Changelog

​

Agent Monitor filters and Zed skills

• Agent Monitor filters: Filter agent runs by user and source, with run source and actor shown on each card. See Agents.
• Zed native skills: The CLI now syncs skills to Zed. See Skills.
• One-command Test Device install: Hosted install scripts set up a macOS or Windows test device in one command. See Detect.
• Fetch artifacts in agent runs: Agents can fetch artifact content in the sandbox with the new fetch_artifact tool. See Agents.
• List AI providers over MCP: New list_ai_providers MCP tool.
• Device-sync filter for skills: Filter the manage skills list by device sync status. See Skills.
• Google Drive file metadata: The Drive connector supports writable file metadata. See Connectors.
• Model attribution in sessions: Token spans are attributed to the model that produced them. See Sessions.

• Config change auditing: LLM gateway and AI provider configuration changes are audited. See Audit logs.
• Claude Desktop and Cowork skills detected: AI Watch scans now find Claude Desktop and Cowork skills. See Shadow AI.
• Stricter OAuth redirect validation: Redirect URI allowlists are validated consistently at client registration. See Connectors.

• Sharing role clarity: The sharing dialog explains team permission overrides and marks the selected role.
• Slack Enterprise Grid notifications: Notification channels work on Enterprise Grid workspaces. See Agents.
• AI Watch false Inactive: Devices no longer incorrectly show as Inactive. See Shadow AI.
• Windows MSI upgrades: Upgrades no longer silently drop equal-version VC runtime DLLs.
• Resumed sessions render fully: Resumed sessions no longer show truncated history. See Sessions.

​

Session sharing and settings revamp

• Session sharing: Share a session with teammates using the same sharing framework as other resources. See Sessions.
• Revamped Personal and Org settings: Reorganized settings pages that are easier to scan and navigate.
• Agent traces in playgrounds: Inspect an agent run’s trace directly in the playground. See Agents.
• DeepSeek V4 Pro: New model option for agent runs. See Agents.
• One-click Slack consent: Approve a paused agent run from Slack and it mints the session grant for you. See Agents.
• Guided managed Slack setup: Onboarding walks you through connecting managed Slack. See Agents.
• Event trigger conditions: See and set the conditions that fire an agent event trigger. See Agents.
• AI ROI and agent cost cards: The usage page shows ROI cards and managed agent cost metrics.
• Public OAuth clients for MCP servers: Connect upstream MCP servers that use a public OAuth client with no client secret. See Connectors.
• Quieter toasts: Fewer noisy success toasts and a restyled toaster.
• Faster spend views: The Spend page and drawer make far fewer requests.
• Model hover cards: The agent model picker shows models.dev details on hover, one card at a time. See Agents.
• Run cost on monitor cards: Agent monitor run cards show what each run cost. See Agents.
• runlayer doctor: New CLI preflight that checks OAuth and connectivity before you deploy. See CLI deployment.
• Audit log vocabularies: Available audit log action and resource types are queryable over MCP. See Audit logs.

• Verified skills: Admins can mark a skill as verified so users know it’s trusted. See Skills.
• More AI tools detected: Detect now scans for Pi, Kimi Code, Kilo Code, Junie, and Devin CLI. See Detect.

• Skill import: SKILL.md frontmatter is preserved on import. See Skills.
• Spend activity cards: Restored on the usage page.
• AI Watch accuracy: Top connectors show the MCP name instead of the gateway domain, and device mode comes from reported claims. See Shadow AI.
• Manual OAuth credentials: Switching a connector’s auth type no longer leaves orphaned manual credentials behind. See Connectors.
• CLI OAuth errors: Clear guidance when dynamic client registration is rejected or a pending login times out. See CLI deployment.
• Slack agent routing: The Slack front door no longer routes messages to unused, toolless agents. See Agents.
• Directory sync: Sync no longer wedges on a bad event, and duplicate-email collisions are handled cleanly.
• Device counts: Configuration filters count each device once.
• Binary artifacts: Large artifacts download on demand instead of failing with a conflict error.

​

Slack progress cards and artifact versions

• Live Slack progress card: Agent progress appears as one live-updating card instead of a per-tool-call checklist. See Agents.
• Per-agent Slack suggested prompts: Give each agent its own suggested prompts in Slack. See Agents.
• Scheduled run audiences: Choose who a scheduled agent run posts to, with audience badges on each schedule. See Agents.
• Artifact versioning: Artifacts keep version history, mirroring agent and skill versioning. See Agents.
• Windows and Linux skill sync: Automatic skill sync scheduling now runs on Windows and Linux. See Skills.
• Add team assets from the header: Create assets straight from the team header instead of per-tab dropdowns.
• Faster usage page: Usage data loads on demand and no longer re-polls historical queries.

• Session events to your SIEM: Stream session events to your own SIEM bucket. See Audit logs.

• Manual OAuth clients: New authorizations use your configured manual OAuth client even when manual setup is toggled off. See Connectors.
• Activity summary coverage: The activity summary now shows the latest 5,000 sessions. See Sessions.

​

Bedrock provider and artifact tags

• Amazon Bedrock inference: Use Bedrock as an LLM gateway provider for agent runs. See Agents.
• Artifact tags and filters: Tag artifacts and filter them by team or workspace, with the org tag vocabulary also readable over MCP. See Agents.
• Up to 50 subagents: Agents can define up to 50 subagents, and subagent tools now work in Claude Code and the playground. See Agents.
• Slack Enterprise Grid installs: Install the Runlayer Slack app through Enterprise Grid managed installs, and turn off Slack interactive planning when you don’t want it. See Agents.
• Most-used sort by default: The Agents and Skills pages sort by most used out of the box. See Skills.
• Run outcome rate per agent: The usage drawer shows each agent’s run success rate.

• Skill scan risk signals over MCP: Skill reads over MCP include scan risk signals. See Skills.
• Container and WSL detection: The MDM detection option now covers containers and WSL, not just Docker. See Detect.

• Custom OpenAI base URLs: The native OpenAI provider honors a configured base URL, and an ambiguous model name binds to your oldest matching provider instead of erroring. See Agents.
• Connector token auth: Connector clients negotiate supported token auth methods during registration. See Connectors.
• Deployment proxy responses: Public deployment proxy responses strip compression and hop-by-hop headers, fixing corrupted payloads. See Connectors.

​

Per-type scan actions and org tags

• Emergent org tags: Connectors, plugins, skills, and agents are automatically tagged so you can group and find related resources. See Connectors.
• Team-level default for skill device sync: Set whether skills sync to devices by default for a whole team instead of per user. See Skills.
• Clearer error messages: Blocked requests now say what went wrong — size, time, or kind. See ToolGuard.

• Per-type actions for scanning rules: Choose a different action per PII label and credential type instead of one action for the whole rule. See Policies.
• Cursor Cloud hook coverage: Cursor Cloud sessions run under hook enforcement like other clients.

• Anthropic tool scanning: Tool scans complete their full lifecycle, and Anthropic Cowork sessions are classified with the right provenance. See Sessions.
• Codex CLI config: The CLI writes the correct MCP config key for the Codex plugin. See CLI deployment.

​

Connector warnings and settings audit logs

• Shared connector deployment warning: The webapp warns you before deploying a connector that others also use. See Connectors.
• Scheduled runs use the schedule creator: A scheduled agent run executes as the identity of whoever created the schedule. See Agents.
• Slack user-identity sends in the agent UI: The UI shows when Slack MCP actions send as the connected user rather than the bot. See Agents.
• Skills filter bar: Filter the manage-skills page, with the same filters now available to agents over MCP. See Skills.
• Guided Slack agent setup: The Slack agent app workspace walks through prerequisites before install. See Agents.
• Usage token and spend reads over MCP: Agents can read usage-page token and spend data, and usage cost formatting is clearer.
• Plugin lists in Teams: Team and All Workspace plugin tabs load with infinite scroll and server-side search. See Plugins.
• Desktop tray: Admins see recent sessions and can approve access requests from the tray.

• Audit logs for organization settings: Settings changes are recorded in audit logs, with ATLAS techniques on MCP log summaries. See Audit logs.
• AI Watch activity in Shadow: Enforce and Protect block/allow activity is surfaced in Shadow AI. See Shadow AI.

• OAuth reauth dead ends: Stale upstream OAuth sessions are cleared before reauth, and shared-credential reauth routes to the credential owner. See Connectors.
• Skill scans: A skill that crashes the scanner no longer stalls the rest of the sweep. See Skills.
• Shadow AI collection: Collection runs no longer exit before writing results. See Shadow AI.
• Desktop access requests: The access-request row stays visible while the dashboard review is open.

​

CLI self-update and skill scan visibility

• CLI self-update: The CLI updates itself to the matching build for how it was installed, and safely no-ops when it can’t. See CLI deployment.
• Slack channel intro toggle: Turn the agent’s channel intro message on or off per agent. See Agents.
• Session volume timeline over MCP: Agents can read bucketed session volume over time. See Sessions.

• Skill scan failures in the webapp: Failed skill security scans are now visible in the UI, with a summary in CI output. See Skills.

• Policies and scanners UI: The policies action filter renders correctly and the security-scanners client picker no longer breaks. See Policies.
• Slack portal customizations: Manual edits to the long description and background color are preserved instead of being overwritten. See Agents.
• Shadow AI user charts: Charts key by username and device, so per-user activity is no longer merged incorrectly.
• Session grants and accounts: Unpinned session grants count toward the default account.

​

Skill auto-update and Anthropic scanning

• Imported skill auto-update: Opt in to hourly auto-updates so imported skills stay in sync with their source. See Skills.
• Full-screen skill builder: Create skills in a full-screen builder with templates to start from. See Skills.
• Browser extension manual download: Download the extension package directly instead of using the store flow. See Browser Extension.
• Session outcome summaries over MCP: Agents can read a session’s activity and business-outcome summary. See Sessions.
• Slack install outcome on agent create: create_agent now reports the result of the Slack install. See Agents.

• Anthropic tool-result scanning: ToolGuard scans tool results returned through Anthropic inference. See ToolGuard.
• Anthropic inference hooks: New hooks adapter brings Anthropic-based clients under hook enforcement.

• OAuth authorize errors: Authorize requests for an unknown resource return invalid_target instead of a confusing redirect failure.
• AI Watch on Chrome: Runtime Chrome policy is preserved, so monitoring keeps enforcing after a policy refresh.
• CLI MDM profile: The CLI reads its own com.runlayer.cli preference domain, so MDM-managed CLI settings apply. See CLI deployment.

​

Role visibility

• Directory-synced roles: The manage-user page now lists every role synced from your directory instead of only a subset. See Roles.

​

Extension targeting and MCP reads

• Browser extension update targeting: Choose which extension version rolls out to which devices. See Browser Extension.
• PBAC condition operators over MCP: Policy tools now enumerate the available condition operators, so agents build policies without guessing. See Policies.

• Agent run privacy: Runlayer MCP tools redact other users’ agent-run content, so run output is only visible to its owner. See Agents.

• Onboarding connector policies: Existing connector policies are preserved when onboarding runs. See Connectors.
• Deleted skills: Soft-deleted skills no longer show up in agent reads over MCP. See Skills.
• Agent builder: Draft edits apply correctly and live preview takes precedence. See Agents.
• Cursor CLI hooks: Live Cursor CLI hook data is preserved instead of being overwritten.
• OAuth rotation races: Stale rotation-race rejections no longer count as refresh-failure strikes, so connectors stay connected.

​

Cursor coverage and incident badges

• Cursor surface coverage: Runlayer now reports coverage for Cursor alongside your other AI surfaces, so you can see which developer tools are protected.
• Incident badges and compact rows: Incident rows are denser and ATLAS technique badges now open popovers explaining what was detected. See Incidents.
• Larger skill uploads: The skill upload limit is now 5 MB. See Skills.
• Agent management over MCP: New delete_agent tool, plus paging (has_more) on list_agents and list_skills. See Agents.
• Audit log drawer: Pinned table footer and tightened drawer layout when reviewing audit events. See Audit Logs.

• OAuth refresh handling: Connectors that return a nonstandard invalid_refresh_token rejection are now treated as terminal, so you get a clear reconnect prompt instead of silent retries.
• Anthropic model names: Model spellings resolve correctly instead of being inferred from the prefix.

​

Incident detail polish and OAuth fixes

• Incident detail view: Incident tabs, tables, and drawers have been reworked for easier scanning. See Incidents.
• Skill share counts: MCP list_skills now reports how many principals a skill is shared with. See Skills.

• Entra logins: Microsoft Entra OAuth connections no longer re-prompt for consent on every login.
• Firefox AI Watch: The Firefox policy persists outside managed preferences, so it survives restarts.
• CLI on Python 3.10: The CLI runs on Python 3.10 again.

​

Slack agent routing and MCP coverage

• Slack agent routing: Messages to your organization’s Slack app are routed to the best-fitting workspace agent. See Agents.
• Agent control from Slack: Slack runs can use Runlayer’s agent-control tools without extra configuration. See Agents.
• Dynamic plugin installs: The native install flow now offers and installs dynamic plugins. See Plugins.
• Searchable agents tabs: The team and All Workspace agents tabs now search server-side and scroll continuously. See Agents.
• Scanner settings coverage: MCP security scanner settings expose the full REST field set. See ToolGuard.

• MDM configurations: List your MDM configurations over MCP.
• Client blocking capabilities: Read which clients support blocking.
• Session topics and spend: Enumerate session topics and pull spend rollups, plus filter sessions by topic. See Sessions.
• Eval scorers: Discover the available agent eval scorers. See Agent Evals.
• Richer agent reads: Agent model settings, descriptions, skill import sources, and schedule active hours are now readable and writable over MCP. See Agents.
• Session IDs on audit logs: Audit log rows now include the session ID. See Audit Logs.

• CLI security floor: The CLI enforces a higher minimum MCP security level.

• Directory-synced roles: Manual roles can be removed from directory-synced users in the UI.
• Distilled skills: Distilled skills can be removed from the agent UI. See Skills.
• Hosted servers: Hosted uvx servers keep a writable tool directory.
• Slack streaming: Chunk-mode Slack streams stay alive correctly.

​

Device sync, MCP tools, Outlook mailboxes

• Skill device sync: Set an organization-wide device sync default, override it per skill, and let people opt in for their own devices. See Skills.
• Searchable skills tabs: The team and All Workspace skills tabs now search server-side and scroll continuously instead of paging. See Skills.
• Policy condition guidance: The policy builder shows a description and example for each condition field. See Policies.
• Incident scanner shortcut: The Scanner row on an incident links straight to its settings panel. See Incidents.
• Incident audit log filters: Filter incident audit logs directly in the drawer. See Incidents.
• Control navigation: The Monitor section is now called Control.

• Artifacts: Read artifacts and their contents over MCP.
• Skill import from URL: Import skills straight from a public repository URL. See Skills.
• Incident sessions: List the sessions behind an incident. See Incidents.
• AI Watch status: Read AI Watch client and status information.
• Agent starter prompts: Read and update an agent’s starter prompts. See Agents.

• Outlook shared mailboxes: Outlook connections can now use shared mailboxes. See Microsoft Outlook.

• Recursive delete detection: Skill scanning catches split-flag recursive deletes such as rm -f -r. See ToolGuard.

• Codex plugin tools: Dynamic plugin tools now appear directly in Codex. See Agents.

​

Policy builder rework and wider client support

• Policy builder rework: Rebuilt policy builder, including Ask AI drafting that turns a plain-language description into a draft policy. See Policies.
• Teams catalog: Teams now have a catalog page with nested navigation; public/private teams are removed.
• Session timeline filters: Filter and keyword-search the session timeline directly in the drawer. See Sessions.
• Editable starter prompts: Edit an agent’s starter prompts in agent settings. See Agents.
• Per-OS installer downloads: Grab the right installer for each operating system from the Client Updates page. See Updates.
• Guided onboarding: New organization setup flow with a deep-linked checklist, clearer labels, and connector-complete policy defaults.

• Windsurf, Qwen Code and Gemini CLI: Session hooks and enforcement now cover Windsurf, Qwen Code and Gemini CLI. See Sessions.
• Scheduled CLI tasks: runlayer schedule runs per-user tasks on a schedule, with macOS LaunchAgent support.
• Test Device guide: Package-based Test Device setup guide. See Test Device.

• Client PII rule overrides: Override PII detection rules per client. See Policies.

• Browser capture: Perplexity and DeepSeek responses parse correctly again, Bolt sentinel responses are excluded, and Lovable and ChatGPT handoff replies are captured. See Detect.
• Chrome policy on macOS: Synced Chrome policy now refreshes on macOS.
• OAuth token TTL: Connections stay signed in when a provider omits expires_in from its token response. See Connectors.

​

Incident grouping and browser enforcement

• Native tool incidents grouped by class: Dev-tool incidents without a server now group under Terminal and Filesystem classes instead of fragmenting across dozens of per-tool, per-casing groups. See Incidents.

• Grok live enforcement: Pre-send enforcement and exact response capture work again after Grok moved to a new message envelope. See Enforce.
• Google Notebook host move: Prompts on notebook.google.com are captured and attributed to NotebookLM again. See Detect.

​

Codex sync, Intune macOS, ToolGuard status

• ToolGuard status monitoring: Track scanner status in the dashboard, alongside a customer-visible model changelog. See ToolGuard.
• Session scanning cards: Full-session scan results are now split into discrete cards. See Sessions.
• Max reasoning effort: Agents can now run with a max reasoning effort setting. See Agents.
• Outcome-aware incident severity: Severity is now scored from outcomes, with a recalibrated reason map. See Incidents.
• Slack notification scope: Toggle security notifications between incidents and alerts. See Slack Notifications.
• Broader shadow MCP detection: Wider MCP-server source-code signatures and corrected Shadow labeling; weak client evidence is now classified as traces. See Detect.

• Codex auto-sync: Codex configuration now syncs automatically. See Agents.
• Intune (macOS) deployment: Deploy the agent to macOS fleets via Intune from the MDM wizard. See Intune (macOS).
• Managed CLI auto-updates: Schedule automatic updates for the managed CLI.

• Team default permissions: Edit a team’s default permission and cascade it to shared assets. See Roles.
• Disabled connectors issue no tokens: OAuth token issuance is now gated on the connector not being disabled. See Connectors.

• Browser extension capture: Repaired provider capture and session recording in the browser extension.
• Token refresh reliability: Connections stay signed in more reliably when a lot of requests happen at the same time, and refresh problems are now recorded so they surface faster.
• Approvals: Automatic Slack approval retries stopped; blocked users are directed to Slack. See Approvals.
• Local tool sync: Local tools re-sync after configuration changes.
• Interactive artifacts: Popups now work inside the interactive artifact iframe sandbox.
• Transient upstream 401s: Read-only MCP operations retry once in-request after an upstream 401.

​

Agent eval tools and wider enforcement

• Agent eval runs via Runlayer MCP: New Runlayer MCP tools to create and read agent eval runs. See Agent Evals.
• Sessions ↔ audit cross-linking: Move between sessions and audit logs with stacked drawers. See Sessions.
• Violation Type column: Security audit views now include a violation Type column. See Audit Logs.
• Agent run naming: Agent runs are named from session labels, with analyzers firing on subagent stop. See Agents.

• OAuth redirect URI allowlists: A wildcard optimizer flow for OAuth redirect URI allow/deny lists. See Policies.
• PBAC list operators: contains / not_contains policy operators now accept list values. See Policies.
• Sync-only API keys: New skill_sync org-key role for sync-only keys.
• MDM session ingestion: The MDM session-ingestion setting is now enforced.

• Expanded browser enforcement: The browser extension now enforces Lovable, Bolt, Poe, Meta, and Grok surfaces.
• Vercel Eve sessions: Capture Vercel Eve sessions through native hooks.

​

Slack MCP OAuth, Detect drift, and approval surfaces

• Slack MCP (OAuth): Connect Slack MCP through a managed OAuth profile in the broker. See Connectors.

• Detect configured vs running: Detect now surfaces configured-vs-running state with runtime shadows, so you can spot drift between declared and actually-running MCP setups. See Detect.
• Intune packaging: The Intune deployment card now offers a .intunewin package plus a signed detection script for easier MDM rollout. See Detect.
• Approval policy surfaces: New approval policy surfaces across the dashboard and Runlayer MCP. See Policies.
• Scanner policy provenance: The dashboard now shows where each scanner policy came from. See ToolGuard.
• Incident sessions toggle: Toggle related sessions directly on the incident detail view. See Sessions.

• Slack outbound messaging controls: New controls to govern outbound messaging from Slack-based agents.
• Policy details in audit events: Audit events now include the policy details behind each decision. See Audit Logs.

• AI Watch config sync: AI Watch configuration changes are now reported immediately.
• Local connectors visibility: The org-install skill no longer suppresses Runlayer local connectors.
• Directory sync cleanup: Deleted groups are now cleaned up during directory sync.
• Server log paging: ECS server logs now page correctly across large CloudWatch result sets.

​

Global Policies, skills, and new models

• Global Policies page: See every policy in one view, with a pinned pagination footer for easier navigation. See Global Policies.
• Version history for skills & agents: Review diffs across versions with a polished comparison dialog. See Agents.
• Skill auto-sync: Skills now sync automatically as first-class entities, with assigned-skills visibility in ai-watch. See Agents.

• Kimi K3 (Baseten): Select Kimi K3 via Baseten as an agent model. See Agents.

• Security score stability: /tool_list security scores now return stable, consistent results. See ToolGuard.

​

Current version in lists

• Current version everywhere: Agent and skill list and detail views now report the current version directly, so version history reflects the live head without an extra lookup. See Agents.

​

Claude Opus 5 and version history

• Claude Opus 5: Select Claude Opus 5 as the model for your agents. See Agents.
• Agent & skill version history: View and restore previous versions of agents and skills, with version context now recorded on update audit events. See Agents.

• Admin request search: Server-side search across the /admin/requests inbox for faster review.
• Scan correlation IDs: Security scoring responses now include scan_id and tool_fingerprint; pass your own x-runlayer-scan-id header to correlate scans. See ToolGuard.
• Safer connection edits: Agent account connection grant changes are staged until you Save.

• List up to 500 servers: Server listings no longer cap early on large catalogs.
• Plugin shared skills: The Runlayer Plugin now includes shared skills.

​

Protect denylists, ToolGuard feedback, and agent visibility

• Protect MCP denylists: Block known-bad MCP sources by remote URL, npm/PyPI package, or client built-in — allow-unless-denied source governance in Protect mode, without switching to Enforce’s deny-by-default posture.
• ToolGuard feedback API: Report ToolGuard false positives and false negatives via a new POST /api/v1/security/feedback endpoint, using the same API key and role as the ToolGuard scoring endpoints. See ToolGuard.

• Live AI Watch settings sync: Dashboard changes to AI Watch settings now reach managed endpoints automatically, without rebuilding and re-pushing the MDM policy.
• Agent MCP activity: The agent account Activity view now shows tool calls and other MCP events performed by the agent, not just lifecycle and delegation rows. See Agents.
• Slack agent attachments: Slack-based agents can now reliably read image and PDF attachments shared in a thread.

​

New connectors and workspace controls

• Audited remote MCP servers: New vetted remote MCP servers are available in the catalog. See Connectors.
• Google Forms: Added write tools for Google Forms. See Connectors.

• Workspace management: Add or remove skills, plugins, and agents directly from any All Workspace tab. See Skills, Plugins.
• Requests inbox: Unified /admin/requests view with infinite scroll for faster review.
• MDM scan toggles: Turn process and container detection on or off from the MDM config UI. See Detect.
• Legacy Linux support: The Runlayer CLI and AI Watch now ship glibc 2.17 builds for older Linux distros. See Linux CLI.
• Codex client: Runlayer now recognizes the Codex MCP client.

• Session-linked audit logs: Audit log entries are now associated with their session, so you can trace activity end to end. See Audit Logs, Sessions.
• WSL scanning: Home-directory artifact scanning now covers WSL home directories.

​

Offline agent evals and connector improvements

• Offline agent evals: Replay agent runs with overrides, scored by an LLM judge plus custom scorers.
• Skill and plugin owners: Owners are now shown on skill and plugin cards.
• Trial budgets: Platform trial budgets are now surfaced in the webapp.
• Webhook run-as-agent-account: Webhooks can run as an agent account for true machine-to-machine runs.
• Plugin v2 + multisearch: Plugin v2 is now integrated with multisearch.
• Team icon colors: Team icons now use dynamic background colors.
• Agents picker: The agents picker now supports infinite scroll and server-side search.

• Faster connector pickers: Connector pickers now paginate and lazy-load for faster loads.
• Manual OAuth in the CLI: Manual OAuth is now supported in the local CLI.
• CLI deploy link: The CLI deploy link now points at the connector deployment-runs tab.

• Connector descriptions: Deployment connector descriptions are now preserved.
• Claude settings: Claude settings are now preserved during MDM updates.
• Resumed sessions: Resumed session duration is now cleared correctly.
• OAM link metric filter: The OAM link metric filter is now applied as a single IN condition.
• Agent environment variables: Saved agent environment variable descriptions are now clearer.
• Duplicate eval button: Removed a duplicate “new eval” button.

​

Org logo upload and AI Watch coverage

• Organization logo: You can now upload your organization’s logo to brand your Runlayer workspace.

• Broader scan coverage: AI Watch now covers more agent definitions and container artifacts, so more of your environment is scanned. See AI Watch.

• Session endings: Resuming a session no longer produces duplicate session-end events. See Sessions.

​

Sourcegraph connector and agent schedules

• Sourcegraph: The official Sourcegraph MCP server is now available in the catalog. See Connectors.

• Active-hours agent schedules: Agent schedules now support an active-hours window, so agents only run during the times you choose. See Agents.

• Slack blocked-channel enforcement: Slack interactions are now blocked in channels you’ve blocked, closing an enforcement gap.
• Redirect-URI denylist for manual callbacks: Manually registered client callbacks now respect your org’s redirect-URI denylist.

• OAuth token refresh: Failed upstream token-refresh cycles now use escalating backoff, improving connector reliability.
• AI Watch scans: Resolved re-audit findings for more accurate scan results. See AI Watch.
• Agent skills: Skills deleted during a sync retry are now correctly recreated.
• Catalog suggestions: The app no longer invents pending catalog connectors from prompt keywords.

​

AI Watch auto-update and scanner controls

• Self-updating installers: The AI Watch agent now auto-updates on Windows and Linux, so endpoints stay on the latest version without manual reinstalls. See AI Watch.
• Clearer scan status: Scan-unavailable states are now shown separately from security verdicts, and scan dedupe, detection confidence, and transport labels are more accurate.

• Customizable block messages: You can now customize the security block message shown when a scanner violation blocks a request.
• Incidents and sessions from MCP: View incidents and sessions directly through the Runlayer MCP tools.

• Plugin access: Non-admin users now see the plugins they have access to.
• Enforce-mode connectors: Verified claude.ai connectors now resolve correctly under MCP enforce.
• Usage timeline: Empty sessions no longer appear in the timeline.

​

Shadow AI client discovery

• AI client inventory: AI Watch now detects installed AI clients during scans and classifies them as shadow or managed, with a new client catalog and installation tables in the Shadow AI overview. See AI Watch.
• Runtime process & container sightings: MCP processes and MCP configs found inside running containers are correlated as runtime sightings in the UI. See AI Watch.
• Allowlist shadow AI clients: Allowlist discovered AI clients and drill into per-client audit detail. See AI Watch.
• Per-user enforcement disable: Enforcement can now be disabled for individual users. See Enforce.
• Policy-selected installers: Download the AI Watch installers selected by your policy. See AI Watch.
• Auto-provision AI Watch users: Users surfaced during AI Watch scans that don’t match an existing account are now automatically provisioned. See AI Watch.

• Agent usage vs limits: Agent settings now show current usage against run limits and cost budgets. See Agents.
• Redesigned session alerts: The session alerts panel now rolls up findings for a clearer view.
• client_credentials OAuth: Remote MCP servers now support the client_credentials upstream OAuth mode. See Connectors.
• Standalone M2M access: Owner opt-in for standalone machine-to-machine MCP access grants.

• Windows AI Watch scans: Fixed a crash on path digests during scans on Windows.
• Claude Code plugins: AI Watch now scans Claude Code marketplace-bundled plugins.
• Google Slides & Calendar: Catalog tool lists are now populated for these connectors. See Connectors.
• Browser find on settings: Cmd/Ctrl+F no longer hijacks the browser’s native find on settings pages.

​

New connectors and skills cleanup

• Carta, Egnyte, Make, and Replit: Four new MCP servers are now available in the catalog. See Connectors.

• Skills management: Get a heads-up when a similar skill already exists before you create one, see where each skill is used and sort the list, and find and safely clean up duplicate skills. See Skills.
• Unused agents cleanup: A new Unused tab on the Agents page surfaces zombie agents with a last-used badge so you can clean them up. See Agents.
• Usage Activity widgets: The Usage Activity dropdown is now unpacked into six dedicated widgets for clearer at-a-glance insights. See Analytics.
• In-app what’s-new: A what’s-new card and changelog dialog now surface the latest updates directly in the app.
• AI Watch device filters: Unified device filters across AI Watch views. See AI Watch.

• Secret redaction in get_deployment: The get_deployment MCP tool now redacts environment secrets from its output. See Deploy.
• Short-lived token refresh: OAuth now applies a lifetime-relative inline-refresh floor so short-lived upstream tokens refresh reliably.

• Slack auth prompts: Authentication prompts are now sent as direct messages. See Slack.
• AI Watch CLI: aiwatch scan no longer crashes on unexpanded $VAR config paths.
• Spend charts: Sparse spend data is zero-filled so spend charts render continuously.

​

Per-client scanning and Enforce allowlists

• Per-client security scanner overrides: Security scanner settings can now be overridden per MCP client, so you can scan some clients more strictly without changing the global configuration. See ToolGuard.
• Granular credential masking: New controls for choosing exactly which credential types the credential scanner masks. See ToolGuard.
• AI Watch scanner container: Run AI Watch Detect scans from a container image — standalone or on Kubernetes via the provided DaemonSet and CronJob manifests. See Container deployment.
• AI Watch Enforce: MCP allowlists and built-in tool blocks: Enforce policies now support allowlisting MCP servers and blocking built-in client tools, with an allowlist editor and expanded safe defaults. See Enforce.
• Audit logs: sub-day time filters: Filter audit logs down to specific hours, not just days. Also new audit events for agent enable/disable and security scanner settings changes. See Audit Logs.
• CLI MDM deployment guides: New per-platform guides for deploying the Runlayer CLI via MDM. See Runlayer CLI.
• Microsoft Teams connector: Now out of alpha. See Microsoft 365.

​

Monitor dashboard and managed client updates

• Monitor dashboard: New Monitor home for admins with workspace-wide insights; admins now land on Monitor after login.
• Build plugins from anywhere: Multi-select connectors and skills to create or extend a plugin, and add-to-client flows now recommend the Runlayer Plugin. See Runlayer Plugin.
• Client update policies: Admins can now control how managed Runlayer CLI / AI Watch installs update, with backend-managed update channels and native installers (including Windows MSI and Linux packages).
• Runlayer Deploy on Kubernetes: Deploy-hosted MCP servers can now run on Kubernetes (enterprise), with pod logs and status visible in the deployment UI. See Deploy.
• New client guides: Setup guides for Cursor Cloud Agents and Vercel Eve agent accounts.

​

AI Watch on Linux, agent memory

• AI Watch on Linux: Detect-mode support for Linux via native packages, with a deployment guide. See Linux deployment.
• Scoped agent memory: A second memory system alongside workbench memory — agents persist and recall scoped memories across runs. See Agents — Memory.
• GPT-5.6: Available as an agent model when OpenAI is configured as an LLM provider.
• Workday connector guide: New setup guide for the Workday connector. See Workday.

• Microsoft Teams MCP: A new Microsoft 365 connector built on Microsoft Graph delegated permissions (no M365 Copilot license required). Browse teams and channels; read and send channel messages and threaded replies; read and send 1:1 and group chat messages; create and manage chats and channels; and manage chat and channel members. See Microsoft 365.

​

Agent builder and smarter skill scanning

• Agent builder: New dedicated agent creation page with a guided flow.
• Beta connectors + custom OAuth client names: Catalog connectors can now register with a vendor-required OAuth client name and be flagged as beta — unblocking the Figma remote MCP, among others.
• Slack: agents propose help: Invite an agent to a channel and it introduces itself with what it can help with there.
• Skill scan transparency: Skill imports now show the exact source snippet behind each security finding, and shadow skills open in a viewer with inline risk annotations.
• Deploy: paginated deployment logs: Deployment logs now paginate in the UI. See Deploy.
• Settings search: New search box in the Settings sidebar.
• Web AI Watch: precise capture: The browser extension now has dedicated capture for 10 AI chat web clients, reducing false positives.

​

New models and model governance

• Claude Fable 5 and Sonnet 5: Available as agent models when Anthropic or AWS Bedrock is configured as an LLM provider.
• Model governance: Restrict which LLM models each role may use, and configure a recommended model for the workspace. See LLM Providers.
• ⌘K command palette: Now includes actions, recent items, and quick settings.
• OAuth-disconnected notices: When a connector’s OAuth connection stops working, users see a clear reconnect notice in their MCP client instead of opaque errors.
• Teams: Plugins tab: Manage team-scoped plugins from the team page.
• User identity attributes: Directory identity attributes are now shown on the user detail page.
• Faster large workspaces: Infinite scroll and server-side pagination on the agents, skills, and connectors pages.
• AI Watch: Scan project depth and timeout are now MDM-configurable, plus a new AI Watch FAQ.
• New catalog connector: Ashby.

• Agent Slack app icon sync: Agent icons are now synced to Slack app bot profile images. When you create a Slack app for an agent or update an agent’s icon, the icon appears in Slack within seconds. If no custom icon is set, the app uses the Runlayer logo.

​

Copilot CLI hooks, account management

• Connector accounts: rename & disconnect: Rename or disconnect a connected account directly from the connector account menu.
• GitHub Copilot CLI hooks: AI Watch session monitoring and enforcement now cover GitHub Copilot CLI.
• Customizable no-access message: Customize the message users see when a policy blocks access to a connector.
• Agents list sorting: Sort agents by run count and people count.
• Global policy creation: Streamlined create-policy modal with clearer condition fields. See Policies.
• Usage accuracy: Provider token usage is now captured from Claude Code transcripts for accurate per-session accounting.

​

Home tab and agent spend analytics

• Home tab: New Home page with a guided build flow for creating agents, connectors, skills, and plugins from one place.
• Shareable artifacts: Agent artifacts can now be shared with other users.
• Agent spend analytics: Usage now breaks down LLM spend by agent. See Analytics.
• Shadow AI at scale: Drill-downs and server-side filtering and pagination on the Shadow dashboard for large fleets.
• Deploy: search & pagination: Server-side search, pagination, and infinite scroll on the deployments list.
• New catalog connector: Tinybird.

​

Self-improving agents and cost budgets

• Self-improving agents (opt-in): Agents can distill reusable Skills from their successful runs, refining and deduping existing skills instead of piling up new ones. Per-agent toggle; distilled skills stay private to the agent. See Agents.
• Agent cost budgets: Set LLM cost budgets per agent. See Agents.
• Artifacts via Runlayer MCP: Create, update, list, and delete artifacts programmatically. See Runlayer MCP.
• Codex: native skill install: Skills now install natively into Codex.
• AI Watch: browser extension via MDM: The CLI installs the AI Watch Chrome extension and policy from MDM configuration.
• Teams: settings dialog: Rename a team, set its icon, and control its visibility.
• Catalog: official Snowflake Cortex MCP: Replaces the Runlayer-built Snowflake server, which is now deprecated. See Snowflake.

​

Azure AI Foundry and device monitoring

• Azure AI Foundry: Available as an LLM provider for agents. See LLM Providers.
• AI Watch Devices tab: Device inventory on the Shadow dashboard with per-feature check-in and health monitoring.
• VS Code hooks: AI Watch session monitoring and enforcement for VS Code.
• Goose hooks: Hook support for the Goose client.
• Teams: skill sharing: Team owners can share skills with their team.
• Incidents: filtering & priority: Filter the incidents list, Severity renamed to Priority, and improved Slack incident formatting. See Incidents.
• Agent ownership transfer: Admins can change an agent’s owner from the Share modal.
• Connector metrics: unique users: Connector activity metrics now include unique user counts.

• AI Watch on Windows: device-local Scheduled Tasks: The Windows MSI now registers its own Scheduled Tasks at install (a SYSTEM hooks task plus a per-user S4U scan fan-out) instead of relying on Intune Remediations — so AI Watch no longer needs Intune P2 / Remediations, and scans run in each user’s context with no interactive logon, mirroring the macOS launchd model. Tasks live in a hidden, permission-locked \Runlayer Task Scheduler folder and self-heal; use the bundled detect-install.ps1 as the Intune custom detection rule. See Intune deployment.

​

CLI catalog browsing and UI polish

• Collapsible navigation: Sidebar sections can now collapse, persisted per browser.
• Agent artifacts tab: Each agent page now has an Artifacts tab listing the files it has published.
• CLI catalog browsing: Browse skills, plugins, and connectors from the terminal with the new runlayer catalog commands.
• Power BI OAuth fix: Resolved the Entra resource conflict that blocked Power BI MCP OAuth.
• New catalog connector: Chili Piper.

​

AWS Bedrock and AI provider settings

• AWS Bedrock LLM provider + AI Providers settings: Configure AWS Bedrock as an agent LLM provider and manage all providers from the new Settings → AI Providers page; each agent can pick its own provider and model. See LLM Providers.
• Automatic session titles: Sessions now get generated titles so they’re easier to scan. See Sessions.
• Test Connection: interactive tool runner: Run a connector’s MCP tools with real inputs directly from the Test Connection drawer.
• OAuth redirect-URI consent: OAuth authorization to unrecognized redirect URIs now requires explicit consent, with an inline consent card and an admin-managed approved list.

​

Artifacts gallery, simpler AI Watch deployment

• Artifacts gallery: Browse all artifacts published by agents in one gallery. See Agents — Artifact publishing.
• AI Watch: single org-key deployment: MDM deployment now uses one org API key with capability flags for all AI Watch features — no more per-feature credentials. See Deploy AI Watch.
• Per-user credentials for hosted stdio connectors: Deploy-backed stdio servers can prompt each user for their own environment variables (e.g. personal API keys).
• Custom connector icons: Pick an icon when creating a custom connector.
• Auto-created access policies: New connectors automatically get an access policy at creation. See Policies.
• Incidents page UX: Refreshed incidents layout and workflow. See Incidents.

• Microsoft Outlook Calendar: lighter event lists: Listing calendar events now returns smaller summaries by default. See Microsoft 365.

• Google Docs table editing: edit_table can now overwrite an entire row in one call with set_row_text (one value per column), and style_cell accepts a padding option to set cell padding on all four sides (in points). See Google Workspace.

• Microsoft OneDrive document text extraction: onedrive_read_file now extracts text from Word (.docx), PDF, PowerPoint (.pptx), and Excel (.xlsx) files server-side instead of returning raw package bytes, so agents can review PRDs, RFPs, decks, and spreadsheets. Plain-text files are unchanged. Extracted text is capped and flagged with truncated when it exceeds the limit. See Microsoft 365.

​

Skill editing and new connectors

• Skills: edit & rename: Edit skill contents and rename skills directly in the UI. See Skills.
• Audit logs: Unredacted filter: Unredact events now appear as a filterable event type. See Audit Logs.

• Metabase (native): Official native Metabase MCP replaces the Runlayer-deployed server. See Metabase.
• Deel: New hosted Deel MCP connector.

• Microsoft SharePoint exact site lookup: sharepoint_search_sites now resolves an exact site name (including hyphenated names like IntermediaInc-ITSA), a full site URL, or a server-relative path via direct path lookups before falling back to the tokenized tenant search, and surfaces exact matches first. See Microsoft 365.
• Microsoft Outlook Calendar lightweight lists: outlook_calendar_list_events and outlook_calendar_list_calendar_view now return lightweight summaries (a short bodyPreview instead of the full event body), so date-range lists stay compact and no longer truncate. Use outlook_calendar_get_event for the full body. See Microsoft 365.

• Microsoft Outlook in-thread reply drafts: New outlook_create_reply_draft tool saves a Reply or Reply-All as an editable draft nested inside the original conversation, so you can review and send it later instead of sending immediately. See Microsoft 365.

• HITL Notify-Only: New asynchronous approval mode for agents — when a guarded tool call fires, approvers receive a Slack notification and the run pauses until they allow or deny. See Agents — HITL.
• Settings IA: All admin pages (Roles, Policies, Security Scanners, Workspace, MDM Configuration, etc.) have moved under Settings with a left-side nav.
• Agent example prompts: New agents include curated example prompts on the detail page to help users get started faster.
• Quarter-hour agent schedules: Agent schedules now offer :00, :15, :30, and :45 options for sub-hour cadences.
• Slack channel blocklist: Admins can now block specific Slack channels from triggering agent runs.
• Slack step labels: bash sleep N agent steps now render as Waiting Ns in Slack transcripts instead of the raw shell command.
• Slack private channel tolerance: Agents now degrade gracefully when the Slack app is missing private-channel scopes instead of failing the run.
• Runlayer MCP export_audit_logs trims noise: The export tool now strips verbose internal details fields by default; pass an opt-in flag to include them.
• Catalog: Metabase full payload schemas: The Metabase MCP catalog entry (1.0.1) now allows full card payload schemas.

• Sessions hooks installed by default: MDM deployments now install the full event/session hook set by default. Set the Sessions MDM field to false to keep enforcement-only hooks. See Deploy AI Watch.
• Identity Forward on any connector: Identity Forward is no longer limited to Runlayer Deploy. Enable plain X-Runlayer-* headers or the signed JWT on any HTTP-based connector (Streaming HTTP or SSE) from the connector’s configuration. See Deploy — Identity Forward.
• Skill upload: single .md file: The web UI now accepts a single .md file when creating a skill. The file is treated as SKILL.md, and the skill name is derived from frontmatter, the first heading, or the filename. See Skills — Uploading from the web UI.
• Claude Agent SDK integration: New integration guide for wiring Runlayer MCP servers into the Claude Agent SDK, covering HTTP transport, multiple servers, and agent account auth. See Claude Agent SDK.
• Hooks TypeScript SDK: framework adapters: The Runlayer Hooks TypeScript SDK now ships adapters for Vercel AI SDK, OpenAI Agents SDK, and Google ADK tool wrappers, in addition to Claude Agent SDK hooks. See Hooks TypeScript SDK.
• ToolGuard: embedded resource masking: PII and hidden-character masking now covers all MCP content block types, including embedded resources.
• MDM Configuration wizard: A guided wizard in Settings → MDM Configuration walks admins through picking an MDM platform, configuring detect or enforce mode, and downloading deployment artifacts.
• CLI 0.24.14: macOS keychain prompt fix for MDM-deployed binaries; improved hook reliability.

• Webhook authorization: Agent webhooks can now require API-key authentication. Enable it per-webhook and create a scoped API key directly from the webhook dialog. Unauthenticated requests are rejected. See Agents — Webhooks.
• Runlayer MCP: bulk audit log export: New export_audit_logs tool for exporting audit logs as JSON or CSV — no 90-day hot-window restriction, up to 10 000 rows per call. See Runlayer MCP.
• Hooks TypeScript SDK: agent account auth: The Runlayer Hooks TypeScript SDK now supports authenticating as an agent account via client_credentials token exchange, including OBO (on-behalf-of) agent tokens. See Hooks TypeScript SDK.
• SIEM export: customer-owned bucket: SIEM audit log export now supports writing directly to a customer-owned S3 bucket in addition to the Runlayer-owned bucket pattern. See Audit Logs — SIEM Export.
• Shadow Skills analytics: The Shadow page now includes a Skills section with discovery timeline, most common shadow skills, users with shadow skills, and per-client breakdown.
• Subagent events in timeline: Agent run timelines now render subagent tool calls and events inline, giving full visibility into delegated work.
• Claude Opus 4.8: Claude Opus 4.8 is now available as an agent model when Anthropic is configured as an LLM provider.
• Connector Permissions tab: The server-level “Policies” tab has been renamed to Permissions for clarity. Global policies under Admin → Policies are unchanged. See Policies.
• New catalog connectors: AWS MCP, Supernova Relay MCP.

• Microsoft Outlook Calendar: New Outlook Calendar MCP connector with 11 tools covering event CRUD, invitation responses (accept/decline/cancel), meeting-time suggestions, and free/busy lookup. Shares the same Entra app registration as the other Microsoft 365 connectors; add the Calendars.ReadWrite delegated scope. See Microsoft 365.

• Security Scanners redesign: The Security Scanners settings page now groups scanners by lifecycle phase (catalog admission, per-call scanning, session monitoring) and introduces the Mask violation action. Mask redacts detected content (PII values, hidden characters, credentials) and lets the request continue — giving you a middle ground between alerting and blocking. Scanner labels are clearer: “Invisible character detection” and “Credential detection”. See ToolGuard — Violation Actions.
• Self-serve SCIM role mapping: Admins can now configure SCIM groups-to-roles mapping directly in Settings → Workspace → Manage Directory Sync without contacting support. See Roles — SCIM Role Sync.
• Agent clone: The agent “Duplicate” action has been renamed to Clone for clearer terminology. Cloning copies an agent’s configuration, connectors, and tools into a new agent owned by you.
• CLI 0.24.9: The CLI now trusts system CA certificates, fixing connectivity issues in environments with corporate proxy certificates or custom CAs.
• Intune Deployment Package: scan-on-detect option: The Intune deployment package now ships two remediation strategies — Scan on detect (simpler, one script) and Detect staleness + remediate (follows Intune best practice). (Superseded by device-local Scheduled Tasks in 1.28.69.) See Intune deployment.

• Enforce: plugin MCP servers intercepted: Enforce now detects MCP servers bundled in native client plugins (e.g. Claude Code marketplace plugins). Plugin-provided MCP endpoints are subject to the same enforcement rules as any other shadow MCP — they must point at a Runlayer proxy URL or be on the remote URL allowlist.
• Enforce: always-on shadow blocking: Shadow MCP enforcement on the hook path is always active once hooks are installed, regardless of the Full session scanning toggle in workspace settings.
• PII scanning: pattern-based detection: PII scanning now uses regex patterns with validators instead of heuristics. Built-in types: SSN, credit card, phone, email, passport, driver’s license, IBAN, IP address, date of birth, MRN, VIN, Bitcoin address, and Ethereum address. Custom regex rules continue to work alongside built-in patterns. See ToolGuard Models.
• Runlayer MCP server tools: full REST parity: The create_server and update_server Runlayer MCP tools now support all fields from the REST API, including OAuth configuration (manual and broker), audit log sensitivity, tool output offloading, MCP fingerprint, and deployment association.
• Runlayer MCP agent tools: create_agent now accepts model and icon parameters. update_agent now supports is_disabled to enable or disable an agent programmatically.
• Deploy org API keys: Organization API keys can now be scoped with the Deploy role for CI/CD pipelines. See Deploy — Organization API Keys.
• Helm: custom trusted CA bundle: Self-hosted Helm deployments can now mount a custom CA certificate for outbound HTTPS through enterprise proxies. See Helm — Trusted CA.
• Helm: existing backend secret: Reference a pre-existing Kubernetes Secret for backend credentials instead of having the chart create one. See Helm — Existing Backend Secret.
• Helm: DB reader endpoint: Configure a read-replica endpoint via externalDatabase.readerHost to offload read traffic. See Helm — Database Configuration.
• Detect: expanded client support: AI Watch scans now discover MCP configs in Cline, Cline CLI, Gemini CLI, Antigravity, and GitHub Copilot CLI.
• Codex setup: native add command: Codex client setup now uses codex mcp add <name> --url <proxy> for a smoother install flow.
• Shadow reports: user attribution: Shadow discovery reports now show which user each shadow MCP server belongs to.
• Outlook tools expanded: Additional calendar and mail management tools added to the Microsoft 365 connector.
• Salesforce troubleshooting: Added guidance for resolving the “consumer secret is required” error when using External Client App credentials.
• New catalog connector: Ramp Data (read-only financial data, transactions, and reporting analytics).
• CLI 0.24.6 → 0.24.8: Hook enforcement reliability improvements, expanded client scanning, and bug fixes.

• Agent artifacts: Agents can now publish files from their workspace as shareable URLs using the built-in publish_artifact tool. Use it to share generated reports, CSVs, or any file with end users. Artifact publishing is enabled by default on new agents. See Agents — Artifact publishing.
• Runlayer MCP: agent memory toggle: The create_agent and update_agent Runlayer MCP tools now accept an enable_memory parameter so you can enable or disable built-in agent memory programmatically.
• Shareable session links: Agent run sessions can now be shared via a direct link from the sessions list.
• CLI 0.24.4 → 0.24.6: Improved AI Watch hook enforcement reliability on Cursor; internal stability fixes.

• Analytics: Skill risk assessment: The Skills tab now includes a Skill risk assessment widget showing skills ranked by security score with per-skill risk level badges (High, Medium, Low, Minimal, Unknown). See Analytics.
• Analytics: Plugin usage by client: The Plugins tab now includes a Plugin usage by client widget showing which MCP clients generate the most plugin activity. See Analytics.
• Slack DM mode via Runlayer MCP: The update_agent Runlayer MCP tool now supports setting slack_terminal_run_dm_mode to control run-result DMs (always, errors_only, or disabled) without using the UI.
• Agent templates refreshed: Agent creation templates have been replaced with a new set distilled from real workspace patterns, including 1:1 Prep, Release Notifier, Account Intelligence, Daily Briefing, and others.
• CLI 0.24.3: Bug fixes for skill and plugin install name resolution.

• GPT-5.5: GPT-5.5 is now available as an agent model when OpenAI is configured as an LLM provider. See LLM Providers.
• New client setup guides: Setup instructions are now available for Zed, Cline CLI, GitHub Copilot CLI, and Antigravity.
• Microsoft OneDrive & SharePoint: OneDrive and SharePoint MCP connectors are now available. The Outlook, OneDrive, and SharePoint setup guides are consolidated into a single Microsoft 365 page.
• Runlayer MCP server management: Runlayer MCP now supports creating, updating, and deleting connectors (admin-only, confirm-required). See Runlayer MCP.
• Shadow Connectors widgets: The Shadow page now includes a Connectors section with most common shadow servers, users with shadow servers, top servers to migrate, and MCP client usage breakdown.
• Agent accounts for all users: All workspace members can now view agent accounts, create delegations, and create session grants — no longer limited to admins.
• Slack say on all triggers: The agent say tool now works on webhook and scheduled runs (not just Slack-triggered runs) when the Slack MCP connector is attached.
• Agent memory opt-in: Agent memory is now opt-in — enable it from the agent’s advanced settings. Previously it was automatically available on all agents.
• Agent cross-turn context: Agent conversations now include tool calls and results from prior turns, giving the model better continuity across multi-step tasks.
• Agent LLM gateway settings: Self-hosted OpenAI-compatible gateway environment variables are now deprecated in favor of workspace LLM provider settings. Existing environment variables continue to work as a temporary fallback and emit a deprecation warning.
• New catalog connectors: Skyvern is now available in the connector catalog.
• Claude Code plugin install: Plugins are now installed into Claude Code via the marketplace format for better compatibility.

• PII scan direction: PII detection can now be scoped to tool inputs, outputs, or both. Configure globally in Settings → Security Scanners or override per connector. Defaults to input-only. See ToolGuard Models.
• Agent365 Work IQ branding: All Microsoft Agent 365 servers in the connector catalog now include the (Work IQ) suffix to align with Microsoft’s updated product naming.
• Admin setup instructions for all users: A new workspace setting (Settings → Workspace) lets admins show the full admin-facing client setup instructions to every user, not just admins.
• Shadow Connectors widgets: The Shadow page now includes a Shadow vs Managed breakdown chart and a Shadow Server Discoveries timeline.
• MDM guide refresh: Detect and Enforce MDM deployment guides have been refreshed with updated naming (Iru, Kandji) and streamlined instructions.
• Microsoft Outlook MCP: A dedicated Outlook setup guide is now available for the Outlook MCP connector.
• New catalog connectors: Fellow, Tines, Kubernetes, and Superhuman Mail are now available in the connector catalog.
• Agent account creation simplified: The outdated connector setup step has been removed from the agent account creation flow.

• Shadow page: Shadow discovery metrics (MCP servers and skills) now have a dedicated page in the sidebar, separate from the Analytics dashboard.
• Skill security scores: After uploading skill files, the skill detail page displays the overall security score and per-file risk indicators with a drill-down dialog for each finding.
• Manual skill security rescan: Skill owners and admins can trigger a security rescan from the skill detail page for skills uploaded before scanning was enabled.
• Agent activity security section: Each agent run in the Activity view now includes a collapsible Security section showing ToolGuard scan results, policy denials, and warnings.
• Schedule timezone modes: Agent schedules now support a Local wall clock mode that evaluates the cron expression in the selected timezone and automatically adjusts for DST transitions.
• Auto-grant delegation: Starting your first interactive chat with an agent automatically grants a delegation so the agent can act on your behalf.
• Identity Forward: Any HTTP-based MCP connector (Streaming HTTP or SSE) can now receive the authenticated caller’s identity via X-Runlayer-* headers or a signed JWT. Enable it in the connector’s configuration. See Deploy — Identity Forward.
• Policy-blocked tools flagged: Tools and resources blocked by connector policies are now visually flagged in the connector detail view.
• New catalog connectors: Pinpoint ATS, Clay, and pganalyze are now available in the connector catalog.
• Slack agent input: Agents now process link unfurls and bot attachments from Slack messages as part of their input context.
• Connector description limit: MCP server descriptions now support up to 4096 characters (previously 1024).
• Shadow MCP false-positive fix: Improved shadow MCP matching to reduce false-positive detections on command-line argument tokens.
• Detect MDM guide simplification: Organization API key prerequisites have been removed from the Detect MDM deployment guides — enrollment keys handle authentication automatically.

• Configurable skill risk policy: Admins can now configure how the platform responds to skill security scan results. Set per-tier actions (Block, Warn, or Allow) for high-risk and medium-risk skills in Settings → Security Scanners. High-risk defaults to Block; medium-risk defaults to Warn.
• Intune Remediation deployment method: The Intune deployment guide now supports the Remediation method (requires Intune P2). Intune handles scheduling natively — no scheduled task is created on the device.
• New catalog connectors: Smartsheet and DataGrail Vera are now available in the connector catalog.
• Draft connectors hidden from clients: Connectors in Draft status are no longer exposed via the MCP endpoint or the proxy — only the creator can see them until the connector is activated.
• OAuth popup fix: Fixed the upstream OAuth popup flow when the remote server’s COOP header prevents window.opener access.
• Subagent update fix: Updating a subagent no longer clears fields that were not included in the update payload.

• Runlayer Assistant generally available: The in-app Runlayer Assistant is now available to all workspaces with agents enabled — no separate feature flag required.
• Onelayer plugin always visible: The Onelayer plugin now appears in the plugin list for all users without a feature flag gate.
• Slack run source details: Agent runs triggered from Slack now display conversation, channel, and trigger details in the Activity view, with a direct link to the originating Slack message.
• New catalog connector: Amazon Redshift (read-only SQL — discover, explore, and query Redshift clusters and serverless workgroups).
• MDM PowerShell improvements: Windows MDM scheduled tasks now run with a hidden PowerShell window (-WindowStyle Hidden -NonInteractive) so recurring scans no longer flash a console window.
• Sensitive audit log guard fix: Updating a connector without changing its sensitive audit log settings no longer requires Super Admin permissions.

• Claude Opus 4.7: Claude Opus 4.7 is now available as an agent model when Anthropic is configured as an LLM provider.
• Agent icon in creation flow: You can now set a custom icon when creating an agent, not just after creation.
• Deployment custom icons: Deployments now support custom icons — set one during creation or update it from the deployment settings dialog.
• Resume agent runs from Activity: Open a past agent run in the Activity view and click Resume to continue the conversation in the Playground with the full prior context loaded.
• Slack plan improvements: Agent messages in Slack now display which LLM model produced each response. Tool outputs are no longer shown inline to keep messages cleaner.
• Deploy auto-grants developer access: When you deploy a connector via the CLI, the deploying user is now automatically granted developer-level access to the resulting connector.
• New catalog connector: ZoomInfo is now available in the connector catalog.
• Ashby out of beta: The Ashby connector is now generally available (no longer marked as beta).
• PPPC profile for Detect (macOS): The Shadow MCP Detect deployment flow now includes a downloadable PPPC profile for macOS MDMs. Deploy it before the scan script to prevent macOS consent prompts for runlayer-scan.

• Analytics: top agents by tool calls: The Agents tab now includes a ranking of agents by raw tool call volume alongside the existing top-by-runs widget.
• Agent default model updated: New agents now default to Claude Opus 4.6 (claude-opus-4-6). Existing agents keep their current model.
• Agent memory clarified: Agent creation and update endpoints now document the built-in persistent SQLite database — no extra storage setup required.
• Onelayer auto sync: The Onelayer org install dialog now includes an Auto Sync toggle so the plugin is automatically pushed to developer clients via runlayer setup sync.
• Auto-provisioning syncs plugins: runlayer setup sync now installs both connectors and plugins marked for auto-sync, not just connectors.
• CLI target resolution: runlayer run now accepts a connector alias in addition to a UUID.
• Agent account authentication cookbook: New recipes page with copy-paste examples for M2M tokens, OBO flows, session grants, and external user mapping.
• New catalog connectors: Render and Hugeicons are now available in the connector catalog.
• Slack alert toggle states: Budget and scheduled-run failure Slack alerts now show clear status when Slack is not yet configured on the agent.
• Codex MCP instructions: Improved Codex client setup instructions.
• Audit log chart fix: The audit log timeline chart now truncates at the current time instead of extending into the future.
• OAuth fixes: Fixed refresh-token retry loop on upstream 401, isolated rate-limit buckets per identity, and fixed OAuth popup getting stuck on close.

• Session grants: Agent account authentication to OAuth-protected connectors now uses session grants — a model that decouples OAuth credential sharing from delegations. Grants can be personal (caller-only) or shared (fallback for other users). See Agent Accounts.
• Session grant admin revocation: When an admin deactivates a user, all of that user’s session grants are automatically revoked.
• Terraform Provider (Beta): Manage Runlayer policies and resources from Terraform. See the Terraform Provider guide.
• OAuth guide for deployed servers: New guide covering dual-auth architecture, DynamoDB token storage, and the two OAuth integration patterns for custom MCP servers. See OAuth for Deployed MCP Servers.
• Slack say tool: Agents triggered from Slack can now post additional messages back to the conversation thread using a built-in messaging tool.
• Connector docs expanded: The Connectors page now covers the connector catalog, manual setup, deploy flow, and ToolGuard security in detail.
• MDM script fixes: PowerShell scripts no longer fail on uv stderr output; macOS scripts fix .runlayer directory ownership.

• Analytics Agents tab: The Analytics dashboard now includes an Agents tab with an agents inventory card (total, public vs private, created in period) and an agent runs over time chart.
• Duplicate agent: Any workspace member can duplicate an agent from the agent detail page or from the agent card menu. The copy clones configuration, connectors, and tools.
• Onelayer OpenAI org install: “Add to Organization” for the Onelayer plugin now supports both Anthropic and OpenAI paths. The OpenAI flow walks admins through registering an MCP connector and uploading skills in ChatGPT.
• Directory sync locks manual editing: When SCIM directory sync is enabled, manual role and group editing is disabled in the UI with an explanatory banner.
• Connector search: Connectors can be searched by name or description using the global command palette (Cmd/Ctrl+K) and via the query parameter on the servers API.
• Schedule count badge: Agent cards now display a badge showing how many active schedules the agent has.
• Connector icons on agent cards: Agent cards display icons for their attached connectors.
• CLI 0.24.0: Bug fixes and scan parsing improvements.

• Goose MCP client support: Goose is now a supported MCP client with hosted and local setup guides, native skill install, and plugin install via MCP fallback.
• CLI 0.23.0: New interactive skills find and plugins find commands for browsing and installing skills or plugins from the terminal.
• Agent list sorting and filtering: The Agents page now supports sorting by newest, oldest, alphabetical, and last-used, plus a status filter (active / disabled).
• Agent playground auto-tools: The Playground now automatically injects Runlayer tools (search, run, manage) so agents can reason about the workspace without manual connector setup.
• Agent connector grant access: Connectors requiring authorization now show a guided access setup dialog directly during agent creation, with per-connector status indicators.
• SIEM export (S3): Audit logs can now be continuously exported to an S3 bucket for SIEM ingestion (CrowdStrike, Splunk, Sentinel). See Audit Logs.
• Enforce remote MCP URL allowlist: Admins can now allowlist specific remote MCP URLs so Enforce does not block trusted third-party MCP servers. See Enforce policy.
• Tool selector categories: The tool picker in policies now includes an annotation-based category dropdown next to “Select All” for faster bulk selection.

• Runlayer MCP subagent management: Add, update, and delete subagents on an agent directly through Runlayer MCP tools (confirm-required).
• Manage Slack App link: Agent Slack settings now include a direct link to manage the agent’s Slack app on api.slack.com.
• Improved scheduled run reliability: Scheduled agent runs now retry transient authentication errors automatically instead of failing immediately.
• New catalog connector: Ravenna (AI knowledge management — search knowledge bases, manage channels, and automate support workflows).

• Analytics v2 Overview redesign: The Overview tab now shows a Tasks chart (human vs agent), Usage card (users, agents, connectors), Most Used Clients, and a redesigned Security Alerts widget. The previous tool calls timeline has been replaced.
• Deploy agent from plugin: Create an agent directly from a plugin detail page — the new agent inherits the plugin’s connectors and skills automatically.
• New catalog connectors: AirOps (50 tools) and Pendo are now available in the connector catalog. Datadog now uses the full toolset by default.
• CLI deploy URL: The CLI now prints the deployment URL after a successful deploy.

• Sensitive audit log redaction: Super Admins can mark connectors as sensitive. When enabled, tool call arguments, results, and security scan details are automatically redacted from audit log entries for that connector.
• Analytics Connectors tab: Connector-related widgets (top by tool call, connector health, usage by client) are now in a dedicated Connectors tab. Skills tab renamed “Skills created over time” to “Skills usage over time.”
• Scheduled run failure DMs: Agent owners receive a Slack DM when a scheduled agent run fails.
• Agent advanced settings: Model, environment variable, and subagent settings are now visible only to admins and the agent owner.

• ToolGuard sensitivity levels: Each scanner phase (Tool List Guard, Tool Call Guard, Tool Intent Guard) now supports Strict, Balanced (default), or Moderate sensitivity, configurable globally and per connector.
• Runlayer MCP policy CRUD: Create, update, and delete policies directly through Runlayer MCP governance tools (in addition to list and read).
• Security warning classification: Hidden-character masking and sensitive-token masking findings are now classified as security warnings instead of violations.
• Connection test timeout: MCP connection tests now enforce a 15-second timeout to prevent long hangs.
• CLI 0.22.2: Minor fixes and improvements.

• AI Watch now scans Codex and OpenCode plugins: Detect discovers installed plugin artifacts in Codex and OpenCode alongside existing client support.
• Enforce now supports Claude Code on macOS: Shadow MCP tool call interception is available for Claude Code.
• Agent policies: Agents now have a dedicated Policies section for managing per-agent access rules directly from the agent detail page.
• Analytics: skill usage timelines and top skills: The Skills tab now shows skill usage over time and a ranking of the most-used skills.
• Zoom connector: Zoom is now available in the connector catalog with meeting search, recording access, and Docs creation tools.
• CLI 0.22.0: Includes Codex and OpenCode plugin scanning support.

• Agent subagents: Agents can now delegate work to lightweight child agents that inherit the parent’s connectors and tools but follow their own instructions.
• Analytics v2 tabbed layout: The Analytics dashboard is now organized into Overview, Skills, and Plugins tabs with dedicated widgets for each area.
• Agent run audit events: Agent runs now emit AGENT_RUN, AGENT_RUN_SUCCESS, and AGENT_RUN_FAILURE audit log events with source, model, and duration.
• Deploy force-delete: Deployments with connected connectors can now be deleted via a Delete All option that removes the deployment and its connected servers together.
• Agents API: The public Agents API routes have been renamed from /assistants to /agents.
• Kandji shadow MCP support: Kandji is now included in Shadow MCP device filtering.

• Codex as native plugin client: Codex now has first-class plugin install support in the CLI.
• Agent templates: Create agents from pre-built templates (workspace agent, research agent, weekly summary, morning brief) that pre-fill name, prompt, connectors, and tools.
• Retry failed agent runs: Failed runs can be retried directly from the Activity view.
• Agent owner visible: The agent owner is displayed on the agent detail page.
• Grant access on connectors: Connectors that require authorization show a Grant access button directly on the connector card when attaching to an agent.
• Kandji MDM: Kandji is now a supported MDM platform for auto-provisioning.
• Vimeo connector: Vimeo is now available in the connector catalog.
• Workday configurable OAuth scopes: Workday deployments now support configurable OAuth scopes.

• Agents closer to GA: Agents now support workspace-level LLM provider settings with Anthropic, OpenAI, and OpenAI-compatible gateways, backend proxying for model traffic, richer Playground and Activity views, custom icons, built-in per-agent memory, and simpler enable/disable controls for Slack, webhook, and scheduled runs.
• Shadow AI coverage now includes skills: Detect can now discover shadow skills in supported clients, classify them by risk, and surface analytics so admins can see what is spreading, where it came from, and which skills are outdated.
• Deploy UX has been revamped: The deploy flow was rebuilt around guided dialogs, inline CLI commands, clearer setup states, better connector visibility, and a new Build with Runlayer MCP entry point for AI-assisted server creation.
• Plugins are easier to publish, install, and manage: Runlayer now has a more complete plugin workflow across UI and CLI, including Claude-format plugin publishing, inline manifest support, native install guidance for more clients, richer plugin metadata, and more reliable push/sync behavior.
• Granular admin roles reduce the need for Super Admin: Runlayer now supports specialized roles for Security, IT, Helpdesk, Developer, and Analytics work, with capability-based access across the UI and API plus multi-principal policies for clearer separation of duties.

• CLI improvements: CLI credentials are now stored in the OS keychain, verified-local is folded into run, and local capabilities sync now also support http and sse servers.
• Auditability improvements: Skills and plugins now have stronger audit parity, with additional coverage for installs, updates, and upstream token refresh events.
• Workspace admin polish: Workspace settings got safer unsaved-change handling, plugin and deployment flows were cleaned up, and admin user details now have a dedicated page layout.
• OAuth Broker coverage expanded: Added Guru as a supported OAuth Broker vendor.

• Plugins & Skills: Skills are now first-class—browse, manage, and upload them from their own section. Bundle skills with connectors into plugins for a single MCP endpoint with the right tools and instructions.
• Manage Connectors View: Rebuilt “My Connectors” and “Manage Connectors” pages with sidebar navigation, a request/approval flow for non-admins, and granular per-connector permissions by user, group, role, or agent. “Policies” renamed to “Permissions.”
• Tool Intent Guard: Runtime model that analyzes tool inputs and outputs together—detecting intent drift, output poisoning, data exfiltration, and prompt injection with fewer false positives. (Previously called “ToolGuard Output Scanning”.)
• Configurable PII: PII scanning is now fully configurable per connector with custom rules.
• Organization API Keys & JIT Auth: Org-level API keys scoped by role for Detect scans and security scanning. Automatic configuration provisioning uses enrollment keys. Just-in-Time Auth prompts for credentials only on first tool call with a three-tier cache.

• 25+ new catalog connectors: Lemlist, Webflow, Google Analytics, Neon, Pylon, DX, official Slack MCP, Deepwiki, CircleCI, Ashby, Figma Desktop, Miro, Jamf, Cloudflare (16 servers), Datadog, Vanta, Granola, LaunchDarkly, and more—plus BigQuery and Slack out of beta.
• Faster dashboards: Analytics and metrics pages load significantly faster under heavy usage.
• Audit log improvements: New tabs, filters, cross-page date alignment, and a Top MCP Clients chart in Analytics.
• MCP client setup: New guides for Raycast, Claude Code, and Gemini CLI, with admin-managed and remote-only instruction modes.
• OAuth improvements: Compliant discovery for ChatGPT, Cursor Hook compatibility, and automatic session cleanup on credential revocation.
• Bug fixes: Token scanner false positives, SCIM sync failures on stuck events, and audit log chart aggregation.

• Deploy servers directly from the Catalog: Go from discovery to a running managed server faster—and get clearer status that distinguishes “deployment complete” from when a server is actually ready after cold starts.
• MCP Watch (Shadow MCP discovery): Admins can now spot unmanaged MCP servers across devices, track discovery trends over time, and identify migration opportunities directly from Analytics.
• MCP Watch Re-analysis: Admins can now trigger re-analysis of discovered MCP servers directly from the UI.
• Microsoft Agent 365 Integration: Full OAuth broker support and catalog servers for Microsoft Agent 365.
• Server metrics dashboard: New per-server metrics tab with tool call health, usage, and performance charts to help troubleshoot issues faster.
• Agent Accounts (Beta): Register AI applications as agent accounts to authenticate programmatically and call MCP tools through Runlayer.
• Slack rollout improvements: Organization-wide Slack App installs make it easier to enable Slack notifications across the workspace, with support for multiple Slack apps per agent.
• Plugins improvements: Plugins now support OAuth authentication for safer, smoother connections in more environments.

• Safer deployment logs: Sensitive environment variables are now redacted in deployment logs by default.
• Faster audit logs at scale: More read-heavy operations (including audit logs) were optimized to keep the UI responsive under load.
• Improved tool security scanning performance: Added caching for tool list scanning to reduce repeated work and speed up scans.
• Updated ToolGuard: New threat detection capabilities and improved security scanner defaults.
• OAuth compatibility fixes: Better discovery and validation across providers, including fixes for edge-cases with client IDs and PKCE.
• Analytics improvements: Analytics graph now shows today’s tool calls for more up-to-date visibility.
• Bug fixes: Fixed PII scanner false positives on numeric IDs in URLs, OAuth token handling for tokens without expiration, and audit log validation for tool names with special characters.

• Permission Warnings: Users now see a warning before connecting an MCP client if they lack the necessary permissions.
• ToolGuard Area of Concern: Security violations now show the specific area of concern that triggered the detection.

• Added Pulumi and Parallel Search to the MCP catalog.
• CLI: New pull command for downloading runlayer.yaml deployment configurations.
• New optional MCP caching setting for tools/list requests to improve performance.
• Increased rate limit to 1000 requests/hour for OAuth client registrations.

• Visual Query Builder for Audit Logs: Advanced filtering UI for building complex queries.
• Security Alert Emails: Admins now receive email notifications when security violations occur, configurable in workspace settings.

• Added Grain, Fireflies, Iterable, Box, and Contentful to the MCP catalog.
• New guided onboarding flow for first-time users to configure their MCP clients and preferences.
• Runlayer Deploy now supports deploying arbitrary Docker images, not just MCP servers.
• Runlayer Deploy now includes a persistent NoSQL storage for deployed services.
• Verified icon now shown on trusted MCP servers that came from the catalog.
• Fixed PII Scanner false positives on ISO timestamps being detected as SSNs.
• CLI: Fixed edge-cases with token refresh and token expiration.

• Server Disable/Enable: Admins can now disable MCP servers to temporarily prevent all access without deleting the server configuration.
• Alert Mode for Security Scanners: New “Alert” mode allows security scanners to log violations without blocking requests, useful for monitoring and tuning policies.

• Added MCP client name and version tracking to audit logs and analytics.
• Added Ramp to the MCP catalog.
• MCP tool annotations from servers are now displayed in the UI.
• Audit log drawer now shows the actual content that was blocked by security scanners.

• Human-in-the-Loop Security Review: Admins can now review, approve, or reject security violations from the audit logs.

• Added Snowflake, ClickUp, and HubSpot to the MCP catalog.
• Added duplicate server detection to warn when creating a server with a configuration that already exists.
• Improved security violation error messages for non-admin users.
• Skip scanning image and audio content in tool responses for better performance.
• Various Projects page UI improvements.

• Runlayer Deploy, a new way to deploy MCP servers via Runlayer’s managed infrastructure. Learn more.

• UI improvements including server drawer fixes and policy management enhancements.

• Runlayer CLI deploy command: A new command for deploying Docker-based services to your Runlayer infrastructure.
• Token Masking Scanner: Sensitive tokens are now redacted instead of blocked, providing better experience while maintaining security.

• Added a new setting to control whether employees can submit new MCP servers for admin approval and browse the Catalog to install MCPs. Enabled by default.
• Redesigned User Details page.
• Various UI improvements and bug fixes.

• Policy Based Access Controls: Complete rewrite of the authorization engine with advanced condition-based policies.
  • Support for policy conditions with operators like contains, matches, in, and logical combinations.
  • Enhanced policy evaluation engine for fine-grained access control.
  • Constraints over MCP client and MCP server attributes. Example: enforce internal-only email domains for Gmail MCP.
  • OAuth Refresh Token Rotation: Automatic rotation of OAuth refresh tokens for improved security.
• Redesigned Pages: Completely redesigned settings, audit logs and users pages.

• OAuth from MCP Clients: Enables authenticating to upstream OAuth servers directly from MCP clients like ChatGPT, Claude, Cursor and others.
• Server Configuration Drawer: New streamlined interface for viewing and editing MCP servers.
• Audit Logs Redesign: Improved table layout and navigation.
• UI improvements including sticky headers and various bug fixes.

• MCP Prompts Support: Full integration with the MCP prompts specification.
• Enhanced Catalog: Added popularity-based sorting.
• Server Editing: Ability to edit server name and description from details page.
• Multiple UI improvements including calendar component, hover interactions, and analytics enhancements

• Expanded Client Support: Added ChatGPT, Gumloop, and additional AI platforms as supported MCP clients.
  • Client-specific connection instructions and configuration examples.
  • Setup guides for each platform’s MCP integration requirements.
• Improved OAuth Error-handling: Improved OAuth connection flow to surface clearer, fine-grained error messages, to help debug issues.
• Improved Prompt Guard v2: Updated to newer model version for better prompt attack detection.
• Improved Security Feedback: Enhanced security violation messages with better context for troubleshooting blocked requests.
• OAuth Compatibility: Added support for longer auth tokens from origin MCP servers.

• Local MCP Servers v2: Use local MCP servers with the same security, authz, observability and auditing as remote MCPs.
• Management API: Automate server and user provisioning via REST API with API key authentication. Full documentation at /docs.
• MCP Details Redesign:
  • Rebuilt server details with tabbed navigation, client-specific setup instructions (Claude, Codex, others), and one-click deeplinks.
  • Improved server card layouts and visual hierarchy for faster navigation and configuration access.
• Official MCP Registry Schema: Migrated catalog to standardized MCP registry schema. Ensures ecosystem compatibility and automatic validation.
• Improved Error messages and Timeouts:
  • Enforced strict timeouts on all MCP operations. Prevents hung requests with predictable error messages.
  • Captures stderr output, exit codes, and connection errors for faster troubleshooting of MCP server failures.

• Made analytics available for non-admin users, showing only their usage data
• Added Vercel, Intercom, Clockwise, Figma, Pagerduty & Pipedream to the MCP servers catalog
• Enhanced catalog page with improved links and navigation
• Fixed missing stdio arguments for local servers
• Fixed API 403 errors in Server Permissions tab
• Improved SCIM sync reliability for directory events older than 30 days

• Fixed problem with non-admin users visiting Permissions tab causing API Error

• Fixed SCIM sync initialization for organizations with directory activations older than 30 days
  • Resolved issue where SCIM sync couldn’t initialize properly if the initial directory activation event was more than 30 days in the past
  • Enhanced event retrieval logic to search through historical events when needed
  • Improved sync reliability for long-established directory integrations

• Completely revamped SSO and SCIM implementation
• Added support for syncing Users and Groups from SCIM
• Added support for role mapping, to map IdP Groups to Runlayer roles
• Groups are editable (CRUD) when SCIM is disabled; read-only when SCIM is enabled

• Add a new AUTH_API_KEY secret (or auth_api_key variable if you’re using the Terraform stack). Runlayer support will provide you with this value.
• Update the value of the auth_client_id variable to the new client ID. Runlayer support will provide you with this value.

• Add support for custom NPM configurations and private package repositories

• Auto-add an ALLOW policy for the admin who created a server

• Prevent OAuth flow from ending prematurely if the popup needs to show an approval screen

• Fixed OAuth connection status for servers with refresh tokens
  • Connections with valid refresh tokens are no longer incorrectly marked as expired in the UI

• Added integration support for Codex CLI
• Renamed “My Servers” to “MCPs” throughout the interface for clearer terminology

• Fixed OAuth token refresh functionality for MCP servers
  • Resolved issue where expired OAuth tokens would not automatically refresh
  • Improved authentication reliability for OAuth-enabled servers
  • Enhanced session persistence for uninterrupted server connections

• Fixed an issue where the IAM permissions needed for Prompt Guard V2 were not being applied correctly
• Fixed editing servers throwing an error.
• Removed caching from user API endpoints.

• Manual OAuth Configuration: Support for MCP servers without Dynamic Client Registration (DCR)
  • Configure OAuth client credentials directly for servers that don’t support automatic registration, like Github
  • Client secrets are encrypted at rest
  • Automatic detection when manual setup is required with guided UI flow
• OAuth flow now supports version 2025-06-18 of the MCP specification
• Catalog now has two entries for Github: one with OAuth and one with PAT token authentication

• Add Support for Local Servers
  • Run MCP servers directly on your local machine without network dependencies
  • Visual indicators distinguish local servers from hosted infrastructure
  • Add local server Atlassian to Catalog

• Enhanced Prompt Attack Detection: New security scanner with improved accuracy and lower latency
  • Labeled as Prompt Guard V2 in the security settings UI and turned on by default; legacy scanner renamed to “Prompt Guard (Legacy)”
  • Advanced prompt attack detection system for better threat identification
  • Infrastructure optimizations for faster response times

• Fixed a client-side caching bug where the version update banner would show up when it shouldn’t
• Fix JSON format not initializing correctly on server edit page

• Linear MCP Server: Updated to use HTTP streaming endpoint

• Role-Based Tool and Resource Visibility: Enhanced permission system with intelligent filtering
  • Tools and resources are now filtered based on user permissions in list views
  • Users only see items they have access to, eliminating confusing access denied scenarios
  • Improved performance through optimized policy evaluation
  • Replaced automatic admin bypass with proper role-based access control

• RSS-Enabled Changelog: Automatic RSS feed generation
  • Users can now subscribe to changelog updates via RSS
  • Cleaner, more minimal changelog format with categorized updates
  • Improved readability with description labels for each version

• Improve E2E tests that test MCP server creation

• Enhanced CI/CD Pipeline: Improved build reliability for more stable deployments

• Raw JSON Server Configuration: Introduced dual editing modes (Form and JSON) for server configuration
  • Toggle between intuitive form interface and powerful JSON editor
  • Paste .env content to automatically populate environment variables
  • Real-time validation with clear error messages
  • Comprehensive testing for enhanced reliability
• OAuth Connection Handling: Fixed issue where tools and resources were fetched even when OAuth was not properly connected

• Improved Proxy Architecture: Enhanced performance through optimized middleware implementation

• Central Icon System: Implemented comprehensive icon system for improved visual consistency
  • Enhanced visual hierarchy and user experience
  • Consistent iconography across the platform

• MCP Server Validation: Added intelligent retry logic for improved reliability
  • Automatic retry with smart intervals
  • Enhanced OAuth discovery and error categorization
  • Reduced false negatives from temporary network issues

• Load Testing Framework: Introduced comprehensive performance testing capabilities
  • Configurable test scenarios for various workloads
  • SSE response validation and compliance checks
  • Performance benchmarking for scalability validation
• Per-Server Security Settings: Granular security controls for individual servers
  • Override specific security scanners while maintaining global defaults
  • Admin-only security configuration interface
  • Flexible Inherit/Block/Alert/Allow options
• V2 Design Implementation: Major visual refresh
  • New logo system and comprehensive icon library
  • Component library with Storybook integration
  • Consistent theming with design tokens

• Version Update Notifications: Smart in-app update system
  • Automatic detection of new versions
  • Dismissible notifications with user preferences
  • Responsive design with theme support

• Global Security Scanner Settings: Centralized security configuration
  • Unified security policy management
  • Configurable scanner thresholds
  • Enhanced governance capabilities

• Enhanced Version Management: Improved version tracking across deployments

• Security Scanner Optimization: Major performance improvements
  • Consolidated scanning architecture for faster response times
  • Optimized ML-based security scanning
  • Maintained full security detection capabilities