The Shadow MCP inventory tells the truth about enforcement, and the stop button really stops

Every row in the Shadow MCP inventory now reports what enforcement actually delivers, from one server-computed verdict, and policy edits that would silently override recorded access decisions require explicit confirmation. The assistant's stop button now actually ends the turn server-side instead of letting it keep generating and spending in the background, and Windows machines install the device agent from a signed MSI.

Features

• Enforcement reported truthfully, row by row #5564 - Each inventory row renders from one server-computed access summary instead of re-deriving enforcement in the browser. A server approved for part of an audience reads Restricted rather than Allowed, and a decision nothing enforces or the current rules contradict says so, naming what displaced it. (Author: @daviddanialy)
• Policy edits can't silently override decisions #5571 - Editing a blocking policy's allow or block list now checks the change against recorded access decisions. Contradicting one requires explicit confirmation in a dialog that lists the affected servers, and a confirmed save marks each displaced review as superseded, actor-attributed and audit-logged, with decision history preserved. (Author: @daviddanialy)
• A detail page that answers instead of repeats #5531 - The Shadow MCP server detail page is reworked around a summary strip of status, calls, people, and last-called, dropping the fact list that restated the traffic table beneath it. Long user lists collapse, and the unreviewed badge says Unreviewed instead of contradicting the notice under it. (Author: @daviddanialy)
• The stop button now stops the assistant #5614 - Pressing stop previously only aborted the browser's view of the turn: the reply kept generating server-side, kept calling tools, kept spending, and reappeared on reload. Stop now cancels queued turns and interrupts the one in flight. The partial reply stays in the transcript, and every tab watching the chat settles instead of tailing a turn that has ended. (Author: @adaam2)
• Windows installs from a signed MSI #5607 - The Windows device-agent walkthrough now installs from a signed MSI that registers the machine-wide service itself, with a stable download link that always resolves to the current signed version and an Intune note for fleet deployment. (Author: @bradcypert)
• A management API for signing keys #5593 - For organizations with the customer-managed encryption keys entitlement, the new jsonWebKeySets API offers org-scoped CRUD of JSON Web Key Sets backed by customer KMS keys, plus the publish, activate, retire, and revoke lifecycle of their published keys. (Author: @bflad)
• Sign-in surfaces harden #5505 - Remote session issuers now capture the upstream's advertised PKCE support and warn when an identity provider does not advertise S256. Client documents may register redirect URIs on a different origin than the client ID, with exact-match validation still enforced (#5608). (Author: @bflad)
• The Secure section reorganizes #5558 - Navigation is now Watchdog, Guardrails, and Shadow MCP: the Risk Policies page becomes Guardrails and absorbs Detection Rules as a tab, with old URLs redirecting, Risk Events returns below Watchdog (#5597), and one Suppress dropdown replaces the separate suppression buttons (#5551). (Author: @dennnis-ez)
• Groundwork for gateway endpoints #5569 - Not yet customer-visible: the control plane for meta MCP servers with ordered member sets, and the gateway protocol surface serving the fixed tool contract on the canonical MCP path (#5573). The dashboard experience ships in 1.18.0 behind a rollout flag. Session portability also gains a per-organization toggle on the admin features pages (#5557, @simplesagar). (Author: @daviddanialy)
• Platform operators only #5601 - Visible to platform operators, not customer organizations: per-key inference limits on the billing admin page, and complete monthly inference spend history with a graph (#5627). (Author: @danielkov)

Bug fixes

• Concurrent token refreshes stop racing each other #5293 - MCP clients with several open sessions now share one refresh-token rotation with a short grace period instead of racing into an invalid_grant error, and the consent page shows a connected upstream grant even when a different identity provider originally created it (#5565). (Author: @danielkov)
• Watchdog suppression works past the time window #5609 - Suppressing a signal now collects its findings without the page's time window, fixing a silent no-op for findings older than the view, and an empty collection shows an error instead of doing nothing. (Author: @dennnis-ez)
• Per-user telemetry stops counting platform-side inference #5556 - Risk-analysis judges and other platform-side completions no longer count as the session owner's usage on employee surfaces. (Author: @daviddanialy)
• OTel forwarding keeps retained header values #5598 - Adding or removing one forwarding header no longer clears the encrypted values of the headers you kept. (Author: @disintegrator)
• Assistant onboarding no longer crashes on refresh #5592 - Loading the assistant onboarding page directly tripped React's hook-order invariant once permission grants finished loading; each frontend tool now renders as its own element. (Author: @bradcypert)
• The command palette finds every MCP server #5456 - Remote, tunneled, and unproxied servers now appear in the MCP Servers group alongside toolset-backed ones instead of being reachable only from the list page. (Author: @aa-wong)
• Enrollment refuses impersonated sessions #5545 - Manual device-agent enrollment is refused while impersonating an organization or user, or without membership in the active organization. (Author: @bradcypert)
• Roles can be created without a description #5330 - The Create Role dialog accepts an empty description field and omits it from the request. (Author: @qstearns)
• Internal #5625 - Skill insight queries avoid scanning unrelated session telemetry (@tgmendes); local dashboard dev proxies session-handoff URLs correctly (#5590, @simplesagar). (Author: @tgmendes)