server@2.26.0

Minor Changes

• 12dd47d: Accept Agent Hooks Protocol attachment uploads at /ahp/uploads. Text attachments referenced by inbound user messages are stored as prompt attachments, the same way as attachments captured from other harness hooks.

• ac8cb8e: Extend Agent Hooks Protocol content enforcement beyond tool inputs and user prompts. Compatible clients can withhold unsafe tool results and model responses through replacement effects, and enforce additional content boundaries using their advertised capabilities. Observation-only clients continue to capture events without blocking or replacing content.

• 43ef3f2: Add an Agent Hooks Protocol endpoint at POST /ahp. Harnesses that speak AHP can send tool calls, user prompts, and session lifecycle events with a hooks API key. Speakeasy policies can deny tool calls and prompts the harness intercepts.

• a539ae0: MCP servers returned by mcpServers.get, mcpServers.list, mcpServers.listForOrg, mcpServers.create, mcpServers.update and remoteMcp.createServerAndMcpServer now carry a toolset summary for hosted servers (id, slug, name, configured tool count excluding external MCP proxy tools, tool selection mode, external MCP slugs, whether the server is proxy-only, external OAuth server, and registry specifier), the primary_endpoint_id and primary_endpoint_url of the address that stands for the server, and the platform_endpoint_slug of its oldest platform endpoint. Custom-domain endpoints count only on a verified, activated domain. List endpoints load these in two batched queries regardless of page size, and listForOrg fills them only for servers the caller can read. If these details cannot be loaded, reads still succeed without them.

• 57c0a7c: Directory role mapping saves now replace a source's complete role set atomically, preserve unchanged mappings, and audit added and removed roles separately. An empty set removes all mappings for that source. Older dashboard clients retain a compatibility endpoint that cannot overwrite an existing multi-role set.

• ebe489d: Choose Direct or Progressive tool discovery for a gateway, with optional connection overrides in consent and Inspect. Existing connections follow the gateway default unless they choose a mode explicitly.

  Organization gateway connections can choose a mode at sign-in too; they default to Progressive. Organization gateway servers are named by their slug, with the project prefixed only when two projects share a slug.

  Discovery modes are available to every organization.

• 153f30a: Staff can migrate MCP servers that still proxy an external MCP attachment from a new External MCP migration page in the admin dashboard. Each migration switches the server in place to a remote MCP server on its existing sign-in provider, so it keeps its ID, address, plugin entries and access grants, and signed-in sessions keep working. Stored header values are copied to the remote server, and headers that clients send are passed through unchanged. The old toolset is disabled, not deleted. Servers whose setup cannot carry over are listed with the reason. A preview runs every step and rolls it back first, and no sign-in provider or client is created. The page can be filtered by organization and project.

• a6fea10: Organization administrators can find one member through the Platform MCP by their complete email address, so their MCP access can be checked even when fewer than five members match the search. Partial searches that match fewer than five members stay hidden.

• 46ea2c4: The Platform MCP can now create gateways and set their members. create_gateway creates a private gateway with its default address and an ordered list of member MCP servers in one step, and set_gateway_members replaces a gateway's members with an exact ordered list. Both apply all their changes together or none: a server that cannot sit behind a gateway is named with the reason.

• af8d5e3: The consent screen tool picker is now available to every organization, so the "Tool filtering on consent screens" setting and the consent_tool_filtering product feature are removed. Stored tool selections are still enforced.

Patch Changes

• 23b1010: Add a guarded staff Admin MCP proposal for adding a new MCP server to the registry, with schema validation, a full-record approval preview, duplicate-name checks at prepare, approval and execution, and a receipt that commits with the entry. Drop the outdated note that customer catalog reads still use Pulse from the admin registry pages.
• 23b1010: Add a staff Admin MCP tool that returns an upload URL and a single-use upload token, sent as an Authorization header, for publishing an image as a public Speakeasy asset, for example a registry entry icon. The PUT response gives the asset's public URL. Only PNG, JPEG, GIF and WebP up to 4 MiB are accepted, detected from the file bytes.
• 56ac009: Add "Open in Stripe" links beside the Stripe customer ID and Stripe subscription ID on the admin organization record. They point at the live or test Stripe dashboard to match the admin API's Stripe key, and are hidden when no Stripe key is configured.
• 8e35762: Attaching a toolset whose hosted MCP server is turned off to an assistant now requires mcp:write on that toolset, since attaching turns the server on. Toolsets whose MCP server is already on still only need mcp:connect. Toolsets already attached to the assistant are left as they are on update: they are not turned back on and need no extra permission.
• 39c5f57: Refreshing an MCP grant no longer asks for a reconnect when identity chaining serves the upstream. Such grants have no interactive upstream session, so refresh used to fail with invalid_grant once the access token expired. Refresh still asks for a reconnect when chaining does not serve the upstream, or when stored state confirms that a fresh sign-in repairs it: the human's retained sign-in can no longer be renewed, or it predates the current identity provider registration. Refresh also asks for a reconnect right after the identity provider definitively refused chaining, and a tool call that hits such a refusal while a linked upstream session needs reconnecting answers with the reconnect challenge instead of a 403, so the consent page can offer a separate sign-in. Anything refresh cannot confirm lets it proceed: failed reads, an upstream whose discovery is not cached, a Speakeasy issuer that is paused, keyless or whose readiness or sign-in enforcement could not be read, and configuration problems that only an administrator can fix.
• 522aed4: Log each bearer accepted on the legacy toolset audience with its issuer, slug, and project, and count shared authorization server and organization gateway lookups that reach the legacy MCP slug fallback under their own entry points.
• bf35058: Dispatch batch-only risk scanners through Pub/Sub analysis handlers so their findings reach ClickHouse with stable identities. Keep inline Postgres analysis while applying category scopes before dispatch.
• cf69e15: Risk finding dismissals now use ClickHouse as their source of truth while preserving Postgres compatibility and audit records. Finding-created webhooks can cut over per organization to the ClickHouse writer without duplicate customer deliveries.
• 84b11ec: Route batch prompt-injection and prompt-policy judges to analysis handlers for organizations on the ClickHouse risk-findings cutover, avoiding duplicate judge spend and metering.
• 6a87c5a: Risk exclusion suggestions, grouped chat results, and flagged session recall now read live findings from ClickHouse. Recall rebuilds match spans from source content so masking remains fail-closed during cutover.
• d94f984: Improve chat risk counts, filters, findings, and detail views so they consistently reflect current risk findings.
• b66dd83: Anthropic inference hook verdicts now fit Anthropic's default 5-second timeout, and long conversations no longer time out on every turn while older content is rescanned.
• c354dad: Risk findings now honor disabled rules, built-in presets, and detection scopes consistently before storage. Transient Presidio analysis and finding delivery failures are retried instead of being silently dropped.
• 5772ad0: Assistants no longer fail to respond in Slack when the person who mentions them has many permissions. An assistant's permissions for a turn are now checked against the current permissions of the assistant, its owner, and the person it acts for on every request, so a permission someone loses also stops applying to assistant turns already in progress.
• ead238e: Remote Identity Providers are now called Authorization Servers, matching what they are: the upstream OAuth servers where each user signs in so an MCP server can act for them. The organization page, an MCP server's Authentication settings (formerly Connected services), the attach, modify, and remove sheets, and the Service Account picker all use the new name, and the field's hint now explains what an authorization server does instead of calling it rarely needed. Platform MCP's setup guidance uses the same name, and an authorization server it attaches is named "Authorization server".
• 3e95e3f: Expose an organization's available MCP gateway URL in the existing device-agent policy response.
• be7de1d: Allow a directory group or attribute value's role set to keep a mapping to a role that has since been deleted, so adding another role to that source no longer fails. Deleted roles still cannot be newly mapped and continue to grant nothing.
• 228d54b: The analytics catalog no longer offers a sessions dataset. Explore, widgets and the Platform MCP analytics tools ask about tool calls and skills.
• 8d1de47: Turning identity chaining on now records the server connection's scopes on the binding: what an interactive sign-in through the selected client requests for that server (the client's scope, the resource's challenge or pinned scopes, or what the resource and its authorization server advertise). The set is recorded whole, sorted: identity chaining drops OpenID Connect scopes from its request, and when that leaves none it still rejects an ID-JAG naming a scope outside the recorded set. Existing bindings are unchanged until identity chaining is prepared again with prepareEMA. prepareEMA records its scopes only when the client is not linked to the user session issuer, no single remote MCP server signing in directly through that issuer serves the resource, or the connection names only OpenID Connect scopes while the request names others; they are still what a DCR registration asks for, and an ignored value no longer changes the binding's generation or audit history. With neither naming a scope, nothing is recorded and identity chaining requests no scope, as before. A gateway member qualified through a different sign-in issuer is not resolved, so its binding records the request's scopes. readEMA, prepareEMA and Platform MCP's get_xaa_readiness also report the connection's current scopes and whether they differ from the recorded ones, and the Okta resource connection view reports the recorded scopes for a bound server.
• a7351ff: Adds organizationRemoteSessionIssuers.listEMAServices, which lists every service Enterprise Managed Authorization reaches in an organization. Each entry has the identity providers the service accepts, when it last accepted each one, and the MCP servers that reach it with their status and sign-in identity provider. Servers the caller can't read are counted, never named. readEMA, getIssuer and setEMAProviders report when the service last accepted each provider. setEMAProviders takes an optional expected_providers and fails with conflict when the saved list has changed. Speakeasy now vouches only for servers on Speakeasy's own sign-in; on a server whose sign-in goes through an external identity provider it is skipped as not_trusted_by_endpoint. Platform MCP guidance describes which identity providers a service accepts. With no saved list, a vendor reached from a server on Speakeasy's own sign-in now defaults to the Speakeasy issuer, where before only a saved list naming it did; the internal-session-issuer rollout gates this default, and ema-providers gates only saving a list.
• 7744525: The consent page now runs the live identity chaining exchange for Speakeasy-issued sign-ins, as it already does for external identity providers. A service that accepts the user shows "Connected through your identity provider" before approval, and one that refuses them shows the refusal and blocks "Give access" instead of failing on the first tool call. An ambiguous refusal of a signed assertion right after a signing key is published reads as neutral, since the service may not have fetched the key yet; configuration, client and scope refusals still block. The credential obtained on the consent page belongs to that sign-in, and any grant backed by the same sign-in reuses it on first use instead of signing a second assertion. Approving before the check finishes keeps the earlier behavior: the first tool call runs the exchange. Revoking the sign-in, rotating the issuer key or changing the binding before approval leaves the credential unused, denying consent erases the credentials stored at that moment, and a consent check never replaces another grant's or another sign-in's stored credential. Reloading the consent page does not redeem again.
• 1881ba7: Stop the local billing stub from promoting new organizations to legacy Pro.
• 0cea169: Deleting a toolset whose MCP server was moved to a remote MCP server now succeeds and leaves that server, its address, plugin entries and access untouched. It previously failed with "hosted MCP identity belongs to another server".
• 0cea169: The External MCP migration page now lists every toolset still backed by an external MCP attachment, including ones to delete: toolsets with MCP off and no server, toolsets whose attachment is no longer on the active deployment, toolsets that proxy more than one upstream, and toolsets that were already migrated. Staff can delete those from the page, with the same preview first; deleting removes the toolset with its server, addresses and plugin entries, and leaves an already migrated server untouched.
• 0cea169: The External MCP migration page no longer blocks servers that have no sign-in provider, whose sign-in provider has no upstream client, that use an OAuth proxy or an external OAuth server, that serve other tools, or whose users send their own headers. Those servers now migrate: an OAuth proxy, an external OAuth server and any other tools are dropped, and the page shows each one as a warning before the migration runs.
• 0cea169: The External MCP migration page now lists and migrates servers built from individually picked external MCP tools, not only servers that proxy a whole external MCP server. Each one switches to a remote MCP server for the same upstream.
• df74672: The platform hosts now answer /.well-known/openai-apps-challenge with the token set in GRAM_OPENAI_APPS_CHALLENGE_TOKEN, so the Speakeasy Platform MCP can pass OpenAI's app directory domain verification. Without the token, these hosts still return not found. Custom domains are unchanged.
• 89e2130: The organization MCP gateway now lists only servers you can actually use: servers that need no sign-in, servers already configured with credentials, and servers you can connect from the gateway's sign-in page. Servers whose authentication the gateway cannot provide no longer appear on the consent screen or in list_servers. Servers built on a toolset that has its legacy MCP endpoint turned off no longer fail with "not currently servable" when described or called through the gateway.
• e1771b5: The organization MCP gateway no longer lists servers built on toolsets that contain platform tools, such as the tools assistants use. These servers were already left out of plugins added automatically, and the gateway now follows the same rule. Assistants and direct MCP connections keep access to them.
• d910a2d: The Platform MCP install for Claude Code starts with the /plugin marketplace add and /plugin install commands again. The next step shows how to turn on auto-update: with /plugin → Marketplaces → Enable auto-update for yourself, or with a managed settings snippet for your whole organization. The Headless walkthrough and the public marketplace README both use this order.
• e6c8e50: Tool call and skill charts read a per-call table instead of re-sorting every event in the window, so dashboards like MCP & Tools load without running ClickHouse out of memory.
• 0560be0: Remove the retired Fly.io assistant runtime backend and configuration. Assistant runtimes now default to GKE, with local Docker support retained for development. Speakeasy Functions remain on Fly.io.
• f06dde6: Retire the Risk Overview page. Old links to it now open Watchdog.
• 81a16a9: Under the shadow risk engine mode, realtime enforcement no longer waits for the fine-tuned risk model: the legacy engines answer and the model's verdict is compared when it arrives. Under the llm mode the same applies when no policy enforces from the model and its verdict is only compared.
• 33d3bcf: Record explicit evaluation triggers, manual run identities and stable request timestamps in sensor readings and outcomes. Write results to run-scoped ClickHouse storage with request-time retention and seed examples of independent manual runs.