Watchdog alerts are readable from Platform MCP, and the risk model can be compared before it enforces

Watchdog no longer requires a trip to the dashboard: a read-only Platform MCP tool serves rule-level alerts, the affected users and client surfaces, and fully redacted sampled evidence, so an agent can pull the same picture an admin would. The risk engine flag also becomes a mode rather than a switch, adding a shadow setting where the fine-tuned risk model scans the same traffic alongside the existing engines without ever denying a request on its own, so its verdicts can be compared before anything changes. Anthropic inference hooks now return a verdict inside the provider's default five second window instead of being cut off mid-evaluation.

Features

• Watchdog alerts in Platform MCP #6557 - A read-only list_watchdog_findings tool surfaces rule-level Watchdog alerts, the affected users and client surfaces, and fully redacted sampled evidence. (Author: @svadrutk)
• Compare the risk model before it enforces #6636 - The gram-risk-llm-analyzer flag now selects a risk engine mode per organization. off keeps the gitleaks, Presidio, prompt-injection, and destructive-tool engines; shadow keeps those engines enforcing while the fine-tuned risk model scans the same traffic so its verdicts can be compared, never denying a request on its own; llm swaps the engines for the model as before. Organizations on the existing boolean flag keep today's behavior until the flag is switched to multivariate. (Author: @dennnis-ez)
• Shadow verdicts kept for comparison, never enforced #6637 - Organizations running shadow mode keep the risk model's verdicts in the findings store, marked so they can be compared with the legacy engines' findings per message. Shadow findings are never enforced and never appear in Risk Events, the Dismissed listing, the overview, signals, the Watchdog, reveal, or OpenTelemetry data exports. (Author: @dennnis-ez)

Bug fixes

• Inference verdicts return inside the provider timeout #6610 - Feature flags resolve once per delivery rather than once per scanned input, inputs are scanned concurrently, and a long transcript that still cannot be fully evaluated in time is denied with a retry message while the evaluated messages are checkpointed, so the retry scans only the remainder. (Author: @danielkov)
• Large attachments stop forcing fail-open scans #6641 - Realtime risk enforcement truncates scan inputs at a 50 KiB default instead of 1 MiB, adjustable through a feature flag, which cuts the timeout-driven fail-open scans that large prompt attachments were causing. (Author: @vishalg0wda)
• Client registration failures say which kind they were #6360 - Automatic OAuth client registration failures are classified as unreachable or refused, with bounded diagnostics recorded for dynamic client registration and Client ID Metadata Document callbacks. (Author: @qstearns)
• Plugin publishes no longer wait on the hourly sweep #6596 - A plugin package publish triggered by someone who is not a member of the project's organization publishes right away under an existing organization member instead of failing and waiting for the hourly sweep. A publish that cannot find any member is recorded once rather than retried. (Author: @danielkov)