A remote MCP server's upstream credential no longer has to come from each person who connects. Create a remote session client with a shared credential, and every caller reaches the upstream through it, obtained through an OAuth client credentials grant, with no per-user connect step; if the upstream rejects the token, the platform gets a new one and retries once before naming the server administrator. In the Access Hub, Claude Tag's guided setup drops its "not ready yet" note now that workload sign-in works end to end, and the Team Access tab shows the scopes a remote MCP server's connected clients actually request. More on the two credential models in Upstream credentials and on reading a server's access in Team Access.

Features

• Give a remote MCP server one shared upstream credential for every caller — Remote session clients can now be created with a single credential the client holds for itself, entered by hand as a client secret or key set with an issuer token endpoint, no metadata discovery required. Using that credential at request time obtains the upstream token through the OAuth client credentials grant for every caller, so nobody connects their own account; a rejected token gets one retry before the error names the server administrator instead of asking the caller to reauthorize. (#7335, @bflad; #7333, @bflad)
• Claude Tag's guided setup works end to end — Shared authorization servers for issuers on the dedicated authentication host now serve their own token endpoint, off the host that carries MCP traffic, and accept a workload grant that names no resource, exactly as Claude Tag sends when its Resource field is left empty; the token it issues works at every MCP server the issuer covers. The guided setup's "not ready yet" note is gone. (#7334, @bflad; #7348, @bflad)
• See the scopes a remote MCP server's clients actually request — The Team Access tab now shows each connected client's identity provider, issuer, and the scopes a login would request today, with a read-only summary for members who can view but not edit the server. (#7293, @daviddanialy)
• Register a platform outside the catalog with the same guided setup as Claude Tag — The Access Hub's forms for registering a custom platform, and for allowing and editing access under one, now come from the same definitions the catalog's guided setups use, with the same fields, checks, and wording. (#7297, @aa-wong; #7299, @aa-wong)
• Team Access rows show their matching plugin — A role row on an MCP server's Team Access tab now links to the plugin that distributes that server to the role, where one exists. (#7306, @alx-xo)
• The remote session client page leads with the identity provider — Settings folds into Overview, which now shows the identity provider's endpoints, registration methods, and supported scopes above the client's own editable settings. (#7353, @daviddanialy)

Bug fixes

• Stop forwarding Speakeasy's own credentials to remote MCP servers — Requests proxied to a remote MCP server no longer copy Speakeasy's own session, project, or tunnel headers upstream, and a remote header can no longer read its value from one of them; Authorization stays allowed as a source, since forwarding the caller's own upstream credential is what pass-through identity is for. (#7366, @ThomasRooney)
• Identity providers keep their discovered grant profiles — Creating or refreshing an identity provider from discovered metadata now keeps the authorization grant profiles it advertises, so identity chaining no longer reports a provider as unsupported right after it was discovered. (#7340, @daviddanialy)
• Block the Admin role's use or management of a server again — Setting the Admin role's use or manage line to "No access" on a server's Team Access tab no longer fails; only a block on viewing the server is still refused, since that would hide the Team Access tab from every administrator. (#7345, @adaam2)
• The people directory no longer repeats a person and stalls — A next-page cursor now carries the exact activity timestamp a page ended on, so a person whose most recent activity was excluded usage no longer shows on every page while the rest of the list stays out of reach. (#7217, @simplesagar)
• Chat search pagination no longer repeats or skips chats — A next-page cursor now carries the exact start time a page ended on, fixing both a chat that showed on every page and a list that stopped early. (#7222, @simplesagar)