server@2.10.0

Minor Changes

• 8df3dad: Agent API keys can now poll agent.getPlugins when the agent holds the new org:device_agent_sync grant. The response includes the agent's principal, and plugins resolve for the agent, its roles, and the org wildcard. Adds the agent-runtime-safe org:device_agent_sync and org:hooks_ingest scopes in registry and delegated-policy version 2.

• 8df3dad: Agent API keys can now send hook events when the agent holds the org:hooks_ingest grant. Events are attributed to the agent itself: a self-reported user_email or cached session identity never re-attributes them to a person, and agent sessions are stored without requiring an email. The OTEL and LiteLLM ingestion endpoints continue to reject agent keys.

• fa8710d: Attach owned upstream accounts to agents with exact session and grant-generation checks throughout OAuth and tool execution.

• e23ba04: Adds the oktaResourceConnections API: per-server Cross App Access readiness derived from the upstream authorization server's advertised grants, the recorded AI agent, and the Okta resource connections the administrator confirmed.

• b5fa7ca: Retain encrypted OIDC delegation credentials with lazy renewal, bounded consent retry, and sanitized organization-admin status.

• 0541e99: Allow organization administrators to move user-session issuers between project and organization scope, or consolidate one issuer into another after reviewing an impact and conflict preflight. Migration preserves clients, sessions, consents, CIMD allowlists, remote-session credentials, and attached resources while auditing the source retirement. Access tokens bound to the source issuer are rejected by repointed servers until the client refreshes, which succeeds against the migrated session. Client registration, session minting, refresh rotation, consent, and remote-login callbacks now lock and recheck the issuer they write under, so a write that raced a migration or delete is rejected instead of landing on the retired issuer.

• 40279e9: Organizations now verify a domain before setting up single sign-on. WorkOS refuses to start an SSO connection until a domain is verified, so the IdP and SSO page gains a Domain verification card that opens the WorkOS Admin Portal. Once verified, the card lists every verified domain, because SSO only applies to users on those domains. Until a domain is verified, the Single Sign-On and Directory Sync cards are dimmed, their Configure buttons are disabled, and an amber warning explains why. The setup board adds a "Verify your domain" task that the identity provider task now depends on. Organizations that already have an active SSO connection are treated as verified and are not blocked.

  The verified domains are kept in sync from WorkOS events: organization_domain.verified adds a domain, organization_domain.deleted removes one, and organization.created / organization.updated replace the list from the organization's full domain set. Onboarding status reports domain_verified and verified_domains.

• a03357f: Scope agent delegation to a selected MCP server while preserving live policy exclusions. Require explicit permissions when creating or rotating agent keys.

• 11c951b: Scope agent MCP credentials to live delegable access, support agent-owned upstream account bindings, and preserve agent identity in sessions and usage views.

• 8794f71: MCP servers can select an existing organization- or project-owned user session issuer during creation or from authentication settings. Interactive creation prefers a sole organization issuer, requires a choice when several exist, and keeps project-specific issuer creation as an explicit fallback. Organization-owned issuer settings remain read-only from project pages.

• 42135ec: Add the read-only list_watchdog_findings Platform MCP tool for rule-level Watchdog alerts, affected users and client surfaces, and fully redacted sampled evidence.

• 2fb01cf: Accept the workload assertion grant at the MCP token endpoint, behind the agent authorization rollout. A JWT bearer request that presents no client authentication exchanges a workload's platform-issued identity token for a session scoped to the named MCP server. The grant resolves the token's issuer to a trusted workload issuer, verifies it against that issuer's published keys, requires exactly one audience naming the endpoint, refuses a replayed token, admits the subject through the tenant's workload admissions, and requires a live assigned agent. The session has no client and no refresh token, lasts 15 minutes, and carries the endpoint's issuer, including the authentication host for issuers that opt in. Where the grant is accepted, the authorization server metadata lists jwt-bearer in grant_types_supported. Every verification or admission failure answers the same invalid_grant; outages answer 503 and rate limits 429, both with Retry-After.

Patch Changes

• 6b39418: Request logs for the device-agent endpoints (agent.getPlugins, agent.reportAIScan, agent.reportSessionMoved, agent.createSessionHandoff) now identify the machine as well as the credential. The Gram-Device-Serial, Gram-Device-Hostname, and Gram-Device-Environment headers an agent reports land on the request's wide event as gram.agent.device.serial, gram.agent.device.hostname, and gram.agent.device.environment, so devices in a fleet sharing one organization install key can be counted and told apart without joining ingress logs for client IPs. The serial is recorded as reported rather than hashed — it authorizes nothing and is the key MDM inventory uses — and is normalized exactly as the stored per-device heartbeat is, so placeholder serials from white-box hardware are dropped instead of collapsing a fleet into one device. A value the agent does not report yields no attribute at all. Agents predating these headers report none of them and stay unidentified in the logs until they upgrade.

• f120307: Classify automatic OAuth client registration failures as unreachable or refused and record bounded diagnostics for Dynamic Client Registration and Client ID Metadata Document callbacks.

• 8771101: Require https for workload issuer identifiers and their jwks_uri. An assertion naming a plain-http issuer is untrusted, and an issuer row with a plain-http jwks_uri is refused before any key set fetch.

• ff75a7c: Adds a nullable creation_source column to organization_metadata so the flow that created an organization can be recorded.

• aa2f201: Records the flow that created an organization and shows it as "Created via" on the admin organization record, marking organizations created through the platform-admin prospect flow. Organizations with no recorded source read as "Not recorded".

• 8c8a1dc: Anthropic inference hooks now return a verdict within the provider's default five second timeout instead of being cut off mid-evaluation. Feature flags are resolved once per delivery rather than once per scanned input, inputs are scanned concurrently, and when a long transcript still cannot be fully evaluated in time the request is denied with a retry message while the messages that were evaluated are checkpointed, so the retry only scans the remainder.

• 8771101: Optionally serve the per-server MCP OAuth authorization server on an alternate authentication host that carries no MCP traffic, configured with GRAM_AUTHENTICATION_HOST_URL. A user session issuer opts in with use_authentication_host. For its /mcp and /x/mcp servers the host answers the authorization server routes (metadata, register, authorize, consent, token and revoke), and returns 404 for everything else and for every issuer that has not opted in. Opted-in servers announce the authentication host as their issuer in authorization server metadata, protected resource metadata, authorization responses and minted tokens, while the resource stays on the MCP host. Authorization server metadata is served only on the host its issuer names. The ID-JAG exchange is not accepted on the authentication host.

• 6efa45c: Splits the Okta AI agent setup into separate checklist steps, ending with setting up a first Cross App Access connection. Speakeasy now ticks the linked app steps from the applications sync, flags a linked app that is inactive or has nobody assigned, and collapses the checklist once setup is complete. The checklist moves above the connection details.

  The checklist item key is now an enumerated value in the API. The Okta settings code is reorganized by tab with no change in behavior, and links to settings URLs that were never released are removed.

• 6efa45c: Okta readiness dashboard: gate the applications snapshot on a clean verification and explain a degraded connection inline, scroll to the connection card after verifying, show when a degraded check ran, confirm before resetting a Cross App Access confirmation, surface confirmed rows under the Needs action filter, fit the readiness table at 1440px, disambiguate duplicate app instances, say Speakeasy consistently in the console checklist, move Sync now feedback to a toast, and fold the Okta page into the Identity page as concern tabs (identity?tab=sso|provider|applications|cross-app-access; /okta and identity?tab=okta redirect there) with a vendor-neutral provider picker. The console checklist is now two groups, Connect and Cross App Access setup, with the steps a verification can observe ticked automatically, the per-app steps left to the Cross App Access tab, and the agent credential step deferred until the token exchange consumes it.

• 494418a: Platform GCP credentials that impersonate a service account in Speakeasy's own project now record the own-project exemption on create and update, so the identity provider signing credential the runbook creates is usable. Creating, updating and deleting platform credentials requires a fresh platform admin session. A new GRAM_IDENTITY_PROVIDER_SIGNING_SERVICE_ACCOUNT setting pins which service account the signing credential may impersonate, checked when a key is provisioned or rotated and on every client assertion signed with a managed key.

• efe2924: Plugin package publishes triggered by someone who is not a member of the project's organization, such as a Speakeasy admin editing a customer's MCP servers, now publish right away under an existing organization member instead of failing and waiting for the hourly sweep. Publishes that cannot find any member are recorded once instead of being retried.

• 8771101: Refuse workload assertions whose JOSE typ header marks them as a WIMSE Workload Identity Token (wit+jwt) or an RFC 9068 access token (at+jwt). These credentials must never be exchanged as bearer grants, so they are rejected before any key set is fetched. Assertions with no typ or any other value verify as before.

• 9770a19: Realtime risk enforcement now truncates scan inputs at a 50 KiB default instead of 1 MiB, with the limit adjustable through a feature flag. This reduces timeout-driven fail-open scans for large prompt attachments.

• 11e3d4e: The gram-risk-llm-analyzer feature flag now selects a risk engine mode per organization: off keeps the gitleaks, Presidio, prompt-injection and destructive-tool engines; shadow keeps those engines enforcing while the fine-tuned risk model also scans the same traffic so its verdicts can be compared, never denying a request on its own; llm swaps the engines for the model as before. Organizations on the existing boolean flag keep today's behaviour until the flag is switched to multivariate in PostHog.

• d1534b0: Organizations running the shadow risk engine mode now keep the fine-tuned risk model's verdicts in the findings store, marked so they can be compared with the legacy engines' findings per message. Shadow findings are never enforced and never appear in Risk Events, the Dismissed listing, the overview, signals, the Watchdog, reveal or OpenTelemetry data exports.

• 2c35119: Hooks session state is now bound to the project that owns it. Session MCP inventory snapshots, their inventory-read status, and the session agent variant are cached per project, and only a sender authenticated to that project can write them. A hooks key from one project can no longer change what the shadow-MCP guard reads for the same session id in another project. MCP inventory reported by unauthenticated Claude hooks is no longer recorded. The first project to attribute a session claims its cached identity atomically; that identity is only returned to its own project and can't be replaced by another, so another project's OTEL export can no longer redirect a session's unauthenticated hooks. Hooks buffered by an authenticated request are only flushed by that project. Sessions already in progress at deploy lose their cached inventory snapshot until their next inventory report.

• 8771101: The MCP OAuth token endpoint now checks grant_type before it authenticates the client. A request with an unsupported grant_type gets unsupported_grant_type even when it has no client credentials or has invalid ones. The authorization_code and refresh_token grants still require full client authentication. A JWT bearer request that has client credentials is still an authenticated ID-JAG exchange. A JWT bearer request with no client credentials gets invalid_client, the same response as before.

• 40a1936: Update weekly billing emails to summarize agent session storage, risk scanning, and MCP gateway egress from product meters. Show estimated spend only for pay-as-you-go organizations and compare usage across completed billing-cycle days.