Edit an MCP server's access one scope at a time, and manage user session issuers for the whole organization

The Access tab on an MCP server is now a single list with a row per principal, and each row shows separately whether that person, role, or everyone can connect to, view, and manage the server. Each of the three can be changed on its own, so a role that reaches a server through an organization-wide rule can be narrowed for that one server without touching the role anywhere else, and taking connect away no longer strips view and manage with it. Organization admins also gain an API for user session issuers that every project inherits, with deletion guarded while a live MCP server or toolset still depends on the issuer, and agents working through Platform MCP can read a bounded summary of Shadow MCP policy decisions.

Features

• Per-scope access editing on an MCP server #6246 - The People and Roles tabs and the single "can connect, view, or manage" choice are replaced by one list where each principal has its own line for connect, view, and manage. Blocked scopes are now independent of one another, so "cannot connect but still administers" is expressible for the first time, and a role reaching a server through an organization-wide rule can be narrowed or closed for that server alone. (Author: @adaam2)
• Organization-level user session issuers #6200 - Organization admins can create, update, and delete user session issuers and their CIMD clients at the organization level, inherited by every project, through the management API. Deletion runs a preflight and is blocked while a live MCP server or toolset still references the issuer, and project-level mutations are restricted to issuers the project owns. (Author: @bflad)
• Shadow MCP policy decisions summarized from Platform MCP #6235 - Agents working through Platform MCP can read a bounded summary of Shadow MCP policy decisions without the summary exposing principal identities. (Author: @TristanSpeakEasy)
• Anthropic inference hooks from the setup board #6239 - A new setup card turns on Anthropic inference hooks in one pass: it mints the endpoint Claude posts each conversation to, walks through pasting it into the Claude.ai inference hook settings, switching on enforcement and starting the rollout in Shadow mode, and saves the signing secret Claude reveals. Traffic is confirmed from the conversations the hook delivers. The webhook URL and signing secret controls are shared with the integrations sheet, and the previous Anthropic card lives on as "Set up Anthropic admin controls", hidden by default. (Author: @qstearns)
• Setup board reorganized around outcomes #6202 - "Connect identity provider" and "Directory sync" merge into one "Set up identity provider" card, publishing the plugin marketplace becomes a section at the front of the cards that need it, and coding assistants split into an Anthropic card for Claude Code and Claude Cowork and an "other platforms" card for everything the device agent covers. Each platform's instructions sit inline in its own step, and confirming traffic is the last section of both cards. The linear wizard at /setup/wizard was removed in this release and returns in 1.23.0. (Author: @qstearns)

Bug fixes

• Beta badges removed from Risk Events and Shadow MCP #6234 - The page headers now match the sidebar entries, which dropped their Beta label earlier. (Author: @simplesagar)