server@1.7.0

Minor Changes

• 5027338: The MCP server Clients and Sessions tab now leads with active session and client counts, and renders both listings as searchable, filterable, sortable tables paginated ten rows at a time, with member avatars and creation dates on sessions. The clients table reports how many active sessions each client holds, backed by a new active_session_count field on the user session clients API, and clicking that count narrows both listings to that client behind a clear-filter bar.
• 374394a: The user-session OAuth authorization server now emits the RFC 9207 iss parameter on every authorization response, success and error alike, and advertises authorization_response_iss_parameter_supported in its metadata document. This satisfies the MCP 2026-07-28 Authorization Response Validation requirement and lets MCP clients holding concurrent flows against several authorization servers detect a mix-up attack.

Patch Changes

• 19ca2a8: Keep shadow MCP risk finding descriptions generic instead of naming the tool that was called.

• 1fa0caf: Surface that Claude Cowork still needs its own manual setup step when Device
  Agent is selected on the "Instrument agents" onboarding step — Device Agent
  only covers coding assistants running on the developer's machine, not
  Cowork's cloud sandbox. The new note links straight into the Manual Setup
  flow for Cowork.

  Also aligns MDM vendor wording with the Iru rebrand ("Iru (formerly Kandji)")
  across the Device Agent setup page and Codex onboarding copy, matching the
  naming already used on the MDM integrations page.

  Conversation events (UserPromptSubmit/Stop) are now also written to
  ClickHouse telemetry so the onboarding "Confirm traffic" feed shows prompts
  and assistant replies, not only tool calls.