Release v2.31.0

What's Changed

• Add CIMD support to XAA Connect by @ignaciojimenezr in #3344
• ui bug followup cimd xaa by @ignaciojimenezr in #3340
• dcr xaa connect tab by @ignaciojimenezr in #3351
• feat(learning): guided tours that teach by driving the UI by @chelojimenez in #3334
• fix(playground): stop guest first-run onboarding from hanging forever (#3352) by @olartgabo in #3357
• fix(design-system): soften form-control focus ring so it doesn't read as an error by @olartgabo in #3157
• feat(sdk): 2026-07-28 OAuth machine spec steps (Phase 2, 2M-a remainder) by @chelojimenez in #3358
• feat(connection): allow pinning MCP protocol version when adding a server by @chelojimenez in #3365
• Document protocol version pinning in Add Server modal by @mintlify[bot] in #3369
• feat(learning): guided tours ride the system prompt and pace one step per turn by @chelojimenez in #3368
• feat(oauth): surface the 2026-07-28 OAuth machine (Phase 2, 2M-b) by @chelojimenez in #3363
• Add 2026-07-28 OAuth protocol version to docs by @mintlify[bot] in #3372
• feat(agent): docs-first answers for product questions, offer before acting by @chelojimenez in #3373
• fix(harness): sweep remaining PR #2996 review findings (COMP-10) by @ignaciojimenezr in #3041
• feat(computers): chat attachments land in the computer filesystem (COMP-14) by @ZeHuari in #3367
• Docs: add chat attachments section to Computer page by @mintlify[bot] in #3376
• fix(computers): guest sign-in affordance fires for anonymous actors (COMP-3) by @olartgabo in #3132
• fix(agent): stop the in-app assistant inventing a "weather" server by @chelojimenez in #3381
• No AI slop in docs by @prathmeshpatel in #3371
• fix(playground): let the lead client be unchecked in the compare picker by @olartgabo in #3370
• feat(oauth): validate callback state + RFC 9207 iss before redemption (Phase 2, 2R-iss) by @chelojimenez in #3375
• feat(oauth): issuer-key OAuth client credentials with lazy migration (2R-store) by @chelojimenez in #3377
• feat(oauth): SSRF-guard outbound OAuth metadata fetches across all machines (P1 hardening) by @chelojimenez in #3379
• fix(computers): stop advertising bash to guests off the swarm path by @chelojimenez in #3382
• feat(hosts): move the client selector into the Connect canvas by @olartgabo in #3269
• Document canvas-pinned client selector by @mintlify[bot] in #3386
• feat(oauth): issuer-key local OAuth token reads (2R-store follow-up) by @chelojimenez in #3387
• feat(oauth): route 2026-07-28 through the connect-form OAuth protocol leg (2M-c) by @chelojimenez in #3388
• Document OAuth protocol auto-alignment with 2026 RC wire pin by @mintlify[bot] in #3393
• fix(oauth): shared hardening pass across the four debug OAuth machines by @chelojimenez in #3389
• feat(oauth): wire runtime insufficient_scope step-up from transport to client by @chelojimenez in #3390
• Document OAuth runtime scope step-up on tool calls by @mintlify[bot] in #3395
• feat(hosts): protocol-version dropdown — Automatic, Latest, and every known MCP version by @olartgabo in #3364
• Update protocol version dropdown docs by @mintlify[bot] in #3408
• feat: Project Environments — Inspector UI (management, suites, journeys, runner) by @chelojimenez in #3405
• docs(evals): reconcile evals docs with shipped SDK and CLI (CERD-35) by @nachocossio in #3403
• fix(oauth): allow client secrets shorter than 8 characters by @Jatlus in #3283
• fix(ui): tidy the STDIO environment-variables editor in Add Server by @olartgabo in #3410
• feat(computers): configurable working directory for the bash tool (COMP-16) by @ZeHuari in #3384
• fix(servers): tidy the Config tab, and stop it crashing the page in local mode by @olartgabo in #3412
• feat(harness): cross-instance RPC log fan-in via the Convex sink (COMP-21, inspector) by @ZeHuari in #3392
• fix(oauth): harden metadata proxy SSRF validation by @ignaciojimenezr in #3411
• feat(journeys): re-gate pinned plugin servers at connect time (D2, inspector) by @chelojimenez in #3417
• refactor!: rename Computer "environments" to sandbox "images" by @chelojimenez in #3418
• chore(deps): bump zod to ^4.2.0 across all workspaces by @chelojimenez in #3399
• feat(conformance): era-awareness so modern servers stop false-failing (Phase 3 §11.5) by @chelojimenez in #3400
• feat(conformance): add --protocol-version to the CLI conformance command by @chelojimenez in #3404
• test(sdk): pagination-parity evidence + modern wire invariants (Phase 3 §11.1) by @chelojimenez in #3401
• feat(inspector): cursor pagination parity for prompts + resource-templates routes by @chelojimenez in #3398
• feat(sdk): thread SEP-2549 cacheMode + cache-serve provenance (§11.2) by @chelojimenez in #3402
• feat(inspector): surface SEP-2549 cache provenance in tools/resources/prompts UI by @chelojimenez in #3407
• feat(sdk): dual-era logging core — one concept, era-specific delivery by @chelojimenez in #3397
• refactor(swarms): simplify session readiness UI with dots and tooltips by @chelojimenez in #3424
• feat(oauth): surface dual-era logging + SEP-2577 deprecation labeling (§11.3) by @chelojimenez in #3406
• feat(environments): expose Project Environments on the API, SDK, and CLI by @chelojimenez in #3425
• feat(sdk): MRTR manual driver core for 2026-07-28 input_required (Phase 4 PR1) by @chelojimenez in #3430
• refactor(environments): correct and consolidate the environment contracts (Phase 0) by @chelojimenez in #3438
• feat(plugins): MCP JSON compatibility and plugin client API (INS-1) by @chelojimenez in #3421
• Document additional JSON config wrapper shapes by @mintlify[bot] in #3440
• feat(oauth): wire SEP-2350 insufficient_scope step-up through every surface (Phases 0–5) by @chelojimenez in #3427
• feat(cli): interactive MRTR (input_required) across tools/prompts/resources (Phase 4 PR6) by @chelojimenez in #3431
• Document --interactive and --yes flags for CLI commands by @mintlify[bot] in #3443
• fix(oauth): use the challenge resourceMetadataUrl when re-authorizing (SEP-2350) by @chelojimenez in #3445
• refactor(plugins): share the SDK's MCP shape logic instead of mirroring it by @chelojimenez in #3444
• feat(environments): resolve interactive turns from one environment spec (Phase 1, inspector) by @chelojimenez in #3446
• fix(oauth): PRM step-up review follow-ups stranded by #3445 squash-merge by @chelojimenez in #3449
• feat(inspector): local MRTR input_required UX — tools/resources/prompts/chat (Phase 4 PR2) by @chelojimenez in #3432
• Pull request for mintlify/docs-update-pr-3432-1785053424934 by @mintlify[bot] in #3452
• feat(plugins): Connect Add-plugin UX (INS-2) by @chelojimenez in #3451
• Add plugin import and management documentation by @mintlify[bot] in #3456
• feat(mrtr): inspector hosted continuation transport for 2026-07-28 input_required (Phase 4 PR3b) by @chelojimenez in #3433
• feat(environments): Playground environment mode + Connect entry point (Phase 2) by @chelojimenez in #3450
• feat(inspector): Apps MRTR input_required interaction (Phase 4 PR7) by @chelojimenez in #3434
• Document elicitation support for MCP App widget tool calls by @mintlify[bot] in #3459
• feat(mrtr): hosted direct-op input_required suspend/resume for 2026-07-28 (Phase 4 PR4) by @chelojimenez in #3435
• feat: enable protocol auto-detection and version-aware OAuth by @ignaciojimenezr in #3441
• feat(mrtr): hosted chat/agent-loop pause/resume for 2026-07-28 input_required (Phase 4 PR5) by @chelojimenez in #3436
• feat(plugins): effective capability resolution (INS-3) by @chelojimenez in #3460
• feat(environments): environment-first eval results (Phase 3) by @chelojimenez in #3458
• fix(evals): name environment-derived host columns in the CrossHost matrix by @devin-ai-integration[bot] in #3465
• fix(playground): scope the previewed host id to its project by @devin-ai-integration[bot] in #3464
• feat(environments): complete swarm environment UX (Phase 4) by @devin-ai-integration[bot] in #3466
• feat(plugins): Playground plugin selection and Chatbox capabilities (INS-4) by @devin-ai-integration[bot] in #3468
• feat(plugins): local stdio materializer (INS-6) by @devin-ai-integration[bot] in #3469
• feat(sdk): era-neutral subscription coordinator for 2026-07-28 subscriptions/listen (Phase 5) by @devin-ai-integration[bot] in #3463
• feat(sdk): modern (2026-07-28) conformance MUST checks, era registry hardening, readiness channel by @devin-ai-integration[bot] in #3467
• fix(plugins): EOCD preflight screen no longer fails open on trailing bytes by @chelojimenez in #3442
• refactor(inspector): make the form-data → persistence secret contract explicit by @chelojimenez in #3448
• types(skills): widen pinned-skill channels to include 'plugin' by @chelojimenez in #3409
• feat(plugins): Computer and Claude Code delivery (INS-7) by @devin-ai-integration[bot] in #3484
• fix(sdk): restore the 2025-11-25 legacy tasks wire (params.task) + version-aware tasks dispatch by @devin-ai-integration[bot] in #3485
• feat(sdk): judge subscriptions/listen conformance from the wire by @devin-ai-integration[bot] in #3481
• feat(cli): subscriptions listen mode for 2026-07-28 subscriptions/listen (Phase 5) by @devin-ai-integration[bot] in #3479
• feat(inspector): hosted MRTR browser consumer leg (2026-07-28 §12.5) by @devin-ai-integration[bot] in #3482
• feat(images): blueprint format across v1 API, SDK/CLI, editor, and chat injection by @chelojimenez in #3474
• feat(inspector): LOCAL subscriptions/listen lifecycle bridge + era-branched UI (Phase 5) by @devin-ai-integration[bot] in #3480
• Document subscription stream panel in Resources tab by @mintlify[bot] in #3500
• feat(sdk): add the io.modelcontextprotocol/tasks (SEP-2663) extension wire by @devin-ai-integration[bot] in #3486
• feat(inspector): dual-wire tasks in the local routes and the client UI by @devin-ai-integration[bot] in #3487
• feat(inspector): hosted tasks routes via reconnect-per-poll by @devin-ai-integration[bot] in #3488
• feat(inspector): hosted tasks client wiring (batch polling, scoped tracker) by @devin-ai-integration[bot] in #3489
• feat(sdk): MCP Tasks conformance suite + CLI/route/UI wiring by @devin-ai-integration[bot] in #3490
• Add MCP Tasks Conformance docs for CLI and SDK by @mintlify[bot] in #3507
• feat(plugins): native Codex plugin harness (INS-8) by @devin-ai-integration[bot] in #3505
• feat: auto-negotiation always-on across HTTP + stdio (Phase 5 activation) by @chelojimenez in #3508
• Docs: extend auto-negotiation to stdio by @mintlify[bot] in #3510
• feat(plugins): plugin snapshots in evals and simulations (INS-5) by @chelojimenez in #3513
• Docs: plugin provenance & OpenAI submission report by @mintlify[bot] in #3514
• Workstream A: MCP tasks protocol boundary — unblock the 2026 wire, discriminate validation, correct conformance by @chelojimenez in #3511
• plugin crash by @ignaciojimenezr in #3512
• Tasks conformance: judge the discriminator on the raw wire, resolve the era-gate target by @chelojimenez in #3515
• Docs: remove the tasks full-support plan from the repo by @chelojimenez in #3517
• feat: environment-backed chatboxes — publish UI + live-follow chat-v2 (Phase 5) by @chelojimenez in #3519
• feat(swarms): capture + replay MCP App widget snapshots for swarm sessions by @chelojimenez in #3521
• Document MCP App widget replay in swarm sessions by @mintlify[bot] in #3522
• MCP Tasks: shared lifecycle engine, per-task poll scheduling, tri-state host policy by @chelojimenez in #3518
• Swarms: move sessions into journey block and polish personas UX by @chelojimenez in #3524
• Add Swarm AI generation; remove the chatbox synthetic surface by @chelojimenez in #3525
• Fix Sessions tab defaulting to the auto-preselected persona by @chelojimenez in #3529
• Cleanup: strip inert synthesisRunId plumbing + dead headless org-BYOK facade by @chelojimenez in #3530
• fix(oauth): era-gate the RFC 9207 iss mismatch rejection by @ignaciojimenezr in #3520
• Docs: OAuth iss mismatch warning behavior by @mintlify[bot] in #3534
• feat: update VS Code host profile to 1.130 by @ignaciojimenezr in #3380
• Absorb transient connect resets and stop 502s reading as MCPJam outages by @chelojimenez in #3531
• SDK: observe manager connect rejections instead of leaking unhandledRejections by @chelojimenez in #3535
• fix(protocol): keep automatic reconnect negotiation broad by @ignaciojimenezr in #3533
• MCP Tasks: wire tasks into the execution surfaces (Workstream C + D5) by @chelojimenez in #3527
• CLI: task testing parity with the Inspector Tasks tab by @chelojimenez in #3526
• fix(sdk): mirror SEP-2243 x-mcp-header params on a cold client by @chelojimenez in #3540
• feat(sdk): propagate OpenTelemetry trace context over MCP _meta (SEP-414) by @chelojimenez in #3541
• fix(sdk): bump MCP v2 packages from 2.0.0-beta.4 to 2.0.0 by @chelojimenez in #3543
• fix(playground): explain connection failures in plain language by @ignaciojimenezr in #3539
• fix(inspector): re-register the MRTR collector on every connect by @chelojimenez in #3544
• fix(sdk): register notifications/tasks through the v2 schema overload by @chelojimenez in #3547
• feat(tracing): show HTTP headers for MCP exchanges (SEP-2243) by @chelojimenez in #3548
• feat(sdk): post-negotiation capability re-resolution (eraCapabilities.modern) by @chelojimenez in #3550
• fix(sdk): read 2026 server identity off the _meta stamp; green the SDK suite by @chelojimenez in #3551
• feat(oauth-conformance): server-side spec-obligation checks (HP-17 3/4/5) by @olartgabo in #3383
• fix(observability): make server 5xx diagnosable by @ignaciojimenezr in #3532
• Clarify client identity in Playground compare columns by @vigneshgopalandd-maker in #3546
• fix: era-aware pingServer (server/discover on modern) + Tasks tab capability-probe race by @chelojimenez in #3554
• Fix pingServer() docs: async return type and era-aware behavior by @mintlify[bot] in #3559
• deploy workflow failing by @ignaciojimenezr in #3560
• docs: COMP-15 — Claude Code host GA docs + readiness record by @olartgabo in #3221
• Pull request for mintlify/docs-update-pr-3221-1785346040211 by @mintlify[bot] in #3562

New Contributors

• @devin-ai-integration[bot] made their first contribution in #3465

Full Changelog: v2.30.0...v2.31.0