project instead of granting one person a private exception. The project assistant can also deliver the skills it writes, attaching them to a plugin or assistant without handing you back to the dashboard to finish.

Features

• Inventory and status surfaces know your policy's posture #4596 - Under an allow-all policy the inventory marks a server blocked only when a block rule names its URL and allowed by default otherwise, the status banner reads "Allowing by default", and the primary action on a row or detail view flips to Block Server / Unblock Server. Each action edits the block rule for that one URL, so it is safe to run alongside others. A project holding both dispositions from earlier edits resolves deny-by-default. (Author: @alx-xo)
• Approving a request on an allow-all policy unblocks the server for everyone #4597 - From the approvals page or the inventory review flow, approving a bypass request against an allow-all policy removes the server's block rule project-wide rather than granting one principal an exception; revoking restores the block, and denying changes nothing. The approval sheet skips the audience and policy pickers and says plainly that approval applies to the whole project. Block-all policies keep their per-principal bypass behavior, and every decision is audited the same way in both postures. (Author: @alx-xo)
• The project assistant can distribute the skills it creates #4847 - Ask the assistant to add a skill to a plugin or assistant and it does, instead of pointing you at Distribute → Plugins to finish by hand. platform_distribute_skill attaches the skill, pinning a version or tracking the latest valid one, platform_undistribute_skill revokes a single distribution while leaving the skill and its versions intact, and platform_list_plugins resolves a plugin by name to the ID both take. All three run under the same permissions, feature gating, and audit logging as the dashboard. (Author: @simplesagar)

ChatGPT spend shows up in your cost analytics, and shadow MCP policies can allow by default

ChatGPT and ChatGPT Work usage now counts toward tokens under management and appears in your usage and cost views, split by product, so the AI spend you already had visibility gaps on lands in the same place as Claude Code, Codex, and Cursor. Shadow MCP policies gained a second posture: allow every server and name the ones to block, including servers your inventory hasn't seen yet. And the project assistant can act on risk findings rather than only listing them, suppressing a class of findings or dismissing one as a false positive.

Features

• ChatGPT and ChatGPT Work usage counts toward your analytics #4851 - ChatGPT and ChatGPT Work now appear as distinct sources across labels, icons, and the onboarding live tail, with Work rows routed separately so the per-product split survives summarization. Their tokens count toward tokens under management and appear in usage and cost analytics from here on (#4850), matching how polled Claude Chat and Cursor usage already bills. Rows recorded before this release are retained but not backfilled. (Author: @daviddanialy)
• Choose the default posture for a shadow MCP policy #4595 - When creating a policy, pick whether it blocks every server and allows exceptions or allows every server and blocks exceptions. The server selector flips to match, and the posture is read-only when editing because changing it means recreating the policy. (Author: @alx-xo)
• Allow-all policies are enforced in the hook path #4594 - Under an allow-all policy, every externally hosted MCP server is permitted unless a block entry names its URL. A project can have only one enabled shadow MCP blocking policy, so two policies can never disagree at enforcement time. (Author: @alx-xo)
• Name the servers to block on an allow-all policy #4593 - Allow-all policies carry a blocked URL list, mirroring the allowed URL list on block-all policies. The two lists are mutually exclusive by posture, and a blocked URL can name a server the project inventory hasn't observed yet, so you can block proactively. (Author: @alx-xo)
• The assistant can resolve risk findings #4782 - New assistant tools suppress a whole class of findings, mark a specific finding a false positive, and reverse either action. The writes go through the same service methods the dashboard uses, so they stay gated on org admin and audited against the invoking user, and exclusion match values are fingerprinted before the model sees them so an equivalent exclusion is reused rather than duplicated. A rule breakdown tool answers "which rules fire most" in one small call, and the findings listing now defaults to 25 results, capped at 50, to keep triage from filling the assistant's context. (Author: @adaam2)
• The assistant can create project skills #4790 - Hand the assistant complete SKILL.md content and it creates the skill under the same validation, versioning, permissions, and audit logging as creating one by hand. (Author: @speakeasyforgebot)
• Readable assistant tool calls #4846 - The project assistant now announces each batch of tool calls with a short activity phrase, such as "Investigating failures in the last 30 days", which becomes the heading of a single collapsed group. Consecutive batches merge into one group whose heading advances as the investigation moves along, so a long tool run reads as progress rather than a wall of calls. (Author: @adaam2)
• Sync metrics for device integrations #4811 - Sync runs and auto-paused schedules now emit OpenTelemetry metrics by provider and outcome, backing the failure-rate and auto-pause monitors for the MDM integrations rollout. (Author: @daviddanialy)
• Risk findings storage prepared for reveal metadata #4794 - New columns on the risk findings store, plus matching changes to ingestion (#4818) and the backfill tooling (#4795), so findings can carry reveal metadata in a later release. No user-visible change yet. (Author: @dennnis-ez)
• Contract value estimator on the billing page #4828 - For platform admins only, the TUM Contract section estimates what an enterprise account is worth under a committed platform fee with tiered overage or under pay-as-you-go, and flags accounts whose overage has outgrown their base contract. (Author: @simplesagar)

Bug fixes

• Codex compliance rows no longer double count tokens #4813 - Codex compliance cost rows carried token counts on the same keys the usage stream uses, so an organization running both feeds had its token metering counted twice. Those rows now meter cost only, with the raw counts preserved under separate attributes because the compliance feed also covers surfaces the usage stream never sees, such as cloud-delegated tasks and code review. (Author: @daviddanialy)
• OAuth token exchange works with strict providers #4848 - Client credentials are now form-urlencoded before going into the Authorization header, as the spec requires, fixing invalid_client failures against providers that decode them strictly, such as Snowflake. (Author: @danielkov)
• Challenges page totals match what's on screen #4814 - Unattributed authorization challenges are excluded from the buckets endpoint, so pagination and totals agree with the rows rendered. (Author: @simplesagar)
• Screen readers hear when the contract estimate fails #4829 - The failure message replaces a loading skeleton after the page has settled, so without a live region there was nothing to indicate the estimate had failed or that reloading would fix it. (Author: @simplesagar)

Ask the project assistant and get an answer cited from the docs, and read billing for whatever date range you pick

The assistant can now read the AI control plane documentation and cite the page it drew from, so a "how do I configure this" question comes back with a link you can check rather than an answer you have to trust. On the billing page, the usage card follows whatever range you select instead of snapping back to the full cycle, and connecting an upstream MCP server can surface its published setup guide. Billing contacts also start getting a Monday email with their usage for the cycle.

Features

• The project assistant reads and cites the product documentation #4786 - Two new assistant tools expose the roughly 110 AI control plane documentation pages: one returns the page index, the other returns a single page's markdown along with the public link to cite. The assistant can only read pages that are in the index, so it cites documentation rather than fetching arbitrary URLs. (Author: @simplesagar)
• The billing usage card follows the range you picked #4789 - Typing a range, picking one on the calendar, or drilling into a bar now updates the usage card to that window: billed tokens for the range, overage attributed to the time it was actually incurred with the crossing day prorated, and the per-unit average over the same window. Allowance figures stay cycle-only and hide on partial ranges, and the details table uses the same attribution, so card and table always agree. (Author: @daviddanialy)
• Setup guides for upstream MCP servers #4721 - Published setup documentation for an upstream MCP server can be looked up by its endpoint URL, its registry specifier, or both, with matches returned most specific first and each one reporting how it matched. Servers with no published guide return an empty list rather than an error. (Author: @walker-tx)
• Weekly usage summary email for billing contacts #4646 - Every Monday, each organization's billing alert contact gets their tokens-under-management total for the active cycle with a percent-change badge against the same elapsed point in the previous cycle. The token components behind that total are defined once and shared with the billing measure, so billing and reporting move together. Organizations with no usage in either window are skipped. (Author: @daviddanialy)
• Risk Events listing served from ClickHouse #4766 - The project-wide Risk Events listing reads from ClickHouse behind the risk-list-from-clickhouse flag, keeping the same ordering, filters, and pagination, and fixing a bug that skipped the first result after a page boundary. (Author: @dennnis-ez)
• Business memory extraction, in internal validation #4757 - Durable knowledge is selectively extracted from completed sessions, with semantic duplicates suppressed, behind a corpus browser that offers semantic search, a jump to the cited source message, and a counted content-scope tree. The dashboard is gated to developer sessions while extraction quality is validated, so nothing is customer-visible yet. (Author: @chase-crumbaugh)
• Typed feature flags in the dashboard #4649 - A reactive feature-flag hook now distinguishes loading, enabled, disabled, missing, and error states, so a gated surface can tell "still loading" from "off" instead of flickering. Project navigation is the first consumer, with its existing opt-in and opt-out behavior unchanged. (Author: @alx-xo)

Bug fixes

• Saving an app verification token takes effect immediately #4778 - Domains provisioned before the OpenAI challenge feature shipped were missing the route, so the token endpoint returned a 404 until some unrelated change rebuilt the ingress. Setting or clearing the token now triggers that rebuild directly. (Author: @ThomasRooney)
• Serve the 0.3.12 hooks binary #4749 - Hook installations get the latest binary, and previously pinned releases stay available for installations that haven't regenerated their bootstrap script. (Author: @gram-bot)

Connect Claude Code and VS Code without client registration, and serve an MCP server straight from your domain root

MCP clients that identify themselves with a URL, including Claude Code and VS Code, can now finish the OAuth flow without Dynamic Client Registration, loopback redirects included. Custom domains gained a root route: point https://your-domain.com/ at one of your MCP endpoints and clients connect at the bare domain while browsers get the installation page.

Features

• OAuth without Dynamic Client Registration #4730 - The session OAuth authorization server now supports Client ID Metadata Documents, so clients that present a URL-shaped client ID, such as Claude Code and VS Code, complete the flow without registering first, including loopback redirects on any port. Available per organization behind the gram-user-session-cimd flag. (Author: @bflad)
• Route a custom domain root to a default MCP server #4601 - Pick one of the domain's MCP endpoints as its default and the bare domain serves that server directly, with slug renames following automatically. Custom domains can also serve an OpenAI app-submission verification token at /.well-known/openai-apps-challenge, so a ChatGPT app review can verify domain ownership with no changes to your own site. Both settings live on the custom domain page, and the default server can also be set from an MCP server's settings. (Author: @ThomasRooney)

Bug fixes

• Renamed shadow MCP servers keep the new name #4697 - Renames written in quick succession could tie on their stored version and intermittently revert to an older observed name. Versions are now stored at nanosecond precision so each update supersedes the state it was based on. (Author: @ThomasRooney)
• Detector copy no longer lists specific coding agents #4769 - Shadow MCP detector text and other product strings use generic wording, so a newly supported agent doesn't need a copy change to be covered. (Author: @svadrutk)

Access controls apply on every plan, and external OAuth setup configures itself

Role-based access control is no longer something your plan decides: grants are enforced on every account tier, with the rollout flag gone. Setting up an MCP server behind an external OAuth provider now discovers the provider's metadata for you, validates as you type, and tests the connection before you save. If you push device evidence to Drata, connecting it provisions the Custom Connection itself. That last change also alters the record schema, so anyone with a declared Drata or Vanta schema needs the breaking change below.

Breaking changes

• Evidence records carry per-device attestation strength #4720 - Pushed Drata and Vanta coverage records replace assignedUserAgentActive and assignedUserAgentLastSeenAt with agentActive, agentAttestation, and agentLastSeenAt. The attestation value is device when the record is backed by that machine's own agent heartbeat, matched on hardware serial, and user when only its assigned user's heartbeat backs it, so one push can carry both strengths honestly. Customer-declared Drata and Vanta record schemas need updating to match. (Author: @daviddanialy)

Features

• Access controls apply on every account tier #4681 - RBAC grants are enforced regardless of plan, and the dashboard rollout flag is gone, so the permissions you configure hold everywhere rather than only on the tiers that had the feature turned on. (Author: @tgmendes)
• External OAuth setup configures itself #4571 - Point at a provider and its metadata is discovered for you, fields validate inline, and a test button confirms the connection before you save, so a misconfigured provider surfaces during setup instead of on a user's first login attempt. (Author: @simplesagar)
• Add project skills as context for a single assistant turn #4703 - Pick the skills that matter for one Project Assistant question instead of relying on whatever is globally in scope. (Author: @simplesagar)
• Function tools can read MCP client metadata #4748 - Function-based tool calls now receive the calling MCP client's metadata, so a tool can adapt its behavior to the client that invoked it. (Author: @qstearns)
• Drata provisions its own Custom Connection on connect #4758 - Connecting Drata now creates the dedicated Custom Connection with the right record schema for you, keyed on a deterministic name so re-saving reuses it instead of piling up duplicates. The connection ID field became optional, and optional settings moved behind an Advanced disclosure, so a Drata connection is Region, API key, and Test. (Author: @daviddanialy)
• MDM integrations page follows the coverage pipeline #4753 - A pipeline banner shows live connected counts and org-wide fleet coverage over two role-labeled groups. Detail pages are role-specific: inventory sources keep their device tables and "synced" language, while evidence destinations drop the inventory a sink doesn't own, show what they publish, and break down which sources feed them. (Author: @daviddanialy)
• Identity provider setup reuses a provider you already have #4695 - Providers can be looked up by their upstream issuer URL, returning the one the project would use, so automatic setup flows reuse an existing provider instead of scanning the whole list in the browser. Platform-catalog providers are reusable this way for the first time. (Author: @bflad)
• Groundwork for sorting and filtering Risk Events #4735 - Risk findings now record the originating message time and the assistant that produced them, so a later release can sort and filter the Risk Events listing on both without a cross-store lookup. (Author: @dennnis-ez)

Bug fixes

• External OAuth configuration is back on eligible MCP servers #4569 - The external OAuth options returned to the authentication page for the servers that support them. (Author: @disintegrator)
• Drata pushes survive real-world API responses #4745 - Three defects found against the live API: session listings with numeric IDs now decode correctly and report their real errors rather than a misleading fallback, an empty fleet clears evidence by deleting records because Drata rejects an empty session, and per-record schema rejections hidden inside a 2xx response now fail the push instead of quietly publishing a partial fleet. (Author: @daviddanialy)
• Vanta pushes match its actual contract #4751 - Every record now carries the required externalUrl field, the last-seen timestamp is always sent because Vanta schemas mark every property required, and the response check follows the full-state contract Vanta really returns instead of an accounting object it never sends, which had been failing every push. (Author: @daviddanialy)
• The agent coverage meter reads correctly in dark mode #4759 - The meter track collapsed to the card color in dark mode, hiding the uncovered remainder and making coverage look far higher than it was. The track now stays visible on both light and dark grounds. (Author: @daviddanialy)
• Unsupported MDM providers stay hidden #4756 - Microsoft Intune no longer appears in the integrations list, pipeline counts, source breakdown, or by direct URL until it is fully supported, and the pipeline's agent input is labeled "Active agents" with its source named. Vanta is hidden the same way (#4758) until a supported path exists for partner-built integrations. (Author: @daviddanialy)

Per-person spend budgets, Claude Opus 5 as the default model, and summaries for agent sessions

Spend is now something you can cap per person rather than review after the fact: budget rules match people by their directory attributes, warn or block when someone crosses their limit, and reset on the calendar window you choose. In-app chat and newly created assistants now run on Claude Opus 5. Agent Sessions gained on-demand summaries and pinning, so a long session can be read at a glance and the ones worth returning to stay within reach.

Features

• Per-person spend budgets #4229 - Set organization-wide budget rules that target people by their directory-synced attributes and give each matched person a spend limit for a UTC calendar window. A periodic evaluator totals every matched person's LLM spend, records warning and breach events, and rules set to block stop that person's Claude Code traffic until the window resets. Editing a rule archives the current version and creates a successor instead of overwriting it, and rules are archived rather than deleted, so a past event always resolves to the exact configuration that fired it. Budgets appears as a tab on the Costs page and is rolling out to selected organizations behind a feature flag. (Author: @subomi)
• Claude Opus 5 is the default chat model #4574 - Claude Opus 5 joins the supported model catalog and becomes the default for in-app chat and for assistants you create from now on. Purpose-specific choices for judges, embeddings, and similar tasks are unchanged. (Author: @simplesagar)
• Summaries and pinning on Agent Sessions #4533 - Ask for a summary of a session on demand and read it in the session side panel, and pin the sessions worth returning to from either the list or the detail sheet. A Pinned filter narrows the list to what you marked. (Author: @simplesagar)
• A dedicated view for pinned sessions #4611 - An All and Pinned toggle on Agent Sessions gives pinned work its own list rather than leaving it behind a filter chip. (Author: @simplesagar)
• Export chat transcripts with a producer API key #4527 - chat.load now accepts a producer-scoped API key alongside a dashboard session and a chat-session token, so a backend integration can pull transcripts without a browser session. A direct producer key counts as a first-party project credential and can load any chat in its project, while external-user callers and chat-session tokens stay limited to their own chats and the project and organization boundaries still apply. The key-scope description in the dashboard now says the key can export transcripts, and the endpoint appears in the published API docs. (Author: @mfbx9da4)
• Redesigned login and register screens #4534 - Signing in now opens on an animated walkthrough of a governed agent session, showing five policy decisions (grant, flag, deny, hold, and audit) in sequence, next to a cleaner panel carrying the Speakeasy lockup and single sign-on. (Author: @simplesagar)
• Admin controls for the chat analysis pipeline #4529 - Platform administrators can turn the work-units judge on or off for an organization, set its daily evaluation cap, and start a pass immediately with a Run now control instead of waiting for the next chat write or periodic sweep. Every change records a before and after audit snapshot. (Author: @chase-crumbaugh)
• Admin management of platform-level external credentials #4550 - An External Services section in organization settings lets platform administrators create, inspect, update, and remove the platform's own external credentials, starting with the ambient GCP identity, with a live verification probe that reports which identity a credential resolves to. (Author: @bflad)
• Custom domain and certificate health checks, in observation mode #4404 - A daily check now examines custom domain routing and TLS certificate health and logs what it finds, including the notifications a later release will send. Nothing is stored or emailed yet, and the dashboard warnings and manual recheck ship alongside but stay dormant until the observation period ends. (Author: @ThomasRooney)
• Groundwork for device integrations #4554 - New tables record the connection between an organization and an external device-management or compliance vendor, the sync schedule for each connection, and the hardware inventory those vendors report. Devices that stop being reported are marked missing rather than removed, so coverage history survives. (Author: @daviddanialy)
• AI SDK 7 for dashboard chat #4418 - The dashboard chat runtime moves to AI SDK 7, along with matching major versions of its integrations, the OpenRouter provider, and the assistant-ui adapter. (Author: @alx-xo)
• Telemetry log mirroring always runs #4607 - Telemetry log rows are now always mirrored to their Pub/Sub topic. The killswitch that gated this could never evaluate correctly and so blocked every publish while logging a warning on each batch, and the publish path was already best-effort. (Author: @subomi)

Bug fixes

• Enabling an MCP server no longer fails on a duplicate display name #4538 - When the project's Default plugin already listed a server under the same display name, enablement aborted. It now picks the first available name instead, and deleting an MCP server detaches it from its plugins so the name is free for a replacement. (Author: @disintegrator)
• External OAuth metadata is accepted by strict clients #4570 - MCP servers backed by an external authorization server now publish RFC 8414 metadata whose issuer matches the server's resource URL, so spec-compliant OAuth clients no longer reject the document. (Author: @bflad)
• Published plugin names follow an MCP server rename #4541 - Renaming an MCP server now updates the name shown for it in published plugins, instead of leaving the old one behind. (Author: @disintegrator)
• Import .env now works for MCP environment variables #4572 - The control opens a file picker, fills in one secret row per assignment, and tells you when a file cannot be read, rather than doing nothing. (Author: @simplesagar)
• Tool Logs show the real tool name for Codex calls #4514 - Codex sends no per-call tool identifier, so its MCP calls could never be joined to their recorded provenance and each session collapsed to a single arbitrary tool name. Both sides now derive from a shared session and tool key, so rows carry the tool that actually ran and group per tool rather than per session. (Author: @bradcypert)
• Detection sensitivity sits with the detectors it affects #4598 - The sensitivity slider moved out of its own policy-editor step and into the Detect stage, appearing only when a confidence-scored category is enabled. The policy flow is now Detect, Scope, Action, and Review, and the help text no longer names internal engines. (Author: @dennnis-ez)
• Dead skill share links show a friendly message #4545 - A mistyped or expired public skill link now lands on the page's own unavailable state instead of a full-page crash, and crash details redact capability tokens from error messages and URLs so a share token is never shown. (Author: @simplesagar)
• Common Billing date ranges resolve instantly #4588 - Ranges like this month, this year, and since July 1 are now worked out locally rather than costing an AI request. (Author: @speakeasyforgebot)
• Platform Status opens the right page #4556 - The profile menu link now points at status.speakeasy.com, the domain the status page moved to. (Author: @simplesagar)
• Stronger dashboard session tokens #4528 - Newly issued session tokens are generated from 256 bits of random entropy rather than a v4 UUID, which carries less entropy in a recognizable format and was never meant to be used as a security token. Existing sessions stay valid. (Author: @mfbx9da4)
• Custom domain provisioning no longer trips over unused machinery #4585 - An unused Kubernetes Gateway API provisioner was removed. No environment enabled it, and it broke the custom domain health sweep on clusters without those definitions installed. Custom domains are provisioned entirely through Ingress. (Author: @ThomasRooney)
• The dashboard asks search engines not to index it #4509 - The app shell and the web server now both send a noindex signal for the whole dashboard host, including error responses. Nothing there is meant for search results, since the app sits behind login and shared pages are tokenized links. (Author: @simplesagar)
• Newer hooks binaries are served to installations #4599 - Hook installations now receive the 0.3.5 binary, following #4553 for 0.3.4. Previously pinned releases stay available, so an installation that has not regenerated its bootstrap script still installs. (Author: @gram-bot)

Employee enrollment loads in a blink with numbers that match your cost views, and blocked MCP calls now say why

The Employee Enrollment page no longer makes you wait: on large projects it goes from seconds to tens of milliseconds, and the token counts it reports are now the same canonical agent-usage measure behind your cost and billing pages. When an organization access policy blocks an MCP server or tool, the error explains what was denied instead of failing opaquely, and skills gain organization settings for content upload and efficacy sampling.

Features

• Employee enrollment loads in tens of milliseconds #4520 - The enrollment list now reads a pre-aggregated view of observed agent usage across Claude Code, Codex, Cursor, and Claude Chat instead of scanning raw telemetry, and it requests only the fields it renders rather than building breakdowns it discards (#4485). Token numbers on this page now match the measure used by your costs and billing views, and people with activity but no email still show up so nobody quietly disappears from the list. (Author: @daviddanialy)
• Blocked MCP servers and tools explain the denial #4382 - When an organization's access policy blocks an MCP server or tool, the response now names what was denied and what to do about it, so a policy decision reads as a policy decision instead of an unexplained failure. (Author: @simplesagar)
• Organization settings for skill content upload and efficacy sampling #4501 - Control whether skill content is uploaded and how many sessions get scored for efficacy, so you can tune how much skill data leaves your machines and how much scoring you pay for. (Author: @danielkov)
• Manage tool metadata on an MCP server through the API #4359 - List, set, and delete metadata for the tools on an MCP server, plus two batch writes with deliberately different contracts: an authoritative one that makes stored tools match your payload exactly, and an additive one that only inserts and rejects the batch if a tool already exists — so a caller working from a stale view is told about the conflict rather than silently overwriting it. Writes require mcp:write, are scoped to the target server, and are fully audited. (Author: @qstearns)

Bug fixes

• Enrolled employees no longer show zero tokens #4525 - When someone's telemetry split across an opaque user id and their email, the token-less record was shadowing the one carrying their real usage, pushing their activity into "Unknown users". Both records are now matched to the member and merged, so tokens, activity, and linked accounts land on the right person. (Author: @daviddanialy)
• Multi-select controls stay inside their container #4511 - Selected badges now shrink and truncate long labels instead of pushing the clear and dropdown controls past the right edge, as seen on the plugin Manage assignments sheet. (Author: @bradcypert)

See which skills actually save money, explore costs on a stacked timeline, and monitor every AI integration sync

Skills now prove their worth with efficacy scores, attributed session cost, and estimated savings per skill. The costs explorer is rebuilt around a stacked cost-over-time chart with drag-to-drill date ranges, and the AI Integrations page shows every provider sync stream with live status, inline errors, retry, and pause controls. OpenAI Codex joins the supported agent platforms, and skills gain public share links.

Features

• Skill efficacy insights #4458 - Each skill now reports efficacy, activation counts, attributed session cost, estimated savings, trends, and scored-session drill-downs, so you can see which skills actually improve your agents' work — with organization-wide sampling controls to tune how sessions are scored (#4453). (Author: @danielkov)
• Costs explorer rebuilt around a stacked cost-over-time chart #4413 - Daily spend stacks by your current breakdown axis, with weekly and monthly bars for period-over-period comparison and click-or-drag drill-down into any date range. Search, breakdown controls, CSV export, and the date picker form one control bar that pins to the top as you scroll, and re-pivoting updates in place instead of flashing back to skeletons. (Author: @daviddanialy)
• Per-stream status, retry, and pause for AI integrations #4440 - The AI Integrations section moves to a dedicated page with one expandable row per provider connection, showing each event and metric stream's live status, last error, and timestamps — with inline retry, an independent pause toggle, and automatic pausing of schedules the provider keeps rejecting. (Author: @subomi)
• Share skills with a public link #4394 - Mint an unguessable share link for any skill to give people outside the project a read-only view of its name, summary, and latest content. Revoke the link at any time, and archiving a skill revokes it automatically. (Author: @simplesagar)
• OpenAI Codex is now a supported agent platform #4416 - Onboarding now walks through instrumenting both the Codex CLI and the Codex desktop app — deploying the device agent via MDM and forwarding Codex OpenTelemetry logs — and Codex compliance cost polling brings its spend into your cost views (#4407). (Author: @mfbx9da4)
• Guided Shadow MCP policy setup #4274 - Set up a Shadow MCP policy in one atomic flow: pick URLs from your project inventory, review them in a searchable modal, and have allow rules reconciled automatically. The Shadow MCP detector is now mutually exclusive with other built-in detectors, with tooltips explaining how to change the selection (#4483). (Author: @alx-xo)
• Secret scanning catches full AWS credentials #4493 - Scanning now flags AWS secret access keys and session tokens, not just the access key id — and the access key id is treated as a detection anchor rather than a reported secret, so findings mask the actual secret while keeping the identifier visible (#4504). (Author: @vishalg0wda)
• Charts and generative UI in assistant replies #4462 - Project assistants in the dashboard can now answer with Elements chart and generative UI blocks, so questions about usage or spend come back as visuals instead of walls of text. (Author: @alx-xo)
• Bring your own signing keys #3956 - A new organization-scoped external keys API manages the AWS and GCP KMS keys the platform signs with, each backed by an external credential, with full audit coverage. (Author: @bflad)
• Merge duplicate identity providers without re-authentication #4087 - When two remote identity providers point at the same upstream authorization server, a new migrate flow re-points the source's clients onto the target and retires the source — and nobody has to log in again. (Author: @bflad)
• MCP & Tools dashboard streams in panel by panel #4473 - Each card on the MCP & Tools page now loads independently as its data arrives instead of blocking on the slowest aggregate, and the underlying queries prune their scans to the selected window instead of 90 days of history. (Author: @daviddanialy)
• Skill summaries stay in sync and distribution blockers are explained #4454 - Publishing a new skill version updates the registry summary automatically, the Add Skills dialog becomes a multi-select that batches distributions, and skills that can't be distributed show the reason with a Fix link. (Author: @danielkov)
• Faster risk policy lists #4363 - Listing risk policies no longer re-aggregates every risk result in the project on each call, so the policies page loads quickly even with large analysis histories. (Author: @dennnis-ez)
• End-to-end hook performance tracing #4331 - Hook traces now begin on the device and carry operating system, architecture, and on-device elapsed time, so hook performance can be measured end to end and issues diagnosed per platform. (Author: @danielkov)

Bug fixes

• Claude Desktop sessions show the user's name #4437 - Compliance imports no longer overwrite a resolved session owner when a later sync carries no actor identity, email matching is now case-insensitive, and sessions that still can't be matched explain why in a tooltip. (Author: @bradcypert)
• Proxied MCP tool calls no longer rejected on missing internal metadata #4425 - The remote MCP proxy stops injecting an internal x-gram-toolset-id property into tool schemas, so calls to remote and tunneled MCP servers succeed even when the model omits the value or invents its own. (Author: @bflad)
• Faster hook responses on large MCP inventories #4422 - The shadow MCP inventory capture no longer runs on the synchronous hook request path, where it could hold hook responses for seconds; enforcement behavior is unchanged. (Author: @bradcypert)
• Prompt-injection detection copy matches reality #4467 - Dashboard copy and assistant instructions now describe the LLM judge, which has been the only prompt-injection engine since the retired ML classifier was dropped. (Author: @vishalg0wda)

Capture the skills your coding agents actually use, then curate and redistribute them

Skills stop being a manually maintained registry: the hooks now observe skills as your coding agents activate them (including in Cursor), pull in their manifest content, and record them with a summary and version. From there you can rename and edit captured skills, attach them to assistants, and ship the best ones back out to your team. This release also flags MCP servers nobody is calling, warns billing contacts before managed AI credits run out, and attributes cost to the right device even when a session carries no user identity.

Features

• Capture skills from live agent sessions #4341 - The hooks detect when a coding agent activates a skill — including Cursor skill activations — and upload the manifest content, so captured skills appear in the registry with a real summary and version instead of a name-only entry. (Author: @danielkov)
• Curate captured skills #4355 - Rename and edit skills that were captured automatically, with immutable version lineage preserved so you can always trace what changed. (Author: @danielkov)
• Attach skills to assistants #4334 - Skills can now be distributed to assistants, not just plugins. Assistants expose the skills they carry, and each skill's detail page reports which assistants actively use it. (Author: @danielkov)
• Spot inactive MCP servers at a glance #4309 - The Distribute MCP listing now flags servers that have never received a tool call and warns when a server has been silent for two weeks, so you can retire or fix servers nobody is using. (Author: @mfbx9da4)
• Credit warnings before managed AI usage hits its cap #4321 - Organization billing contacts now get an email as managed OpenRouter credit usage crosses 50%, 75%, 90%, and 100% of the monthly cap, for both the chat key and the internal key, so credits never run out by surprise. (Author: @daviddanialy)
• Attribute team spend to devices, not a black hole #4376 - Sessions authenticated with a company API key carry no user email, so their spend used to pool into one bucket. The cost breakdown now falls back to the device hostname reported by the hooks, and the remaining shared spend is labeled "Team-wide API Usage" instead of "(unset)". (Author: @daviddanialy)
• Chat with tunneled MCP servers in the Playground #4329 - Tunneled MCP servers can now be selected and exercised in the Playground (behind the gram-tunneled-mcp flag), so you can test a locally tunneled server end to end before distributing it. (Author: @svadrutk)
• Enroll device agents with per-user keys #3806 - A new token exchange trades an org-scoped agent key plus a verified user email for a long-lived, per-user key with a narrower scope. Each device gets its own key, so enrolling a new machine never breaks a user's other devices. (Author: @bradcypert)
• Issuer setup documentation on the New Client sheet #4093 - Remote identity issuers can link their client setup documentation, shown alongside the provider's discovered service documentation when creating a client — so customers can register their own OAuth client and own its credentials and rate limits. (Author: @bflad)
• Ask the assistant what shipped this week #4354 - The Project Assistant can now read the public changelog and answer questions about recent platform and dashboard releases, with a ready-made "What's shipped this week?" suggestion on the chat landing page (#4374). (Author: @simplesagar)
• Recommended detection scopes for risk policies #4370 - Risk policies now surface recommended detection scopes through the management API, with per-policy, per-category overrides, so tuning where a detector looks no longer requires hand-written expressions. (Author: @vishalg0wda)
• Search cost breakdowns #4356 - A search box on the costs breakdown filters the visible rows or sessions instantly, without losing your breakdown-axis selection. (Author: @simplesagar)
• Search within a plugin #4357 - The plugin detail page gains a search bar that filters its MCP servers, assignments, and skills. (Author: @simplesagar)
• Project homepage metrics load faster and match the Costs page #4371 - The homepage spend and session widgets now read from the same pre-aggregated source as the Costs page, so they load quickly and the two pages always agree. (Author: @subomi)
• Consistent provider and surface labels #4241 - Provider names and product-surface labels are normalized across reporting, agent sessions, tool logs, and cost views, so Claude desktop and web sessions group under one canonical label. (Author: @disintegrator)
• Device Agent install page polish #4372 - The install page adds an MDM rollout recommendation and drops the preview badges now that the Device Agent is generally available. (Author: @bradcypert)
• Prompt scanner pub/sub handlers #4223 - Internal groundwork that moves prompt scanning onto asynchronous pub/sub processing. (Author: @vishalg0wda)

Bug fixes

• Hidden Account Type breakdown restored in the cost explorer #4383 - Drilled slices that mix classified and unclassified spend now show the Account Type breakdown, with unclassified spend surfaced as a first-class "(unset)" group instead of disappearing. (Author: @daviddanialy)
• Policy scope traffic preview no longer crashes #4398 - The traffic preview handled matched messages that produced no highlight spans by crashing; it now renders them cleanly. (Author: @vishalg0wda)
• Dashboard console warnings cleaned up #4330 - Fixes React warnings from nested log controls, duplicate risk-rule keys, and command-palette focus restoration. (Author: @alx-xo)

Automatic offboarding via SCIM and MCP client identity logged in function backed tools

Offboarding just got safer: when your identity provider deactivates a user, the platform now revokes their organization access and role assignments immediately — no manual cleanup, no lingering sessions. Function-based tools can also see which MCP client is calling them, unlocking per-client logging and observability, and the Plugins page now shows how many active skills each plugin carries.

Features

• Automatic deprovisioning on SCIM deactivation #4283 - When a user is deactivated in your identity provider, their organization membership and role assignments are revoked and their cached session info is invalidated right away. Membership syncs only import active users, and deactivated users no longer reappear in organization rosters. (Author: @claude)
• See which MCP client is calling your tools #4234 - Function-based tools now receive the calling MCP client's name and version through ctx.clientInfo, so you can tailor logging and observability by client. The value is self-reported metadata from the client — use it for insight, not authorization. (Author: @kevinkruger)
• Skill counts on plugin cards #4326 - Each plugin on the Plugins page now shows the number of active skills it carries, so you can see what a plugin distributes without opening its detail page. (Author: @danielkov)

Distribute skills to plugins straight from the dashboard

Skills recorded in the registry can now actually reach your developers: attach a skill to a plugin — tracking the latest valid version or pinning a specific one — and it ships inside the published plugin packages for Claude Code, Cursor, and Codex. Each skill opens as a dedicated detail page with version history and distribution controls, and the Project Assistant can now answer questions about your skills too.

Features

• Distribute skills to plugins #4284 - Attach a skill to a plugin, tracking its latest valid version or pinning a specific one, and it ships inside the published plugin packages for Claude Code, Cursor, and Codex. Revoking a distribution, deleting a plugin, or archiving a skill cleans up automatically, and distribution changes flag the plugin for its next publish. (Author: @danielkov)
• Skill detail pages with distribution management #4302 - Skills open as a dedicated detail page with an at-a-glance sidebar, section navigation, and a distribution banner for attaching the skill to plugins. The plugin detail page's Skills section now lists the skills a plugin carries, with add and remove controls. (Author: @danielkov)
• Project Assistant knows your skills #4320 - The Project Assistant gains read-only tools to list project skills, inspect the latest skill content, review version history, and inspect plugin distributions, so you can ask it about your skills setup directly. (Author: @danielkov)
• Copy the plugin version in one click #4319 - A copy button next to the version badge on the plugin detail page copies the version string to the clipboard. (Author: @claude)

Bug fixes

• Chat session owners shown by name #4289 - Chat sessions now resolve their owners from organization members instead of displaying opaque external user IDs. (Author: @subomi)
• Plugin assignments dropdown scrolls again #4311 - The user and role picker in the plugin assignments sheet now scrolls with the mouse wheel when it contains many entries. (Author: @AshGodfrey)
• Historical unattributed spend backfilled as team #4318 - Older cost rows that landed in the "(unset)" account-type bucket before company-credential classification shipped can now be backfilled as team spend, so historical breakdowns match the new attribution. (Author: @daviddanialy)

Keep agents working through outages, assign plugins to specific people, and track skills in a registry

Control-plane hiccups no longer have to stop your developers: org admins can now choose to fail open during outages, and hook events captured while offline are spooled locally and replayed in order once connectivity returns — nothing is lost, and explicit denies still block. Plugins also get real audiences: assign each one to everyone, specific roles, individual members, or email addresses, and the device agent delivers it only to those people. A new Skills registry rounds out the release, giving projects a versioned home for skill manifests.

Features

• Fail open during outages #4204 - A new "Fail Open During Outages" setting on the Logging & Telemetry page lets org admins decide whether agent tool calls proceed or block when Speakeasy is unreachable. Explicit deny decisions and broken credentials always block, and the setting replaces the old Observability Mode toggle. (Author: @daviddanialy)
• Offline event capture and replay #4232 - Hook events that can't be delivered during an outage now buffer locally on the device and replay automatically on recovery, with a 15-day dedupe window so competing drains never double-count #4238. Replayed messages are flagged on transcripts and risk results so retroactive findings are distinguishable from live ones #4246. (Author: @daviddanialy)
• Plugin assignments #4095 - Organizations using the device agent can choose who receives each plugin: an org-wide default, specific roles, individual members, or email addresses. New plugins default to everyone, so nothing stops being delivered until you narrow the audience. (Author: @bradcypert)
• Skills registry #4258 - A new Skills page at /skills records, inspects, compares, and archives project skill manifests with immutable canonical versions, backed by a project-scoped management API #4254 and new project-selectable read and write permissions in RBAC role management #4224. (Author: @danielkov)
• Readable non-secret environment values #4157 - Environment entries can be marked non-secret so their values stay viewable, copyable, and editable after save #4228. Secret entries keep today's encrypt-and-redact behavior, and everything defaults to secret. (Author: @walker-tx)
• Catalog installs are remote MCP servers #4180 - The catalog "Add to Project" flow now installs each selected endpoint as a remote MCP server with OAuth auto-configuration when the upstream supports dynamic client registration, replacing the heavier deployment and toolset pipeline. (Author: @qstearns)
• Device agent setup in onboarding #4235 - Onboarding now includes device agent setup instructions, and the device agent page has been revamped to make rollout easier. (Author: @adaam2)
• Right-click context menus everywhere #4210 - Every table row, card, and list entry now has a right-click context menu mirroring its "⋯" menu, and sources table rows are real links with native open-in-new-tab and copy-link. (Author: @simplesagar)
• See the live published plugin version #4088 - The plugin detail page shows the version currently live in the published marketplace manifests, so it can be compared directly against what installed clients like Claude Code report when debugging sync lag. (Author: @claude)
• Dashboard links unfurl in Slack #4244 - Dashboard links shared in Slack now unfurl with the Speakeasy logo and a humanized page title instead of a bare URL. (Author: @simplesagar)
• One-domain hook installs for locked-down environments #4191 - Observability hooks now install through a pinned, checksum-verified binary downloaded from your Speakeasy server domain — the same domain hooks already send telemetry to — so restricted or sandboxed developer environments only need that one domain allowed. (Author: @danielkov)
• Hook decision metrics #4282 - Every hooks endpoint now tags its duration metric with the allow, deny, or ask verdict, so decision rates can be charted independently of processing outcomes. (Author: @daviddanialy)

Bug fixes

• Company-credential sessions count as team spend #4259 - Claude sessions authenticated with an API key, gateway, Bedrock, or Vertex are now classified as team in the account-type cost breakdown instead of falling into the "(unset)" bucket. (Author: @daviddanialy)
• Transcripts keep conversation order after replays #4277 - Chat messages replayed from a device's offline spool are stored at their original timestamps, so backlog drained after an outage no longer appears out of order in transcripts. (Author: @daviddanialy)
• No more duplicate observability plugins on the device agent #4278 - The device agent now only receives marketplaces for the org's default project plus projects the caller is assigned to, instead of one observability plugin per published project in the org. (Author: @bradcypert)

Typed date ranges apply everywhere in the time range picker

Typing a natural-language date range like "last week" now works even on pages that hide the quick presets. The picker converts the parsed preset into its concrete date range and applies it, instead of silently doing nothing.

Bug fixes

• Natural-language dates work without presets #4173 - When a typed range like "last week" parsed to a preset that a page doesn't offer (such as the billing page, which hides all presets), the picker applied nothing. It now applies the preset's concrete date range. (Author: @simplesagar)

Shadow MCP server detail pages and RBAC for remote MCP servers

Shadow MCP inventory grows from a list into a place to investigate: each discovered server now has its own detail page, and organization admins can rename inventory entries without losing their canonical URL identity. Access control widens too — the Roles & Permissions "Specific Servers" picker now lists remote and tunneled MCP servers alongside toolset-backed ones, so connection policies can cover every kind of server you run.

Features

• Shadow MCP server detail pages #4065 - Each server in the Shadow MCP inventory now has a dedicated detail page backed by a project-scoped API, so a discovered server can be investigated in one place. (Author: @alx-xo)
• Rename Shadow MCP servers #4214 - Organization admins can give Shadow MCP inventory entries a friendly name without changing the canonical URL identity used to track them. (Author: @alx-xo)
• Permission remote and tunneled MCP servers with RBAC #4167 - The Roles & Permissions "Specific Servers" picker for mcp:connect now lists remote and tunneled MCP servers alongside toolset-backed ones, backed by a new org-wide server listing, so connection policies can scope to any server in the organization. (Author: @qstearns)
• Filter risk events by assistant #3933 - The "Risk Events" page gains an "Assistant" filter listing the project's assistants plus a "No assistant" option, so findings from chats not linked to an assistant can be surfaced on their own or scoped to a single assistant. (Author: @linear-code)
• Pause model provider keys without deleting them #4182 - Custom model provider keys can be disabled and re-enabled in place, so temporarily falling back to the platform key no longer means deleting and re-entering a key. (Author: @danielkov)
• Prompt-injection detection upgraded for everyone #4184 - Prompt-injection detection now uses the LLM judge for all organizations, replacing the previous heuristics layer with higher-quality analysis across the board. (Author: @vishalg0wda)

Bug fixes

• Remote MCP servers behind strict origin checks work again #4171 - Browser-only headers (Origin, Referer, Cookie) are no longer forwarded to remote MCP upstreams. Servers enforcing DNS-rebinding protection (e.g. Langfuse) previously rejected dashboard-driven requests with "Something went wrong loading tools", and the dashboard session cookie no longer leaks upstream. (Author: @svadrutk)
• MCP inventory captured at session start #4170 - The hooks relay again sends a redacted MCP inventory snapshot on session start and configuration changes, so external MCP URLs appear in Shadow MCP inventory before a tool is ever called. (Author: @alx-xo)
• Linked accounts attach to the right employee #4196 - The employees list now attaches linked accounts by directory ownership instead of raw telemetry user ids, so stray telemetry rows can no longer hand an account — and its role bucket — to the wrong person. (Author: @daviddanialy)
• Deleted usage rows excluded from billing #4174 - Tokens-under-management totals and breakdowns now filter out soft-deleted usage rows, matching how the costs page already reads the same data. (Author: @daviddanialy)
• Consistent Speakeasy branding in the dashboard #4179 - Remaining user-visible "Gram" mentions in dashboard copy now read "Speakeasy", and the brand logo gains an accessible label for screen readers. (Author: @simplesagar)
• Created and updated dates on risk policies #4199 - The risk policies table shows "Created" and "Updated" columns with compact relative dates; hovering reveals the exact timestamp. (Author: @simplesagar)
• Model provider key table polish #4188 - Key editing and row actions are improved, table actions are aligned, and disabled keys are easier to identify #4183. (Author: @danielkov)

Bring your own model provider keys and a truer tokens-under-management view

Projects can now run AI surfaces on their own model provider keys: set a project default key in settings, override individual surfaces like assistants, the risk-policy judge, or the prompt-injection classifier, and see at a glance which surfaces run on your key versus the platform key. Billing also gets more honest — tokens under management now counts only the agent traffic the platform observes from your users' sessions, never inference the platform spends itself, with richer breakdowns by model, agent, provider, project, user, and role.

Features

• Bring your own model provider keys #4115 - Manage model provider keys from project settings: set a project default OpenRouter key, override individual surfaces, and see which surfaces run on your key versus the platform key. Keys are validated with the provider on save, stored encrypted, and never returned by the API. (Author: @danielkov)
• Assistants run on your key #4114 - Assistant completions route through a project's own model provider key when one covers the assistants slot, with the platform-covered behavior unchanged for projects without a key. (Author: @danielkov)
• Your key for risk scanning too #4116 - The risk-policy judge and the prompt-injection classifier each get an independent key slot, falling back to the project default key and then the platform key when unset, and both slots are listed in project settings #4117. (Author: @danielkov)
• Tokens under management, redefined as observed agent traffic #4146 - The billing page now counts the tokens the platform observes coming from users' agent sessions (input, output, and cache writes), never inference the platform spends itself. Breakdowns now cover model, agent, provider, account type, project, user, division, department, and role. (Author: @daviddanialy)
• Average token throughput at a glance #4168 - The billing cycle panel gains an average tokens-under-management stat with a per hour, day, or week toggle, computed over the elapsed window of the active cycle. (Author: @daviddanialy)
• Manage headers on remote MCP servers #4076 - A new API manages the headers a remote MCP server sends upstream, so servers that need custom header configuration can be wired up without workarounds. (Author: @svadrutk)
• See who uses a Shadow MCP server #3947 - A project-scoped API lists the users and usage of a Shadow MCP server, with generated dashboard SDK support, so unsanctioned MCP usage can be traced back to the people using it. (Author: @alx-xo)

Bug fixes

• Environment variables no longer save their masked placeholder #4152 - The MCP server "Authentication" tab could persist the server-redacted placeholder (e.g. sup*****) as the real value. Saving now only writes values you actually typed, removes them on an intentional clear, and otherwise leaves the stored secret untouched. (Author: @walker-tx)
• Clear guidance when tools fail to load without authentication #4016 - When MCP tools fail to load on a server with no authentication configured, the dashboard now shows actionable guidance with a "Configure authentication" deep link instead of a generic error. (Author: @linear-code)
• Assistant onboarding finds your existing integrations #4164 - Assistant onboarding now checks your existing toolsets first and includes tools proxied from external MCP servers in its search, instead of telling you integrations you already set up aren't available. (Author: @danielkov)
• Stable environment variable ordering #4150 - The environment variables table on the MCP server page no longer reorders its rows on every page refresh or tab focus change. (Author: @walker-tx)
• Cowork tool calls labeled in tool logs #4020 - Tool calls made by Cowork are now labeled cowork in tool logs, so filtering by Cowork source works. (Author: @linear-code)
• MCP attribution works with org-wide hooks keys #4155 - When the Claude hooks plugin authenticated with an organization-wide key, recovered MCP attribution never matched its telemetry rows and sessions stayed labeled "custom". Attribution is now matched by organization, so true server and tool names come through regardless of how the plugin authenticates. (Author: @subomi)
• Internal: dormant telemetry endpoint removed #4158 - The unused telemetry.queryRiskTokens endpoint, which computed a superseded billing population, is removed. (Author: @daviddanialy)