Gateway owners can now pick how agents discover tools behind a gateway, and every organization gets the consent screen's tool picker instead of only the ones it was rolled out to. Directory-synced organizations can also give a group or attribute value more than one role at once.

Features

• Choose Direct or Progressive tool discovery for a gateway — Direct lists every qualified member's tools in one bounded page instead of discovering them one call at a time, which suits MCP clients that can't use progressive discovery reliably. A connection can override the gateway's default from consent or Inspect, and the organization gateway offers the same choice across every project a person can reach. Available to every organization. (#6812, @ThomasRooney)
• The consent screen's tool picker is available to every organization — Narrowing an approval to specific tools from the consent screen no longer needs an admin to find and turn on a separate setting first; it works wherever the screen is eligible. Tool selections already saved from earlier approvals keep being enforced. (#7589, @ThomasRooney)
• Give a directory group or attribute value more than one role at once — Directory-synced organizations can add or remove roles on a mapping independently instead of replacing a single choice, with chips that collapse into a "+N more" popover when a row is full and a save that cannot silently overwrite a set changed elsewhere. (#7307, #7311, @TristanSpeakEasy)
• Add several MCP servers to a plugin at once from a searchable sheet — Plugin setup now uses the same server picker as the organization gateway: search by name or slug, see each server's logo and kind, and add many at once instead of one <select> submission at a time. Servers whose MCP is turned off show as unavailable instead of failing after selection. (#7662, @qstearns)
• Find a member by their complete email through the Platform MCP — Organization admins checking a named colleague's MCP access can now search by their exact email address and get a match even when fewer than five members would otherwise match, so the lookup no longer comes up empty for a small organization. (#7623, @simplesagar)
• Create gateways and set their members from the Platform MCP — An admin can now ask an agent to put a set of MCP servers behind one gateway endpoint, instead of doing it from the dashboard; the new tools create a gateway with its members in order or replace a gateway's membership outright, all or nothing. (#7510, @qstearns)
• Agent Hooks Protocol clients can block unsafe content, not just observe it (for harnesses that speak AHP) — A compatible client sending tool calls, prompts, and model responses through POST /ahp can now have a policy deny or replace unsafe content before it reaches the model, and can upload text attachments for the same scanning, instead of only capturing events after the fact. (#7300, #7672, #7679, @danielkov)

Bug fixes

• The MCP & Tools dashboard loads again on high-traffic projects — Its charts used to sort every event in a 7-day window, which could exhaust the analytics database's memory and take other dashboards down with it; they now read from a table that already holds one row per call. (#7626, @subomi)
• Assistants stop going silent in Slack for people with many permissions — A large permission set could grow an assistant's authorization token past the request header limit, so the turn silently failed to start. Permissions are now checked live instead of carried in the token, which also means a permission someone loses stops applying to their in-flight turns immediately. (#7661, @danielkov)
• The organization gateway lists only servers you can actually use — Servers whose authentication the gateway can't supply, or that are built for assistants rather than general use, no longer show up on the consent screen or in list_servers only to fail when called. (#7594, #7648, @danielkov)
• Risk findings consistently honor disabled rules and policy scopes — Findings written for the upcoming findings store could skip a policy's disabled rules and category scopes, and a transient scan failure could be dropped instead of retried; both now match the rules the existing findings pipeline already applies. (#7660, @vishalg0wda)
• Long conversations stop timing out on every turn under Anthropic-based risk checks — The verdict budget assumed a 10-second timeout while Anthropic's default is 5 seconds, so once a conversation's unscanned history grew past what fit in that window, every later message re-scanned it all and timed out again, failing open. Verdicts now scan only what's new plus a bounded backlog. (#7731, @vishalg0wda)
• Attaching a toolset to an assistant can no longer turn on its MCP server without write access — Attaching a toolset whose hosted server is off now requires mcp:write on the toolset, closing a path where a caller who could only connect to a toolset was able to turn its server on. (#7607, @daviddanialy)
• The Platform MCP's Claude Code install leads with the quick commands again — Setup starts with /plugin marketplace add and /plugin install instead of a settings file edit, with the auto-update settings snippet shown as the next step instead of the only option. (#7621, @simplesagar)
• MCP sessions served through identity chaining stop asking for a reconnect every hour — Refreshing a grant on a server with no interactive upstream session used to always report that a reconnect was needed; refresh now asks identity chaining directly and only falls back to a reconnect when one would actually fix it. (#7572, @daviddanialy)