Approving an MCP server under a shared authorization server no longer means approving it again on your next visit: an unchanged approval is now reused automatically, and only a changed tool list, upstream permission, or a server you haven't seen yet brings back the full consent screen. Organizations with directory sync get a review queue for the changes that actually need a decision: a new group with no role, a new attribute value, or a mapping whose source has disappeared from the directory, plus a bulk setup flow for mapping everything else in one pass. More on this in Shared authorization servers.

Features

• Skip repeat consent for MCP servers you've already approved — Reconnecting a client to a server under a shared authorization server now reuses your saved approval and its tool selection automatically, instead of showing the consent screen again. A new server, a changed tool inventory, or a missing upstream connection still asks for approval, and withdrawing consent clears every saved approval for that server. (#7606, @bflad)
• MCP servers that share a sign-in can each use their own upstream OAuth client — Servers behind the same shared authorization server, including gateway members, now sign in through the upstream client configured for each one individually instead of a client shared by the whole issuer, so one server's credentials no longer leak into another's. (#7653, @danielkov)
• Review directory changes that need a role, and map the rest in bulk — The SSO tab now lists directory groups and attribute values that showed up with no role, and mappings whose group or value has disappeared from the directory, so admins decide instead of just noticing them in the table. "Set up in bulk" maps every remaining unmapped group and attribute value in one reviewed step, reusing an existing role with the same name where one exists. Admins can also turn on email reminders for pending reviews. (#7725, #7722, #7781, @TristanSpeakEasy)
• See where the directory hands out a role from the server's own Team Access list — An MCP server's Team Access list now shows which directory groups and attribute values grant each role, including a link back to the review queue when one of them has been removed from the directory. (#7830, @TristanSpeakEasy)
• Org Gateway now requires an administrator to opt in — Turning on the organization-wide MCP gateway now walks admins through a role-by-role access review first, with one shared view for inspecting and adjusting effective access by role or by person, available from both the gateway settings and Roles & Permissions. (#7611, @chase-crumbaugh)
• Every kind of MCP server now shows in one list — The MCP Servers page and command palette list hosted, remote, tunneled, and unproxied servers together instead of fetching and filtering them separately, so a server no longer goes missing from search because of how it's backed. (#7754, @daviddanialy)
• Find skills and agent identities from Command K — Searching the command palette by name now also surfaces skills and registered agent identities, opening straight to their overview page instead of requiring a trip through the sidebar. (#7887, @simplesagar)
• Headless devices can enroll and authenticate as workloads — An admin can issue a single-use join token so a headless box, such as a one-off VPS, registers its own key and enrolls as a workload, then polls for its assigned plugins' MCP servers and sends hooks with a short-lived workload token instead of holding a long-lived agent API key. (#7450, #7451, #7404, @bradcypert)

Bug fixes

• OAuth sign-in errors now say why — A failed MCP connection login now names the identity provider's actual OAuth error, such as invalid_grant or invalid_client, instead of a generic "upstream token exchange failed" that required a support round-trip into server logs. (#7618, @daviddanialy)
• Legacy Claude Code hook requests no longer time out — A slow risk scan could leave an older curl-based hook script waiting past its own timeout and blocked with HTTP 000, even in fail-open organizations. The check now answers within a 5-second budget and falls back to the organization's fail-open or fail-closed setting if it needs more time. (#7135, @mfbx9da4)
• Long conversations no longer slow down Anthropic inference hook checks — Risk verdicts on Anthropic inference now scan only the latest exchange instead of rescanning the whole transcript, so scan time stays flat as a conversation grows and a denial applies only to the turn that introduced the content. (#7787, @vishalg0wda)
• Deleting an MCP server or gateway no longer blocks saving policies that also cover other servers — A risk policy that targeted several servers kept the deleted one's ID, so the next save failed with "MCP server does not belong to the project." Deleting a server or gateway now removes it from every policy's scope at the same time. (#7902, @daviddanialy)
• Device agent installer links on Windows now download the real installer — The stable installer link returned the dashboard's HTML instead of the .msi, so the Windows setup step saved a web page under the installer's filename. (#7916, @mfbx9da4)
• MCP server headers can no longer be configured to leak your session token upstream — A configured header can no longer read the inbound Authorization header as its source, which could forward your Speakeasy credential to an upstream server under another name. Reading an upstream credential from a separate header still works. (#7821, @daviddanialy)