server@2.14.0

Minor Changes

• bd885c7: Add off-by-default staff Admin MCP write consent, immutable proposals, same-staff browser approval and a guarded single-organisation logs feature change. The approved change executes with live staff and connection checks, transaction-time state validation, an idempotent receipt and staff audit masking. Other write operations remain unavailable.

• e9c6584: Add guarded staff Admin MCP writes for the consent_tool_filtering feature, onboarding task visibility and enterprise trial extension, with readable approval previews. All writes stay off by default and use the same proposal, same-staff browser approval and receipt safeguards.

• ecf54b8: Choose when a Slack assistant replies: only when @-mentioned, when @-mentioned and then for the rest of that thread, or to any message in its channels. Slack setup asks this in plain terms, and it can be changed later from the chat or the trigger settings. An assistant following a thread can step out once it is no longer needed, and an @-mention brings it back caught up on what it missed. It never replies to its own messages, and when it starts a new thread it can keep the replies in its current conversation.

• 679c03b: Add remoteSessions.count, which returns how many distinct people hold a live session through one remote session client. The dashboard's User Identity row will use it to show how many people are signed in.

• 7181521: A grant made directly to a person for a specific resource now outranks a block they inherit from a role or from everyone. Administrators can block an MCP server for a role, including a directory-synced one, and still give individual members of that role access to it by name without changing role membership. A person's own blocks still apply, grants covering every resource do not outrank blocks, and agent grants never outrank blocks. The rule applies to every blockable permission (the organization, projects, MCP servers, environments, skills, plugins, and workloads). access.listGrants now reports each scope's direct_selectors, and the MCP server access page shows who keeps access through their own rules before a role or everyone is removed from a server.

• 679c03b: remoteSessions.commitServerIdentityConfiguration accepts an optional registration_method in auto client mode. cimd, the default, prefers a Client ID Metadata Document and falls back to dynamic client registration; dcr always registers dynamically.

• ca3afe9: Extend the Platform MCP add-existing-mcp-servers workflow so it works from any agent client, reports local (stdio or localhost) servers and leaves them unchanged, and can optionally move migrated servers onto the organization's Tailscale private network.

  Add a read-only get_network_ingress Platform MCP tool for organization administrators. It reports whether private networking is switched on for the organization, the ingress's configured, enabled and observed state, and the one next action standing between the organization and private MCP access, with a dashboard setup link. It never returns provider credentials or resources.

• 89836f1: Remote MCP URL verification now recognizes servers that speak MCP 2026-07-28. The probe first asks the server to describe itself with server/discover and falls back to the initialize handshake, so servers that implement either one verify and can be installed from the catalog. Previously, a server that supported only 2026-07-28 was reported as not being an MCP server.

Patch Changes

• d24e7a1: Add an "Open in WorkOS" link beside the WorkOS org ID on the admin organization record. It appears when the organization is linked to WorkOS and the admin API has WORKOS_ENVIRONMENT_ID set.
• 7169c94: Make MCP method availability version-aware across hosted, platform toolset, and meta servers. Keep initialize and ping for revisions before 2026-07-28, and prepare 2026-07-28 server/discover with shared server descriptions, the correct supportedVersions field, and privacy-aware cache hints. Acknowledge discovery notifications without a JSON-RPC response body.
• 835852c: Pin the unconditional Temporal schedule count in the worker test to the 26 schedules that registerSchedules installs, so the test no longer depends on catching Temporal's schedule listing mid-registration.
• 0fb637f: Show members who hold a role through a directory role mapping on the Team page, the Roles & Permissions page, role filters, and role member counts. Members now report mapped roles in a separate directory_role_ids field, and the Team page marks them as coming from the directory because they cannot be removed there.
• 2042413: The project's managed assistant can now list a project's plugins, read one plugin by name, and list the assignment targets that can receive plugins through the Platform MCP list_plugins, get_plugin, and list_plugin_assignments tools, so it can resolve a plugin before distributing a skill to it. Plugin assignment and membership changes remain available only to external Platform MCP clients.
• 0db6bec: Admit the Platform MCP list_access_members tool to the project's managed assistant, so the dashboard assistant can look up organization members by an identity query of at least three characters. Results keep the masked identities, the five-person suppression threshold, and the short-lived member references, and the tool description now explains both to the calling agent. list_access_roles and get_mcp_access stay external-only.
• e600db2: Add list_risk_findings, list_risk_findings_by_chat and get_risk_rule_breakdown to the Platform MCP. The tools read the same store as the dashboard's Risk Events listing, redact every matched value to a length-and-hash fingerprint, pseudonymize user identities the way list_watchdog_findings does, page with opaque cursors bound to their filters, and share the row-level Watchdog read budget.
• f55f62f: Platform MCP gains get_tool_usage_summary, which breaks one project's tool calls down by what they reached over a named window: hosted MCP servers, tunneled MCP servers, gateways, shadow MCP servers, local tools, and skills. It reads the same target-aware pipeline as the dashboard Insights board and the managed platform_get_tool_usage_summary tool, so every surface reports one number for one window, and folds the names calling apps used for a configured server onto that server (with its mcp_id) so a hosted server reached through a plugin prefix is never counted as shadow MCP. Every target type is reported, zero included, with its share of all calls; shadow MCP servers are counted but not named.
• 7fef8b5: Enable hook fail-open during control-plane outages for newly created organizations. Existing organization settings and explicit fail-closed choices are preserved.
• f143e71: An MCP-scoped risk policy no longer requires at least one tool per selected server. An empty tool list (or unchecking every tool in the dashboard scope picker) is now normalized to "every tool on this server," matching what happens when no tool selection is made at all, instead of being rejected or silently dropping the server from the policy's scope.
• e8cc5c9: When the upstream connection behind an issuer-gated MCP server can no longer be refreshed (for example, the provider revoked its refresh token), MCP clients are now directed to reauthorize instead of retrying the rejected request. The 401 explains that the upstream must be reconnected and carries error="invalid_token" for refreshable sessions, and the token endpoint declines to refresh those sessions until the upstream is reconnected. Temporary upstream token endpoint failures now return 503 with Retry-After, and upstream client configuration errors tell the user to contact the MCP server administrator.
• 10bfa54: Use the official MCP SDK client for meta MCP member calls and consent verification, supporting MCP 2026-07-28 discovery with fallback to older protocol versions. Preserve tool result precision and reliably clean up legacy sessions, including after failed connections.
• 0be1824: Okta setup checklist: order the public-key steps the way the Okta console requires (save the key URL first, then switch client authentication), list the required API scopes and admin roles one per line, submit the client ID from its checklist step instead of a separate section, and make the group headings easier to see.
• 479824f: Add mark_risk_findings_false_positive and unmark_risk_findings_false_positive to the Platform MCP so an administrator can dismiss specific Watchdog findings, or restore them, from an agent. Both require confirmation, replay safely on an idempotency key, audit the acting user per finding, and return a receipt that partitions the requested ids into changed, already in the requested state, and not found.
• 02f5d25: Add list_skill_distributions and undistribute_skill to the Platform MCP. Administrators and members can now see which plugins carry which skills in a project, with the version each distribution resolves to and whether it follows the latest version, and an administrator can take a skill back from one plugin or assistant, undoing distribute_skill, after confirming the exact target.
• 1d0ef43: Log why a remote MCP readiness check failed, and stop the check from retrying its connection five times.
• 3fd3187: Fail closed for risk-policy self-removal until organization-scoped audience coordination can support effective exclusion. Remove the table-wide grant lock while preserving separately requested administrator audience changes.
• 2aa7341: Use a tunneled server's saved resource identifier as the audience of signed caller assertions. When the setting is empty, use tunneled-mcp-server:<ID>. Preserve trailing slashes and escaped characters when saving the identifier, and explain the audience setting in the dashboard. Show the organization ID that caller assertions carry in organization_id on tunneled MCP server settings.
• 9364289: Verify AI integration credentials before storing them. A save that would start polling on an unanswered key or external scope probes every sync schedule the provider runs with the cheapest read that schedule already makes; a refusal from every schedule fails the save with the provider's own message and writes nothing, and a partial refusal saves while pausing just the refused schedules in the same transaction. Provider rejections and outages recorded on a schedule row no longer fail the PollAIData activity, so one misconfigured integration stops tripping activity-failure alerting.