server@2.24.0

Minor Changes

• b9747bb: People can now sign in through a shared authorization server on the authentication host. It serves registration, authorization and consent there, including federated login and connecting upstream services, and its token endpoint accepts the authorization code and refresh token grants. Its metadata and the protected resource metadata of its MCP servers point MCP clients to it, while the IdP and upstream login callbacks stay on the platform host.

• b9747bb: The ID-JAG exchange is now accepted on the authentication host, and an ID-JAG must be addressed (aud) to the issuer the authorization server metadata announces. For an issuer that opts in with use_authentication_host, that is the authentication host issuer rather than the MCP server URL, so update the identity provider's audience when turning the setting on.

• 991d279: Organizations with a verified email domain can enable an internal session issuer through the new internalSessionIssuers API (get, setEnabled, rotate): a permanent issuer URL with a dedicated Speakeasy-managed signing key, routine and compromise key rotation, and a disable switch that keeps the URL. A compromise rotation withdraws every key first, then disables the old KMS versions and, while the organization can still use the issuer, replaces the key, retrying cleanup hourly until it succeeds. Each signed assertion carries an email on one of the organization's verified domains. Expired keys are retired hourly, and the same hourly sweep activates a routinely rotated key once it is ready. Signing can be paused for the platform or one organization with the internal-session-issuer-signing-paused flag, which pauses signing unless it is explicitly and recently off, or GRAM_INTERNAL_SESSION_ISSUER_SIGNING_PAUSED. Rollout is gated by the internal-session-issuer flag. The issuer's keys are never visible to customer key APIs or usable for client authentication. A read-only Platform MCP tool, get_internal_session_issuer, reports the issuer's state and URL.

• f355401: Identity chaining tries a vendor's EMA providers in order until one succeeds. Providers that cannot serve, or that the endpoint's authorization server does not trust, are skipped, and a transient failure is retried briefly before the next provider, all within the request deadline. Organization admins set the order with organizationRemoteSessionIssuers.setEMAProviders (behind the ema-providers rollout); an empty order restores the endpoint's configured external issuer and stays possible with the rollout off. Speakeasy serves only vendors whose order names it, and only while the organization's sign-in enforcement is on. Issuer and identity-chaining reads report the order with each provider's availability.

• ebcffe1: Authorizing an MCP gateway no longer asks you to connect every service before you can approve it. The consent page shows how many of the gateway's servers are connected, a list of those servers, and a Give access button that works before any service is connected. The list opens by default when the gateway has five servers or fewer; longer lists start collapsed behind Show servers. Each server shows its status. A server that signs in through one service has its own Connect or Reconnect button in the list, which goes straight to the provider and returns to the list.

  Each server also has its own connect page, which lists only that server's services and has no separate approval, since connecting is all the server needs. It is where you manage a connected server, and where you connect a server that signs in through more than one service. When a gateway tool call reaches a server you haven't connected, or whose connection was rejected, the error includes a link to that server's connect page, which signs you in and goes straight to the provider. This applies to organization gateways and to gateways built in a project.

• d44bf33: Organization admins can turn the organization gateway off with the organization_gateway_disabled product feature. While it is off, /mcp/gateway/<organization-slug> and its sign-in routes answer 404 from the next request, organizations.getGateway reports turned_off, and the Platform MCP's get_my_organization_gateway tells members to ask an admin to turn it back on. The gateway stays on for organizations that never change the setting.

• 9ca2264: Every organization with one organization-wide authorization server now has an organization gateway at /mcp/gateway/<organization-slug>: one MCP URL that gives each person every MCP server in the organization they can use, across all projects. People sign in with their organization account, and the servers they see follow their access, so a granted or revoked server shows up or disappears on their next request. Servers keep their own sign-ins: the gateway's connect page lists the services behind servers in any project, and a server whose service is not connected yet reports that on its own while the rest keep working.

  The MCP Servers page shows a Connect all servers button with the URL when the gateway is available, organizations.getGateway reports the URL or why there is none, and the Platform MCP's new get_my_organization_gateway tool gives it to members. The delete preflight for an organization-wide authorization server now reports withdraws_organization_gateway when deleting it would take the gateway away.

• 7dd5f51: With directory sync on, a role's page now lists the directory groups and attribute values that give out the role, in place of the read-only member list, with links to IDP and SSO, where mappings are changed. A role nothing is mapped to says so and offers to map a group.

  The Platform MCP's role listing now names each role's directory groups and attribute values too, with how many directory users each matches; small counts are withheld, and a mapping whose group was deleted is flagged as removed.

  An MCP server whose identity is set to Manual now says "Manual" on its details pill, matching the setting, instead of "None".

• ad0aec0: Shadow AI folds into Security and Policy behind the gram-shadow-ai-guardrails flag: a Shadow AI policy in Guardrails with an Access, Scope and Review flow over the organization's whole scan target library, a Shadow AI targets tab, a Watchdog tile and a Risk Events category filter. listAiScanTargets now returns each target's access summary, and the Platform MCP's list_ai_scan_library reports each target's state, decision and rationale.

• edd2b05: Record the sign-in behind each MCP grant and check, before Speakeasy vouches for a user to another service, that the grant still traces to a current sign-in: not revoked, within the method's maximum age of when the user actually authenticated at WorkOS, made with the email WorkOS verified at that sign-in (a later profile email change waits for a fresh sign-in), still a member, not deprovisioned, on one of the organization's verified domains. Sign-ins are recorded only in the organization the user signed in to, and a grant is never minted from a sign-in an administrator, sign-out everywhere or deprovisioning revoked, including one still being recorded when the revocation landed. auth.logoutEverywhere ends every dashboard and identity provider session and revokes the user's sign-ins and the grants made from them; organizations.revokeMemberSignIns revokes a member's sign-ins and grants in the active organization only, and leaves their dashboard sessions alone; removing a member does the same where enforcement is on. Broad revocations also end the member's MCP grants that predate linking. A user's own sign-out is not audited as a member-access change. Revocations reach the token cache and WorkOS through a durable queue retried every five minutes. Making new links, evidence lookups, deprovisioning revocation and both revocation endpoints are behind the sign-in-enforcement flag, evaluated per organization; with it off nothing new is linked; links already made keep being honoured. Once a user has signed out everywhere, dashboard sessions issued before then are rejected whatever the flag says. Existing grants keep working and are simply not linked.

  Which sign-ins can back an assertion now depends on the method, each with its own maximum age: enterprise SSO (7 days); Google sign-in on a Google Workspace account that belongs to one of the organization's verified domains, or Microsoft sign-in on a work account in a tenant the organization pinned (24 hours); magic link (4 hours); and password sign-in, with or without a second factor (4 hours). Google and Microsoft evidence needs WorkOS to return OAuth tokens for those connections. Personal Google or Microsoft accounts never qualify. Every method is allowed by default. Limiting methods per organization and pinning Microsoft tenants arrive with the sign-in settings (AIM-551); until then Microsoft sign-ins do not qualify.

• 578545f: Unproxied MCP servers can now be added with URLs that only resolve or route inside the client's network, such as tailnet or VPN hosts. Clients connect to these servers directly, so Speakeasy no longer looks up or connects to their URL: creating one checks only that the URL is a well-formed http or https address, no default icon is fetched from the vendor's site, and the unused unproxiedMcp.listTools endpoint, which connected to the server to list its tools, is removed.

• 9915940: Warn before changing the user session issuer of an MCP server that already has one. Its connected clients must sign in again, and the new userSessionIssuers.getAttachImpact preview also says when the authorization server clients are sent to changes, so anything configured with it must be updated. MCP server settings now show the issuer URL, token endpoint, and resource of a shared authorization server, and the issuer picker marks issuers that share one.

• b9734d6: Show where a user session issuer's MCP servers send clients to authorize. Issuers now report their authorization server mode (one per MCP server, or one shared by the issuer), whether the shared issuer URL is pinned, and, for a shared authorization server, its issuer URL and token endpoint or why it is not served. Organization administrators can list project-specific issuers alongside organization-owned ones with a tier filter, read any issuer in the organization, and list the MCP servers attached to an issuer. Migration preflights now warn when consolidating changes the authorization server that clients and identity providers are configured with.

Patch Changes

• d0d57c3: Require initial and updated direct agent policy grants to fit within both the configuring person's and current owner's effective permissions. Reject broader grants atomically with safe permission-limit guidance, while retaining independent credential checks and authorized policy deletion.

• bf0d83e: Plugin server entries and MCP install page metadata for a hosted MCP server now return both toolset_id and mcp_server_id, set to the same id, whether the record is stored under the toolset or its MCP server. Callers that read toolset_id keep working once hosted records move to the MCP server key. Remote, gateway and other non-hosted entries are unchanged. Platform MCP plugin reads keep the toolset's MCP slug for a hosted entry stored under its MCP server when the server has no endpoint. addPluginServer accepts an entry echoed from a read, with toolset_id and mcp_server_id both set to the same id. The Plugins page's server filter matches a hosted server whichever id a saved filter names.

• 9e9338d: Behind the hosted-mcp-server-key-writes rollout flag (off by default), hosted MCP plugin entries, install page metadata, and assistant attachments are saved under the toolset's canonical MCP server instead of the toolset. With the flag off, saves keep today's row shapes. Adding a hosted toolset to a plugin (directly, on toolset creation, or when MCP is turned back on) stores the entry under its MCP server. Saving install page metadata moves an existing toolset-keyed record onto the MCP server in place, keeping its id and environment configuration, and drops a duplicate MCP-server-keyed record beside it (the toolset-keyed record wins, as every reader already shows it). Saving an assistant moves its hosted attachments onto the MCP server, keeping their environments, so the assistant's runtime config is unchanged. Toolsets without a canonical MCP server keep the toolset key, and so do assistant attachments to a toolset with MCP off or no MCP slug. The plugin:server_add audit event for a wrapped toolset names the MCP server instead of the toolset. The Plugins page's server filter lists a hosted server once whichever key its entries use.

• ef64cd8: New remote session clients created by Auto-Configure, the install workflow or Platform MCP no longer store a copy of the discovered scopes; each sign-in requests what the MCP server asks for. Dynamic client registration still names those scopes, so providers that limit a client to its registered scopes accept them. Only scopes an operator picks are stored, and saving a client no longer rewrites scopes that were left unchanged. Resource-first scope resolution is now always on, so the remote-session-live-resource-scopes flag is removed, along with the warning that a client's scopes lose to its provider's scope override.

• 1588f36: The consent page no longer blocks "Give access" for MCP servers reached through enterprise-managed authorization. Those services have no token until access is given, so their tools can't be listed beforehand. When every service on the page uses identity chaining, none is connected, and there is no saved tool selection, the Tool access section says that tools load after access is given, and the connection starts with all tools available to the user. If every identity chaining check is refused, approval is blocked again.

• 4129078: Google Antigravity joins the CIMD known-client catalog and the Shadow AI scan target list. Presets-mode issuers now admit its client_id (https://antigravity.google/oauth/client-metadata.json), and device agents now detect the Antigravity macOS app by bundle ID (com.google.antigravity) and the Antigravity CLI by its agy binary and ~/.gemini/antigravity-cli config directory.

• 51e7eb5: The toolset API's MCP hosting inputs are deprecated: mcp_enabled, mcp_slug, mcp_is_public, network_access_mode and custom_domain_id on toolsets.update, plus toolsets.setUserSessionIssuer and toolsets.checkMCPSlugAvailability. They still behave as before for this release. Use mcpServers.update, mcpEndpoints.create/mcpEndpoints.update and mcpEndpoints.checkSlugAvailability instead; note the endpoint check is scoped to one domain and returns true when the slug is available. The OpenAPI document and SDK mark them deprecated, and the server logs a warning with the caller's user agent when a request uses them.

• 8324479: mcpEndpoints.update can now change the address of a hosted MCP server's endpoint. It applies the same rules as changing the toolset's MCP slug or custom domain and keeps the toolset in sync. Creating a second endpoint for a hosted server, or deleting its endpoint, is still rejected.

• 156ba4c: mcpServers.delete on a toolset's own hosted MCP server (id equal to the toolset id) now disables it through its backing toolset, as turning MCP off on the toolset does, instead of rejecting the call; other toolset-backed servers are still deleted. The server stays listed as disabled and keeps its endpoint, so it can be re-enabled at the same address; a custom domain root is released as on any disable. The server page no longer offers Delete for hosted servers.

• 3b1cc16: mcpServers.update accepts hosted MCP servers: name, visibility, user session issuer, tool filtering group and network access mode are written through the backing toolset, so the toolset and the server stay in step. Toolset updates no longer touch a deleted toolset that shares the slug. The server page keeps a hosted server's visibility controls (status, availability switch, Danger Zone) read-only, and the command palette re-enables a public hosted server as public.

• 855faca: Migrating an organization's user session issuer now moves each hosted MCP server through its toolset, like a toolset save, and records the server change in the audit log. A hosted server that has drifted from its toolset keeps the previous issuer-only update, so the migration never changes a server's URL, name or plugin entries.

• b9747bb: Federated login now completes for MCP servers whose issuer opts in with use_authentication_host. The browser stays bound to the consent page on the authentication host, upstream logins return there, and sign-ins started on the MCP host, such as connecting from the dashboard, move to the authentication host first. A sign-in in progress when an issuer turns use_authentication_host on or off must be restarted.

• 5b0bcf4: On the consent page, a service connected through identity chaining that connects once access is given now reads "Automatically connects when you give access" instead of "Ready to connect after authorization".

• 5b0bcf4: On the consent page, when tools load after access is given, the button that loads them now reads "Load tools" with a short explanation, instead of "Retry", which looked like an error.

• 9d280a0: Identity provider setup failures now name a next step — wait and retry, verify a domain, or contact support — instead of a generic "failed to generate WorkOS admin portal link". The setup wizard also says when it could not read your setup status, rather than showing every step as not set up.

• 3d95f68: After a compromised-key replacement, the issuer's JWKS shows the new key on every server within about a second, and a vendor's rejection of an assertion signed by a recently published key is no longer cached. When every EMA provider fails and one asks for reauthentication, the client gets the reconnect challenge. Sending more than 10 EMA providers returns a readable error.

• 0d64dd8: Sign-ins through a gateway now request the scopes of the member MCP server the connection is for, discovered the same way as a sign-in to that server directly, instead of falling back to the identity provider's whole scope list. As with direct sign-ins, the member's scopes now take precedence over a provider's scope override. The consent page shows the same scopes.

• 9238b7f: Add -move-dependents to the hosted MCP wrapper backfill. It re-keys toolset-keyed MCP metadata and plugin members onto each toolset's canonical MCP server in place, and moves assistant toolset attachments to assistant MCP server attachments under the same id. When a server-keyed twin exists, the toolset-keyed row wins: the twin is removed in the same transaction and its full contents are recorded for rollback. Rows whose toolset or project is deleted (orphaned) and assistant attachments the assistant runtime does not dial are reported instead of written. Applying it requires -report and -readers-cut-over, which confirms AIM-16 phase A (dual-key readers) and phase B (writers switched to the server key) are both fully deployed, and writes a journal entry per row, synced before each commit.

  Every -apply now refuses an existing report path. The backfill stops on transient database errors instead of reporting them as Sync refusals, and records its audit entries without publishing audit webhook events. Audit loggers accept audit.WithoutOutbox() for operator backfills.

• 547c8c3: Prompt injection policies keep the production prompt-injection detector when an organization runs the fine-tuned risk model, in every engine mode; the model's prompt-injection verdict is recorded for comparison only.

• 2f329a3: An organization admin who signs in to an organization that already exists from another Speakeasy product now starts the same 14-day enterprise trial as a new signup. Those organizations previously stayed behind the book-a-demo gate, because a trial was only armed when the account had no organization yet. A member cannot start the trial. An organization that already has a trial, is on a paid tier, or was created as a prospect still follows its existing path.

• f82dc6f: Add storage for Speakeasy sign-ins and link MCP grants to the sign-in that created them, so revoking a sign-in can revoke its grants.

  Also record the evidence that decides which sign-in methods may back a signed assertion (the social identity provider's managed domain and tenant), and let each organization limit those methods on its issuer. Sign-ins also keep the email WorkOS verified and when the user actually authenticated, issuers can pin Microsoft tenants, and revocation deliveries gain leases and backoff.

• 991d279: Organization admins can enable Enterprise Managed Authorization from Speakeasy's own page under IDP and SSO › Identity providers. Its card there summarizes the issuer's status and URI and opens the page, which has separate sections for status, the issuer URI to register with supported services, signing keys (rotate the key routinely, replace a compromised key, or finish setting up a new one after a key was withdrawn), and disabling it with an explanation of the effect. If a replacement key can't be set up, the page says so instead of reporting success. The issuer now also checks that it belongs to the deployment serving it before it signs or can be enabled. Audit log entries for the issuer and its keys link to the Speakeasy provider page, and the page keeps checking for a rotated key's automatic activation.

• efe468a: Remote MCP sign-ins no longer add openid, email, profile and offline_access to scopes an operator set. A client's scopes, a pin on an MCP server and a provider's scope override are requested exactly as set. A scope set an MCP server challenges with gains only the standard scopes that server advertises, and advertised scope lists are requested as published. Providers that advertise those scopes but refuse them for a given app no longer fail sign-in with invalid_scope.

• c30c169: Bound workload operations by the assigned agent owner's live permissions, in addition to the session's approved access and the agent's current policy. Existing workload sessions and configured Assistant triggers lose access when their current owner loses permission; restoring permission cannot exceed the session's approved access or the agent policy.

• 3d95f68: The Platform MCP get_xaa_readiness tool lists a vendor's EMA providers in order with each one's availability, and reports identity-chaining readiness for vendors whose order names the Speakeasy issuer and for organizations without an Okta connection while the ema-providers rollout is on. Okta resource connection details are still reported when every provider is external and the organization has an Okta connection.