Shadow MCP server detail pages and RBAC for remote MCP servers

Shadow MCP inventory grows from a list into a place to investigate: each discovered server now has its own detail page, and organization admins can rename inventory entries without losing their canonical URL identity. Access control widens too — the Roles & Permissions "Specific Servers" picker now lists remote and tunneled MCP servers alongside toolset-backed ones, so connection policies can cover every kind of server you run.

Features

• Shadow MCP server detail pages #4065 - Each server in the Shadow MCP inventory now has a dedicated detail page backed by a project-scoped API, so a discovered server can be investigated in one place. (Author: @alx-xo)
• Rename Shadow MCP servers #4214 - Organization admins can give Shadow MCP inventory entries a friendly name without changing the canonical URL identity used to track them. (Author: @alx-xo)
• Permission remote and tunneled MCP servers with RBAC #4167 - The Roles & Permissions "Specific Servers" picker for mcp:connect now lists remote and tunneled MCP servers alongside toolset-backed ones, backed by a new org-wide server listing, so connection policies can scope to any server in the organization. (Author: @qstearns)
• Filter risk events by assistant #3933 - The "Risk Events" page gains an "Assistant" filter listing the project's assistants plus a "No assistant" option, so findings from chats not linked to an assistant can be surfaced on their own or scoped to a single assistant. (Author: @linear-code)
• Pause model provider keys without deleting them #4182 - Custom model provider keys can be disabled and re-enabled in place, so temporarily falling back to the platform key no longer means deleting and re-entering a key. (Author: @danielkov)
• Prompt-injection detection upgraded for everyone #4184 - Prompt-injection detection now uses the LLM judge for all organizations, replacing the previous heuristics layer with higher-quality analysis across the board. (Author: @vishalg0wda)

Bug fixes

• Remote MCP servers behind strict origin checks work again #4171 - Browser-only headers (Origin, Referer, Cookie) are no longer forwarded to remote MCP upstreams. Servers enforcing DNS-rebinding protection (e.g. Langfuse) previously rejected dashboard-driven requests with "Something went wrong loading tools", and the dashboard session cookie no longer leaks upstream. (Author: @svadrutk)
• MCP inventory captured at session start #4170 - The hooks relay again sends a redacted MCP inventory snapshot on session start and configuration changes, so external MCP URLs appear in Shadow MCP inventory before a tool is ever called. (Author: @alx-xo)
• Linked accounts attach to the right employee #4196 - The employees list now attaches linked accounts by directory ownership instead of raw telemetry user ids, so stray telemetry rows can no longer hand an account — and its role bucket — to the wrong person. (Author: @daviddanialy)
• Deleted usage rows excluded from billing #4174 - Tokens-under-management totals and breakdowns now filter out soft-deleted usage rows, matching how the costs page already reads the same data. (Author: @daviddanialy)
• Consistent Speakeasy branding in the dashboard #4179 - Remaining user-visible "Gram" mentions in dashboard copy now read "Speakeasy", and the brand logo gains an accessible label for screen readers. (Author: @simplesagar)
• Created and updated dates on risk policies #4199 - The risk policies table shows "Created" and "Updated" columns with compact relative dates; hovering reveals the exact timestamp. (Author: @simplesagar)
• Model provider key table polish #4188 - Key editing and row actions are improved, table actions are aligned, and disabled keys are easier to identify #4183. (Author: @danielkov)