Server-side OAuth metadata discovery for Remote MCP and a redesigned org home

This release adds an RFC 9728 OAuth Protected Resource Metadata discovery endpoint for Remote MCP servers, brings tag editing into the playground tool editor, migrates dashboard tables to Moonshine, and ships a redesigned org home with favorites and a contributor facepile.

Features

• Server-side OAuth Protected Resource Metadata discovery for Remote MCP #3032  - Adds the remoteMcp.discoverProtectedResourceMetadata endpoint that probes a remote MCP server for an RFC 9728 OAuth Protected Resource Metadata document server-side under guardian.Policy. External resource servers are unlikely to allowlist the Gram dashboard origin via CORS, so discovery moves to the backend, following RFC 9728 §3.1 path-style and origin-style discovery and returning typed unavailability codes with backend-composed user messages. (Author: @bflad )
• Tag editing on tool variations #2962  - Exposes tags on tool variations and adds a tags row to the playground tool editor for HTTP tools, with chip input, base-source quick-add, an override indicator, and a reset-to-source affordance. (Author: @bflad )
• Dashboard tables migrated to Moonshine Table #3004  - Migrates dashboard tables to Moonshine Table with sortable insights columns and removes the legacy table wrapper. (Author: @alx-xo )
• Redesigned org home with favorites and contributor facepile #3014  - Redesigns the org home page with a two-column layout. The left rail shows compressed Recent challenges and Recent activity, while the right column shows projects as a thin rectangular stack or a 1/2/3-column card grid (toggle persisted in localStorage). Each project row or card shows the most recent audit-log action with a hover tooltip for full UTC and local timestamps, a facepile of up to 10 active contributors, a star to favorite or unfavorite, and a kebab menu. A new Add New dropdown next to the search bar offers Project, Team member, and Role, gated by org:admin. (Author: @simplesagar )

Bug fixes

• Deterministic UUIDv5 org IDs from WorkOS #3023  - Derives org IDs as deterministic UUIDv5 from the WorkOS org ID during Register and auto-provisioning, replacing the previous "org_" + random UUID format which was not a valid UUID. (Author: @adaam2 )
• Preserve theme and project favorites across logout #3034  - Preserves theme and saved project favorites when logging out, so visual preferences and starred projects survive the next sign-in. (Author: @alx-xo )