Changelog

Distributing MCP servers to your team is now much clearer. The Plugins pages show the real state of your marketplace setup with direct calls to action, a single install dropdown covers both GitHub and zip installation, and a new readiness bar on each MCP server page tells you exactly what's left before the server is usable — URL, authentication, source, and plugin membership. Remote MCP servers also gain a header management API for passing custom headers upstream.

Features

• Redesigned Plugins pages #4003 - The marketplace card now reflects real setup state: until the marketplace repo exists and a collaborator has accepted their GitHub invite, it shows a "Not published" state with Publish now and Add collaborators calls to action. A single Install dropdown (GitHub installation via marketplace, or direct zip download) replaces the old split button on both the Plugins index and detail pages, and zip downloads work even before the marketplace is set up. The Default plugin gets its own badge and description. (Author: @adaam2)
• MCP server readiness bar #4003 - Each MCP server page gains a collapsible readiness summary covering Server URL, Authentication, Source, and Included in Plugin status, with links to fix each item — so it's obvious what stands between a server and its users. (Author: @adaam2)
• Custom headers for remote MCP servers #4075 - A new header management API lets remote MCP servers carry custom headers, so upstream servers that expect extra headers can be connected without workarounds. (Author: @bflad)
• Clearer billing model breakdown #4071 - The billing page's model breakdown now separates the Risk Policy Analysis Model — the platform's own risk-scanning inference, the metered unit of tokens-under-management contracts — from the Completion Model used by chat surfaces like the playground and Slack. Risk-analysis inference is attributed to the scanned user, so user, role, and division breakdowns report whose traffic was analyzed. (Author: @daviddanialy)
• Hooks install from your org's marketplace #4017 - The hooks setup dialog's Claude Code instructions now install from your organization's published plugin marketplace, with copyable commands and managed-settings snippets, instead of a public repository that carried no credentials. (Author: @danielkov)

Bug fixes

• Remote MCP servers join the Default plugin reliably #4003 - MCP servers now attach to the Default plugin when they're enabled, so remote servers (which start disabled) no longer fail with "mcp server is disabled or has no published endpoint" when added. Adding a second endpoint to an already-attached server works, endpointless servers are hidden from the plugin's add-server picker, and removing a server's last address asks for confirmation. (Author: @adaam2)
• Accurate employee enrollment stats #4094 - The enrollment page no longer shows 0 tokens and stale activity for employees whose telemetry rows split across identity keys: usage rows carrying a user ID but no email now merge into the employee's summary, and role breakdowns resolve those users instead of bucketing them as Unassigned. (Author: @daviddanialy)
• Faster toolset listing #4089 - Listing toolsets no longer rebuilds every platform tool descriptor per tool, significantly cutting latency for projects with large toolsets. (Author: @walker-tx)

The billing page now answers "where did the tokens go?" in detail: pick any billing cycle and slice org-wide usage by token type, risk involvement, or analytics dimensions, then drill into any date range on the chart. Admins also get visibility into device agent adoption — the Employee Enrollment table shows whether each member's agent is checking in — and agent sessions now display the personal AI account email behind each session, not just the attributed work email.

Features

• Token usage breakdown on the billing page #3973 - A billing-cycle picker scopes a new Token usage panel to any contracted cycle. The stacked chart slices org-wide tokens by type (input, output, cache read, cache write), risk involvement, or analytics dimensions, with daily, weekly, and monthly granularity and a cumulative view. Click or drag across bars to drill into a range, type a custom period in natural language, and read per-metric cycle totals with sparklines in the details table below. Finalized cycles are served from durable billing snapshots, so historical numbers stay stable. (Author: @daviddanialy)
• Device agent status on Employee Enrollment #4066 - An admin-only Device Agent column shows whether each member's Speakeasy device agent is Active, Stale, or Not Enrolled, refreshes every 30 seconds, and is sortable — so it's easy to spot who is (or isn't) running the agent right next to their telemetry enrollment. (Author: @bradcypert)
• AI account email on agent sessions #3943 - Session list rows, transcript user messages, and the session details popover now show the email of the personal AI account behind a session (e.g. a Gmail on a Claude Max plan) alongside the attributed employee's work email. Attribution is also deterministic: the device-enrolled work email always takes precedence over the account's self-reported email. (Author: @daviddanialy)
• External credentials management API #3911 - Manage the AWS and GCP IAM credentials the AI Control Plane uses to authenticate into a customer cloud account through a new organization-scoped API, with per-provider create, update, get, and delete plus a filterable list. Access is gated on org roles and every change is audited. (Author: @bflad)
• Safer hook sign-in #3957 - Browser login for hooks now delivers the minted API key to the local listener as a form POST instead of a callback URL parameter, keeping the key out of browser history and request logs, and the sign-in tab closes itself once authentication completes. (Author: @danielkov)
• Observe pages restricted to org admins #3922 - The Observe section (Costs, MCP & Tools Insights, Employee Enrollment, Agent Sessions, and Tool Logs) is now gated on the org admin role, so basic members see an access-restricted notice instead of org-wide telemetry. (Author: @mfbx9da4)
• Issuer documentation links #4055 - Issuer discovery now captures RFC 8414 service documentation, policy, and terms-of-service URLs and surfaces them on remote session issuers across the project, organization, and admin views. (Author: @bflad)
• Reorganized remote sessions management API #3955 - The org-admin remote sessions service is split into per-resource services for issuers, clients, and sessions, mirroring the project-scoped layer. Note this is a breaking change for the management API and SDK: method names drop their redundant resource suffix (e.g. organizationRemoteSessionIssuers.createClient becomes organizationRemoteSessionClients.create). (Author: @bflad)

Bug fixes

• Billing charts match billed totals #4061 - The billing page's headline chart and every breakdown (model, user, division, role, source, token type) now read the billed population directly, instead of org-wide analytics aggregates that could overstate usage by orders of magnitude. (Author: @daviddanialy)
• Tool Logs status filtering #3975 - The response status filter now applies at the trace level, so status-less rows no longer leak successful traces into "Non-2xx responses", and the Tool Logs page gains a first-class Error, Success, Blocked, and Pending status filter. (Author: @simplesagar)
• Employee session counts from telemetry #3946 - The Agent Sessions card on the employee detail page now counts distinct sessions from telemetry instead of an email substring match against mirrored chats, so the number is consistent with every other metric on the page. (Author: @linear-code)
• Deleted MCP servers keep their tool-usage classification #4040 - A managed server's usage history no longer flips to shadow MCP classification once the server is deleted or recreated. (Author: @linear-code)
• Confirm before deleting a risk policy #3863 - Deleting a risk policy now asks for confirmation instead of removing it immediately. (Author: @alx-xo)

Shared chat histories are now easier to navigate as a team. Each thread and user turn can show who wrote it — name and avatar included — and opening a thread someone else created shows a read-only transcript instead of a composer that would fail on send.

Features

• Attribute chats to their creator #3930 - An opt-in history.resolveCreator callback resolves a chat's userId or externalUserId to a displayable name and avatar, shown on thread-list rows and above each user turn in the transcript. The dashboard wires this up for the Project Assistant using its existing org member list, so no identity data is fetched from inside Elements itself. User message bubbles also get an iMessage-style blue treatment. (Author: @adaam2)
• Read-only view of threads you don't own #3931 - An opt-in history.isOwnChat callback reports whether the caller owns a thread, and the composer is hidden for threads they didn't create. Admins opening another member's chat now see a read-only transcript instead of a "chat not found" error on send. (Author: @adaam2)

Bug fixes

• Chat MCP tools restored #3831 - Chat MCP tool connections no longer fail with an "Illegal invocation" fetch error that left chats without their configured MCP tools. Opening a chat via a shared ?threadId= URL also reliably restores the linked conversation instead of sometimes landing on a new empty thread. (Author: @danielkov)
• One-click dismissal for the time range picker #3862 - Clicking outside the TimeRangePicker while its input is in edit mode now exits editing and closes the dropdown in a single click. Typed-but-uncommitted text no longer makes the dropdown undismissable and is discarded on outside click. (Author: @daviddanialy)

MCP servers that live behind a firewall can now join an AI Control Plane project: run the new tunnel agent next to the server and the AI Control Plane routes traffic to it, no inbound network access required. On the risk side, a built-in exclusions library now suppresses well-known false positives — test credit cards, example API keys, placeholder emails — so risk events stay focused on findings that matter.

Features

• Tunneled MCP servers #3703 - MCP servers running in a private network can now be added as tunneled sources. The tunnel agent ships as a public Docker image (ghcr.io/speakeasy-api/gram-tunnel-agent:latest, linux/amd64 and linux/arm64) that runs alongside the server and connects out to the AI Control Plane, and the tunneled MCP server page includes Docker and Kubernetes setup instructions. (Author: @ThomasRooney)
• Built-in exclusions library for risk detections #3895 - Known false positives — test credit card numbers, example API keys and tokens, module and content hashes, and placeholder emails — are now suppressed automatically across all detection sources. A read-only Built-in library section on the Exclusions tab lists the live catalog, backed by the new risk.listBuiltinPresets endpoint. (Author: @dennnis-ez)

Bug fixes

• Session status reflects refresh expiry #3936 - A session's active or expired status is now keyed off its refresh token expiry, so sessions that can still refresh no longer show as expired. (Author: @linear-code)
• Non-Corporate Accounts policy card restored #3940 - The Non-Corporate Accounts detector — including its approved-email-domains configuration — is back on the risk-policy detail form after being dropped in a refactor, and the Off-Policy Content card no longer appears twice. (Author: @daviddanialy)

Policy authors can now prove a prompt guardrail works before rolling it out: a new evaluation workbench replays real chat transcripts through a policy and shows per-message judge verdicts, with verdicts saved as regression sets for future changes. A new Non-Corporate Accounts risk policy flags sessions authenticated with personal AI accounts or unapproved email domains, and assistants can now connect directly to remote MCP servers alongside their toolsets.

Features

• Policy evaluation workbench for prompt guardrails #3924 - Replay real chat transcripts through a prompt guardrail and see per-message judge verdicts with cost and latency details before enforcing the policy. Reviewer verdicts can be saved, listed, and deleted as regression sets, so a policy edit can be checked against past decisions instead of guesswork. CEL scopes are supported in replay. (Author: @vishalg0wda)
• Flag sessions from personal AI accounts #3861 - A new Non-Corporate Accounts risk-policy category flags sessions authenticated with a personal AI account or with an AI-account email domain outside an approved list you configure. Findings appear once per session on the Risk Events page, and the approved-domains list is editable in the Policy Center's Customize sheet. (Author: @daviddanialy)
• Attach remote MCP servers to assistants #3831 - Assistants can now connect directly to MCP servers, including remote (external SaaS) and tunneled servers that aren't backed by an AI Control Plane toolset. The assistant setup chat can list the project's MCP servers and attach one by name, and the assistant's runtime connects to it alongside its toolsets. (Author: @danielkov)
• Self-serve sign-in for hook plugins #3824 - Connecting the hooks plugin no longer requires Python or manual API key setup. On session start the plugin opens the dashboard in a browser, receives a hooks-scoped API key on a localhost callback, and caches it per device. Machines that have never signed in aren't blocked — sessions proceed with a warning, and enforcement only becomes strict after the first successful sign-in. (Author: @danielkov)
• Track skill activations in Codex sessions #3896 - Opening a skill's SKILL.md or mentioning a skill by name in a Codex session now surfaces as skill.activated events in observability, matching the visibility already available for Claude Code sessions. (Author: @danielkov)
• Email org admins when an access request is submitted #3221 - Org admins now get an email when a new access request comes in, so requests are noticed and approved without anyone having to watch the dashboard. (Author: @alx-xo)
• See which account an employee used last #3909 - The Employees page's Last Activity column now shows the most recently used AI account as a dropdown, with icons distinguishing team accounts from personal ones (#3858 by @chase-crumbaugh). (Author: @daviddanialy)
• Refresh list pages in place #3860 - Catalog, MCP, Agent Sessions, Employee Insights, User Sessions, Risk Events, and the Observe Tools and Agents log pages now have a manual refresh button in the toolbar, so the latest data is one click away without reloading the page. (Author: @simplesagar)
• Assistant setup chat history is preserved #3811 - Prior onboarding threads with the assistant setup chat are now listed and URL-addressable, so a setup conversation can be picked up where it left off or shared with a teammate. (Author: @claude)
• Groundwork for shared remote session providers #3812 - An internal admin API now manages a platform-wide catalog of remote session providers, laying the foundation for projects to inherit shared providers in a future release. (Author: @walker-tx)

Bug fixes

• Restore MCP tools in chat #3831 - Chat MCP tool connections no longer fail with an "Illegal invocation" fetch error that left chats without their configured MCP tools, including the assistant setup chat. Opening a chat via a shared ?threadId= URL also reliably restores the linked conversation instead of sometimes landing on a new empty thread. (Author: @danielkov)
• View teammates' assistant chats read-only #3931 - Admins opening another member's project assistant chat now see a read-only transcript instead of hitting a "chat not found" error on send. The composer is hidden for threads the signed-in caller didn't create, matching what the backend has always enforced. (Author: @adaam2)
• Let environment editors edit environments #3916 - Creating, updating, and deleting environments now checks the environment:write permission instead of project:write, so principals holding only environment:write are no longer rejected. Dashboard gates were realigned to match. (Author: @qstearns)
• Recover from stale hooks credentials #3901 - Cached hook credentials that are rejected on auth are now cleared automatically, so Claude prompt submission continues and the user is prompted to reconnect instead of getting stuck. (Author: @danielkov)

Assistant messages made up entirely of tool calls no longer show a stray copy button with nothing to copy.

Bug fixes

• Hide the copy button on tool-only turns #3834 - A message consisting solely of tool calls or reasoning has no copyable text, so the lone copy button no longer hangs beneath it. (Author: @disintegrator)

Costs, Insights, Agent Sessions, Tool Logs, and Employees now break down AI usage by account type (Team versus Personal) and provider (Claude, Codex, Cursor), with per-account cost estimates spelled out clearly. Logging in to the CLI as a device agent is also more secure, using a one-time PKCE code instead of passing a raw key in a URL.

Features

• Break down AI usage by account type and provider #3755 - Costs, Insights, Agent Sessions, Tool Logs, and Employees now split AI usage by account type — Team (enterprise) versus Personal (individual, e.g., Claude Max) — and by provider (Claude, Codex, Cursor). Personal usage is flagged at a glance on sessions and logs, and each employee's linked AI accounts are listed with the option to scope their metrics to a single account. (Author: @daviddanialy)
• Clearer cost estimates #3755 - Cost now reads as "Est. cost" (with an explanation on hover) everywhere it appears in Costs and Insights, since the figure is derived from token usage at standard API rates and only reflects real spend on metered accounts, not flat-fee plans like Claude Max, Pro, Team, or Enterprise. Admins can declare a provider integration's billing mode — Metered, Flat rate, or Unknown — under Settings → Logging & Telemetry, and once an account is declared metered, its cost reads as a confident "Cost". (Author: @daviddanialy)
• Secure CLI device-agent enrollment #3810 - A new cliAuth service backs device-agent enrollment: the dashboard CLI callback authorizes a PKCE-bound one-time code against an active session, then redeems it for a per-user API key without the raw key ever traveling in a URL. Existing CLI producer-key login is unchanged. (Author: @bradcypert)
• Surface Claude attribution dimensions in the cost explorer #3638 - Telemetry query results and the cost explorer now surface Claude attribution dimensions, giving a clearer view of where usage and cost originate. (Author: @subomi)

Bug fixes

• Show historical findings for disabled policies in Risk Events #3847 - Filtering Risk Events by a disabled policy previously returned no results because the query required the policy to be enabled. An explicit policy filter now surfaces that policy's past matches, and the dashboard flags the inactive policy with a banner and an "(inactive)" label in the filter. The default unfiltered view is unchanged and still lists only active policies. (Author: @daviddanialy)
• Drop false-positive US driver's license findings #3836 - US_DRIVER_LICENSE Presidio findings are now dropped at the finding level so they never surface, even when a policy pins no entities and Presidio scans its full default recognizer set. (Author: @disintegrator)
• Fix dropped connections on function-runner calls #3846 - HTTP keep-alives are now disabled on function-runner calls, and that path gets its own timeout, so retries dial fresh connections instead of reusing pooled connections to Fly machines that were autostopped mid-flight (which surfaced as instant EOF errors). The timeout now sits above the runner's five-minute execution budget, so long tool calls are no longer cancelled by the caller. (Author: @disintegrator)
• Fix a nil pointer panic in telemetry SearchUsers #3843 - Calling telemetry SearchUsers without a filter no longer panics. (Author: @disintegrator)
• Adjust API endpoint paths to RPC conventions #3825 - Internal API endpoint paths were adjusted to follow existing RPC API conventions. (Author: @disintegrator)

New assistants and in-app model usage now default to Claude Sonnet 5, available across the playground, Elements, and onboarding model pickers.

Features

• Default to Claude Sonnet 5 #3758 - Claude Sonnet 5 (anthropic/claude-sonnet-5) is now the default model for in-app usage and newly created assistants, added to the allowlist and every model picker across the playground, Elements, and onboarding. Specialized models used for risk and PromptIntel judging, chat segmentation, embeddings, and follow-on suggestions are unchanged. (Author: @simplesagar)

New assistants and in-app model usage now default to Claude Sonnet 5. Remote session clients can also be created at the organization level, so every project can share one instead of configuring its own, and admins get finer control over who can unmask redacted secrets in Risk Events.

Features

• Default to Claude Sonnet 5 #3758 - Claude Sonnet 5 (anthropic/claude-sonnet-5) is now the default model for in-app usage and newly created assistants, added to the allowlist and every model picker across the playground, Elements, and onboarding. Specialized models used for risk and PromptIntel judging, chat segmentation, embeddings, and follow-on suggestions are unchanged. (Author: @simplesagar)
• Organization-level remote session clients #3749 - Create a remote_session_client with no project so every project in the organization can attach and use it, mirroring the existing convention for organization-level remote session issuers. A project admin can attach, detach, and use an organization-level client from their own session issuer, but editing or deleting it stays with org admins. (Author: @bflad)
• Restrict who can unmask redacted secrets #3766 - Server-side controls now govern who can reveal redacted secrets flagged in chat, giving admins a way to restrict access to sensitive matched values. (Author: @qstearns)
• Human-readable plugin marketplace names in Claude Code #3763 - Plugin marketplaces now send a human-readable display name to Claude Code, so plugins show with their admin-entered name and capitalization (e.g., "MoonPay MCP Servers") instead of a de-slugified lowercase name ("Moonpay mcp servers"). (Author: @bradcypert)
• Unified endpoint for third-party hook ingestion #3661 - A single /rpc/hooks.ingest endpoint now accepts hook events from any third-party provider. Hook plugins authenticate each developer locally through a browser callback flow and store a hooks-scoped key on the device, while existing provider-specific hook endpoints keep working. (Author: @danielkov)
• Redirect URI callout for remote identity provider clients #3762 - The Remote Session Client form now surfaces the callback URL needed when manually configuring a remote identity provider client, making the setup step easier to complete correctly. (Author: @qstearns)
• Caching for public OAuth and MCP metadata endpoints #3761 - Public well-known OAuth/MCP metadata responses now send Cache-Control: public, max-age=60 and a strong ETag with 304 revalidation, so clients and proxies can cache them. The OAuth Client ID Metadata Document keeps its one-hour max-age and also gains an ETag. (Author: @bflad)

Bug fixes

• Gate secret reveal behind the chat:read scope #3764 - Users without the chat:read scope now see flagged secret values in Risk Events as a non-interactive "Hidden" placeholder instead of a reveal control, and the page-level "Reveal all" toggle is hidden for them. (Author: @simplesagar)
• Add session_capture_exclusions table #3528 - Internal schema migration adding a session_capture_exclusions table. (Author: @simplesagar)

Remote session OAuth now works with identity providers that require Client ID Metadata Documents (CIMD), so organizations with stricter upstream authorization servers can register outbound clients without a shared secret.

Features

• Outbound CIMD support for remote session OAuth #3706 - Create a remote_session_client in CIMD mode: the AI Control Plane generates the client ID, hosts a public client metadata document, and sends that URL as the client ID on every outbound authorize, token, and refresh call, with no symmetric secret required. Issuer discovery now detects CIMD support automatically, which gates the new option, and the client and issuer views surface the metadata URL and support status. (Author: @bflad)

Context an application injects into a user turn no longer clutters the conversation. It now folds into a collapsible disclosure that's there when needed and out of the way otherwise.

Features

• Collapse injected context into an "Additional context" disclosure #3721 - App-injected context in a user turn now folds into a collapsed Additional context disclosure that expands to inspect, instead of rendering the raw tags inline. The expanded block wraps to the message width, so opening it no longer widens the chat bubble. (Author: @adaam2)

Organizations get more control over access and risk detection this release: the built-in admin and member roles can now be tailored per organization, and risk policies gain a sensitivity slider for tuning how aggressively detections fire. Shadow MCP enforcement is also hardened against a couple of false results.

Features

• Editable system-role permissions #3727 - Edit the permissions of the built-in admin and member roles per organization, while their name and description stay platform-managed. The Admin role is guarded against losing the org:admin permission to prevent an org lockout. The roles tab is reworked so the whole role row opens the edit sheet, scope groups show a description when collapsed, and the members column uses an interactive member facepile with hover focus and click-to-view-all. Directory Sync (SCIM) organizations see info alerts on the team, roles, and identity pages explaining that members and roles are managed by the identity provider while SCIM is enabled. (Author: @adaam2)
• Configurable risk detection sensitivity #3723 - Each risk policy now has a minimum match-confidence threshold, adjustable with a Sensitivity slider in the policy wizard, so detections can be tuned to be more or less aggressive. The default sensitivity is lowered to 0.5. (Author: @dennnis-ez)

Bug fixes

• Harden Codex shadow MCP enforcement #3719 - Codex shadow MCP calls are now checked against the session's actual MCP server inventory, closing a gap where enforcement could be bypassed. (Author: @danielkov)
• Fix Cursor shadow MCP enforcement false positives #3720 - Cursor shadow MCP enforcement no longer wrongly blocks Speakeasy-hosted MCP servers when a shadow MCP risk policy is enabled. Access is now decided by the server URL rather than requiring the agent to echo an internal identifier. (Author: @danielkov)
• Fix duplicate servers in the MCP catalog #3310 - The MCP catalog no longer lists duplicate servers (with an inflated count) when loading more results. (Author: @alx-xo)

A new RBAC scope lets you decide who can read other members' agent session transcripts. Everyone can always read their own sessions; reading everyone's now requires an explicit grant.

Features

• chat:read scope for agent session transcripts #3688 - A new chat:read scope gates access to other members' agent session transcripts: anyone can read sessions they own, while reading every member's session requires an unrestricted chat:read. The scope is not a default of any system role — not even admin — so it must be granted via a custom role. Members without it see only their own sessions, and each dashboard session open is recorded in the audit log. (Author: @adaam2)

A handful of Project Assistant improvements land together: rename conversations inline as you work, see at a glance who owns each assistant, and keep the chat clean with app-injected context folded into a collapsible disclosure.

Features

• Rename assistant chats from the live chat view #3649 - The dock header shows the active conversation's title and lets you click to rename it inline. Names you set are kept — automatic title generation skips any chat you've renamed, and clearing the title re-enables auto-naming. (Author: @simplesagar)
• See who owns each assistant #3709 - An assistant's creator is now shown as its owner — an avatar and name on both the assistant card and the setup page — resolving to the creating member, "No owner" when never attributed, or "Orphaned, no owner" when the creator has left the organization. (Author: @simplesagar)
• Tidier injected context in assistant chats #3721 - App-injected context in a user turn now folds into a collapsed Additional context disclosure you can expand to inspect, instead of rendering the raw tags, and the expanded block wraps to the message width so opening it no longer widens the bubble. (Author: @adaam2)

Two chat-detail fixes land together: the "Risky only" filter now finds flagged messages no matter where they sit in a long thread, and search steps through every match in order instead of highlighting them all the same color.

Bug fixes

• Fix "Risky only" filter missing findings on other pages #3715 - The filter previously showed nothing when flagged messages sat on transcript pages that weren't loaded. chat.load now returns the seqs of flagged messages so the panel can window the full thread and filter correctly, and the toggle is available to any authorized viewer rather than only org admins. (Author: @adaam2)
• Step through search matches one at a time #3715 - Search-within-thread now steps through every occurrence in document order, across message text and tool call arguments and output, with the active occurrence highlighted distinctly, instead of jumping per message and highlighting every hit the same color. (Author: @adaam2)

When the risk engine blocks a tool call it's now a durable, linkable page with thumbs-up/down feedback — and the reason is handed back to the agent so it explains the denial instead of inventing one. Agent Sessions also gain an agent-type filter.

Features

• Durable tool-call block pages #3672 - Blocked tool calls are now first-class entities with a stable /blocks/<id> URL and 👍/👎 feedback. The block reason is injected into the agent-facing response (Claude, Cursor, and Codex) with a link to the block page, so the agent can reason about the denial instead of hallucinating one, and a More Info link reaches it from the Risk Events modal. (Author: @daviddanialy)
• Filter agent sessions by agent type #3712 - The Agent Sessions page gains an agent-type filter, populated from the agent sources actually present in each project's chats. (Author: @simplesagar)
• Read-only and destructive labels in Distribute MCP tools #3713 - The Distribute → MCP → Tools view now shows the same text permission labels (Read-only, Destructive, Idempotent) as the Connect catalog, instead of icon-only badges, for quicker at-a-glance behavior hints. (Author: @daviddanialy)
• Up-to-date badge on plugin detail #3708 - The plugin detail page now shows an explicit Up to date badge and surfaces the last-published time even when there are unpublished changes, rounding out the publish-freshness view. (Author: @daviddanialy)
• Shorter access-request links on blocked tool calls #3710 - The "Request access" link on a blocked tool call now embeds a short cache-backed token instead of a 1,000-plus character encrypted blob, with previously issued links still working until they expire. (Author: @daviddanialy)

Bug fixes

• Risky-only filter and in-thread search reworked #3715 - The chat detail "Risky only" filter now windows the full thread and shows flagged messages even when they sit on other transcript pages, and search steps through every occurrence in document order — across message text and tool call arguments and output — with the active match highlighted distinctly. (Author: @adaam2)
• Prompt correlation no longer stalls on busy sessions #3716 - Claude Code prompt correlation now bounds its work and drains a large backlog of unlinked prompts incrementally, so prompts stay reliably linked to their telemetry instead of failing entirely on high-volume sessions. (Author: @danielkov)
• Detect step Continue enables for category-level detectors #3714 - Creating a risk policy now enables the Continue button when only category-level detectors (Prompt Injection, Shadow MCP, Destructive Tools, Destructive CLI Commands) are selected, instead of treating those categories as empty and keeping the step disabled. (Author: @daviddanialy)

Project Assistant chats can now be renamed right from the live chat view instead of navigating elsewhere first.

Features

• Rename assistant chats from the chat view #3649 - Click the conversation title in the chat header to edit it inline. Manually chosen names are preserved. Automatic title generation skips any chat that's been renamed, and clearing the title re-enables auto-naming. (Author: @simplesagar)

Pin important conversations to a dedicated section above your recent chats, and republish a plugin in one click straight from its detail page — with an at-a-glance badge that tells you whether what's live matches what you've changed.

Features

• Pin chats on the chat page #3670 - Pin and unpin conversations on the chat page; pinned chats surface in a dedicated Pinned section above Recent Chats so the ones you return to stay within reach. (Author: @simplesagar)
• Publish plugins from the detail page #3690 - After adding or removing a server or editing a plugin's metadata, a Publish now prompt offers a one-click republish — or opens the first-publish dialog for projects not yet connected to GitHub — so there's no need to return to the plugins list. The page also shows publish freshness: an Unpublished changes badge when the live state differs from what was last published, or the last published time when up to date. (Author: @daviddanialy)

Bug fixes

• Faster tool observability filters #3699 - The logs and insights pages now read hosted MCP server display names straight from telemetry filter options instead of hydrating full toolset resources for server filter labels, so those filters load faster. (Author: @danielkov)
• Long chat searches no longer error #3700 - The find-in-conversation bar now gates queries at 200 characters and flags the over-limit state inline — the search icon turns into a red warning with a tooltip and the match counter shows a live count — instead of failing with a hard validation error. (Author: @adaam2)

Every subject in the org audit log now links to its own detail page so you can pivot from an event to the thing it happened to, and org admins can register a standalone remote session client directly from the Remote Identity Provider page.

Features

• Jump from any audit log entry to its subject #3683 - MCP servers, risk policies, environments, assistants, roles, members, and collections now render as links in the org audit log, alongside the deployments, toolsets, projects, plugins, and API keys already linked. Project-scoped subjects route under their own project, and risk policies and roles deep-link to the specific item. (Author: @simplesagar)
• Register a remote session client from the issuer page #3678 - Org admins can create a standalone client directly from a Remote Identity Provider's Clients tab via a new New Client sheet, supporting Dynamic Client Registration when the issuer advertises a registration endpoint or manual client ID and secret entry. The client inherits a project-scoped issuer's project, or the admin names a project when the issuer is organization-level. (Author: @bflad)
• See chat titles in the cost dashboard #3677 - The cost dashboard's session table now shows each chat's title in place of its id, so spend is easier to attribute to the conversation that drove it. (Author: @adaam2)
• Hook event processing metrics #3685 - Hook event processing duration is now measured for Claude, Codex, and Cursor hook traffic, giving clearer visibility into hook performance. (Author: @subomi)

Bug fixes

• Shadow MCP enforcement survives a missing session snapshot #3614 - The Claude hook shadow-MCP guard no longer depends on the server having cached the SessionStart MCP inventory in time: the inventory is persisted per session and replayed in the blocking PreToolUse payload, so enforcement stays reliable and still fails closed when no inventory is available. (Author: @bradcypert)
• Combined session filters no longer return empty #3673 - Session list dimension filters now match per-chat instead of per-row, so combining a user-directory filter such as department with a hook source no longer comes back empty when those attributes live on different rows of the same chat. (Author: @subomi)

Long chat threads are easier to navigate now: a find-in-conversation bar jumps between matching messages instantly, backed by full server-side text search instead of only scanning what happens to be loaded on screen.

Features

• Search within a chat thread #3634 - Jump between matches with prev/next controls, or Enter/Shift+Enter to step forward and back (wrapping at the ends), and Escape to clear. The active match highlights in bright yellow against paler surrounding matches across message text, tool names, and tool arguments and output, and the tool call holding the active match expands automatically. Powered by a new query parameter on chat.load that returns matching messages plus surrounding context. (Author: @adaam2)

A dedicated User Sessions page brings every active session together under the Identity nav, with filters, per-server session panels, and one-click revoke. Setting up SSO and directory sync is smoother too, with the Configure buttons now routing through the in-product setup wizard.

Features

• User Sessions page #3524 - A filterable User Sessions page under the organization Identity nav lists every session with its issuer, client, resolved subject identity, and status, and lets you revoke. Facet filters cover status, client, user, and MCP server, and each MCP server's Authentication tab gains its own sessions panel with right-click and menu revoke plus brand-themed status badges. (Author: @simplesagar)
• Read-only session tools for assistants #3524 - Two new platform tools, list_user_sessions and get_user_session, let an assistant inspect active sessions safely. (Author: @simplesagar)
• Bulk session management on MCP Connections #3581 - The org-level MCP Connections page adds multi-select with select-all to revoke sessions in bulk, a search box, a status filter, and brand status badges. (Author: @simplesagar)
• Guided SSO and directory sync setup #3547 - On the Identity page, the SSO and Directory Sync (SCIM) Configure buttons route to the in-product setup wizard until a connection exists, then open the WorkOS portal to manage it — so admins start in the right place instead of being dropped into the admin portal cold. (Author: @simplesagar)
• Standalone remote-session clients #3640 - Remote-session clients now manage their identity-provider attachments through dedicated attach and detach endpoints and can be created standalone with zero or more issuers, giving cleaner control over how clients map to issuers. (Author: @bflad)

Investigating long agent chats and MCP traffic just got far more capable. Search the full text of a conversation and jump between matches, scroll a transcript with tens of thousands of messages without it bogging down, jump straight to just the risk findings, and analyze tool-call activity for any single MCP server.

Features

• Search within a chat thread #3634 - The chat detail sheet gains a find-in-conversation bar backed by full-thread server-side search. Jump between matches with the prev/next controls or Enter/Shift+Enter, the active match is highlighted across message text, tool names, and tool arguments and output, and the tool holding it expands automatically. (Author: @adaam2)
• Smooth, virtualized transcripts with a risk-only view #3590 - Even a chat with tens of thousands of messages scrolls smoothly: the transcript is paginated and virtualized with infinite scroll that keeps your place. A risk-only view returns just the messages with active findings, padded with surrounding context and grouped into expandable segments. (Author: @adaam2)
• Accurate conversation totals #3601 - Counts in the filter bar now reflect the whole conversation instead of just the loaded page, so a 19,000-message chat no longer reports "Showing 150 of 150 entries" and the risk count agrees with the risk-only view. (Author: @adaam2)
• Per-server MCP analytics #3470 - Each MCP server's details page gains an Analytics tab scoped to that server across both remote-backed and toolset-backed activity: a time-range picker, trend cards for tool calls, failed calls, error rate, and average latency, a tool-calls time series, and top tools by call count and by failure rate. (Author: @bflad)
• Drag-to-zoom on charts #3516 - Select a time window directly on dashboard charts to zoom into the period you care about. (Author: @alx-xo)
• Search the Assistants list #3544 - A search box above the Assistants list filters the grid by name and model, with a clear "no matches" message when a query comes up empty. (Author: @simplesagar)
• Faster tool logs #3542 - The tool logs page loads noticeably faster. (Author: @chase-crumbaugh)

Bug fixes

• Leaner, more reliable registry catalog #3622 - The registry list view no longer pulls full tools lists into its response, shrinking the payload and making the catalog hold up better on flaky networks. (Author: @qstearns)
• Cmd+K focus and ranking #3582 - Recently visited pages show only when the search box is empty, so a closer text match always ranks first, and the closest result keeps the auto-selected highlight without an extra keypress. (Author: @simplesagar)
• Filter sheet options now apply #3526 - The multiselect controls in the unified filter sheet now register clicks, so filters on the MCP & Tools and Insights pages respond again. (Author: @bflad)
• Agent filter reloads data #3545 - Selecting an agent on the MCP & Tools insights page now updates the tool usage summary instead of leaving the graphs unchanged. (Author: @bflad)

This release smooths a lot of rough edges. Assistants pick up newly connected integrations mid-conversation and stop churning their runtimes, hooks fail safely and retry transient errors instead of dropping events, Speakeasy Functions ride out load spikes, and token and cost counts come out right for coding sessions.

Features

• Assistants pick up MCP changes mid-conversation #3013 - When you attach or remove an MCP server, the assistant reconciles its live connections on the next turn instead of staying blind to the change until its runtime restarts — so a newly connected integration like GitHub MCP is usable right away. (Author: @danielkov)
• Organization-level observability mode for hooks #3565 - Turn on a mode, from the organization logging settings, that makes generated hook plugins fully non-blocking, so they only observe and report and can never deny or delay a tool call. It defaults off, preserving existing behavior. (Author: @danielkov)
• Speakeasy Functions ride out saturation #3627 - Tool-call and resource-read requests now retry on a saturated runner's 429 and Fly's 503 with jittered backoff instead of surfacing transient saturation as a hard failure, and recovered attempts log as warnings rather than errors. (Author: @bflad)
• Function concurrency sized to real capacity #3591 - Function concurrency limits now track actual execution capacity, so a memory bump no longer inflates the request cap, and a saturated runner returns a retryable response instead of dropping the connection. (Author: @bflad)
• Operator memory and scale overrides persist #3543 - Function deployments now prefer operator-set memory and scale overrides and carry them forward across redeploys, so a later customer deploy no longer resets them. (Author: @bflad)

Bug fixes

• No more assistant runtime teardown loops #3551 - A single bad assistant turn no longer tears down and recreates its runtime forever: errors from a live runtime are treated as terminal and capped, and a hard ceiling fails a stuck event instead of churning machines indefinitely. (Author: @danielkov)
• Idle assistant VMs are reaped #2821 - Stopped per-thread runtime VMs are now reaped after 14 days idle instead of waiting for the whole assistant to fall silent, so busy projects stop accumulating orphaned machines while a dormant thread still cold-launches into the same app. (Author: @danielkov)
• Truncated tool calls no longer wedge threads #3549 - A model response cut off mid-tool-call is dropped at capture, with the preceding messages kept, so the thread stays usable instead of failing and retrying forever. (Author: @danielkov)
• Chat deletion guards for active assistants #3592 - Deleting a chat that backs an active assistant is now blocked and returns a conflict, instead of soft-deleting the conversation out from under a running assistant. (Author: @danielkov)
• Assistants recover from a deleted backing chat #3593 - A chat that backs an active assistant clears its soft-deleted state automatically on the next message, so an assistant whose chat was deleted out from under it recovers; chats with no active assistant stay deleted. (Author: @danielkov)
• Accurate token totals for coding sessions #3620 - Per-session and per-user totals now derive from input plus output tokens when a provider omits an explicit total, fixing "0 tokens" readings for Claude Code and similar AI-coding sessions. (Author: @simplesagar)
• Hardened hook ingest #3560 - Hook senders retry a dropped request with backoff instead of blocking the tool call or losing the event, and the server de-duplicates redelivered events so each is recorded exactly once. (Author: @danielkov)
• Hooks fail closed when the AI Control Plane is unreachable #3522 - The Cursor hook now emits a deny with a readable reason when the AI Control Plane is unreachable or returns an error, instead of silently allowing the call and bypassing blocking policies, and sends its MCP inventory on stdin so large inventories no longer risk dropping telemetry. (Author: @bradcypert)
• Clearer hook verification message #3556 - When an MCP tool call can't be verified, the deny reason now tells you to restart Claude or run /reload-plugins and includes an error code, instead of implying the session is still initializing. (Author: @danielkov)
• Per-session identity isolation in batched logs #3525 - When a collector or gateway re-batches multiple sessions into one OTLP logs export, each Claude Code session keeps its own identity, so a session is never cached or authorized with another session's email or organization. (Author: @bflad)
• Trusted trace boundaries on public routes #3663 - Public MCP and OAuth routes start a fresh server-side trace per request and record the inbound trace context as a link, so third parties can't merge unrelated requests into one trace or steer your trace IDs. (Author: @bflad)
• Cleaner challenge list #3628 - Challenges raised by users outside the organization, such as a staff member impersonating a customer org, are filtered out so they no longer clutter the list or skew its counts. (Author: @adaam2)

Agents can now react to what happens in the tools your team already lives in. A shared webhook-trigger foundation lets Slack, Linear, and GitHub events drive your agents, with signature verification, delivery de-duplication, and event filtering handled for you — so wiring up a new source is a matter of pointing it at the AI Control Plane.

Features

• Linear webhook triggers #2729 - Drive agents from Linear events with verified HMAC-SHA256 signatures and Linear-Delivery de-duplication. Comments fold onto their parent issue's conversation, so an agent sees the full context of an issue rather than scattered events. (Author: @danielkov)
• GitHub webhook triggers #2729 - Drive agents from GitHub events with verified sha256= signatures and X-GitHub-Delivery de-duplication. Pull request, review, and comment activity correlates onto the PR, and pushes onto their repo and branch, so related events arrive as one coherent conversation. (Author: @danielkov)
• A shared foundation for webhook sources #2729 - A common webhook-trigger abstraction centralizes signature verification, replay protection, and a default-deny event-type allowlist with CEL filters, so every source — including the existing Slack trigger, now rebuilt on it — behaves consistently and new sources land quickly. (Author: @danielkov)