Logging on by default for new organizations, OpenClaw joins the agent sources, and MCP collections are removed

This release removes MCP collections, so read the Breaking changes section below if your organization used them. New organizations now start with logs, tool I/O recording, and agent session capture switched on, so the first session is visible without a setup step. OpenClaw becomes a named agent source whose sessions count toward usage and cost, skill improvements are recommended passively from efficacy analysis, and the remote MCP connect page asks for fewer clicks.

Breaking changes

• MCP collections are removed #5938 - The collections service and its /rpc/collections.* endpoints are gone, along with the Collections pages and sidebar entry, the Publishing section on MCP server settings, the collection group panel in access grant rules, the "Catalog kind" filter on Sources, and the Collection origin label on catalog sources. Collection audit actions are no longer recorded; the audit_log.mcp_collection_event_v1 webhook event stays registered but deprecated so subscriber event lists keep working. The backing tables are dropped in a follow-up migration. (Author: @adaam2)

Features

• New organizations log from the first session #5948 - Enable Logs, Record Tool I/O, and Agent Session Capture are on at creation for every new organization, and the enterprise setup wizard drops its logging opt-in step. Trial expiry no longer disables logging. Existing organizations are unchanged, and org admins can still turn each setting off under Logging & Telemetry. (Author: @simplesagar)
• OpenClaw is a first-class agent source #5929 - OpenClaw appears as a single entry in the agent-type filter, and its sessions take part in prompt-to-response turn correlation using OpenClaw's own per-run identifier. Its sessions now contribute to token, cost, and tool-call summaries, which previously counted only Codex, Cursor, and OpenCode (#5932), from deployment onward. The generated plugin package includes OpenClaw install instructions, including the conversation-access setting that prompt and usage capture depends on (#5933). (Author: @bradcypert)
• Skill improvements are recommended without asking the agent #5838 - High-confidence, transcript-grounded skill recommendations are now generated during efficacy analysis and flow into the existing edit-suggestion workflow. New plugin packages and managed assistants no longer expose the skill-feedback tool; previously installed clients can keep submitting through the retained endpoint. (Author: @danielkov)
• The remote MCP connect page asks for less #5861 - A server whose single required service is not yet linked sends you straight to that provider instead of an interstitial with one button, while a server fronting several providers keeps Connect as its own step. The header names the requesting client and the server side by side, tool access leads with "All tools" and reveals the picker only when narrowed, and the page now shares the dashboard's design system. (Author: @adaam2)
• Watchdog explains the org risk score #5988 - An info tooltip spells out that each signal inherits its score from its policy and that the overall score weights the most severe signal, the average of the top signals, and the total number of findings rather than a plain average. (Author: @simplesagar)
• The demo organization stays one click away #5958 - The account menu keeps an Explore demo org entry after the trial welcome banner stops showing it. (Author: @simplesagar)
• Gateway endpoints, rolling out behind a flag #5836 - Behind the gram-gateway-endpoints rollout flag, calls dispatched through a gateway are now attributed to it in telemetry and billing events, the observability overview can filter to one gateway, and the gateway's Overview tab shows usage scoped to it, the discovery funnel, and calls by member, with activity markers on gateway cards in the MCP listing (#5837, #5986). Gateway cards show their members' logos and a status dot, member management moves onto the Overview tab, and team-access rows on gateways and MCP servers alike click through to a pre-filled grant dialog (#5883). Production end-to-end testing fixes follow: removing a member unbinds its provider from the consent screen, malformed JSON-RPC bodies return the spec's parse-error code, and the add-member sheet no longer implies unproxied servers can be added (#5962). (Author: @daviddanialy)

Bug fixes

• Ingestion keeps up under heavy challenge volume #5829 - Authorization challenge logging now writes in batches instead of one insert per event, which had held pooled connections and let challenge, event feed, and risk finding ingestion fall behind a growing backlog. (Author: @bradcypert)
• Deleting a tunneled source no longer hangs #5962 - The confirm dialog closes and navigates on success instead of sticking on "Deleting…". (Author: @daviddanialy)
• Internal #5834 - Telemetry tables gain gateway attribution columns ahead of emission, with no customer-visible surface. (Author: @daviddanialy)