server@2.12.0

Minor Changes

• ad3563a: Add read-only staff Admin MCP tools for global issuers (list, detail, duplicate and migration preflights, convergence candidates), support matrix facts, organization onboarding configuration, project MCP server inventory, and bounded organization inference key state, spend history and metered usage totals. Each tool requires live verified staff context and returns typed, bounded projections that omit credentials, provider identifiers, server URLs and customer-authored text.

• f480067: Add an MCP Servers view to the admin organization navigator that lists a project's MCP servers with their URL, visibility, source and creation date, and copies a server's URL in one click.

• 8636862: Add the workloadIdentities management API: read an organization's workload identity trust policy, register and withdraw the external issuers it trusts, and admit and withdraw the subjects those issuers may present. Admitting a subject assigns the agent it inherits its policy from in the same transaction, and withdrawing an issuer withdraws its admitted subjects, so neither half-configured state is reachable. Every write returns the whole policy. Gated on workload:read and workload:write, and audited under the workload-issuer and workload-admission subjects with before and after snapshots.

• 068e1bf: Configure Remote MCP server identity through one atomic provider and client setup operation.

• d621b76: The setup board now has a single "Set up identity provider" task with three steps: verify a domain, connect single sign-on, and sync the directory. The separate "Verify your domain" task, and the legacy "Connect identity provider" and "Set up directory sync" tasks, are gone, so nothing on the board is blocked behind another identity task. The security onboarding preset and the demo organization show the combined task. The single sign-on step stays disabled until a domain is verified, and a blocked portal popup now shows an error on every step.

• 3552233: Allow risk policies to target selected MCP servers, gateways, and tools while restricting those policies to tool traffic.

• 36646bc: Add directory role mappings to the access API. Organization admins can map a directory group, or a directory attribute value such as department_name=Sales, to a role, and members who match get that role on top of the roles assigned to them directly. syncDirectoryGroups pulls groups from the organization's linked directories so they can be mapped before any directory event delivers them. Setting and removing a mapping are audited under the directory_role_mapping subject, and role member counts include members who hold a role only through a mapping.

• 8a4657e: Add organization Slack workspace authorization. Organization administrators can connect and disconnect multiple workspaces from Identity; connecting a listed workspace again reauthorizes it. Credentials remain encrypted and workspace changes are audited. Shared Explore Demo shows read-only workspace history. Directory sync and identity mapping are not included.

• 662c2d9: Sync organization Slack directories after connection or on an administrator's request. Show workspace sync history, member counts, and a searchable read-only directory across workspaces. Complete snapshots preserve identity mappings and retained members; failed fetches leave the prior directory intact.

  Shared Explore Demo shows saved directories without allowing sync. Disconnecting a workspace deletes its synced members. Connected workspaces sync every 30 minutes, refreshing rotating Slack tokens as needed, and admins can still sync now.

• 632cdc4: Show mapped Slack workspace accounts under Work identities on a person's Accounts & devices page. Employees can read their own mappings and contact an administrator for corrections. Organization administrators can review an active person's exact membership in the organization directory. Reads require a browser session and active membership; mappings grant no additional permissions.

• 0d17f90: Let organization administrators map Slack memberships to existing personnel from an inline picker, reassign or remove mappings, and review directory changes without granting new permissions. Syncs map members whose email matches exactly one person.

  The shared demo shows synthetic mappings with read-only controls. Disconnecting a workspace removes its mappings.

• f01aad0: Add an observed support coverage matrix to the staff admin app, on each organization's record.

  A new admin.getSupportCoverage endpoint reports, per consuming surface, evidence for session activity, policy enforcement, identity attribution, token usage and shadow MCP exposure. Policy enforcement joins tool_call_blocks to session summaries via chat_id; identity counts sessions bound to a named user separately from those bound only to a device hostname; shadow exposure is derived from trace_summaries, which already carries the MCP server URL and hook_source on the same trace.

  Every (capability, surface) pair is returned with an explicit status so evidence found and evidence absent stay distinct, and hook sources the fold does not recognize are reported rather than dropped. Folding a raw hook_source onto a surface now happens server-side in internal/agentsurface.

  The integration cards beside the matrix read from the operator-editable support matrix catalog, ranked by how much of that organization's missing coverage each method would close.

Patch Changes

• ab78538: Allow public PKCE clients (token_endpoint_auth_method: none) to register with the staff Admin MCP, so desktop MCP clients can connect. Clients registered with a secret must still authenticate with HTTP Basic, and public clients must present no credentials.
• c4e433b: Serve the full product on extra first-party hosts listed in GRAM_PLATFORM_HOSTS (such as ai.speakeasy.com) alongside the server URL's host. Login started on such a host calls back and lands on that same host, and the dashboard reports telemetry for ai.speakeasy.com to the production projects.
• 8636862: Tighten issuer resolution and tier scoping on the workload identity trust policy. An admission resolves its issuer at the tier it is written to, so an organization-tier admission can no longer bind a project-tier issuer; where the same issuer URL is registered at both tiers the project row wins, matching how the verification path resolves it. Two rows sharing an issuer URL at the same tier are refused rather than silently resolved, because choosing between them would decide which jwks_uri verifies the subject and whether wildcards are permitted for it. Reading and withdrawing a single admission are scoped by project the way the list already was, the admitted-subject list applies the issuer's visibility predicate to its join so an admission cannot surface an issuer the caller cannot otherwise see, and withdrawing one tier keeps the shared agent assignment while the other tier's admission is still live instead of leaving it with no policy. The issuer and JWKS attributes carry FormatURI, so a value that is not a URI is rejected by generated clients and by the contract.
• 81693dd: Adds the workload:read and workload:write RBAC scopes, which gate managing an organization's workload identity trust policy: its issuers, its admitted subjects, and which agent each inherits its policy from. Both are admin system-role defaults and neither is a member default, since reading the policy discloses which machines an organization recognises. They are registered as agent-runtime scopes but deliberately not agent-runtime-safe, so a workload cannot use its inherited policy to admit further machines.
• 5657e3a: Adds allow_wildcard_admission to workload_issuers, and match_kind to workload_identity_admissions and workload_agent_assignments, so a workload subject can be admitted by a trailing wildcard on its sub where the issuer permits it. Every column defaults to today's behaviour, so no existing issuer, admission or assignment changes until an operator opts in.
• 8636862: A workload subject can now be admitted, and resolve its agent, by a trailing wildcard such as wimse://identity.anthropic.com/org/<ORG_ID>/agent/* rather than the whole value — but only under an issuer that permits wildcard matching, which is checked on every lookup rather than trusted from write time, so clearing the issuer's permission revokes wildcard rules already written. The * is mandatory and must be last, so a rule states its own breadth instead of a bare stem quietly matching more than it appears to. Where a wildcard rule and an exact one both cover a subject, the most specific wins, which lets a fleet share one agent while individual principals are pinned elsewhere. Exact matching is unchanged and remains the default.
• 8636862: Seed the demo organization with a second workload issuer that permits wildcard admission, a wildcard admission standing for an agent fleet, and its agent assignment. The existing Acme CI issuer keeps wildcard admission off on purpose: its subjects encode a branch ref, where a wildcard would admit anyone able to push a branch.
• 4135eac: Speed up chat.load on Agent Sessions by reading token/cost metrics from chat_session_summaries, skipping Claude OTEL scans for non-Claude chats, and running remaining ClickHouse enrichment in parallel.
• c5b9863: Let organization admins turn off the device agent's Shadow AI scan from the fleet configuration.
• d192f03: Add management API and SDK operations to prepare, inspect, and unlink downstream identity-chaining client registrations with explicit grant evidence and generation checks. Readiness fails closed on missing grant evidence, and uncertain registration persistence requires reconciliation rather than replay.
• 52c3dc3: Hook ingest pins a session to the project that first created its chat, so a later request with a different project header cannot stamp messages onto that chat. Chat list counts and last-message times now ignore those sibling-project rows, matching the transcript the UI can actually load.
• 35060d1: Protect active identity-chaining bindings during issuer lifecycle changes. Block unsafe issuer deletion and consolidation, and show binding counts and explicit unlinking guidance in the dashboard and admin migration review.
• 8762f37: Expose advertised authorization grant profiles in identity-provider API and SDK models. Discovery and refresh retain only fresh, matching-issuer evidence and preserve upstream HTTP status in partial-discovery diagnostics. Advertised profiles describe capabilities, not client authorization or user access.
• 52cbebd: Add the launcher.judge management endpoint (POST /rpc/launcher.judge), which routes command palette intent decisions to Jev via OpenRouter. The dashboard sends the typed query and a short list of fuzzy-prefiltered candidates; the server frames target, action and readiness questions for TypeSafe's System One judge, pays with the organization's internal OpenRouter key, and returns probability distributions keyed by the caller's candidate ids. Organizations without a usable OpenRouter key get disabled: true and no outbound call is made. Person candidates are never forwarded.
• e524c9b: Creating or updating a risk policy scoped to selected MCP servers no longer fails with "length of body.tools must be greater or equal than 1" when a server follows the policy tool rule.
• 0e155d1: Make the setup wizard the only onboarding view at /setup, and derive the tasks it walks from the onboarding survey result recorded through a new submitOnboardingSurvey endpoint. Onboarding presets and setup cards are each defined in one registry.
• 27be39b: Generate OpenCode plugin loaders that work on OpenCode 2 as well as OpenCode 1, so published plugins register their MCP servers and skills again on OpenCode 2.
• 42ab0c8: Generate an OpenCode observability plugin that loads on OpenCode 2 as well as OpenCode 1, so hook events and enforcement work again on OpenCode 2.
• 1edb857: Add the latest OpenRouter models to the playground, chat, and assistant model pickers: Claude Opus 5.5, Claude Fable 5.1, GPT-6 Astra, GPT-6 Sol, GPT-6 Luna, Gemini 3.8 Flash, DeepSeek V4.1 Flash, Grok 4.7, Qwen3.8 Max, Qwen3.8 Flash, GLM-5.3, and Kimi K3.
• 0aac924: Connecting an upstream service from the MCP consent page on an extra platform host (such as ai.speakeasy.com) now returns to that host after the upstream login, instead of failing with "authn challenge state does not match this MCP server". The disabled "Give access" button on the consent page also no longer renders black on black while hovered or focused.
• e251e57: Add User, Agent, and No Identity modes for Remote MCP servers, including identity selection during creation, managed Authorization credentials, and editable Remote Identity Provider setup.
• e0d0e98: Fix the MCP consent page looping on "Connected elsewhere" when one remote session client is shared by remote MCP servers with different upstream URLs. Connecting now records the upstream of the server being connected.
• 8b9f7ec: Accept Tailscale identities with names beginning with RFC 2047 Q-encoded characters and empty optional profile-picture headers.