Org Gateway now waits for an administrator to turn it on, and turning it on comes with a real audit trail: review every role's effective MCP access, inspect what each person can reach, and remove or block specific grants from Settings or Roles & Permissions. People who have already approved a client on one server behind a shared authorization server now skip the consent screen on another server under the same issuer, as long as nothing about their access changed. More on this in Organization gateway.

Features

• Org Gateway requires an administrator to opt in, with a full access review — Review organization-wide MCP access by role before enabling, inspect each person's effective assignments, remove server-specific grants or block role access, and open client-specific connection instructions from the Organization Gateway card or Roles & Permissions. (#7611, @chase-crumbaugh)
• Approvals carry over across servers behind a shared authorization server — An identified person's saved tool selection and session length now auto-apply to another server under the same issuer and OAuth client, with the browser checking current tools before any click; a new server, a changed tool inventory, or a missing permission still asks for full consent. (#7606, @bflad)
• Each MCP server on a shared sign-in can use its own upstream OAuth client — Servers and gateway members sign in through the client configured for them instead of one client shared by every server on the issuer, and the consent screen offers each server only its own clients. (#7653, @danielkov)
• Set up directory role mappings in bulk, and review what changed since (organization admins) — previewDirectoryRoleSetup and applyDirectoryRoleSetup map every directory group and attribute value to a role in one pass, and a new review queue raises directory changes that need a decision, a group with no role, a changed attribute value, or a mapped group that has gone from the directory, with email and webhook notifications once items have waited 15 minutes. (#7722, #7725, #7781, @TristanSpeakEasy)
• Directory mapping and member pages show more about where access comes from (organization admins) — Mappings report whether their source is still active or missing, and members list their directory groups and which mappings currently grant them a role, so a role reached through two groups shows both. (#7715, #7826, @TristanSpeakEasy)
• Search chats from the Platform MCP — search_chats and read_chat search messages by text, owner, or participant and read surrounding context, gated by chat:read and audit logged. (#7734, @ThomasRooney)
• Preview and confirm a deployment redeploy or rollback from the Platform MCP — redeploy_deployment retries or rolls back a whole project deployment with the existing authorization and audit workflow, and reuses the same deployment on a retried request instead of creating a duplicate. (#7900, @simplesagar)
• OAuth connection failures name the real reason — A failed login now shows the identity provider's standard OAuth error code, or says the provider was unreachable, instead of a generic "upstream token exchange failed"; a provider outage now answers with a retryable error instead of a flat failure. (#7618, @daviddanialy)
• Tunnel agent status reaches the dashboard (network administrators) — Connected tunnel agents, target network checks, and MCP request history now show in the dashboard; agents report aggregate HTTP progress without collecting payloads or making MCP calls. (#6874, @ThomasRooney)
• An MCP server's Identity settings flag a shared OAuth client — If a server's OAuth client also signs in other MCP servers, its User Identity settings now say so, since changing or rotating that client changes sign-in for all of them. (#7644, @danielkov)

Bug fixes

• Legacy Claude Code hook requests stop timing out — The endpoint now answers within five seconds using the organization's fail-open or fail-closed setting when a policy check runs long, instead of letting older curl-based hook scripts block with "HTTP 000"; the slower check still finishes in the background. (#7135, @mfbx9da4)
• A configured MCP server header can no longer read your Speakeasy credential — Creating or updating a header that sources from the caller's Authorization request header is now refused, since that header can carry the Speakeasy session credential and must not be forwarded to an upstream server under another name. (#7821, @daviddanialy)
• An MCP server's own URL is rejected as its OAuth client_id — The request now fails fast with a hint to check the client ID setting, instead of retrying and failing with a retryable error after fetching that URL as a metadata document. (#7862, @bflad)
• Risk policy checks look at only the latest exchange again — Anthropic inference hook verdicts no longer re-check a whole conversation, so long conversations stop timing out and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Directory role mappings can't exceed 20 roles per source, and inactive directories stop granting roles — Saving more than 20 roles on one group or attribute value now fails clearly, and roles mapped through a deleted directory no longer contribute to anyone's access. (#7829, #7313, @TristanSpeakEasy)
• A session moved between organization hosts keeps the right organization selected — Opening the dashboard on the legacy host no longer resets the organization you picked on your organization's own host. (#7915, @adaam2)
• Deleting a server no longer breaks a multi-server risk policy — Deleting an MCP server or gateway now removes it from the scope of every risk policy that also targets other servers, so those policies can still be saved; a policy left with no target is deleted, as before. (#7902, @daviddanialy)
• A custom domain that isn't verified and activated no longer breaks an MCP server's issued URLs — The Playground URL and the issuer of dashboard-minted session tokens now fall back to the server's platform endpoint, or to /mcp/{slug}, until the custom domain is ready. (#7753, @daviddanialy)
• The device agent's Windows installer link works again — The stable installer links moved from /v1/install/ to /rpc/install/, since production never routed the old path to the server and the Windows setup step was saving the dashboard's HTML instead of the installer. (#7916, @mfbx9da4)
• Hosted MCP servers list correctly again when their toolset is gone — Listing MCP servers no longer returns servers backed by a deleted toolset, the hosted server summary now includes the toolset's description, and server reads report whether any endpoint, including a custom domain still activating, actually routes to it. (#7754, @daviddanialy)