Tool Logs filters now narrow to what's actually there as you apply them, and organization administrators get a ready-made Explore dashboard for what risk policies have caught. Alongside that: agent identities can borrow a personal connection instead of needing a shared credential, hosted MCP servers move onto one settings page, and admins get a single place to manage the credentials servers use upstream.

Features

• Tool Logs filter counts narrow as you filter #8148 - Each filter group now lists only the values that still have calls under the filters already applied, while its own values stay selectable. The time range moved next to the search bar, and the summary and timeline panel takes less vertical space. (Author: @adaam2)
• See who an agent acted for #7927 - A call an agent made on someone's behalf now reads "agent ↳ on behalf of <person>" in Tool Logs, and filtering by that person includes the agent's calls made for them. (Author: @adaam2)
• Delegate your personal connection to an agent, or block one from using it #8013 - An agent identity can now use a personal OAuth connection its owner, or another authorized editor, hands it, instead of requiring a shared credential. Anyone can also block a specific agent from their own connection without managing the agent, and "All servers" is offered only when every server is actually reachable with the agent owner's and your own permissions; agent bindings stay on the current connection as it's reauthenticated. (#7944, #8017, #8168, #8225, @mfbx9da4)
• Hosted MCP servers move onto the MCP server page #7942 - Settings that used to live on the toolset page, tools, resources, prompts, and team access, are now on the server's own page like every other server kind, and old toolset links redirect automatically. (#8009, #8021, #8016, @daviddanialy)
• A Security & risk dashboard for organization admins #7908 - Explore gains a risk_findings dataset, counts only, never the matched values or the chats they came from, and a ready-made dashboard breaking findings down by category, rule, policy, agent, team, and person. (Author: @simplesagar)
• Explore gets Signal Intelligence #7693 - Query signal patterns across conversations through the same analytics API and Platform MCP tools, with exact session counts, top-session concentration, and comparisons against the previous window. (#7696, #7700, @disintegrator)
• Manage the credentials your MCP servers use upstream #7933 - Organization admins can list every upstream auth client, see which servers offer each one, rename, enable, or disable it, and decide who may use it, all from one place instead of each server's own settings. (#7934, @danielkov)
• A shared Connections view across gateways #7974 - See every upstream connection for project and Organization Gateways in one place, searchable by identity and filterable by server or provider, with authorization deadlines shown separately from token expiry. (Author: @bflad)
• Duplicate and correct remote session clients #7976 - Copy a client's settings to register a new one in one step, or fix a client's ID in place instead of deleting and recreating it; a corrected ID asks affected users to reconnect once. (#7980, @bflad)
• See the sessions your agent produced #8110 - Agent owners without chat:read can now see their own agent's sessions on the agent page's Overview and Sessions tabs, and chat.list accepts an agent_id filter. (Author: @speakeasyforgebot)
• Share an Okta org across organizations #8145 - More than one Speakeasy organization can now connect and verify the same Okta org, instead of the second one failing with "this Okta org is already connected to another organization." (Author: @qstearns)

Bug fixes

• Device agent enrollment no longer needs organization read access #8123 - Organization members can complete device-agent enrollment without also holding organization read access. (Author: @qstearns)
• Organization role changes apply even when WorkOS is early #7993 - A membership role update from WorkOS now applies within about a minute even when its webhook arrives before the event is readable, instead of waiting for the organization's next WorkOS event. (Author: @TristanSpeakEasy)