server@2.29.0

Minor Changes

• 8b2d0e2: Staff can store an Adoption Dashboard Link on an organization's overview in the admin dashboard. The link must be https, is cleared by saving an empty value, and is returned by the organization record and the staff Admin MCP organization summary.

• 9dd6775: The Platform MCP can now serve a small discovery surface to hosts with tight tool budgets, such as Codex Agent Plugins. Callers in the treatment see search_platform_tools, describe_platform_tool and call_platform_tool, plus execute (Code Mode) when the organization has Code Mode. Every Platform tool stays reachable through them with its usual authorization, confirmation and audit rules. A PostHog multivariate flag picks the surface per harness; callers outside it keep the full catalogue.

• 4ac5c1a: "All servers" in the new agent identity flow, and when editing an agent's servers, no longer ends in "requested agent access exceeds your permissions". The option is offered only when you, and the agent's owner, can reach every server in the agent's project. Otherwise it stays off and says why, and you choose the servers one by one. A server you can see but cannot connect to is marked the same way, and "Select shown" leaves it out. The new agents.checkPolicyGrants endpoint answers whether policy grants could be written, using the same rule as agents.create and agents.createPolicyGrant, and writes nothing.

• 4559629: The device agent can now show which MCP servers a person still needs to sign in to. agent.getMyConnections reports the enrolled user's sign-in state for each MCP server in their plugins, with a link that signs in to it in the browser (or, when the user lacks access, a link to request it), and each server listed by agent.getPlugins now carries a stable id shared across plugins.

• 555b83e: Organization admins can decide who may use each auth client: Use grants permission to use the client and Blocked takes it away, on every server that offers the client. Rules on personal clients never let anyone use another person's connection. Admins can also replace an existing API key's own policy with keys.updatePolicy, and a key's policy can only name auth clients and projects in its own organization. Both changes are recorded in the audit log.

• 6b409a8: Organization admins can list the auth clients Speakeasy uses to reach upstream MCP servers, see which servers offer each one, rename, enable or disable a client, and stop a server offering it. Each server now states whether its upstream needs authentication, so a server that needs it but offers no enabled client reads as incomplete setup rather than as needing none. Stored header values are never returned, and every change is recorded in the audit log.

• 1778326: The Platform MCP get_mcp_connection_settings tool now reports whether an MCP server's upstream needs authentication and which auth clients it offers, and get_mcp_access reports whether each role may use each shared credential the server offers. Staff server-health inspection lists a server's auth clients and its upstream authentication state, without names or header values.

• c1a55fb: People can block one agent from their own upstream connection without managing the agent, and agent managers can add auth client restrictions to an agent's policy. Only the person who set a connection block can remove it.

• 276e173: GKE is now a workload identity option when creating an agent. The setup trusts one cluster by its project, location and name, admits one namespace and service account on it, and gives the pod manifest and token exchange the workload needs, with no secret stored in the cluster.

• cbea82c: A legacy hosted toolset's /mcp/<slug> alias now follows the endpoint that holds it: renaming that endpoint moves the alias, and deleting it moves the alias to the server's platform endpoint, else its oldest one. A hosted server's slug no longer follows its endpoint, so look a hosted server up by its endpoint slug, not its server slug, after an address change. Visibility and the session issuer are no longer copied onto the toolset. Name and tool variations stay toolset settings: mcpServers.update still writes them to the toolset, and the server mirrors them.

• cbea82c: A hosted MCP server can now have several endpoints. mcpEndpoints.create adds one under the hosted address rules, and mcpEndpoints.delete removes one; an enabled hosted server cannot lose its last endpoint that can serve, so disable it first. Deleting an endpoint left on a deleted or unverified domain is always allowed.

• 15808f5: Tool usage queries accept mcp_server_ids and return mcp_server_id on hosted server options, targets and traces. Calls recorded before hosted servers stamped a server id still match. hosted_toolset_slugs keeps working and is deprecated.

• 10daa1a: Remote session clients on an organization's authorization server can be duplicated from the Clients list or the client's detail page. The copy keeps the original's settings and, by default, its client ID and secret, or registers a new client with the authorization server when it supports dynamic registration. A client metadata document client gets its own document. The copy opens for editing right away, and MCP servers keep using the original.

• a22772c: Administrators can now correct a remote session client's client ID in place instead of deleting and recreating the client. A corrected ID revokes the sessions obtained through the old one, so users reconnect once. Clients can also be given a display name; a client without one is shown by its client ID.

• 5297c22: People can hide gateway MCP servers they do not use. Hidden servers leave the gateway's tools, list last on the consent page with a Show button, and are readable and settable through the hiddenMcpServers API.

• b3e6186: A project's first enabled approval policy now gives it an approvals server, the MCP server agents call request_approval on. Speakeasy creates it at <org>-<project>-approvals, adds it to the Default plugin as speakeasy-approvals and republishes the plugin, so agents that use the Default plugin can request approval without extra setup. The server has its own sign-in issuer: developers in Claude Code or Codex sign in with their Speakeasy account and request approval as themselves, while agents with a key keep using the key. A held call names this server's URL. The policy editor says where the server went, the server shows as Built-in on the MCP and plugin pages, and policies and gateways cannot include it, because the gateway serves it before any policy runs.

• 4cd0996: Discover advertised OAuth registration and Client ID Metadata Document support during staff catalogue review. Preserve bounded public capability evidence in approved promotions and setup-guide requests, and distinguish unknown authentication evidence from manual setup in catalogue APIs.

  Catalog setup badges and filters distinguish automatic, manual, and unknown setup. CIMD-capable entries use the existing automatic OAuth installation flow.

• 05e84c0: Allow staff to explicitly promote remote MCP servers despite health eligibility criteria through the admin dashboard and Admin MCP, recording the override in the audit log. Run automatic eligibility reviews weekly while keeping setup-docs delivery hourly. Exclude matching catalogue URLs from discovery and the default promotion queue and notify staff after rejection, archival, and restoration.

• 55a8f1f: The device agent shares the hidden MCP server preference with the gateway consent page. agent.getMyConnections reports each server's hidden state, and the new agent.hideMcpServer and agent.unhideMcpServer set it, so hiding a server in one place hides it in the other.

• e94ce5d: Add Code Mode discovery for MCP gateways. A single execute tool runs ephemeral Python with tool search, schema descriptions and live authorized calls to hosted, remote and tunneled tools. All tools (frozen) and Specific tools reuse the catalogue fixed at consent from a fast cache; All tools (live) refreshes only approved members. Adding a member requires new consent. Settings, consent and Inspect support connection overrides, execution results and nested-call outcomes.

  Organization gateway connections can choose Code Mode on the consent page too, searching and calling approved tools across projects the person can reach.

  Code Mode is off by default and rolled out per organization: Speakeasy staff enable it from the admin dashboard's organization Features page. New selections also require a configured code runtime.

  Assistant runtime discovery skips terminating sandbox pods when selecting a running pod.

• a232676: Add a shared Connections view for project and Organization Gateways, with organization-wide upstream visibility, identity search, server/provider association filters, creation dates, and authorization ordering. Apply filters before cursor pagination and support loading subsequent pages and retrying errors on gateway and provider-client session lists. Expose upstream authorization deadlines separately from access-token and refresh-token expiry.

  Add administrator session inspection through Platform MCP and Command K navigation to gateway connections and client registrations. Refresh relative date filters and include entire selected calendar days.

• 85067d5: Choose All tools (live), All tools (frozen), or Specific tools when approving a gateway connection. Frozen and Specific tools stay fixed at consent and are served from a fast cache, so tool access is much faster; live discovery refreshes tools from the approved member servers. Adding a member or connecting a previously unavailable server requires new consent. Calls execute live and re-check access.

  The organization gateway offers the same tool picker, across every project the person can reach.

• 34b8d5b: Hosted MCP servers are managed on the MCP server page: Tools, Resources and Prompts tabs, per-tool Team Access, and hosted Settings sections (tool selection mode, environment variables, server instructions, export). Old toolset page links redirect to the matching tab of the hosting server's page. MCP server reads name a toolset's hosting server in the toolset summary.

• 20eabcd: Hosted MCP servers now write their own hosting state, and the toolset's hosting fields mirror it. This is an API change: toolsets.update rejects mcp_enabled, mcp_slug, mcp_is_public, network_access_mode and custom_domain_id with a bad request error, toolsets.checkMCPSlugAvailability is removed, and toolsets.setUserSessionIssuer is deprecated: it now writes the session issuer through the hosted MCP server, answers with Deprecation and Sunset headers, refuses to unlink an issuer that identity-chaining bindings depend on (409), and will be removed on 2026-11-25. Use mcpServers.update for visibility, network access and the session issuer, and mcpEndpoints.update to change a hosted server's address. To detach a session issuer from a hosted server, set clear_user_session_issuer on mcpServers.update. A hosted server keeps a single address: mcpEndpoints.create adds one only to a hosted server that has none, for example after its custom domain was deleted, and a hosted server without an address cannot be enabled. New toolsets get their MCP server and a platform endpoint at creation.

• 20eabcd: mcpServers.update accepts clear_user_session_issuer to detach a server's user session issuer, for hosted, remote, tunneled and unproxied servers, whether the issuer belongs to the project or the organization. It cannot be combined with user_session_issuer_id, and is refused while identity-chaining bindings in the project depend on the issuer. Saving a remote or tunneled server without an issuer mints one only when the request switches it onto a new remote or tunneled backend, from another remote backend or from a toolset or unproxied one; saving it on the same backend keeps it without an issuer.

• d586069: The Platform MCP setup-guide search tool is now search_speakeasy_docs (was search_gram_docs), and setup guide resources use speakeasy://platform-mcp/setup/... URIs instead of gram://. Hosts that see only the Platform MCP discovery tools are now told to answer how-to and setup questions with search_speakeasy_docs and cite the pages it returns.

• bf9c972: Plugin assignments now carry an install mode for the device agent: required (installed, can't be turned off), default (installed, can be turned off) or available (off until the user turns it on). setPluginAssignments accepts install_modes per principal URN and keeps a principal's current mode when it is omitted. agent.getPlugins returns each plugin's install_mode, resolving overlapping assignments to the strictest mode, plus its display name and description. The observability plugin is always required.

• 640af79: Explore has a risk_findings dataset, so widgets and dashboards can count what the risk policies caught: by category, rule, detector, severity, policy, agent, team and person. It answers counts only, never individual findings, and leaves out the matched values and the chats they came from. Like the rest of the risk surfaces it is for organization administrators: describe lists it to them alone, queries, value lists and widget saves refuse anyone else, and a shared widget over it tells other viewers it is for org admins instead of reading as broken. A Speakeasy-built "Security & risk" dashboard shows findings, high and critical findings, people affected, findings over time by category, top rules, and findings by agent, person and policy. The Platform MCP analytics tools follow the same rules.

• 1ca6078: Add risk.listApprovals, risk.getApproval and risk.decideApproval for tool approval requests. Org admins see every request; other members see the requests they can approve and their own. Only a listed approver, signed in to the dashboard, may decide, and never the person who made the call. Requests and decisions are recorded in the audit log, and creating approval policies is gated behind the risk-tool-approvals flag.

• 0442db1: Query Signal Intelligence through the shared analytics API and Platform tools with explicit matching rules, arbitrary attribute breakdowns, complete time series, and inspectable measurement definitions.

• 68a05bc: Find signal patterns across conversations with exact session breadth, top-session concentration, separate message/session co-occurrence denominators, and qualified previous-window comparisons. Dashboard and Platform MCP share the same measurements and permission-checked supporting references.

• 1e93dfa: Send tool approval requests to approvers as Slack DMs. Each approver on the policy, with roles expanded to people, gets a message from the Speakeasy app with the tool, the agent's reason, each redacted argument as its own field and Approve once and Deny buttons. A click goes through the same approver check as the dashboard, and every DM shows the outcome once the request is decided or expires. New Slack installs ask for chat:write; workspaces installed before it report it under missing_scopes, and the Slack workspaces page asks admins to reinstall. Approvers can always decide in Speakeasy. mise run zero:slack connects a Slack test app to the local organization. Behind the risk-tool-approvals flag.

• 5191698: Tool logs now show who an agent acted for. An agent call made on a person's behalf reads "agent ↳ on behalf of ", and filtering by that person includes the agent calls made for them. The new agent_ids filter narrows those to one agent. Calls recorded before this change show the agent alone.

Patch Changes

• 4ee1ad2: Browse and search the enabled staff Admin MCP tools on the setup page before connecting a client, with descriptions and access labels for reads, approval flows, and direct writes.

• f2793e3: The admin server now reads the upstream client selector write flag from PostHog, the same way the API server and worker do. Before this, admin actions that write upstream client selectors were always refused.

• ae42165: Platform MCP install instructions, member connection status, the plugin device agent link, and the organization gateway URL now use the organization's stored default platform host, which is the host the dashboard shows. Without a stored host, they follow the platform host the request arrived on, so the device agent link now also follows that host instead of always using the configured dashboard URL. Requests through a custom domain or private network keep the configured URLs.

• f8ff593: Generated plugins now use the organization's stored default platform host, the host the dashboard shows, for MCP server and gateway addresses, the observability plugin's server URL, and the Codex telemetry endpoint. Organizations without a stored platform host keep the configured server URL, and custom-domain and private-network addresses are unchanged.

• 6767be8: An agent using a personal upstream connection a user attached to it is now checked against that connection's owner when upstream auth is enforced, and the authorization shadow records the check instead of skipping it. The owner comes from the same exact, tenant- and sign-in-scoped attachment that serves the token, so a revoked, deleted, reconnected or out-of-scope attachment still names nobody and is refused. Ownership only narrows the agent's grants: a connection attached by anyone other than the user the agent represents is still refused, and the token served must come from the connection the check was decided for.

• 1085b08: Agent identities can use personal OAuth connections assigned by their owner or another authorized editor. Editors can attach only their own connections, remove another member's assignment, and explicitly replace it with their own. MCP client authorization alone does not grant permission to change connections.

  Servers appear in one list ordered by recent tool activity, with shared access labeled separately. Assigned connections show whose account is used. All servers preserves valid assignments and names servers without an available connection. Expired assignments are flagged in the agents list and overview and can be refreshed by their account holder. Agent gateways resolve each server's assigned connection when executing tools.

• 08b63be: An agent's owner can now see the sessions their agent produced. Without chat:read, Agent Sessions lists your own sessions plus those of agents you own, and you can open them, but deleting one still needs chat:write. chat.list accepts an agent_id filter. The agent page's Overview and Sessions tabs list the agent's recent sessions and link to Agent Sessions filtered to that agent. The list of clients signed in as the agent is now labelled MCP connections.

• 62405e3: Advertise authenticated AHP subscription defaults through hooks/configuration. User messages and tool requests use interceptors with a ten-second timeout and the organization's current fail-open or fail-closed setting. Session, turn-end, model response, and tool result events use observers. Both modes request body content.

• 17bd3bf: Include authenticated attachment upload defaults in AHP configuration discovery. Advertise the validated request-origin upload URL, a ten-second timeout, and a 1 MiB limit without exposing credentials. Discovery clients must authorize the upload destination before forwarding their configured transport headers.

  Preserve configured server URL path prefixes for uploads. Report unavailable staged attachment evidence as a backend error so fail-closed clients cannot mistake a partial or empty scan for success.

• 5c7b1ba: Adds a table recording the default auth permission grants the backfill provisions, so a rerun never restores what an admin removed and a rollback removes exactly what was provisioned.

• 0908c44: Organizations can now be granted the default auth permissions the mandatory auth client check needs: everyone's and each agent's use of their own personal connections, shared clients for whoever can connect to a server using them, and a policy for each legacy API key that has none. An offline backfill grants them for every organization and records each grant it writes, so a rerun never restores one an admin removed; the upstream OAuth migration grants them for the clients it records, and new organizations start with the personal default. Role permission counts no longer include these provisioned permissions.

• 1e6f4ec: Agent keys, agent sessions and workload sessions whose stored policy predates version 5 are read at admission with an auth client ceiling over every client in the project of each server they can connect to (the whole organization when that access names no project), still bounded by the agent's, owner's and authorizer's live permissions. Nothing changes for requests today; the mandatory authorization shadow now evaluates these credentials as the upcoming auth client check will, and labels them legacy_auth_ceiling. Nothing is re-issued.

• bfdbb69: Adds a table recording which agents a person has blocked from their own upstream connection, so they can later remove only the blocks they wrote.

• c1a55fb: The default auth permission backfill now gives each attached agent permission to keep using its owner's connection, and lists attachments it cannot carry over so their owners can reconnect or configure the agent.

• c1a55fb: Auth client grants can name an upstream OAuth client with upstream_client, so one restriction covers a person's connection across every auth client that shares it.

• c1a55fb: New sign-ins, ID-JAG exchanges, workload grants and dashboard-minted sessions now record which typed auth client serves each MCP server they reach, alongside the upstream OAuth client they already record, so credentials issued after the upstream OAuth migration stay covered without another run. Choices several auth clients could serve are still recorded without one and reported by the migration. How requests authenticate upstream does not change.

• 1f6f513: Adds tables recording, per assistant, trigger and execution context, the versioned set of upstream auth client choices its turns use.

• c7d8212: Assistant turns now bind a versioned execution-selection profile that records, for each MCP server the assistant reaches, which typed auth client its turns use, kept separately for turns run for an identified user and turns run as the trigger's workload. A server several clients could serve, or only a personal connection could serve on a turn with no user, is reported instead of guessed. The upstream OAuth migration records profiles for every assistant trigger and reports what still needs configuring. How turns authenticate upstream does not change yet.

• 2ec5a32: Staff can now turn on upstream auth enforcement per organization from the upstream OAuth migration page, and only once its auth clients, credential choices and assistant profiles are recorded. Under enforcement each request is served with the auth client its credential chose, assistant turns with the one their profile names, and using that client requires permission; a credential with no usable choice is asked to reconnect rather than served with another client. Valid credentials from another organization are refused on an organization's public servers instead of being served anonymously. Turning enforcement off returns the organization to the previous behavior within a minute.

• c1a55fb: The upstream OAuth migration now names, on every live credential's choice for a server, the one typed auth client that serves it, and reports coverage by credential class (interactive, ID-JAG, dashboard-minted, workload and agent sessions). A choice that several auth clients could serve is listed for an administrator to resolve instead of being guessed, and choices whose client is gone or no longer fits the server are listed as needing a reconnect.

• 1ef0e61: Adds the upstream_auth_enforced organization feature, which records upstream auth client enforcement. The generic product feature toggle refuses it.

• 0f26b39: Responses from external MCP servers are now size-limited during connection, tool discovery, and tool calls. Each JSON response body, error body, or single server-sent event may be at most 16 MiB; a larger one fails the request with a "response body exceeds the configured read limit" error instead of being buffered in full. Long-lived event streams keep working, since the limit applies to each event rather than to the whole stream.

• a287d4e: Speakeasy OAuth authorization and browser sign-in errors now return HTTP 400 instead of 401, with their existing descriptions. Invalid client metadata at MCP authorization endpoints returns invalid_client. Token and revocation client authentication failures return 401 with a matching challenge when authentication was attempted through the Authorization header, and 400 otherwise. Token and revocation requests with duplicate credentials or multiple authentication methods return 400 invalid_request before authentication. Dependency outages during authorization authority checks, consent state lookup, client lookup, token revocation, and identity-provider code exchange return HTTP 503 instead of client errors.

• 2942096: Speakeasy MCP, Platform MCP, and Admin MCP now show pre-authentication authorization errors on an HTTP 400 page with an explicit return link for remote and custom-scheme callbacks. Automatic error redirects remain available for registered HTTP and HTTPS callbacks on 127.0.0.1, ::1, and localhost. The page names the MCP client and server, explains the error and the next step in plain language, and keeps the error code, description, and a support reference under a collapsible technical details section with a copy button. Consent-denial and post-authentication redirects are unchanged.

• b68ecc3: OAuth token endpoints now distinguish infrastructure failures from invalid clients and expired or revoked grants, so clients can retain their registration and recover appropriately. MCP token and revocation failures use OAuth JSON responses with cache-prevention headers, and missing grant types return invalid_request.

• 63a0b5d: Tool calls made by a federated platform, such as a GKE workload, a GitHub Actions workflow or a Claude Tag channel, now count toward the agent it signs in as, so the agent's page shows them. The workload that made each call is still recorded with it.

• ea8df7e: Relayed MCP requests still waiting on a remote MCP server 45 seconds into a shutdown are now answered with a JSON-RPC error (-32603, data.reason server_shutdown) instead of being cut off, and the remote MCP server is sent a best-effort notifications/cancelled on protocol revisions before 2026-07-28. During shutdown a relayed response stream also ends as soon as its response has been relayed. Response streams that go idle or fail before their response is relayed now answer the client with an SSE JSON-RPC error event rather than an error the client could not read, and tool calls interrupted by shutdown are logged with status 503 rather than 502.

• df2e979: Ends relayed MCP listen streams as soon as a server starts shutting down, so clients reconnect to a replica that is still serving instead of holding shutdown open for the full drain window. Standalone GET streams close with an SSE retry field and 2026-07-28 subscriptions/listen streams close with their completion result. Requests still running at the shutdown deadline are now cancelled and their connections closed right away, and relayed streams record why they ended, whether their response had been relayed, and whether they were resumable.

• 593b110: Updating a hosted MCP server's address through the endpoint API now accepts an mcp:write grant scoped to that server, as the toolset API did, instead of requiring project-wide mcp:write.

• cbea82c: The MCP address availability check takes an optional mcp_server_id, so a server adding its own older address in Settings no longer sees it as already taken.

• cbea82c: Platform MCP connection settings for a hosted server report legacy_platform_slug, the older Speakeasy address its custom-domain alias still serves.

• cbea82c: A Speakeasy-hosted MCP address that still serves an older custom-domain address is reserved, so another project can no longer take it. Hosted MCP servers report that address as legacy_platform_slug.

• b4eca3b: Trace summaries now carry the MCP server id each trace was served by, so observability can filter hosted MCP servers by server id.

• 82716a0: mcp_metadata.mcp_server_id is now a NOT NULL column instead of a nullable column with a CHECK constraint.

• ceb2d8f: Plugin servers are always backed by an MCP server or a gateway now, so the unresolved plugin server backend is gone from get_plugin and the plugin page shows gateway members as "Gateway" instead of "Toolset missing".

• 15cfb8f: A hosted MCP server whose custom domain never went live, or was deleted, can now move its endpoint to the platform domain through mcpEndpoints.update. The endpoint keeps its id, and the move applies the platform slug rules and availability check. A server on a live custom domain, or on one that health checks disabled and that can be reverified, still cannot leave it.

• 22a8eb1: Re-registering a remote session client that stores no scope now registers the scope its logins request, so providers that only grant registered scopes keep accepting those logins.

• e532172: Show readable error pages for MCP authorization, consent, Platform MCP sign-in, and staff approval failures. Pages explain expired links and organization policy blocks, include copyable technical details, and omit return links when no validated callback is available. Machine endpoints retain their existing error responses.

• 0bc2702: Show actionable error pages for expired sign-in and setup callbacks. Link setup failures directly back to organization setup, dashboard connection failures back to the dashboard, and assistant failures back to the conversation or assistant. Return canceled sign-ins to consent or login, and explain how to restart failed assistant connections.

• 62cc5be: Legacy MCP slug URLs (serving, OAuth metadata, OAuth endpoints, and install pages) now return not found for MCP servers in deleted projects, and in-flight gateway sign-ins stop when their project is deleted.

• dc16595: Okta connections accept org URLs on okta-gov.com (Okta for Government High) and trexcloud.com (the orgs Okta uses to review integration submissions).

• c662c74: Add storage for the MCP servers each person hides.

• 323ef48: Batch risk analysis only publishes scan requests, so the analysis handlers scan and meter each message once.

• 29bbebe: Chat risk counts, filters and highlights, Platform MCP chat listings and session recall masking always read risk findings from ClickHouse.

• d905833: A tool call held for approval on a proxied MCP server now comes back as a tool result marked isError, with the request token and the steps to request approval, the same shape hosted servers return. It used to come back as a JSON-RPC error, which agents treat as a failure rather than instructions to follow.

• 95b11df: Assistants now connect to hosted MCP servers at the server's own endpoint, including its custom domain, instead of the legacy toolset address on the platform host.

• aee9894: Keep agent connections working when their assigned upstream session is reauthenticated. Assignments follow current credentials on the same session row; deleted or revoked sessions still require explicit reassignment.

• dba7b6a: Validate catalogue promotion titles and descriptions against the 100-character catalogue limit. Show field-specific guidance without discarding reviewed input, and return actionable length errors through the admin API and Admin MCP.

• de5038b: Code Mode runs that fail now return the output the program printed before the failure, so print can be used to debug a traceback, a CPU, memory, result or callback limit, or the wall deadline. Output keeps the same 16 KiB limit and sets output_truncated when cut.

• c28eb88: The consent page's Hide control is now an eye-with-strikethrough icon beside Connect that appears when you hover or focus a server row (always on touch screens), with a tooltip explaining that hiding stops your agent from trying to access the server.

• 06d8d61: Publishing plugins is much faster. A publish now downloads only the marketplace files it carries over unchanged, and downloads them in parallel, instead of reading the whole repository one file at a time.

• 39b2d86: The hooks bootstrap now unpacks the hooks binary with node when a machine has none of unzip, busybox, python3 or bsdtar, such as a slim container image built to run a Node app. On those machines the hooks binary used to fail to install, and plugins that fail closed blocked every agent tool call.

• ed1e146: The hooks bootstrap now unpacks the hooks binary with python3, or failing that bsdtar, when a machine has neither unzip nor busybox, such as the official OpenClaw container image. On those machines the hooks binary used to fail to install, and plugins that fail closed blocked every agent tool call.

• d78a73a: DNO-1412: Agent API keys and headless devices acting for an agent can send hooks to a project with only org:hooks_ingest bounded to that project. Hook ingestion no longer also requires project:read on the project named in Gram-Project, so a hooks-only agent is no longer refused as forbidden. Every other route, and every caller that is not an agent, still requires project:read on the selected project.

• 8608197: Keep Codex on the dedicated native plugin packages and remove the Codex overlay from published portable packages to avoid selecting Codex's restricted Agent Plugins tool budget. Preserve Agent Plugins 1.0 packages, Copilot marketplace routes, Cursor configuration, and explicit Agent Plugins ZIP downloads.

• bac96f4: Drop the unused MCP collection tables and the external_mcp_attachments.organization_mcp_collection_registry_id column that pointed at them.

• c2f4775: Drop the retired toolsets.oauth_proxy_server_id column and the check that kept it exclusive with the external OAuth server link.

• d4ef9a3: The upstream auth client backfill now records an enterprise-managed authorization (EMA) client for a binding made for the organization's gateway sign-in issuer, and offers it on the servers in the binding's project at the binding's resource. Previously such a binding was reported as matching no server, so its client was never recorded. Requests are still chained only through a binding for their own sign-in issuer and project.

• c36e851: Editing an MCP Authentication Provider's session length, sign-in flow, client admission, or trusted identity provider is no longer refused while identity-chaining bindings exist. Deleting the provider, or detaching it from an MCP server, still requires unlinking those bindings first.

• fbe8a8c: A gateway connection approved with "Gateway default" now keeps the discovery mode that was the default at consent until it reconnects, so changing a gateway's default mode (for example to Code Mode) no longer swaps the tools of connected clients mid-session. A tool call for a tool the connection's mode does not serve now says the gateway's tools may have changed and to reconnect, instead of "unknown code mode tool".

• 4be3c1a: MCP gateways are available to every organization: the MCP page lists them and Add a server offers New gateway, without the gram-gateway-endpoints rollout flag.

  Command K lists gateways by name and opens their overview.

• 6baa296: Platform MCP checks a newly added MCP server's readiness the first time you ask, instead of reporting it as temporarily unavailable until you force a check. find_mcp also finds a server by its source URL, even after the server is renamed.

• 9856ae1: Platform MCP register_remote_mcp now returns next_action: connect_sign_in and automatic_client_registration when the server's OAuth client can be set up automatically, so agents offer to connect sign-in in chat instead of only sending the user to the dashboard. The dashboard setup link stays as the fallback.

• 06edc85: Platform MCP get_my_install_instructions now returns a ready-to-use path for each client when installing a single MCP server: a one-click Cursor install link plus its mcp.json block, the claude mcp add command for Claude Code, the config.toml block and codex mcp login command for Codex, the opencode.json block for OpenCode, and a generic JSON config for other clients. No credentials are included; sign-in still happens in the browser.

• e2b938b: Platform MCP register_catalog_mcp and register_remote_mcp now return already_registered: true when the MCP server was already in the project, so agents say it was already there instead of reporting it as newly added.

• 9b9d266: An MCP server added from a URL through the Platform MCP without a display name is now named after the name the server reports for itself, or the URL's host name when it reports none, instead of the full URL. A new server's slug and endpoint address now come from that name, for example linear and <organization>-linear, with a short random suffix only when that address is already taken. A name given when adding the server still wins, and servers that already exist keep their names and addresses.

• 4828c5f: Platform MCP search_mcp_catalog results leave out tool_count when the tool count is unknown instead of reporting 0, and describe auth_setup in plain words so agents tell users how each server signs in, checking the setup guide when it is unknown.

• 452500c: Platform MCP get_mcp_readiness now checks an MCP server again when its last stored check has expired, instead of reporting the expired result as stale. If that check is refused or fails, it still returns the last stored check, marked stale.

• a3da755: Hosts on the Platform MCP discovery surface (Codex, ChatGPT) now see the first-run tools listed directly next to the discovery tools: catalog search, candidate inspection, adding a catalog or remote MCP server, find_mcp, readiness, install instructions and docs search. Those steps take one call instead of a search, a describe and a call. Every other tool is still reachable through search.

• c9acf83: Hosted MCP servers now read their enabled, public and session-issuer state from the MCP server instead of the toolset: legacy /mcp/<slug> serving and install pages, gateway members, consent, plugins, assistants, access visibility, usage metrics, search indexing, the issuer attach preview and the deployment impact report. Today both copies agree, so nothing changes for users; a hosted server whose MCP server no longer matches its toolset is still not served.

• 20eabcd: A disabled hosted MCP server now reads as public, and comes back public when an assistant re-enables it, only when it carries external OAuth; otherwise it reads and comes back private.

• c7fd1c0: Signing in through a user session issuer no longer fails with a server error when the issuer's session length is stored in days. Days count as 24 hours when minting and refreshing sessions, in the consent screen's session-length choices, and in the issuer details. Months are still refused because they have no fixed length. The seeded partner gateway issuer now stores its 30-day session length in hours.

• f2793e3: Upstream OAuth migration status no longer counts credential choices for deleted MCP servers as live coverage gaps, and reports agent attachment grants that wait for upstream selector writes to be allowed.

• f61a3a6: Dashboard links that the server builds for an MCP server, in device agent plugin listings and in Platform MCP setup and authorization steps, now use the /mcp/<server> address. The older /mcp/x/<server> links keep redirecting.

• 74650c1: Allow organization members to complete device-agent enrollment without requiring organization read access.

• c76db3f: More than one organization can now connect and verify the same Okta org. A second organization no longer fails verification with "this Okta org is already connected to another organization".

• bf9c972: Platform MCP plugin assignments now cover install modes. get_plugin returns each current assignment's install_mode, and set_plugin_assignments accepts optional install_modes keyed by assignment reference, keeping a reference's current mode when it is omitted. The assignment version also covers modes, so a mode-only edit made elsewhere is caught as a conflict.

• 628e396: Agent identity pages now work while a platform admin has the RBAC override turned on. Agent management no longer rejects requests that carry the override. Instead, the override narrows each agent permission check: the check must pass both your real grants and the override. Registered agents remain visible in the roster and Command K, with their available actions refreshed when the override changes. Agent owners keep managing their own agents, and delegating access to an agent is still limited by your real grants.

• 7164f6c: A credential source's typed upstream auth clients, server links and copied credential headers now stay in line as the source and its servers are written, instead of waiting for the next organization-wide backfill run. Adding, rotating or deleting a remote source's header records or updates its client and the copies on the upstream OAuth and EMA clients its servers offer; deleting the source or the server retires them; and a server created in front of a source that already carries headers picks them up as it appears. Tunneled sources get the same treatment through their own deletion and the servers arriving on or leaving them. Since the serving path sends an auth client's copied headers with the upstream request, a deleted header could previously still be sent, and a rotated one sent with its old value, until the next run. Administrator-created clients, administrator detachments and credential choices are left untouched.

• 08f92db: The remote MCP proxy now labels relayed list and resources/read results cacheScope: "private" whenever Speakeasy's access gate or filters shape them, so a shared cache cannot serve them to another caller. Anonymous callers of public servers still receive the upstream's own cache hints.

• 36ccde6: Add the require_approval risk policy action for MCP tool calls. A covered call is held and returns a request token; the agent files the request with request_approval on the new Speakeasy Approvals MCP server, waits with the watcher it returns, and retries once an approver approves. Each approval releases exactly one retry of the same call. The dashboard shows approval policies read-only until their editor ships.

• ff6a2b2: Removing an "All" permission from a role now also removes unrestricted grants stored by older versions, which previously stayed in place. The role editor now checks the permissions the server saved and shows an error, keeping Save enabled, instead of reporting "Role saved" when a permission change did not persist.

• a58d9a3: Explore signal activity over minutes through calendar months, break it down by captured attributes, inspect measured definitions, and export the measurement context. Demo data includes linked conversations, intraday patterns, missing labels, and separate manual runs.

• 4a3531f: The server no longer reads the retired OAuth proxy link on toolsets. A hosted MCP server that still carries the link can now change its visibility, it is no longer reported as requiring OAuth unless it has a sign-in provider or an external OAuth server, admin server health no longer reports oauth_proxy as its legacy authentication, external MCP migration no longer warns about the link, and deployment evaluation counts only an external OAuth server as configured OAuth.

• 1570489: Add tool approvals to Guardrails: a "Require approval for tool calls" use case with its own Tools, Who and Review steps (approvers are specific people or roles), a Require approval badge with the approver count in the policy list, and a Tool approvals tab where approvers see held calls with each argument on its own row and the agent's reason, and approve once or deny. The demo org seeds an approval policy with pending, used, denied and expired requests. Behind the risk-tool-approvals flag.

• 31bd957: Tool Logs filter counts now narrow as you filter: each filter group lists only the values that still have calls under the other applied filters, while its own values stay selectable. The time range moves next to the search bar, and the summary and timeline panel takes less vertical space.

• de7bc77: Hosted MCP serving, install pages, metadata and toolset views now carry a toolset's hosting state (enabled, public, session issuer and preferred address) in its own value instead of overwriting the toolset row's hosting fields. Behavior is unchanged.

• cd3ab7d: A toolset now counts as hosted only through its hosted MCP server. A toolset without one is no longer served at its legacy /mcp/<slug> address, no longer counts as an enabled, public or private server, and no longer appears in admin server lists or as a user session issuer owner. The external MCP migration tool now deletes such toolsets instead of blocking on them. Nothing writes the toolset MCP hosting columns any more, and the retired hosted MCP wrapper backfill tool is removed.

• 863893f: Add workload identity setup for inference. Workloads can exchange trusted issuer JWTs for project-bound inference tokens when their assigned agent and owner explicitly have inference permission, without MCP configuration or transcript access.

• 11cb71b: Organization changes from WorkOS, such as membership role updates, are now applied within about a minute even when WorkOS sends its webhook before the event is available to read. Previously the change could wait until the organization's next WorkOS event.