server@1.15.0

Minor Changes

• 6285d16: The admin projects list now reports how many MCP servers each project has, so an operator can read the number off the list instead of opening every project. The count covers both server models at once: every mcp_servers row in the project, plus every MCP-enabled toolset that no mcp_servers row already describes.

• 2fb5b71: A blocked employee now says why they need the server. The request page redeems the block link into a short form instead of filing the ask the moment it loads, and risk.createPolicyBypassRequest carries that justification onto the review as the requester's note. Previously every requester's note was the policy's block reason — the same sentence for everyone the policy stopped — so the review page's "who asked, and why" told a reviewer nothing about any individual ask. A client that sends no note still falls back to the block reason.

• 6f6a133: The MCP evidence dossier gains three deterministic sources. The assembler now
  consults the code host about a package's declared source repository (stars,
  forks, contributors, commit recency, archived status), asks OSV.dev which
  published vulnerability advisories name the package, and reads the domain
  registry's registration record for a remote server's registrable domain.
  Package registries also surface their declared repository and homepage URLs.
  Each source follows the dossier's existing contract — found, not-found, and
  could-not-look stay distinct, with failures recorded as gaps — and the
  approval page renders the new facts in the evidence panel, including a
  dedicated advisories group where checked-and-clean is shown as a finding
  rather than an absence.

• c6b0c7f: Expose active directory groups and exact directory attribute values as plugin assignment audiences for organization administrators.

• 33322d9: Add the remaining per-user lookups an identity view needs: devices, whole-id risk findings, and the shadow MCP servers one person reached.

  • deviceIntegrations.listManagedDevices takes user_ids and user_emails, OR'd. Both legs are needed: a device only carries a resolved user id when the MDM's reported email matched a member, and the MDM's email can be an alias the directory does not know.
  • risk.listResults takes external_user_ids, matched whole rather than as a substring. The existing user_id filter is a case-insensitive substring match, so filtering to dev@acme.co also returns dev@acme.com's findings. Both the Postgres and ClickHouse paths honour the new filter; user_id is unchanged.
  • GET /rpc/access.listShadowMCPInventoryServersForUser inverts the shadow MCP inventory. The table is URL-keyed with no user column, so the set of servers comes from that person's telemetry and is then enriched with the same policy state the project-wide listing shows.

  The shadow MCP filter routes its email leg through the canonical identity fold, so one person's work and personal addresses resolve to the same subject instead of splitting across them.

• 08a549b: Add live Stripe PAYG subscription status, a controlled customer portal, and end-of-period cancel and resume controls for organization administrators.

• 2fb5b71: MCP approval change detection and re-review: a daily sweep re-gathers evidence for approved servers and compares the permission-relevant slice (OAuth scopes, authority mode, demanded credentials, published advisories) against the snapshot the approval rested on. Drift sets a changed-since-approval flag — cleared only by a new decision — announces once per distinct change through the audit-log webhook channel, and surfaces on the review page as a diff banner and on the inventory as a badge.

• 1c5ae7c: Add evidence change-detection columns to MCP approval requests: evidence_changed_at flags a permission-relevant drift from the evidence the latest approval rested on, and notified_change_fingerprint makes the daily recheck announce each distinct change once.

• ce7b28a: The MCP research agent goes live end to end. A new
  mcpApproval.startResearch endpoint (decide-scoped) opens a report row and
  enqueues a Temporal workflow that runs a bounded tool-calling loop over the
  research web tools — search and page fetch — with the untrusted-content
  posture pinned in its prompt, then extracts a schema-held report: summary,
  independent-coverage level, and tiered claims where every web-sourced claim
  carries its citations or is dropped. Reports land on mcp_research_reports
  with model, prompt version, and per-run spend metadata; re-runs are additive
  and at most one run per request is in flight. The approval page's research
  section gains a Run Research button, polls while a run is live, and renders
  the report with its coverage callout, tier chips, citation links, and run
  footer.

• 4b8c41d: Show pay-as-you-go organizations their current billing cycle on Billing: tokens
  under management and their flat-rate cost, Other inference spend through the last completed
  day, and the estimated invoice total for the cycle. The estimate appears once
  Stripe billing has started, and the monthly Other inference spend meter now says plainly
  that it runs on the calendar month rather than the billing cycle.

• 1c8fa7b: Persist catalog MCP icons on mcp_metadata and render them in the dashboard. A new assets.fetchImageFromURL endpoint downloads a catalog server's registry icon into an image asset at install time, and the install workflow stores it as the server's MCP metadata logo. The MCP server detail sidebar now renders the persisted logo, and collection listings populate icon_url from it for both toolset-backed and mcp_server-backed servers. Remote-backed servers with no catalog icon now get the vendor's favicon as a default logo, matching the existing unproxied-server behavior.

• ce7b28a: The research agent now runs the prompt-injection judge over every page it fetches, and records a flagged page as a finding on the report. A vendor page that tries to steer whoever is reviewing the server says more about that server than any claim in the report, so the attempt is surfaced as evidence rather than only defended against: the agent still sees the page, labelled as material that tried to instruct it, and the finding is attached by the runner after extraction so a model that just read the manipulating page cannot leave it out. Pages the judge could not answer for are counted separately, because an empty findings list next to a judge outage does not mean nothing was tried.

  Starting a research run also serializes properly: the check for an in-flight run and the insert that creates one now share a transaction behind a row lock, so two clicks that land together buy one run instead of two paid agent runs.

• 6f6a133: The MCP research agent's web toolset lands as the research platform
  toolset: platform_web_search runs cited web searches through OpenRouter's
  web-search plugin on the org's chat key (tagged mcp-research for distinct
  spend attribution), and platform_fetch_page fetches public pages through a
  guardian-routed client with byte, redirect, and per-run fetch budgets, and
  reduces HTML to readable text. Both tools are gated on the mcp_approval
  feature and no assistant is granted the toolset by default — the research
  agent runner attaches it explicitly. Their descriptions carry the standing
  posture: everything returned is untrusted data to weigh and cite, never
  instructions.

• bd2d77e: userSessions.listUserSessions now returns each session's last_used_at and its upstreams — the remote sessions Gram holds for the same subject and issuer. Both legs of a brokered connection are available from one call, so a client can show what an agent connects through and what Gram reaches on its behalf without a second request per row.

Patch Changes

• 65bb3c8: Accept Stripe webhook events from newer API versions within the SDK's compatible release train.
• 5a0b6f4: Align self-serve PAYG Stripe billing cycles to UTC midnight. Checkout retries now reuse one durable session intent, active product trials retain their exact local end while Stripe supplies the free stub to midnight, and completed subscriptions persist the confirmed paid-period anchor.
• 9f32ef8: Bill PAYG Other inference spend through durable Stripe invoice allocations. Daily charges freeze after 48 hours, signed corrections carry forward after the 72-hour observation window, and ambiguous invoice items or credit notes reconcile before retrying.
• 6e8ce76: Scope the staff-only platform-admin chat analysis settings and triggers to the organization explicitly selected in each request. This is a coordinated dashboard/API correctness fix rather than a change to a customer-facing contract.
• 4d7b2e3: Send a confirmation email when an organization activates pay as you go. It goes to the billing email, or to every organization admin when none is set, and states the metered rate, which inference is billed at provider cost, and which is funded by Speakeasy.
• 3fe01fd: Keep Platform MCP connections active through rotating refresh tokens with a 30-day sliding idle window and a 90-day authorization cap, while surfacing clear reconnect guidance when authorization expires or is revoked.
• 31a3cbf: Keep the trial OpenRouter credit cap until the trial is demoted, not when the trial window ends. A first-key mint after ends_at no longer receives the enterprise ceiling.
• ff39efd: Handle Stripe subscription loss by closing PAYG admission, disabling the Other inference key, and reconciling later billing events against current organization state.
• cd97dae: MCP observability now keys on each request instead of the initialize handshake,
  which the 2026-07-28 protocol revision removes: a new unsampled mcp.request
  counter records every dispatched MCP request by protocol revision, method, and
  surface across all serving paths, and both tools/list PostHog events carry
  the client's protocol version, name, version, and capabilities. The method
  label on mcp.request.duration is now clamped to a known set so clients cannot
  mint unbounded series, and the MCP-Protocol-Version header no longer leaks
  into tool environment variables as a protocol_version value.
• 2deec50: Every result the hosted and platform MCP surfaces return now carries the resultType field that MCP 2026-07-28 requires on every result, and identifies the responding server under the io.modelcontextprotocol/serverInfo key in the result's _meta. Both fields are filled only when missing, so a result relayed from an upstream MCP server keeps whatever the upstream already supplied.
• efd5ffc: PAYG organization administrators can configure or clear their billing
  notification email through the management API. When no address is configured,
  weekly usage summaries and OpenRouter spend alerts are sent to all effective
  organization administrators; enterprise notification routing is unchanged.
• 2912ce3: Send an idempotent reminder three days before an eligible trial ends, and notify
  PAYG billing contacts when subscription loss or an eligible trial demotion
  pauses access. Both emails re-check current billing state before delivery.
• 6045dca: Let PAYG organization admins view and set independent monthly Security
  inference and Other inference caps for each applicable platform-managed key.
  Each change updates only the selected key, survives lifecycle reconciliation,
  and records a per-key audit event.
• 5ae3aaf: Add privacy-safe Platform MCP durable authorization telemetry and document the operational dashboard, monitor, and revocation-probe contract.
• 5ee1892: Re-arm PAYG inference spend alerts after an explicit cap change while preserving
  deduplication when reconciled OpenRouter limits fluctuate.
• 8deb821: Report PAYG tokens-under-management usage to Stripe from durable hourly snapshots. Signed meter intents retry safely, reconcile ambiguous delivery against Stripe summaries, freeze the billed baseline after 48 hours, and record one carry-forward correction after the 72-hour observation window.
• 432a104: MCP resources/read requests now record the actual MCP server URL in billing telemetry and logs instead of the MCP session id, so resource reads are attributable to the server that served them and the MCP URL filter is no longer polluted with random UUIDs.
• 051ce8c: Serve reviewed provider setup guides as Platform MCP resources and add search_gram_docs, which answers from that pinned corpus with cited excerpts and links back to the full guide. Content past its revalidation date is flagged, then withheld, rather than presented as current, and a query nothing reviewed answers returns guide_unavailable instead of invented steps. Documentation citations now render as passages with resource links in the assistant rather than as raw tool output.
• ed343dc: Reject post-login redirect targets that a browser could read as another origin.
• 27b83ae: Disable trial runtime gates after demotion and restore them when the trial is re-armed or converted to PAYG.