// August 3, 2026v1.4.0
Platform
Security and Policy
Allow-all shadow MCP policies are now operable from the surfaces you actually work in. The inventory shows which servers are allowed by default and which a rule blocks, the per-server action becomes Block Server or Unblock Server, and approving a bypass request unblocks the server for everyone in the project instead of granting one person a private exception. The project assistant can also deliver the skills it writes, attaching them to a plugin or assistant without handing you back to the dashboard to finish.
Features
- Inventory and status surfaces know your policy's posture #4596 - Under an allow-all policy the inventory marks a server blocked only when a block rule names its URL and allowed by default otherwise, the status banner reads "Allowing by default", and the primary action on a row or detail view flips to Block Server / Unblock Server. Each action edits the block rule for that one URL, so it is safe to run alongside others. A project holding both dispositions from earlier edits resolves deny-by-default. (Author: @alx-xo)
- Approving a request on an allow-all policy unblocks the server for everyone #4597 - From the approvals page or the inventory review flow, approving a bypass request against an allow-all policy removes the server's block rule project-wide rather than granting one principal an exception; revoking restores the block, and denying changes nothing. The approval sheet skips the audience and policy pickers and says plainly that approval applies to the whole project. Block-all policies keep their per-principal bypass behavior, and every decision is audited the same way in both postures. (Author: @alx-xo)
- The project assistant can distribute the skills it creates #4847 - Ask the assistant to add a skill to a plugin or assistant and it does, instead of pointing you at Distribute → Plugins to finish by hand.
platform_distribute_skillattaches the skill, pinning a version or tracking the latest valid one,platform_undistribute_skillrevokes a single distribution while leaving the skill and its versions intact, andplatform_list_pluginsresolves a plugin by name to the ID both take. All three run under the same permissions, feature gating, and audit logging as the dashboard. (Author: @simplesagar)