Organisational collections, plugin distribution, and a data-driven project dashboard

This release introduces organisational collections for publishing MCP servers within an organisation, adds a plugins primitive for packaging and distributing MCP server bundles, and replaces the home placeholder with a new data-driven project dashboard. It also ships an expanded hooks dashboard, a super-admin RBAC interface, an OAuth configuration wizard, and a redesigned MCP logs experience.

Features

• Organisational collections and MCP publishing #2199  - Added an MCP collections service, publishing flow, and catalog UI so MCP servers can be shared across an organisation. (Author: @subomi )
• Plugins for MCP server bundle distribution #2194  - Introduced a plugins feature for distributing MCP server bundles to teams, including custom plugin support for Claude via zip. (Author: @bradcypert )
• Plugins database migration #2214  - Added the plugins, plugin_servers, and plugin_assignments tables to support the plugins feature. (Author: @bradcypert )
• Project dashboard #2217  - Replaced the home placeholder with a data-driven project dashboard surfacing key metrics. (Author: @alx-xo )
• Project metrics summary endpoint #2216  - Added a new project metrics summary endpoint that powers the new project dashboard. (Author: @chase-crumbaugh )
• Hooks dashboard with metrics #2175  - Shipped an expanded hooks dashboard with charts for server activity, source volume, user activity, error rates, and usage over time, plus a KPI metrics row and a toggle to show or hide the raw trace log list. (Author: @alx-xo )
• Pre-aggregated summary endpoint for hooks analytics #2241  - Switched hooks analytics charts and KPIs to a pre-aggregated summary endpoint for faster dashboard loads. (Author: @alx-xo )
• Super-admin RBAC interface #2212  - Added RBAC management endpoints and a super-admin interface for enabling RBAC on organisations. (Author: @tgmendes )
• OAuth config wizard #2200  - Extracted OAuth setup for external MCP servers into a dedicated step-by-step wizard with a state machine, supporting both proxy and external OAuth paradigms and adding success and failure result steps. (Author: @walker-tx )
• MCP status dropdown #2205  - Replaced the MCP enable button with a three-state status dropdown for Disabled, Private, and Public. (Author: @alx-xo )
• Global AI Insights action #2239  - Surfaced AI Insights as a static button in the top breadcrumb bar across every project page. Pages that need a custom prompt or tool set declare it with <InsightsConfig />; everywhere else the global default applies. (Author: @simplesagar )
• Redesigned MCP logs #2206  - Redesigned the MCP logs view with color-coded severity badges, left-edge status dots, tighter row density, sample-query popovers on the filter and date-range inputs, and React performance fixes including memoized trace rows and stable callbacks. (Author: @simplesagar )
• Click-to-filter log attributes #2258  - Added click-to-filter on attribute rows in the MCP logs detail sheet. Clicking an attribute filters by equals, exclude, or contains, or copies its value. Also fixed attribute filters returning too few results due to a hardcoded event_source filter that did not account for attributes being spread across multiple log entries per trace. (Author: @simplesagar )
• Restore rich tool UI in the playground #2221  - Restored the rich tool-call rendering in the playground. The MCP Apps integration had replaced the default tool UI for every tool call; the playground now delegates to the default ToolFallback and only appends the MCP App iframe when the tool has a UI resource binding. Elements now exports ToolFallback from its public API so consumers can compose around it. (Author: @simplesagar )

Bug fixes

• Hard limits on Fly runners #2253  - Set a hard limit on concurrent HTTP requests to Gram Function runners deployed on Fly, preventing OOM errors and crashes when a large number of tool calls arrive in a short period. (Author: @disintegrator )
• Idempotent default registry collection bootstrap #2249  - Fixed a race condition where concurrent collections.List calls could fail with "default registry collection already exists" while bootstrapping the default registry collection. The ensure routine now treats unique-constraint violations as success and refetches the existing rows. (Author: @danielkov )
• Corrupt session role resolution #2245  - Added a better error handler for failed role resolution when a user ends up with a corrupt session. (Author: @qstearns )
• Remove legacy sso_connection_id column #2246  - Replaced sso_connection_id with workos_id in queries and app code, then removed the legacy column. (Author: @qstearns )