v1.19.1

Platform

// September 2, 2026

MCP endpoints refuse cross-origin browsers, and a role grant can now scope to a single server

Every MCP endpoint the platform serves now validates the Origin header and rejects cross-origin browser requests, as the MCP specification requires, with native MCP clients unaffected. Access control gets finer too: a role grant scoped to one MCP server now unlocks managing exactly that server. Tunneled servers can record a resource identifier so user credentials route to them by exact match and an unmatched credential is never forwarded.

Features

Cross-origin browser requests are rejected #5899 - MCP endpoints answer cross-origin browser requests with 403 and reject POSTs that are not Content-Type: application/json with 415. Native MCP clients send neither Sec-Fetch-Site nor Origin, so they are unaffected, and embedded chat keeps working through its session token's audience claim. A follow-up exempts the OAuth callback routes that share the MCP path prefix, which were briefly answered with 403 when a browser followed an identity provider's redirect back (#5913). (Author: @bflad)
Role grants scoped to one MCP server #5909 - Get, update, delete, and tool-filter reads on an MCP server now check mcp:read and mcp:write against that server's own grant resource, aligned with the serving path, and listing returns only the servers the caller holds a grant for. Project-wide and wildcard grants behave as before. (Author: @daviddanialy)
Tunneled servers route credentials by resource identifier #5905 - Tunneled MCP source settings gain a Resource Identifier section for the server's RFC 9728 protected resource identifier. Gateway consent stamps it as the RFC 8707 resource on the grants members mint, and the tunneled backend accepts a credential only when it is unqualified or names that identifier. The lone-token fallback is gone on every surface, so an unmatched credential is never forwarded. Updating a tunneled server no longer requires resending its name, so saving one setting can never revert a rename that landed in between. (Author: @daviddanialy)
One slug namespace for hosted servers and endpoints #5917 - Slug availability checks now span both hosted MCP servers and MCP endpoints, so an endpoint can no longer take a slug a live hosted server still resolves under, and vice versa. (Author: @daviddanialy)
Internal #5918 - Groundwork with no change to production traffic: hosted MCP servers resolved through an endpoint will take their visibility, issuer gating, and RBAC resource from the endpoint's server record rather than the toolset (#5919), and test fixtures stop sharing one toolset across live server records (#5954). (Author: @daviddanialy)