Guided enterprise onboarding, runtime tool filtering, and a configurable marketplace name

This release adds a five-step enterprise onboarding wizard that takes a new org from SSO to live traffic, lets MCP clients filter exposed tools at request time, and makes your plugin marketplace name configurable per project.

Features

• Enterprise onboarding wizard #3079  - A new wizard at /<org>/setup walks a new org through SSO via WorkOS, directory sync, publishing a private plugin marketplace to GitHub, instrumenting each agent platform (Claude Code, Claude Cowork, OpenAI Codex, Cursor) with auto-generated keys, and confirming traffic is flowing. It resumes on the deepest incomplete step, includes a typeahead GitHub-user picker for marketplace collaborators, and ships an enterprise-admin invite email that deep-links recipients straight into the wizard. (Author: @adaam2 )
• Filter exposed MCP tools at request time #3164  - The public /mcp handler now accepts a ?tags= query parameter (comma-separated, union) to expose only the tool variations matching those tags, resolved from the server’s or toolset’s variation group with a project default fallback. (Author: @bflad )
• See tool filtering on the MCP details page #3213  - The Tools tab now shows a read-only scopes panel when filtering is enabled, listing the available filter tags with their member tools and the tools excluded from every filter, with a tag chip to filter the list below. (Author: @bflad )
• Configurable marketplace name per project #2964  - A new Marketplace settings dialog lets you rename a project’s generated plugin marketplace; the default is now <org-slug>-speakeasy so marketplaces stay unique across customers. Saving an override on a project with a published marketplace auto-republishes the manifest to GitHub. (Author: @chase-crumbaugh )
• Project Assistant turns run as the sender #3216  - Assistant turns sent from the dashboard now run under the sending user’s identity, so MCP tool calls, audit attribution, and per-user RBAC reflect who actually sent the message rather than whoever first enabled the assistant. (Author: @danielkov )
• Project Assistant reads from the chat service #3204  - The dashboard Project Assistant now reads its conversation directly from the chat service: assistants.sendMessage takes an optional chat_id to continue a thread or omits it to start one, and replies surface as plain assistant messages from chat.load. (Author: @simplesagar )
• Project Assistant available out of the box #3202  - A new assistants.ensureManagedAssistant endpoint provisions a project’s built-in Project Assistant on first access, so the dashboard sidebar resolves it without manual setup. (Author: @simplesagar )

Bug fixes

• Imported remote MCP sources serve traffic immediately #3179  - Importing a remote MCP server as a source now auto-creates a default endpoint, so the server is ready to serve once enabled instead of requiring you to add an endpoint by hand. (Author: @walker-tx )
• Preserve Authorization header for passthrough tools #3177  - A configured Authorization header on external MCP passthrough tools is no longer overwritten by the gating OAuth token. (Author: @walker-tx )
• Consistent Insights and Logs filter dropdowns #3183  - The filter dropdowns on the Insights and Logs pages no longer race two filters against each other, so valid matches stop falling into “No results found” and the list recovers when characters are deleted. (Author: @simplesagar )
• Insights counts only workspace members #3184  - The Employees and Role views in Insights now exclude impersonating superadmins that previously appeared as a raw UUID. (Author: @danielkov )
• Clearer Shadow MCP rule delete dialog #3191  - Improves the confirmation dialog for deleting Shadow MCP access rules. (Author: @alx-xo )
• Consistent release-stage badges #3180  - Preview and beta badges now render consistently in the side nav and tab navigation. (Author: @alx-xo )
• Reliable enterprise onboarding status #3208  - organizations.getOnboardingStatus no longer returns a 500 in production, now that WorkOS connection and directory lookups use the official WorkOS Go SDK and the correct endpoints. (Author: @adaam2 )
• Reliable organization invite emails #3190  - Organization invite emails now fall back to a non-empty inviter name when the inviter’s display name is blank, preventing rejected invites. (Author: @bradcypert )