server@2.21.0

Minor Changes

• fd61df4: A shared authorization server whose issuer is on the authentication host, pinned there or derived for an issuer that opts in with use_authentication_host, is now served on that host, giving platforms such as Claude Tag a token endpoint on a host that carries no MCP traffic. Until authorization, consent, and registration reach the authentication host, it serves only its metadata, token, and revocation endpoints and accepts only the workload grant, while MCP clients keep signing in through the per-endpoint authorization server.

• 8c561d4: remoteMcp.getServerScopes now needs only read access on the target MCP server and reports each client's issuer_name and issuer_url and whether the caller can_pin. In the dashboard, the pinned scopes picker is read-only unless you have edit access on every server sharing the URL, its status line names what sign-ins actually request when the pin does not decide, and in Settings › Identity members who can read but not edit the server see a read-only "Requested at sign-in" summary of the scopes the connected client requests.

• 1d425ca: Remote MCP servers behind a remote session client that holds its own upstream credential (credential_owner = 'self') now reach the upstream with a token obtained through the OAuth client credentials grant, for every caller. Callers never see a connect step for such a client. When the upstream rejects the token, Speakeasy obtains a new one and retries once; if that also fails, or the token cannot be obtained, the caller gets an error naming the MCP server administrator (or asking for a retry during an outage) instead of a reauthorization challenge. A rejected client is flagged with upstream_rejected_at.

• 111327b: Remote session clients can now be created with credential_owner: self, meaning the client holds one upstream credential for itself (the client_credentials grant) instead of each caller connecting their own account. Using that credential when proxying requests comes in a later release. A self client needs a client secret or a key set, and an issuer with a token endpoint, which can be entered by hand without metadata discovery. Both create methods also accept json_web_key_set_id, so a private_key_jwt client can be created in one call.

• 7954081: A shared authorization server now accepts a workload grant that names no resource, as Claude Tag sends when its Resource field is left empty. The token it issues works at every MCP server of the issuer that the workload's assigned agent may connect to, and a server the agent may not connect to answers 403 insufficient_scope while the token keeps working elsewhere. A grant naming a resource still returns a token for that one server, and the Claude Tag guided setup now asks to leave Resource empty.

• 73d7328: Every hosted MCP server with an address now has its own MCP server record and endpoint from the moment it is created or cloned, instead of only after its network access is first edited. Every change to the hosted server (name, slug, enabled and public flags, custom domain, OAuth issuer, tool variations group, and enabling it by attaching it to an assistant) keeps that record and endpoint in step, and deleting the hosted server removes them along with their plugin, gateway, and assistant attachments. A hosted server whose custom domain was deleted no longer gets an endpoint recreated on that domain, and disabling a hosted server that was its custom domain's root route now clears that route.

• 9e9a4d6: Plugin assignments now carry an install mode for the device agent: required (installed, can't be turned off), default (installed, can be turned off) or available (off until the user turns it on). setPluginAssignments accepts install_modes per principal URN and keeps a principal's current mode when it is omitted. agent.getPlugins returns each plugin's install_mode, resolving overlapping assignments to the strictest mode, plus its display name and description. The observability plugin is always required.

• edf9273: Add project-scoped sensor and signal slugs for analytics and integrations. Accept optional slugs during creation and updates, default new slugs from display names, and expose slugs in all resource responses. Slugs remain reserved while a resource is soft-deleted. Platform MCP exposure remains deferred until signals intelligence is production-ready.

• 517d744: Add project-scoped Platform MCP sensor and signal discovery, atomic confirmed authoring, shared-definition updates, and metadata matching previews. Ship an authoring workflow with the Platform MCP plugin.

• edf9273: Add management APIs for reusable, project-scoped custom signals and sensors. Sensors support multi-label, exclusive-choice, and ordered-score modes, including incomplete drafts and atomic ordered-membership updates. The APIs include cursor pagination, project authorization, and transactional audit events. Deleting a shared signal detaches it from every sensor while preserving the remaining order; deleting a sensor preserves its catalog signals.

  This change provides configuration CRUD only; it does not execute classifiers or produce classification results.

  All configuration methods require the organization's signals_intelligence product feature for sessions and API keys. Disabled organizations receive a forbidden response; feature lookup failures fail closed.

• 56b0efe: The new workloadIdentities.getCustomFlows method serves the forms for trusting a platform the Access Hub catalog does not list: registering and editing a trusted platform, and allowing and editing access under one. Each form's title, description, button labels and fields come from a YAML file shipped with the server and are checked when it loads against the management API form they submit, so a form cannot offer a field its request does not accept or let the operator edit a value fixed at registration. The method requires workload:read.

Patch Changes

• 18ce045: Let administrators take the Admin role off a server's use or management from the server's Team Access tab. Setting the Admin role to "No access" for using an MCP server used to fail with "blocking the Admin role would take this server away from every administrator". Only a block on viewing the server is still refused, because that hides the Team Access tab from every administrator and leaves nobody able to undo it.
• 0acd27b: agent_events rows are now classified and filled in the OTel transform step, so every consumer of the normalized record sees the same event type, identity, tool, outcome and usage columns, for logs and spans alike. The deprecated input_content and output_content columns are no longer filled.
• 76a2a59: Include required type and title fields in Claude plugin user settings so manifests with token or API-key prompts pass Claude Code validation.
• 4470b2a: When an identity provider create includes authorization_grant_profiles_supported, which the dashboard and admin forms send only for drafts built from discovery, the server now runs discovery itself on project, organization, and global creates and through server identity configuration. If every value the form submitted (endpoints, jwks_uri, documentation URLs, supported scopes, grant types, response types, auth methods, and capability flags) still matches the served document and its jwks_uri returns a valid public key set, the provider is recorded as discovered and stores the advertised authorization grant profiles. Fields the form left empty are filled in from the document. Before this, such providers were left undiscovered and did not appear in the Okta Cross App Access table. Creates that omit the field skip discovery. A mismatch, an invalid key set, or a discovery failure is logged and does not block the create. Project-owned creates now reject a taken slug before contacting the provider. Supported lists are compared as sets, a document found at the origin root is not recorded when it contributes any member, and discovery plus key-set validation is capped at about five seconds. When a create is not recorded as discovered, the submitted grant profiles are dropped. Identity chaining now treats a provider as eligible only when its metadata was discovered, and reports an undiscovered provider as needing metadata rather than as unsupported. Changing a provider's issuer URL clears its grant profiles and discovery record until the next refresh, and resets every discovered endpoint and capability the same edit does not restate. Server identity configuration picks the registration method (CIMD, dynamic, or manual) from the submitted form, not from fields discovery filled in. Federated sign-in applies the RFC 8414 default (client_secret_basic) when the provider omits token_endpoint_auth_methods_supported; an explicitly empty list admits no method.
• 7d3730b: Analytics queries, Explore and saved widgets can count the distinct values of a dimension with the count_distinct aggregation, so a tool-calls query answers how many different tools, servers, sessions or people were involved.
• 6827b5f: A skills analytics dataset, one row per skill invocation (a tool call that named a skill), so Explore, saved widgets and dashboards can rank skills and count the skills used. Its description says which producers report skills, since Codex and generic OpenTelemetry producers report none.
• fcf3bc8: The mcp_server dimension of the tool_calls analytics dataset now speaks the display names set in Hooks settings: two reported names with one display name group, filter and count as one server in Explore, saved widgets and dashboards, and the values picker offers the display names.
• 3d08fcc: The Platform MCP exposes the analytics query API: describe_analytics_catalog reads the datasets, fields, grains and limits a project's agent session data is queried through, list_analytics_dimension_values lists what a dimension holds in a window, and run_analytics_query runs a query in that vocabulary, so an agent can ask the questions Explore answers. The three tools are switched on by the same flag as Explore and refuse readably until it is.
• 3d08fcc: An ungrouped analytics query, rows at the dataset's grain, returns at most 200 rows. A grouped result keeps its 1,000-row ceiling, so time-series charts are unchanged. Describe and the Platform MCP catalog report both limits.
• 9b73215: Speakeasy now has one internal path for writing its own log records into the OTel pipeline, applying the same tenancy and validation rules as the /otel/v1/* ingest endpoints. This is internal plumbing: nothing changes for customers sending telemetry.
• 945d59e: Fix the people directory repeating a person on every page and never reaching the rest of the list when that person's most recent activity was Speakeasy-hosted (excluded) usage. Next-page cursors now carry the exact activity timestamp the page ended on; cursors issued before this change keep working.
• bd87570: Fix chat search pagination when a chat also has activity outside the selected time range or filters. Oldest-first paging could show the same chat on every page and never reach the rest, and newest-first paging could stop early. Next-page cursors now carry the exact start time the page ended on; cursors issued before this change keep working.
• 1378037: Platform MCP get_mcp now pages a server's tool list through tool_cursor, and returns exposure_version only on the page that completes the read, so a tool change can no longer be confirmed against a partly read list.
• f8820c1: Retrying a Platform MCP write that already committed now returns its stored result without spending the caller's rate limit, and expired idempotency receipts are swept hourly instead of being kept forever.
• 8298212: Platform MCP tools no longer return raw database or internal error text to the caller. Any tool error that its own handling does not recognise is now logged with its full cause and answered with the generic feature_unavailable refusal, on both the external endpoint and the project assistant.
• 179f66f: Add the hosted-mcp-wrappers migration command, which gives hosted MCP servers created before canonical wrappers existed their MCP server record and endpoint through the same sync every toolset edit runs, auditing the writes as a system actor.
• 4baa1d9: Mapping a custom domain root to a hosted MCP server no longer adds a second endpoint to it when the server is served at another address, which left later edits to that server failing. The root picker offers a hosted server only when it is already served on that domain.
• cde7a08: A hosted MCP server's own wrapper now takes precedence over other MCP servers built from the same toolset, such as gateway members. Publishing plugins no longer fails as ambiguous for a hosted server whose toolset also backs a gateway member once its network access has been edited. Legacy /mcp/<slug> tool calls are attributed to that server, and admin health counts those calls as its traffic.
• f4fe73e: Saving a legacy toolset no longer fails with a conflict when its hosted address or server slug is already held by another server. The toolset saves and stays in its legacy state; requesting a network access mode in that state still returns a conflict.
• 516a9d3: Exclude toolsets containing platform tools, including MCP-backed wrappers, from automatic plugin distribution. Remove proven automatic memberships when toolset contents change while preserving manual memberships, MCP access, and assistant execution.
• bd286a8: Strip Speakeasy-only headers from upstream interactions with remote MCP servers.
• 02e02cf: Risk events found in a prompt attachment, such as a spreadsheet, now show their context. The risk-only transcript returned nothing for these findings because they belong to the attachment rather than a message; it now windows around the prompt the attachment was sent with, and the finding drawer shows the flagged attachment beneath that prompt. The session's risky-only count includes those prompts too.
• edf9273: Expose validated CEL matching expressions on sensor creation, reads, and updates. Omitted expressions default to user messages.
• 111bf1f: Add Signals intelligence configuration management to the dashboard, with reusable signals, sensor modes, and ordered signal membership. The organization-level signals_intelligence product feature controls sidebar and command-palette visibility and direct page access. Read-only project members can inspect configuration; changes require project write access. Enable the feature in demo and local fixtures. Classification execution remains out of scope.
• 3d9795e: Show matching plugin links on Team Access role rows.