Employee enrollment loads in a blink with numbers that match your cost views, and blocked MCP calls now say why

The Employee Enrollment page no longer makes you wait: on large projects it goes from seconds to tens of milliseconds, and the token counts it reports are now the same canonical agent-usage measure behind your cost and billing pages. When an organization access policy blocks an MCP server or tool, the error explains what was denied instead of failing opaquely, and skills gain organization settings for content upload and efficacy sampling.

Features

• Employee enrollment loads in tens of milliseconds #4520 - The enrollment list now reads a pre-aggregated view of observed agent usage across Claude Code, Codex, Cursor, and Claude Chat instead of scanning raw telemetry, and it requests only the fields it renders rather than building breakdowns it discards (#4485). Token numbers on this page now match the measure used by your costs and billing views, and people with activity but no email still show up so nobody quietly disappears from the list. (Author: @daviddanialy)
• Blocked MCP servers and tools explain the denial #4382 - When an organization's access policy blocks an MCP server or tool, the response now names what was denied and what to do about it, so a policy decision reads as a policy decision instead of an unexplained failure. (Author: @simplesagar)
• Organization settings for skill content upload and efficacy sampling #4501 - Control whether skill content is uploaded and how many sessions get scored for efficacy, so you can tune how much skill data leaves your machines and how much scoring you pay for. (Author: @danielkov)
• Manage tool metadata on an MCP server through the API #4359 - List, set, and delete metadata for the tools on an MCP server, plus two batch writes with deliberately different contracts: an authoritative one that makes stored tools match your payload exactly, and an additive one that only inserts and rejects the batch if a tool already exists — so a caller working from a stale view is told about the conflict rather than silently overwriting it. Writes require mcp:write, are scoped to the target server, and are fully audited. (Author: @qstearns)

Bug fixes

• Enrolled employees no longer show zero tokens #4525 - When someone's telemetry split across an opaque user id and their email, the token-less record was shadowing the one carrying their real usage, pushing their activity into "Unknown users". Both records are now matched to the member and merged, so tokens, activity, and linked accounts land on the right person. (Author: @daviddanialy)
• Multi-select controls stay inside their container #4511 - Selected badges now shrink and truncate long labels instead of pushing the clear and dropdown controls past the right edge, as seen on the plugin Manage assignments sheet. (Author: @bradcypert)