A long-standing bug blocked editing a block-all Shadow MCP policy to soften it from denying to warning; that's fixed, along with a gap that let kill switches and risk policies skip traffic served through the legacy MCP slug path. An administrator distributing an MCP server by URL now has their own write recorded as the Shadow MCP approval instead of needing a separate review. More on this in Shadow MCP allow and block lists.

Features

• An administrator's own write can stand as Shadow MCP approval — When an organization administrator puts a server added by URL into a plugin, or widens a plugin's audience, under a project's block policy, that write is now recorded as the Shadow MCP approval for exactly the audience it reaches, with the admin as requester. The project's enabled block policy is always enforced for user-supplied servers now, with no rollout flag gating it. (#7355, @simplesagar)

Bug fixes

• Editing a block-all Shadow MCP policy works again — A block-all policy, the default and what every policy the dashboard creates stores, can once again turn off its Shadow MCP detector or move off the Deny action, exactly as it always could before the disposition field shipped; the previous "cannot change the sources or action" error is gone. (#6921, @dennnis-ez)
• Kill switches and risk policies reach the legacy MCP slug path — Hosted MCP requests served through the legacy toolset-slug lookup now carry the toolset's canonical server when it has one, so kill switches and server-scoped risk policies on prompts/get and resources/read apply to them the same way they do on the endpoint path. (#7387, @daviddanialy)
• The Playground connects to a toolset's working server — A toolset now resolves to an enabled MCP server before a disabled canonical wrapper, so the Playground, session minting, and session management target a server that actually serves instead of 404ing on a disabled wrapper. (#7388, @daviddanialy)
• The role editor shows a blocked-only permission as blocked — A permission a role only blocks now shows a Blocked badge naming the server, instead of looking like a grant. Adding that permission from the picker now grants it next to the block instead of silently deleting the block. (#7412, @adaam2)
• Identity providers with many scopes or a logo read cleanly — Scope lists render as chips instead of one comma-joined string, providers with long URL-style scopes show only what follows the shared base, and logos keep their shape instead of stretching. (#7409, @qstearns)
• Saving a remote session client with no audience no longer fails — An empty audience field used to send an empty string, which the API rejected with a regexp error on every save. It's now omitted instead, leaving the stored value unchanged. (#7431, @daviddanialy)
• Hosted MCP server links open the toolset page — Links to a hosted server from audit logs, assistant entity links, and the server list now open its toolset page instead of the generic server page, which showed controls the server doesn't support. (#7386, @daviddanialy)
• Hosted server health charts exclude gateway member traffic — A hosted toolset's own server and the gateway members fronting the same toolset are now kept apart in Platform MCP diagnostics, health charts, and overview metrics, so a canonical server's numbers no longer include its members' calls. (#7390, @daviddanialy)
• The private network setup sheet suggests a Speakeasy hostname — The Tailscale setup sheet's example organization private hostname is now acme-speakeasy, replacing an older placeholder that referenced the product's previous name. (#7398, @bradcypert)