server@2.32.0

Minor Changes

• 846b422: Staff Admin MCP write tools now apply changes directly instead of through stored proposals and browser approval. Each tool is named after its operation, for example set_organization_feature. The server instructions and tool descriptions require agents to get explicit user confirmation before every change, and the staff event trail now records each write's operation and target.

• fe756cd: Staff Admin MCP now exposes every write operation the server implements while GRAM_ADMIN_MCP_WRITES_ENABLED is on. The GRAM_ADMIN_MCP_WRITE_OPERATIONS setting is gone, so each new write no longer needs a deployment change to go live.

• fe756cd: Staff can redeploy a project's active deployment from the organization's Projects page and through Admin MCP.

• 954c4a9: Staff can now view and set an MCP server's pinned login scopes from the admin dashboard's MCP server page, and describe_mcp_server_health reports them. Customer Identity settings no longer show pinned or requested scopes.

• b6d2df1: Platform MCP catalog search results now render as a carousel of server cards in MCP Apps clients. Each card shows the server's logo, name and description. A server not yet in the project has an Add to project button that asks the agent to add it, and a server already in the project has an Open link to its dashboard page. search_mcp_catalog takes an optional project_slug, which defaults to the organization's Default project, to mark servers already added. The text and structured results are unchanged.

• 3041d9b: The setup wizard has a new Set up Claude Desktop group with two cards.

  • Register Speakeasy's plugins in Claude walks syncing the plugin marketplace in Claude.ai, marking the observability plugin Required, choosing how MCP plugins install, and allowing Speakeasy in Claude's network egress settings. Claude Desktop runs only plugins registered on the Claude organization, not a copy the device agent installs.
  • Add Claude organization instructions gives the organization instruction that moves every conversation in Claude's unified view into Cowork, where the observability plugin captures it, and explains how to check it. It shows only for Claude Team: Enterprise captures Claude sessions through the Compliance API and inference hooks.

  Both cards complete on their own once the first Cowork transcript arrives. Set up Anthropic admin controls now covers Claude Code server-managed settings, Cowork native monitoring and the Organization Gateway, and its traffic check points Cowork to Agent Sessions. Setup cards can now name the plans they need, so a card shows only when the organization's recorded stack has one of them. The support matrix gains a Cowork organization instructions method, and the Anthropic Enterprise Rollout preset includes the new group.

• af7b712: Remove the built-in "Speakeasy Approvals" MCP server. Saving an approval policy no longer creates a per-project approvals server or adds it to the Default plugin, and policy responses no longer carry approvals_server_setup. Held tool calls now always point agents at the shared /approvals-mcp route, which accepts keys. Existing approvals servers answer as not found and drop out of plugins on their next publish. The MCP, plugin, gateway and policy pages no longer have Built-in server handling, and builtin_backend is gone from the MCP server API.

• 87607fe: Long-lived SSE responses now end before the load balancer's response deadline. Remote and tunneled MCP listen streams, and POST streams whose response has been relayed, close with an SSE retry hint at a configurable maximum age (GRAM_STREAM_MAX_AGE, default 55 minutes) so clients reconnect cleanly; subscriptions/listen streams receive their completion result first. The chat turn stream sends a keepalive comment every 25 seconds and rotates the same way, and the dashboard resumes it from its cursor. A new gram.http.stream.duration histogram records how every long-lived response ended, by route, method and end reason.

• e1c9f75: The project dashboard's Sessions tile and Most Agent Sessions by User card now count the sessions shown on the Agent Sessions page. They used to count session ids from telemetry, which includes sessions that were never captured, so the dashboard could show many more sessions than the list it links to. A new chat.countByUser endpoint returns per-user session counts with the same filters and visibility rules as chat.list.

Patch Changes

• f436125: The staff Admin MCP event trail can now record each write's operation and target.
• f412f9a: Admin dashboard sessions and staff Admin MCP connections now expire after 48 hours of inactivity, and admin sessions end 45 days after sign-in however active they stay. Refreshing a staff Admin MCP token restarts the inactivity timeout, so a connection in regular use no longer needs daily consent. Every use still validates the staff member's session live, and each write still needs browser approval.
• 813c8c3: listChallenges takes exclude_scopes, applied before the total and the page. An agent's authorization checks leave out its org:hooks_ingest checks, one per hook event, so the checks that say what the agent may reach are no longer buried. The org Roles & Permissions checks page is unchanged.
• f17b136: Chat completions made with an agent credential or an admitted workload now record the acting agent on the session and carry no human identity, so the agent's owner can find and open those sessions without organization-wide transcript access. Sessions captured before this release are named after their agent on their next turn but keep their previous visibility.
• e8671c2: An agent gateway now tells an agent what is wrong with a server's credential and who can fix it, instead of telling it to ask a gateway administrator. A missing, rejected or expired connection says the server needs re-authentication and asks someone who can edit the agent to open its MCP sign-in step (/<org>/projects/<project>/identities/agents/<agent>/edit?step=2) and reconnect it. A 403 from the upstream says the upstream account may not do the call, which signing in again does not change. An agent not allowed to use a connection is sent to its permissions page instead of being told to reconnect, and a server no auth client serves goes to an admin of the server's project. A missing, rejected or expired credential configured on the server and shared by every caller goes to an admin of the server's project: a service account's on every gateway, and an API key's on agent gateways. Where the organization enforces auth clients, a member that offers a service account beside a personal client the agent has no connection for is served by the service account, on the agent gateway and the server's own endpoint; a client the agent may not use refuses the member on both. connection_status gives the sign-in link in its text and as connectUrl in its structured result, with audience: "agent_editors" and reconnect: true only on servers the agent connects through its own OAuth sign-in. A server it does not connect there says an admin of the server's project fixes it. No message names a person, and the links carry no credential.
• 01cfdf5: An agent's servers and their sign-in are now changed on a new MCP sign-in tab, second on the agent's page after Overview, instead of by walking the six-step setup wizard again. The tab lists the servers and how Speakeasy signs in to each, and saves each change as it is made, with a toast: adding servers in the Add servers dialog saves on Continue, and removing a server from the list or connecting an account saves at once. How the agent's keys sign in to a server is now asked on the server's row in the sign-in view, not in the server picker: an added server that offers shared credentials lists the connected account beside them, and a server with only one shared credential uses it without asking. A red count on the tab shows how many of the agent's servers need someone to sign in. The Edit button is gone from the agent page and the agents list; the agent is renamed inline from its page title. The expired-connection "Review connections" link, Permissions' "Change servers", and the agent gateway's "reconnect it" message now link to the new tab, old edit links redirect there, and a platform rule on the Agent sign-in tab has a Change link to the setup flow's Agent sign-in step. The Activity tab is renamed Audit trail, and an agent's old Activity links land on it. Command K offers each editable agent's MCP sign-in tab.
• 175f853: Tool usage reads for an agent's identity page now find the agent's traces before grouping them, so they finish inside ClickHouse's time limit on busy projects. Filter options load only the groups the page shows. A totals read that stops partway returns an error instead of zero calls. Tool logs say when totals or the timeline could not load, with a Retry, and the dashboard no longer retries a read the server answered with an error.
• 58cde2a: Capture and check user prompts delivered through AHP turn-start events, including prompts from the OpenCode adapter.
• 31c4587: Tool calls and function resource reads that Speakeasy runs itself are now cancelled and answered with a JSON-RPC error (-32603, data.reason server_shutdown) when they are still running 45 seconds into a shutdown, instead of being cut off when the shutdown deadline closes their connection. Tool calls are marked retryable: false and resource reads retryable: true. Interrupted calls keep their telemetry log and tool call record, which show status 503 and the gram.tool_call.interrupt_reason attribute, log a warning, and count on the mcp.tool_call.shutdown_interrupted metric.
• 98dd071: The Amplitude catalog entry links to Amplitude's MCP documentation. The catalog seed now also adds a seeded documentation link to existing entries that have none, without replacing a link staff set in the registry editor.
• 375e12a: A dashboard connection now only works in the browser that started it: signing in, the consent page (including the Code Mode tool review), and finishing a sign-in to an upstream service started from that page. Another browser that opens any of these links is sent to start again. A connection now has ten minutes from when it starts, the same as a trusted-provider sign-in. When it runs out, the page says the link expired. A sign-in restarted because the earlier one was revoked gets a fresh ten minutes. Sign-ins already in progress when this ships finish as before. One exception: when the consent page is on a different host from the sign-in (a custom domain or the authentication host), a sign-in that was in progress while this was rolling out may need to be started again.
• 5a920a8: ChatGPT connections to the Platform MCP now always list every Platform tool directly, instead of the search, describe and call tools that run other tools by name. The ChatGPT app directory requires each operation to be its own tool. The Search Speakeasy Tools and Get Speakeasy Tool Details tools now state that they are not destructive.
• 4327322: Connection outcomes now name the right party to fix them. Expired sign-ins, and sign-ins the person ended, count as failures, not policy blocks. A sign-in an admin or the directory ended is blocked, and the admin fixes it. Refresh tokens sent by the wrong app, damaged saved connections and agent connections that no longer match their server get their own outcomes.
• ef3bf86: A server connection check on the connect page that fails before reaching the service now records a connection event with its reason and who can fix it. Its error page names the check, suggests retrying only for an outage, and no longer shows internal error text. Any unexpected error page now points to Speakeasy support if it keeps happening, instead of telling people to try again shortly.
• 4e06864: Name the signed-in Claude account on Cowork sessions from their first upload. Inside the Cowork VM, where no device agent runs, speakeasy-hooks now reads the account email Claude provides and sends it with each transcript upload. A Cowork session no longer shows as anonymous when its first turn reaches Speakeasy before the session's first OTEL export.
• c3ed8c5: Shared skill pages on custom domains now route to the server backend.
• d5c83fe: The setup wizard hides cards the organization's recorded stack can't use: a card shows only when one of its methods works with any vendor or belongs to a vendor in the stack, and nothing changes for an organization without a recorded stack. Create marketplace and Distribute MCP servers now apply to every stack, because the device agent installs from the same marketplace. Cursor's team marketplace setup moves out of Set up Anthropic admin controls into its own optional Set up Cursor admin controls card, which applies only to stacks with Cursor, and Cursor traffic from the device agent now confirms on the other-platforms card. Setup copy names the device agent's coverage (Claude Code, Cursor, OpenAI Codex, GitHub Copilot) and the Anthropic, Cursor, and OpenAI integrations.
• 8a86080: Slack platform tools on a server with no Slack token, a token Slack rejects, or a token without a needed scope now fail with an error that says what is missing and who can fix it, instead of a generic internal error. A tool call the caller has to fix now answers with the tool's own client-safe message and code on every path (direct /mcp/{slug} calls, assistants, Platform MCP, and gateways) instead of the generic "tool call was rejected as invalid or not permitted". Rejections that carry no such message keep the generic text.
• e613d5a: The setup wizard no longer has a separate Create marketplace card or a Distribute MCP servers group. Distribute MCP servers is now a single card that publishes the plugin marketplace and lets you choose the servers to distribute, as every card that needs the marketplace already does. Saved onboarding playbooks that listed the group or the old card move to Distribute MCP servers when the server starts, and older setup links to either one open Distribute MCP servers. The Managed MCP Distribution preset lists the card instead of the group.
• cd30ba9: With upstream auth enforcement on, a change to a server's derived authorization server no longer invalidates saved consent or an approved gateway connection, and people are told to reconnect whenever a new consent can offer them a connection. With enforcement on, detaching a server's own sign-in client stops the server offering it instead of failing with a conflict; the underlying association is preserved.
• 171a1a8: With upstream auth enforcement on, the Platform MCP connection status, connection test, catalog readiness, XAA readiness and identity provider attachment now follow the auth clients a server offers, instead of its sign-in's bindings and associations. The Okta resource connections page follows them too.
• d98087e: A refresh token from an MCP session that reached its length limit now keeps answering "refresh_token has expired" after the 30-second replay window, instead of "unknown or already used", so health views tell the person to sign in again rather than blaming the AI app.
• a5811dc: A gateway tool call refused because a server's sign-in or settings changed since approval now names the server and says whether reconnecting fixes it or an administrator must. Describing the server, its connection status and Code Mode give the same answer. Connection health records the administrator case as approval_needs_admin. The gateway consent page now lets a person choose between two connected services for one server when sign-in enforcement is off, instead of showing it as not set up.
• f6ee513: Gateways no longer list builtin servers as members, so consent pages and server lists show only servers they can reach.
• 70d1819: A failed hosted tool call, direct or through a gateway, now records its most specific client-safe error on its Tool logs row. A describe_server that cannot reach its member is logged as a failure on the gateway's discovery row. For describe_server and describe_tools, each member that could not be reached gets a failed row with the reason, listing only the tools the call asked of it.
• b575f9e: Connection health now records a gateway server whose sign-in setup an admin changed as setup_changed, apart from a server the person has not signed in to yet. It names the person when reconnecting fixes it and an admin when it does not.
• 3ebaf1d: Gateways record an authorization check only for the servers a call names. Admitting and listing members, filtering a server's tools, and building the consent page's tool inventory no longer record a denied mcp:connect check for every private server or tool the caller has no grant for, so an agent's Failed authorization checks show only real denials. A request records each named server's check once, and each distinct refused tool once. A call that names a public server whose toolset is private now records that toolset's denial on organization and agent gateways too. A direct hosted server's tools/list still records its connection check, but no longer one check per tool.
• 3d3b69d: Add a daily per-install summary of hooks versions, endpoint generations and install routes, with queries for one organization's hooks fleet.
• de550fa: The hooks binary reports its effective fail-open setting, whether a debug log is on, and its spool depth once a day on its first hook event, and the server records them on that hook row.
• 2ba0424: Serve the hooks@0.3.46 binary to hook installations. Previously pinned releases stay available so installations that have not regenerated their bootstrap script can still install.
• 7d52d75: With upstream auth enforcement on, an MCP server offers only the upstream sign-in clients configured for it. A server no longer picks up a client another server on the same User Identity issuer uses, or one a deleted server left behind. A server created on or moved onto an issuer it alone uses still offers the clients bound there. Deleting a server, gateway or toolset now also removes the sign-in bindings that gateway membership created for it.
• 3c84eb6: Consolidating a user session issuer onto another no longer stops when the same app is registered on both through its client metadata document, as Claude Code and Codex are. The source registration merges into the target's: sessions and consents move to it, a person who approved the same access through both issuers keeps the target's approval, and resources approved only through the source are added to it. A shared registration still blocks the migration when it was registered dynamically, or when an issuance selection profile ties it to the source issuer.
• f98c2a8: Failed OpenClaw gateway calls no longer stay "Pending" in Tool logs. OpenClaw's Codex harness sends an after-call hook for an MCP tool only when the call succeeds, so a failed call reported its start and nothing else. The OpenClaw observability plugin now reports, at the end of each run, every call still waiting for its result from the run's transcript: a failed call as a failure with its error, a successful one with its output. A call with no result in the transcript is not reported. Reinstall the plugin to get this. In Tool logs, a hook call with no result reads "Pending" for 10 minutes and "Unknown" after that, so calls from older plugins no longer look like they are still running.
• b2ca43a: The agent install step and the agent key install panel now have a folded "Need to update, reinstall or uninstall on OpenClaw?" section. It says that OpenClaw does not update the Speakeasy hooks plugin on its own, that running a new setup command replaces it, and gives the commands that remove the plugin and the speakeasy MCP server entry. A key issued from an existing agent's Install step now keeps the agent's hook ingestion grant, so a reinstalled hooks plugin can still send events. The agent install command now enables the OpenClaw plugin explicitly, so a reinstall after an uninstall does not leave it disabled.
• 6917e25: Organization gateways now include supported servers that offer typed upstream credentials when auth enforcement is enabled, even when a personal OAuth registration is not linked to the gateway sign-in. Connection setup and access checks still apply, and servers requiring caller-provided headers remain unavailable through the gateway.
• a108268: Platform MCP can read an agent identity: get_agent_mcp_access lists the MCP servers it may connect to, decided as its keys are checked (its own grants, its roles, and grants to everyone, where mcp:connect, mcp:read and mcp:write all count and blocks apply), the rules behind each, and whether it signs in with a shared credential, on behalf of named people, with no one assigned, or with the credential its own client sends. list_agent_authorization_checks lists its recent authorization checks with denials first, leaving out allowed org:hooks_ingest checks. Both use the dashboard's agent permissions. Member access reads now also count a grant that names a toolset-backed server by its toolset ID, as the dashboard's Access page writes it.
• 2bc5e0a: Connect on a Platform MCP server card now opens the server's sign-in page, which sets up sign-in and takes the user straight to the provider, instead of the server's Settings page. The card also shows the catalog name and logo, such as "Linear".
• 2a57b06: Platform MCP tools now show an inline result card in clients that render MCP Apps, such as ChatGPT. Each card links to the matching dashboard page: an MCP server, plugin, skill, risk policy, gateway, dashboard, or the section list when the exact page cannot be named. Reads show the resource, lists show a count and the first few rows, changes show what was done, and refused or unavailable calls show the reason with a request-access link when there is one. Analytics, logs, and results meant for the model stay text-only. Clients without MCP Apps and the managed assistant see the same results as before.
• 6550ba0: The Platform MCP plugin now ships a platform-sign-in skill. When the Platform tools are missing or a call fails with an authentication error, the agent walks the user through signing in for their client, including codex mcp login platform for Codex, which does not open the sign-in page for plugin MCP servers on its own. The other Platform workflows now point to this skill instead of asking the user to repair OAuth, and the marketplace README lists the Codex sign-in command.
• 9c35fe0: The Platform MCP plugin is now listed as "Speakeasy Platform" in Claude, Cursor and Codex marketplaces. The plugin name speakeasy and the MCP server name platform are unchanged, so existing installs keep working.
• a49fc60: The Speakeasy Platform Claude plugin now ships the Speakeasy icon at .claude-plugin/icon.png for its directory listing. Marketplace publishing to GitHub now supports binary files such as icons.
• ad1cb20: The Speakeasy Platform Claude plugin manifest now sets privacyPolicyUrl to Speakeasy's privacy policy, so the Claude plugin directory listing links to it.
• 017d978: Assistant runtimes no longer record a security event each time they start or stop. Every sandbox admits and withdraws its own workload identity, so a busy assistant filled the security log with hundreds of entries that no one had to act on. Creating the runtime's shared issuer, and any person withdrawing it, are still recorded as configuration changes. An agent's Credentials page now shows its running sandboxes as one "Assistant runtime" row with a count, instead of a row per sandbox.
• bb781ad: Remove the code that reads and serves external MCP deployment attachments. Tools from retired external MCP sources no longer resolve, on any deployment.
• b58ac33: Keep the selected server's resource and scopes when connecting a personal registration, including servers offering alternative providers and registrations without a legacy sign-in link. Strict providers no longer reject sign-in for a missing resource, and consent no longer asks to reconnect for account details the server does not request.
• 8554ffd: The Sentry catalog entry links to Sentry's MCP documentation.
• f98c2a8: A failed hook tool call now shows as failed in an agent session. Its result row is stored with an error finish reason, and a failure that carries no error text still gets a result row. The session drawer shows a red cross, a "Failed" label and the error as the call's output. A call with no result no longer gets a green check: it reads "Pending" for 10 minutes and "Unknown" after that, and a tool group with such a call is not marked complete.
• cd7d4d4: An agent session no longer shows as anonymous when its first prompt arrives before the session's identity telemetry. Once telemetry names the person, Speakeasy fills in the session's owner if it had none. It never replaces an owner already recorded and never adds one to a session an agent key produced.
• 8d91008: Sign-ups are now attributed to the campaign that brought the visitor. The sign-up page forwards its UTM parameters and analytics session to the login request, and the server attaches them, with the sign-up host, to the first-time sign-up and new organization events.
• fa6f37b: Fix connecting, disconnecting, refreshing and verifying a sign-in that an administrator added to an MCP server as a credential. Connecting now names the server as the requested resource, so providers that require a resource no longer refuse the sign-in, and rotate and delete confirmations list the servers that offer the client. These connections are now also refreshed and re-checked in the background, the auto-refresh choice applies to them, and connection links sent to a person complete for them.
• 9343348: Calling a tool the MCP server doesn't have is no longer shown in connection history as a Speakeasy error.