The tool picker on MCP consent screens is no longer something an admin has to turn on: every organization now gets it by default, so anyone approving a connection can scope it to the tools they actually want. The dashboard also retires the old "Remote Identity Providers" name. Wherever an upstream OAuth issuer shows up, from the organization page to an MCP server's Authentication tab, it is now called an Authorization Server, matching what it has always done. More on this in Authorization servers.

Features

• Every organization now gets the consent screen's tool picker — The "Tool filtering on consent screens" setting is gone, so the tool picker on third-party consent screens is on for everyone with no per-organization opt-in; tool selections already saved under the old setting keep being enforced. (#7589, @ThomasRooney)
• Remote identity providers are now called Authorization Servers — The rename reaches the organization page, an MCP server's Authentication tab (formerly "Connected services"), the attach and modify sheets, and Platform MCP's setup guidance, so the name matches what the upstream OAuth issuer actually does. (#7384, @adaam2)
• Gateways choose Direct or Progressive tool discovery — Gateway owners pick a default discovery mode, and a connection can override it from consent or Inspect; Direct lists member tools in bounded, concurrent pages so one slow member can't block the rest. (#6812, @ThomasRooney)
• MCP server reads now summarize their backing toolset — Reading an MCP server now includes its toolset's tool count, selection mode, and primary endpoint in one response, so integrations no longer need a second call to show that context. (#7610, @daviddanialy)
• Compatible harnesses can send tool calls and prompts through the Agent Hooks Protocol — A new /ahp endpoint accepts tool calls, user prompts, and session events from harnesses that speak the protocol, using a hooks API key, and Speakeasy policies can deny what it intercepts; attachment uploads and content-replacement enforcement extend the same path. (#7300, #7679, #7672, @danielkov)
• Create gateways and manage their members from the Platform MCP — create_gateway creates a private gateway with an ordered member list in one step, and set_gateway_members replaces the whole list atomically, naming any server that can't sit behind a gateway. (#7510, @qstearns)
• Find an organization member by their full email through the Platform MCP (organization admins) — A complete email address now finds a member even when a partial search would have matched too many people to show. (#7623, @simplesagar)
• Directory role mappings move to a full role set, deleted roles included (organization admins) — A directory group or attribute value's role mapping now replaces its complete role set atomically instead of upserting one role at a time, and a mapping can keep pointing at a role that has since been deleted without blocking new mappings to the same source. (#7307, #7311, @TristanSpeakEasy)
• Enterprise Managed Authorization reports which services trust each identity provider, and the consent page checks live (Enterprise Managed Authorization customers) — listEMAServices lists every service an organization's workload identities reach with the providers each accepts, identity chaining now records the exact OAuth scopes a server connection requests so a later request can't quietly ask for more, and the consent page runs the real identity-chaining exchange before approval instead of waiting for the first tool call. (#7614, #7581, #7580, @daviddanialy)

Bug fixes

• The organization gateway lists only servers you can actually use — Servers whose authentication the gateway can't provide no longer appear on the consent screen or in list_servers, and gateways no longer list servers built on toolsets that carry platform-only tools, such as the tools assistants use. (#7594, #7648, @danielkov)
• MCP grants served by identity chaining stop asking for an unnecessary reconnect — Refreshing a grant whose upstream is served by identity chaining no longer fails once the access token expires; it only asks for a reconnect when chaining genuinely can't serve the upstream anymore. (#7572, @daviddanialy)
• Assistants stop failing to respond in Slack over stale permissions — An assistant's permissions are now checked live against the assistant, its owner, and the person it's acting for on every turn, so a permission someone lost stops applying to a response already in progress. (#7661, @danielkov)
• Risk policy checks stay inside Anthropic's response window — Inference-hook verdicts now fit Anthropic's default five-second timeout, so long conversations no longer time out on every turn while earlier content is rescanned. (#7731, @vishalg0wda)
• The Risk Overview page is retired — Old links to it now open Watchdog instead of a dead page. (#7635, @vishalg0wda)
• The sessions dataset is removed from the analytics catalog — Explore, widgets, and the Platform MCP's analytics tools now ask about tool calls and skills instead. (#7633, @subomi)