Risk policies scope only through detection scopes, and MCP requests no longer trigger toolset indexing

Risk policy writes drop three legacy policy-level scope fields in favor of detection scopes. That is a breaking change for API callers and Platform MCP tools, described below. Dynamic MCP toolsets are now indexed by a scheduled background sweep, so an MCP request never has to kick off indexing work, and the AI scan target config directory check accepts any path the device agent can resolve. Setup gains temporary Session Auditor access for confirming inference hook traffic, and the linear wizard returns alongside the board.

Breaking changes

• Risk policies no longer accept policy-level scope fields #6260 - The risk policy create and update endpoints reject message_types, scope_include, and scope_exempt. New policies leave those legacy columns empty and updates carry stored values forward unchanged, so scope every policy through detection_scopes instead. The fields stay readable until the legacy scope migration folds them, and the secrets guide in the dashboard now scopes its default policy through a detection scope. The same change applies to the Platform MCP risk policy tools, where a stored policy still narrowed by legacy message_types is reported as raw_scope (#6257). (Author: @vishalg0wda)

Features

• Session Auditor access granted and taken back during setup #6304 - The Enable logging step explains that an admin sees only their own agent sessions by default, offers to create a Session Auditor role carrying chat:read and add the admin to it so the Confirm traffic step can see the conversation an Anthropic inference hook delivers, then offers to remove them again once traffic is confirmed. Directory-synced organizations create the role and map it from a directory group instead. (Author: @qstearns)
• The linear setup wizard is back #6296 - /setup/wizard walks the board's cards in order again, and a header button swaps between the board and the wizard. (Author: @simplesagar)
• Set up LiteLLM card on the setup board #6297 - The card creates a LiteLLM instance in place, shows its proxy environment, guardrail fragment, and verification requests exactly as the AI Integrations page does, and confirms traffic from the instance's connection diagnostics. LiteLLM guardrail events no longer count toward the other-platforms card. Hidden by default: a platform admin has to reveal it on the board. (Author: @simplesagar)

Bug fixes

• MCP requests no longer trigger toolset indexing #6324 - Dynamic MCP toolsets are indexed by a scheduled background sweep, so an MCP request never has to initiate indexing work. The sweep's discovery query was also sped up so it no longer times out on projects with many HTTP tools (#6342). (Author: @bflad)
• Any resolvable AI scan target directory is accepted #6289 - Scan target config directories are no longer checked for a particular shape. Any path the device agent can resolve works, including one written with a trailing slash such as ~/Library/Application Support/com.openai.chat/. (Author: @subomi)
• Killswitch picker shows project names #6254 - Choosing MCP servers for a killswitch lists project names instead of project IDs. (Author: @speakeasyforgebot)
• Trial conversions land on pay-as-you-go #6335 - An organization converting through Stripe Checkout at the end of a trial now switches to the pay-as-you-go plan instead of staying on enterprise. (Author: @alx-xo)
• Wizard rail rows settle quietly #6313 - Setup wizard rail rows are no longer focusable or announced as buttons while a card's completion is settling. (Author: @simplesagar)