Faster assistants, file attachments in chat, and organization names in every language

Assistants no longer send every MCP tool schema to the model on every call: tools are discovered on demand, servers connect on first use, and dropped connections reseat themselves, which keeps prompt caching effective for large toolsets and takes MCP handshakes out of cold-start latency. The Project Assistant accepts file attachments, and organization names now accept punctuation and every script, so "Acme, Inc." and a company named in Japanese both get through the door. One breaking change below on external key management.

Breaking changes

• External key updates can no longer change what a key is #4971 - The AWS KMS and GCP KMS update methods drop the fields that defined key identity (key_arn, resource_name, algorithm); changing those now means deleting the key and creating a new one. Deleting a key is refused while a key set or published key still references it, and creating a GCP key requires a fully qualified crypto key version path. (Author: @bflad)

Features

• Assistants respond faster and cache better #4121 - MCP tools are found through a search tool instead of being advertised wholesale, servers connect on first use rather than at startup, and dropped connections reseat automatically. The same release adds a local runtime provider so assistant runtimes run in Docker for local development. (Author: @danielkov)
• Attach files to the Project Assistant #5139 - Drop files anywhere on the chat or use the paperclip. Images and text-like files, including OpenAPI documents, travel with the turn; anything unreadable inline arrives as a short-lived download link. The composer also recalls past prompts terminal-style with the arrow keys (#5178), merges skills and tool mentions into one "Add context" picker (#5142, #5177), and hides its example prompts once a file is attached (#5176). (Author: @adaam2)
• Organization names in every language #5203 - Names accept punctuation and every script, so "Bob's Bakery", "Café Zoë", and companies named in Japanese, Arabic, or Cyrillic all pass validation. Invisible formatting and control characters are still rejected, and URL slugs are unaffected. (Author: @alx-xo)
• Choose accepted OAuth clients from the dashboard #5027 - An MCP server's authentication settings now offer the verified client catalog, any spec-valid client, or none, plus your own document URLs, each verifiable before it's added. Client metadata documents are also cached with proper revalidation instead of refetched on every authorization (#5154). (Author: @bflad)
• Revoking a session revokes it upstream too #5118 - Revoking a remote session now posts the stored token to the issuer's RFC 7009 revocation endpoint, so the upstream provider drops it instead of leaving a live token working elsewhere until it expires. This covers every path that ends a session, including the end-user "Disconnect" on the consent screen. (Author: @aa-wong)
• Set a session refresh policy for the whole organization #5066 - Admins choose Disabled, User controlled, or Required from the MCP Connections page, and end users see the effective policy on the consent screen. Required keeps every eligible connection refreshed; Disabled says plainly that idle connections will lapse. (Author: @speakeasyforgebot)
• Tool calls summarized at a glance #5209 - Agent session views gain compact tool-call rows with persisted two-sentence summaries and risk-first detail expansion, so scanning a long session no longer means expanding every call. (Author: @chase-crumbaugh)
• Watchdog: ranked risk signals, rolling out #5124 - A new Watchdog page clusters live findings into ranked signals with severity scores, trends, and a drawer that turns a signal into an exclusion in one action (#5143, #5207). Rolling out behind a feature flag; it replaces Risk Overview and Risk Events where enabled. (Author: @dennnis-ez)
• Skill details split into focused pages #5159 - Content, usage, feedback, versions, and settings each get their own page instead of one long scroll. (Author: @alx-xo)
• LiteLLM sessions show their originating client #5140 - An agent session routed through LiteLLM displays the supported client that produced it while still matching the LiteLLM filter. (Author: @danielkov)
• Registry evidence on catalog entries #5076 - Catalog entries from external MCP registries now carry the registry's declared source repository and published packages, feeding the approval evidence surface. The API descriptions note these are declarations, not observations. (Author: @daviddanialy)
• Warnings for duplicate identity provider URLs #5136 - Creating or editing a provider that duplicates an existing issuer URL now warns, without blocking the write, since duplication has legitimate uses. (Author: @bflad)
• Logging out clears everything #5131 - Logout now instructs the browser to drop cookies and storage across the whole domain, closing the gaps a plain expiring cookie leaves. Theme preference and project favorites survive. (Author: @disintegrator)
• Exclusion changes apply retroactively everywhere #5204 - Creating, updating, disabling, or deleting a risk exclusion now rewrites the affected findings' state in the analytics store as well as the primary database. (Author: @dennnis-ez)
• MCP protocol version telemetry #4957 - All five inbound MCP paths emit requested and negotiated protocol versions, so client adoption can be measured and version-specific failures diagnosed. (Author: @bflad)
• Platform admin and internal groundwork #5069 - Groundwork for the MCP approval workflow landed without user-facing behavior: summarizing what a tool declares it can do and resolving observed servers to stable artifact identities (#5036). Authorization challenge logging moved to a queue-backed pipeline (#5070) and challenge log pages now serve from pre-aggregated summaries (#5185). Platform operators gained a pay-as-you-go rate adjustment input on the contract estimator (#5145). (Author: @daviddanialy)

Bug fixes

• Employee usage pages no longer under-report #5199 - The rows that carry tokens and cost identify people by provider account email, while hook events carry a resolved user id, and per-employee queries only matched one shape. Employee pages now scope to a person's whole identity set, so someone on a personal AI account stops showing sessions next to zero cost. (Author: @daviddanialy)
• Codex hooks no longer fail with exit 127 #5103 - A background plugin refresh could delete the directory a running Codex session's hook command pointed at. The bootstrap now persists itself in a version-independent location, and a hash-computation bug that silently dropped hooks whose commands contained shell metacharacters is fixed. (Author: @speakeasyforgebot)
• Cursor events attribute to their sessions #5011 - Cursor usage events now decode the conversation id into the standard conversation attribute, tying usage to the session that produced it. (Author: @bradcypert)
• Misconfigured Slack clients no longer mask real alerts #5015 - Slack refusals a caller has to fix, such as a channel the bot was never invited to, are now caller-attributed warnings instead of server errors, so one noisy client can't hold an error monitor at threshold and hide a genuine regression. (Author: @bradcypert)
• Block pages and challenge rows link where you'd expect #5137 - Durable block pages link to the owning project's risk event log, and skill and environment rows on the access challenges page link to their pages instead of showing a bare id (#5134). (Author: @danielkov)
• "Continue chat" only offers your own sessions #5133 - The assistant dock's continue option now lists only sessions the viewer started from the dashboard, backed by a new user filter on chat listing. (Author: @danielkov)
• Audit entries name actors without an organization #5202 - Actions taken from organization-less sessions, such as self-signup provisioning, now record the actor's email instead of a bare id. (Author: @alx-xo)
• Platform admin: organization list paging #5218 - The admin organizations list no longer returns a cursor to an empty page when results are an exact multiple of the page size. Hook installations are also served an updated binary (#5135). (Author: @walker-tx)