server@2.31.0

Minor Changes

• 7a71623: The device agent can now download the organization's Claude observability plugin for a user to upload to claude.ai, so sessions in Claude's cloud environment are recorded under that user. The plugin carries a hooks-only key owned by the user, and each download replaces their previous one. The download needs the user's own key; the shared org install key is refused.

• 5e62b3a: Device agents can report crashes, recovered panics and update rollbacks to the control plane, including agents on servers and CI that authenticate with an agent key. Only reports shaped like a device agent crash are accepted; they are scrubbed again on arrival, forwarded to monitoring as logs and a crash count, and not stored.

• 1f3f475: Agent identity pages no longer send one MCP server activity request per project. A new telemetry.getOrgMcpServerActivity endpoint returns recent activity for every readable project in one request and scans only the recent window. The agents roster also stops loading people-only data it never shows.

• ccfb531: Add an MCP Gateway column to the observed coverage matrix on each organization's record in the staff admin app.

  Every other column is an agent surface folded from a hook_source. The gateway is Speakeasy itself, so its evidence is read from the traffic it served rather than from what an agent reported: session activity counts non-hook trace_summaries traces carrying a toolset slug or a meta MCP server id, matching how the tool-usage reads classify hosted and gateway MCP servers; identity counts the calls bound to a person, stating calls bound only to a managed agent separately; policy enforcement counts distinct mediated executions a risk policy stopped, read from risk_findings rows with a non-empty mediation_surface.

  Two cells can never report for the gateway — it brokers tool calls rather than model calls, and shadow servers are by definition reached around it — so cells carry a new na status that reads as inapplicable rather than as a gap an integration could close. Cells also carry a unit, letting a column name what it counts when the capability's own unit does not fit: the gateway is measured in tool calls where an agent surface is measured in sessions.

• 741dc77: Add an opt-in setting on remote session clients that sends the connecting MCP client's self-reported name to the provider as speakeasy_client_name on /authorize. It is off by default and only sent for anonymous sessions.

• ac9c37b: The GitHub Actions setup offers a fourth choice of jobs, Pull requests. It writes the exact rule repo:<owner>/<repo>:pull_request, which admits pull request jobs that use no environment and refuses branch, tag and environment jobs. The generated workflow runs only on pull_request (opened, synchronize, reopened and ready for review) and skips pull requests from forks, which get no GitHub token. The setup warns that anyone who can push a branch can run such a job with the workflow as their branch has it, and that a pull_request_target workflow is admitted too, a fork's pull request included. Editing an agent whose rule admits pull requests opens on this choice. GitHub Actions is still offered only where the workload-platform-github-actions feature flag is on.

• 339d492: Add an authenticated setup connection test that initializes a Remote MCP connection and discovers tools using the signed-in user's saved authorization without executing tools. Add an opt-in single-server guard to identity configuration saves, and normalize Slack's comma-separated granted scopes during OAuth callbacks and refreshes.

• 8e5727e: Before you delete an MCP server, turn it off, change its sign-in, remove its upstream authorization server, or change or remove one of its addresses, the confirmation now lists who holds an active connection and when each one last used it. Callers whose sign-in is shared with other servers are marked, and you type the server's name to confirm.

• 6a49697: Speed up the project home page by cutting the requests it makes.

  • telemetry.getProjectOverview takes a new include_usage flag. It returns the per-user and per-agent usage breakdowns in the same response. When the project has no agent usage, it returns mcp_usage instead: the number of external end users, the top end users by tool calls, the most used tools, and the tools with the highest failure rate. The dashboard no longer chains telemetry.query and telemetry.searchUsers calls after the overview.
  • telemetry.getProjectOverview no longer returns fields the dashboard never read: comparison, metrics_mode, and the summary's resolved_chats, failed_chats, active_users_count, top_users and llm_client_breakdown. The server no longer runs the queries behind them.
  • chat.list takes a new pinned_first flag. The home page's recent chats now load with one call instead of two.
  • The dashboard asks the server to create the project assistant at most once per page load, instead of once per component that needs it.

• 5b345d7: Deployments no longer accept or carry external MCP servers. The external_mcps field on deployment creation and the upsert_external_mcps field on evolve are removed, and evolving or redeploying a deployment produces one without the external MCP servers its source had. exclude_external_mcps is still accepted but has nothing left to exclude. Deployment processing no longer creates tools for external MCP servers; older deployments that already have them keep serving them.

Patch Changes

• 2356df7: An agent's Activity tab now shows when someone grants it their connection or removes it, and says what each permission change touched. Attaching or detaching a connection also records agent:connection_attach or agent:connection_detach with the agent as subject, next to the existing remote_session:attach and remote_session:detach entries. A permission change row now reads, for example, "mcp:connect · Acme Ops" instead of only "Added direct policy grant to agent".

• 5de619b: Device agent crash reports now keep crashes from the daemon and the menu bar app apart when they share a function name, and can carry the device's OS release.

• 7c6b116: Signing out everywhere now revokes chat tokens derived from earlier dashboard sessions, including access to chat attachments and creation of signed attachment URLs. New sessions remain valid, and API-key and anonymous chat tokens keep their existing behavior. Session revocation lookup failures return a server error instead of an invalid-credential response.

• b4f5e88: Sign-in no longer fails with "remote login callback did not identify the expected issuer" for providers such as Zoom, whose OAuth metadata does not advertise RFC 9207 iss support but whose OpenID metadata does. Speakeasy now reads that setting only from the provider's primary metadata document, and affected providers recover after their next metadata refresh.

• 05205e3: People using a public MCP server without signing in are now asked to reconnect when their provider connection can no longer be renewed. Before, every request failed until they removed and re-added the connection.

• 9b26783: Apply the invited role when the identity provider returns an existing membership without that role. Preserve existing roles in WorkOS and Speakeasy. Refresh the membership before replacing its roles.

• 2d6ba82: An agent that an assistant acts as now lists the assistant's sessions on its identity Overview and Sessions tabs, and in Agent Sessions filtered to that agent, instead of showing none.

• b8c3bb2: Staff can backfill explicit MCP connect grants for everyone who can view or manage an MCP server, so access stays the same once viewing or managing a server no longer implies connecting to it.

• ecd89cd: The card shown after an agent adds a catalog MCP server through Platform MCP now shows the real next step: Add credentials, Connect when only sign-in is left, or no button when nothing required is left. It no longer always says Finish setup. The MCP server readiness bar now treats Included in Plugin as optional and does not count it as a step left.

• 8caefb9: Catalogue promotion no longer files a setup-guide request when the guide repository already has a guide for the promoted slug, or an open pull request changing it. Staff see "Guide already exists" or "Guide in review" with a link in the admin dashboard and Admin MCP. An open guide pull request is rechecked daily and flagged for staff after 14 days.

• 81c7576: The catalogue promotion review form now warns when the setup guide slug already belongs to a published guide, and suggests the existing guide's slug when the server's endpoint matches one. The Admin MCP promotion preview shows the same check. Publishing is unchanged.

• c334170: speakeasy auth now signs in with a PKCE one-time code instead of receiving an API key on its local callback. The CLI sends a code challenge with the browser login, the dashboard returns only a short-lived code bound to that challenge, and the CLI redeems the code with a verifier that never leaves the process. A key for another organization can no longer be swapped in through the callback, and a process that reads the callback gets nothing usable. The callback URL also carries a single-use state token, so stray or forged callbacks are rejected without ending the real login. cliAuth.authorize accepts key_scope: producer for this flow; it requires org:admin, the same as creating a producer key in the dashboard, and the key is recorded in the audit log.

• e73cfef: Keep a person's saved company sign-in when the identity provider rejects a refresh for a reason that doesn't say the token is dead. Later requests try again every five minutes, so access can return without a new sign-in once an administrator fixes the problem at the provider. If the provider keeps refusing for three days, or a retry gets no clear answer from it, the person is asked to sign in again. A rejection of the client itself or a local setup fault does not start the three-day window, since a sign-in cannot fix it. A rate limit on a working sign-in no longer forces a new one. The connect page now says a kept sign-in is retried by itself. The person is also asked to sign in when a refresh was left unfinished or the sign-in setup changed, and company sign-in errors no longer show raw codes.

• 86cc25f: Chat attachments can no longer run script on the Speakeasy API or dashboard origin. assets.serveChatAttachment and assets.serveChatAttachmentSigned now send Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox and X-Content-Type-Options: nosniff with every attachment, and a Content-Disposition that displays raster images, audio, plain text, CSV, Markdown and JSON inline and downloads everything else, including HTML, SVG, XML and PDF. Fetching an attachment or embedding it as an image or audio source works as before. In chat, opening an HTML, SVG, XML or other active attachment now downloads it instead of opening it in a new tab, and replayed SVG images show the file icon instead of a preview.

• 003aa12: Record MCP connection attempts in ClickHouse: one row per step, with a stable reason code, who fixes it and a plain-language message per code. Attempts carry through Speakeasy and provider sign-in. /authorize and the provider callback are recorded. New attempts and single-request rows share a per-organization ceiling, and only catalog apps keep their host in app_key.

• b877cd9: The mcp.connection.events.dropped metric now counts only connection events that were lost. Single-request rows held back by the rate limit or the queue share are written later as a repeat count, so they no longer count as rate_limited or queue_reserved. A held-back row lost when its key is evicted counts once, as repeats_lost, and a lost row that carries repeats counts every event it stood for.

• b7cdd95: Add ClickHouse tables for MCP connection attempts: one row per step, a 30-minute rollup and a long-term daily table with no org, project or person.

• fd3ba7c: Seed realistic request and refresh outcomes in the demo workspace, including member-scoped gateway refusals, renewal failures, and client attribution for request-driven refreshes.

• b43655e: Reloading a gateway sign-in page no longer records every member's sign-in status again. Within one sign-in attempt, a member gets a new record only when its status changes, such as when it goes from needing sign-in to connected.

• 3ff94c3: The consent page tool picker now loads a server's tools for people who connect through their company sign-in, so they can choose tools before giving access.

• c314de1: Capture Claude sessions from the unified Chat/Cowork mode, where Claude runs plugin hooks only inside the Cowork VM. When the standard Claude observability plugin runs there, speakeasy-hooks now relays no per-event hook and instead, each time Stop fires, uploads the transcript lines written since its last successful upload to the new POST /transcript endpoint. The server stores those lines as the session's chat history, keyed by transcript entry, so a re-sent line is never stored twice. The binary recognizes the Cowork VM from Claude Code's entrypoint, so the same plugin keeps relaying per-event hooks, and enforcing policy, in Claude Code. Policy is not enforced inside the Cowork VM.

• ba32126: Saving a server's Team Access or an auth client's access no longer fails with "unknown principal" when a rule names an agent that was deleted. Rules for deleted agents are no longer listed and are removed on the next save, and deleting an agent now removes its rules everywhere.

• 735fbe3: Organization admins can turn device agent crash reports off for their fleet from the device agent configuration page.

• 8216054: Device coverage no longer credits a device with a policy report from another machine. When a device's own agent hasn't reported, its assigned user's report stands in only if it names no other serial and comes from the same OS family, so a MacBook no longer shows "Enforcing policy" because the same person's Windows machine reported.

• ce4737e: Hook endpoints now reject request bodies larger than 20 MiB, both on the wire and after gzip decompression, with a 413 before the body is parsed or the caller is authenticated. Skill content uploads keep their stricter 512 KiB limit and now also answer oversized bodies with 413 instead of 400.

• 3c5581b: Removing every assistant permission from the built-in Admin or Member role now revokes assistant access for its members. Effective permissions always match the role's stored grants; organizations created before assistant permissions existed receive their stored defaults through a one-time backfill.

• c815d93: Members with agent:write on an agent can now list and open that agent's sessions read only, and the dashboard shows them its Sessions panel.

• 503ce66: Prompt and session events from hook-based agents such as OpenClaw and Kit no longer count as tool calls, including rows stored before this change.

• 2f50641: OpenClaw cron sessions are now titled "Cron: " instead of the raw cron envelope, including chats stored before this change.

• 6e241c3: The agent page now shows whom the agent acts for on each MCP server instead of "Authorized by", and tool calls made with an agent API key no longer record the key's issuer as the person the agent acted for.

• 4faf739: Gateway tool calls that fail before dispatch now write a failed tool call row, and functions that fail with unset environment variables say which variables are missing.

• 1d98a9e: Rules that block MCP tools by type, like "block destructive tools", now apply to tools Speakeasy hasn't seen before on remote MCP servers. Speakeasy records a server's tools whenever they're listed, and looks up any unrecorded tool before running it, so these rules no longer depend on someone opening the server in the dashboard. A call is refused if the tool can't be checked.

• 71f1616: In an organization that enforces upstream auth, every caller of a remote or tunneled MCP server now gets its upstream credential from the credentials that server offers, never from whatever the server's sign-in happens to link. People whose chosen credential had outdated header copies, could fall back to company sign-in, or was an identity-provider credential were asked to reconnect, or refused a token refresh, when the sign-in did not also link that credential; they now keep working. Agent API keys with no credential picked for a server, assistants without an agent identity, and Platform MCP calls through the organization gateway use the one credential the server offers them, or none when it needs none, and are refused when there are several to choose from. An assistant without an agent identity can no longer use a person's own connection; give it an agent identity to act for that person. A session for a hosted server can refresh its token again.

• 2395d7b: Selecting an environment whose values reach tool code now requires environment:read on that environment, not only project, MCP server or assistant write access. This applies to direct tool invocation, environment links on sources and toolsets, a toolset's default environment, an MCP server's environment, and an assistant's per-server environments. A project-wide grant covers every environment in the project, and a grant on one environment covers only that one. Existing bindings keep working, and legacy API keys are unchanged.

• f7b6473: When an identity provider rate-limits a company sign-in refresh, Speakeasy now waits as long as the provider's Retry-After asks (at least one minute, at most five) before trying again.

• df33431: The Platform MCP card's setup link now names the open step. On the MCP server's settings page, a banner at the top of the Identity section says what is left: add an API key, set up the OAuth client your team signs in with, or sign in. For an API key, the Custom Headers list opens on its own. When the step is done, the banner says the server is ready to use. The banner and the sidebar readiness bar now use the same check.

• 32d18f2: Add a forward_client_name column to remote session clients, off by default, ahead of an opt-in setting that sends the connecting MCP client's name to the provider.

• 138f46e: MCP clients such as Codex now show plain-language titles for Speakeasy's tool search, tool details, run and code-mode tools, for catalog tools that used to say "Reviewed", and for the feedback tool. Gateway search, details, run and connection tools now have titles too, so clients no longer show their raw names.

• 115d2d4: Consent capture, gateway serving, explicit selections, annotation snapshots and live-grant witnesses now share a 10,000-tool limit. Larger inventories show an actionable size error instead of asking users to retry. Single-server pickers use the same budget. Consent forms and serialized policies support larger selections while retaining size bounds and storage-format headroom.

• 7f7cd45: With upstream auth enforcement on, gateways decide consent from the credentials each server offers. A person can connect a server whose personal sign-in is not linked to the gateway, a server offering no personal sign-in no longer reads as needing setup, and a sign-in no server offers can no longer be connected.

• e0da93f: Gateway instructions now open with one line naming the servers the caller can use, so agents that load tools on demand, such as Codex, know what the gateway reaches before they search. The line stays within 250 characters and ends with a count when servers do not fit. Gateways with their own instructions keep them as written, and the gateway settings page now says so.

• 6b46c5a: Platform tools such as Slack now run when an agent or organization gateway calls them through execute_tool. The call runs in the project of the server that hosts the tool, instead of failing with "platform tool requires project auth context".

• 2c9cfe8: When a gateway server gets a sign-in after a person approved it as needing none, calling that server now says what to do: reconnect the gateway in their AI app, or ask an administrator if reconnecting can't fix it. The session keeps working for the gateway's other servers, and token refresh is unchanged. In Code Mode, tools.connect now returns that message when reconnecting can't fix it, instead of a sign-in link. Gateway messages now say "Reconnect this gateway in your AI app" wherever that's the fix.

• c551914: In Tool Logs, the gateway name on a call that reached an agent gateway or the organization gateway now opens that gateway's page. It used to open the stored gateway page, which has nothing for these gateways and failed to load. An agent gateway opens the agent's Permissions tab and the organization gateway opens its own page, the same places the "dispatched through gateway" icon already opens. Tool usage traces now report the kind, project and agent of the gateway a call reached.

• 59fb8c7: Hook telemetry rows now record which endpoint generation sent them, and take the hooks binary version from the event envelope when the request headers don't carry it, including on offline-spool replays.

• 59fb8c7: Generated hooks plugins record how they were installed (marketplace, download, agent install) in speakeasy.json, and the hooks binary reports it on every request so it shows up on hook telemetry. speakeasy-hooks install marks its plugins as hooks_install, and SPEAKEASY_AI_HOOKS_INSTALL_ROUTE overrides the value for managed installs.

• d1e5d0a: Serve the hooks@0.3.43 binary to hook installations. Previously pinned releases stay available so installations that have not regenerated their bootstrap script can still install.

• 916ca29: Record inbound MCP refresh outcomes, including successful rotation, replay, expired or refused grants, and upstream reconnect requirements. Outages during refresh checks now return a retryable 503 or 500 instead of invalid_grant, and a failed session lookup during refresh replay returns a retryable 503 instead of a 500.

• 9a8baff: The Inspect tab now lists every tool an MCP server offers and shows which ones your access doesn't include under "Not available". Viewing the tab or syncing no longer records or removes tools based on one person's access. Sync is offered only to people who can edit the server, once its tools have been saved, and the connect prompt now explains that you sign in with your own account.

• b437027: Kit assistants can use built-in Speakeasy tools, including replying in Slack threads, alongside their attached MCP servers. A Kit runtime that cannot recover is replaced automatically on the next message instead of refusing every turn, and slow sandbox startups no longer abort the runtime partway through.

• b70dbb2: Kit assistants can use built-in Speakeasy tools such as replying in Slack, and a Kit runtime that can no longer serve turns is replaced automatically on the next message instead of refusing every turn.

• 77acff5: Kit assistants now reply to new Slack threads and to conversations started before a runtime was replaced. A fresh Kit session in a conversation with earlier assistant turns is told that earlier messages are unavailable, instead of the turn failing.

• 5e10d6b: Clean up retired Kit assistant runtimes promptly: their sandbox resources and workload credentials are now withdrawn within about an hour of retirement, even when the assistant stays busy.

• 825d644: Idle Kit assistants on managed GKE checkpoint and stop again instead of staying stuck mid-checkpoint and refusing new turns.

• e218d64: Kit assistants can run on deployments without a separate authentication host. Their workload issuer falls back to the server URL instead of the server refusing to start.

• a6b5787: Record refused and failed MCP request outcomes with client and server attribution, including gateway member failures, credential gaps, and hosted access refusals. Successful requests do not create connection outcome rows.

  Gateway recovery guidance uses fixed, slug-free text; the affected server remains identified separately in structured results. Routine access-token expiry and HTTP-successful tool errors do not create connection-failure rows.

• 2acb565: OpenClaw calls to a Speakeasy gateway now show as Gateway calls instead of Shadow MCP calls. OpenClaw names MCP tools <server>__<tool>, so a gateway configured as "speakeasy" looked like any third-party server of that name. The OpenClaw observability plugin now sends the name and URL of each configured MCP server on tool events, never its headers or credentials, and speakeasy-hooks reports the URL the call reached. Tool usage classifies calls to agent gateways (/agent-mcp/<agent>), the organization gateway and project gateways by that URL and names them after the agent, organization or project. A third-party server with the same name at another URL stays a shadow MCP server. The relay half takes effect with the next speakeasy-hooks release pin.

• 2592515: OpenClaw MCP tool calls now show as Shadow MCP calls in Tool Logs, named after the server they reached, instead of as local tools. OpenClaw names MCP tools <server>__<tool> and stamps every MCP result with details.mcpServer, so ingest reads the server from that marker. This needs no plugin or speakeasy-hooks update. A call's pre-call row has no result, so tool usage carries the server across every row of the call and the call stays one row.

• b773c7d: Connection history records a provider or tunnel outage as that outage even when the outage record can't be stored or read, and the agent consent and token checks classify outages and busy refreshes the same way as other paths.

• 1e11a63: Temporary outages no longer read as sign-in failures: affected routes answer with a retryable 503, and sign-in, connect and gateway pages say the problem should clear.

• 189dd57: Record provider token refresh outcomes with their server or provider-session attribution, including scheduled refreshes and refreshes that finish after the caller disconnects.

• 339d492: Add a default-off, staff-managed provider setup rollout per organization. Gate live connection testing while preserving existing credential and OAuth flows.

• e236ba6: A sign-in where the provider reports a zero, negative or unreadable lifetime now works instead of showing as expired straight away or failing. On a direct server with no credential choice, "Give access" now refuses a posted approval, as well as disabling the button, while every service on the page still needs connecting or reconnecting, and the page says so. When Verify cannot get a working sign-in, it now returns to the service on the page, which says to reconnect or try again, and its log says why.

• 49f5d2c: Add opt-in hooks that distinguish local request setup failures, private-connection capacity, and platform availability checks for MCP connection history. Nothing enables them yet, so connection history and request responses do not change. Tunnel gateways now label their own forward-token refusals with an internal status.

• d21ea12: Connection history now records our own failures to resolve a sign-in, load a gateway member's credentials, or run a hosted server's security check, and gateway tool calls refused because a server's approval no longer matches, in Code Mode too. Hosted servers stop recording notifications.

• 953f0f9: Record sign-in outcomes on connection attempts: Speakeasy sign-in, consent and /token for private servers, public servers and gateways, provider sign-in and its check of the new token, each gateway member's status on the consent page, and gateway tool listings. Responses do not change.

• b9294d4: An MCP connection no longer breaks when a client disconnects while Speakeasy is refreshing its provider token. The refresh now finishes and saves the new token, so the person does not have to reconnect.

• 42addc4: Carry server, client, and trigger attribution through provider refreshes, distinguishing request-driven refreshes from background work.

• dbddb5a: The External MCP migration page and its admin API are gone from the admin dashboard now that the migration is finished. Past migrations still show correctly in audit logs, and deleting a toolset whose server was migrated still leaves that server working.

• 3b06e49: Attribute connection outcomes to the client identity reported by an MCP session, with request client detection as a fallback.

• 4ed5001: Speakeasy now asks for a review before sensitive access is granted and records it when it is. In the role editor, a save that adds a permission, or adds members or agents to a role that already grants a sensitive one, opens a review step that lists what is added and what the new holders gain, and waits for a confirmation when any of it exposes other members' activity or allows destructive changes. Manage Roles and Grant Access preview what a role adds to what the member already holds, counting a permission held on one project that the role gives everywhere, and wait for the same confirmation. The access_role:create, access_role:update and access_member:update_role audit rows carry sensitive_scopes_added in their metadata, naming the sensitive permissions the change gave that were not held before or were held only on some resources; a change that adds nothing sensitive writes no metadata.

• d616859: Saving an MCP server's User Identity no longer removes the sign-in client other servers on the same issuer use. A client for a new provider is added alongside the others, a provider that already has a client reuses it, and a server's callers only need that server's own clients. Turning off User Identity on a server now only removes that server's own clients. Replacing a client other servers use is an explicit choice that lists them, and they move to the new client together.

• 184637a: Record sign-in renewal outcomes so connection diagnostics distinguish successful renewals, temporary provider failures, setup problems, and cases that require signing in again.

• 0a6fa0b: New organizations no longer get an organization-wide sign-in at signup. New MCP servers defaulted to it, which tied every server's upstream client to one sign-in and let one server show another provider's client. Until an admin sets up an organization-wide sign-in, the Organization Gateway is not available to new organizations, including through Platform MCP.

• 44e06d5: Administrators can give a member, a role, an agent or everyone a scope for a limited time, such as an hour of chat:read for an investigation, without changing role assignments. access.createTemporaryGrant sets a deadline between five minutes and 24 hours away. Once it passes the grant stops authorizing new requests, with no sign-out or role removal. access.listTemporaryGrants takes a principal URN and shows each of its grants' boundary, remaining time and the other grants that would keep the same access. access.renewTemporaryGrant and access.revokeTemporaryGrant move or end a grant without touching permanent grants. Each change is recorded in the audit log, including whether administrators gave the access to themselves.

• 5aa992b: Make onboarding customization accessible from each organization's sidebar and Overview. Configure wizard steps and apply shared templates in a tenant-scoped workspace, with explicit save behavior and a separate recorded stack section.

  Allow organization-scoped updates only for the owning organization. Deploy the API before the Admin SPA. Do not roll back the server alone while the newer SPA is served.

• 346ecdc: Tool logs name every gateway a call went through, including gateways in other projects, agent gateways and the organization gateway. The gateway icon on a tool call now opens that gateway's page, where you can see the MCP servers behind it.

• d616859: Turning off User Identity on an MCP server now takes effect in every case, including when a gateway shares its issuer or no server has claimed its sign-in client. Settings now show the sign-in clients a server's callers actually need, so the page no longer reads No Identity while requests still ask callers to sign in, and saving reports an error rather than success when nothing was removed.