gram — The AI Toolchain

gram dashboard@0.110.0

Wed, 19 Aug 2026 16:37:29 GMT

gram dashboard 0.110.0 adds an AI research agent, graph-view MCP connections, drift detection for approved servers, and richer evidence dossiers. • New `mcpApproval.startResearch` endpoint (decide-scoped) launches a Temporal-backed AI research agent that runs a bounded tool-calling loop, extracts a schema-held report (summary, independent-coverage level, tiered claims with citations), and persists results to `mcp_research_reports` with model, prompt version, and per-run spend metadata; re-runs are additive and at most one run per request is in-flight. • New `assets.fetchImageFromURL` endpoint downloads a catalog server's registry icon into an image asset at install time, storing it as the server's MCP metadata logo; collection listings now populate `icon_url` from `mcp_metadata` for both toolset-backed and mcp_server-backed servers. • New `search_gram_docs` resource answers queries from a pinned corpus of reviewed Platform MCP setup guides, returning cited excerpts with resource links; queries with no matching reviewed content return `guide_unavailable` instead of invented steps. • `risk.createPolicyBypassRequest` now carries a requester-supplied justification as the requester's note on the review, replacing the previous behavior where every requester's note was the policy's generic block reason. • MCP evidence dossier gains three deterministic new sources: code-host repository metadata (stars, forks, contributors, commit recency, archived status), OSV.dev published vulnerability advisories, and domain-registry registration records for remote server domains; package registries also surface declared repository and homepage URLs. • Research agent now runs a prompt-injection judge over every fetched page and records flagged pages as findings on the report, surfacing manipulation attempts as evidence rather than silently defending against them. • Daily drift-detection sweep re-gathers evidence for approved MCP servers and compares the permission-relevant slice (OAuth scopes, authority mode, demanded credentials, published advisories) against the approval snapshot; drift sets a changed-since-approval flag, announces once per distinct change via the audit-log webhook channel, and surfaces on the review page as a diff banner and on the inventory as a badge. • MCP Connections view now renders as a graph — rows represent a person, provider, or client, and expanding a row shows the nodes on the other side of its edges; the list splits into active connections and inactive ones (dormant over a week or no longer usable), which remain visible and revocable. • MCP connection listings now carry a status dot (green live, amber expiring, red needs re-auth, grey idle or revoked) so connection health is scannable by colour at a glance. • Organization page moves from `/user-sessions` to `/mcp-sessions` with updated nav entry and title. • PAYG organization admins can view and set independent monthly Security inference and Other inference caps for each applicable platform-managed key; each change records a per-key audit event. • Adds live Stripe PAYG subscription status, a controlled customer portal, and end-of-period cancel and resume controls for organization administrators. • Approval page gains a Run Research button that polls while a run is live and renders the report with coverage callout, tier chips, citation links, and run footer. Breaking changes: • The organization MCP sessions page moves from `/user-sessions` to `/mcp-sessions`; any bookmarks or hardcoded links to `/user-sessions` will no longer reach that page.

gram server@1.15.0

Wed, 19 Aug 2026 16:37:26 GMT

Gram server 1.15.0 adds MCP research agent, evidence drift detection, shadow inventory per-user lookup, and richer session/device APIs. • New `mcpApproval.startResearch` endpoint (decide-scoped) launches a bounded AI research workflow that searches the web, fetches pages, and returns a schema-held report with summary, coverage level, and cited tiered claims stored on `mcp_research_reports` with model, prompt version, and per-run spend metadata. • New `GET /rpc/access.listShadowMCPInventoryServersForUser` endpoint inverts the shadow MCP inventory to return all shadow servers reached by a single user, enriched with the same policy state shown in the project-wide listing. • New `deviceIntegrations.listManagedDevices` accepts `user_ids` and `user_emails` (OR'd) to resolve managed devices per identity, handling MDM alias mismatches across both lookup legs. • New `risk.listResults` filter `external_user_ids` performs exact whole-match lookups (both Postgres and ClickHouse paths), fixing the existing `user_id` substring match that caused cross-user result leakage; `user_id` is unchanged. • New `assets.fetchImageFromURL` endpoint downloads a catalog server's registry icon into an image asset at install time and stores it as the server's MCP metadata logo. • Adds `evidence_changed_at` and `notified_change_fingerprint` columns to MCP approval requests to track permission-relevant evidence drift and deduplicate daily recheck announcements. • MCP evidence dossier gains three new deterministic sources: code-host repository signals (stars, forks, contributors, commit recency, archived status), OSV.dev vulnerability advisories, and domain registry registration records; package registries also surface declared repository and homepage URLs. • MCP approval change detection now runs a daily sweep that re-gathers evidence, diffs the permission-relevant slice (OAuth scopes, authority mode, demanded credentials, published advisories), sets a changed-since-approval flag, fires an audit-log webhook on each distinct change, and surfaces a diff banner on the review page and a badge on the inventory. • Adds `research` platform toolset with `platform_web_search` (cited searches via OpenRouter's web-search plugin, tagged `mcp-research` for spend attribution) and `platform_fetch_page` (guardian-routed fetch with byte, redirect, and per-run budgets, reducing HTML to readable text); both gated on the `mcp_approval` feature. • `userSessions.listUserSessions` now returns `last_used_at` and `upstreams` (remote sessions Gram holds for the same subject and issuer) per session, exposing both legs of a brokered connection in a single call. • Exposes active directory groups and exact directory attribute values as plugin assignment audiences for organization administrators. • Admin projects list now reports the count of MCP servers per project (covering both `mcp_servers` rows and MCP-enabled toolsets) without requiring the operator to open each project. • Policy bypass request flow now collects a requester-supplied justification via `risk.createPolicyBypassRequest`, replacing the previous behavior where every requester's note defaulted to the policy's generic block reason. • Pay-as-you-go organizations can view current billing cycle details on the Billing page, including tokens under management with flat-rate cost, Other inference spend through the last completed day, and an estimated invoice total.

gram server@1.12.0

Mon, 17 Aug 2026 09:43:09 GMT

gram server 1.12.0 adds MCP approval management APIs, evidence dossiers with OSV/code-host/registry signals, and direct server probing. • Adds `mcpApproval.refreshEvidence` endpoint to re-run every evidence source on demand for an MCP approval request, replacing current evidence while leaving frozen decision snapshots untouched. • Adds `mcpApproval.ensureServerReview` endpoint to resolve or open an evidence dossier for any server URL without placing it in the decision queue. • Adds MCP approval management API: list servers awaiting a decision, retrieve evidence and prior decisions for a server, and record an approval or denial with a rationale and explicit set of principals — gated by two new separate permissions for queue review and committing the organisation. • Adds approval-request intake to the MCP approval API: members can submit a server for review by URL or launch command with no permission grant required; admins can promote existing bypass requests into the review queue. • Generates TypeScript SDK bindings and React Query hooks for the new MCP approval endpoints. • Evidence dossiers now probe remote MCP servers directly: OAuth metadata via standard well-known endpoints (auth mode, scopes, dynamic client registration) and tool declarations via unauthenticated `tools/list`, falling back to the MCP registry catalog entry when the server refuses. • MCP registry catalog matches now populate a new provenance section covering official flag, lifecycle status, publish/update recency, and visitor estimates. • Evidence gathering now consults code-host repository signals (stars, forks, contributors, commit recency, archived status), OSV.dev vulnerability advisories, and domain-registry registration records for a server's registrable domain. • Adds org-exposure signals to approval evidence: whether the requesting project already talks to a server, since when, call frequency, and distinct-caller count. • Shadow MCP inventory servers now carry their MCP approval request state, with approval request summaries exposing the inventory server slug for `server_url` targets and list/detail responses including approval request id, status, and requester count. • Shadow MCP page consolidates to a single servers table: `target_kind` field distinguishes review-only targets (requested-but-unobserved URLs and stdio commands); pending decisions sort first and are filterable; the separate Access Requests tab is removed. • MCP approval decisions now enforce policy: approval replaces the server's risk-policy bypass audience with the decision's blast radius (defaulting to everyone, stored explicitly); denial revokes it; under allow-by-default policies the directions invert. • Shadow-MCP block link redemption now attaches the blocked employee as a requester on the server's single canonical review (deduplicated by URL) instead of creating a per-user bypass request; the standalone Approval Requests review page retires. • Retires legacy Shadow MCP inventory enforcement endpoints — upsert/delete policy bypass and block/unblock server — now that every allow and deny travels through a recorded MCP approval decision; `resolveShadowMCPInventoryRequest` remains while pre-approval bypass requests drain. Breaking changes: • The standalone Approval Requests review page is removed; the Shadow MCP servers table is now the only review surface. • Legacy Shadow MCP inventory enforcement endpoints (upsert/delete policy bypass, block/unblock server) are retired; all allow/deny actions must go through a recorded MCP approval decision.

gram dashboard@0.108.0

Mon, 17 Aug 2026 09:43:08 GMT

Gram dashboard adds MCP evidence dossier enrichment, unified Shadow MCP review surface, and risk policy enable/disable controls. • Adds a dedicated advisories group in the MCP approval evidence panel where a clean advisory check is shown as a positive finding rather than an absence. • Unifies the Shadow MCP servers table as the single MCP approval review surface: every server row carries its review state, evidence is grouped by admin question (identity, data access, capabilities, legitimacy, exposure, prior decisions), and allow/deny decisions with required rationale are made in-place; the standalone Approval Requests tab is retired. • Introduces a new `target_kind` field on Shadow MCP server rows that marks review-only targets (requested-but-unobserved URLs and stdio commands) so they surface in the unified inventory list. • Allows risk policies to be disabled and re-enabled from Policy Center and the policy detail page, letting operators pause enforcement without deleting the policy. • Registers `mcp_approval:read` and `mcp_approval:decide` permissions in the role editor's scope picker so they can be discovered and granted. • Command palette now surfaces pending MCP access requests in place of the retired standalone Approval Requests review page. Breaking changes: • The standalone Approval Requests review page is retired; the Shadow MCP servers table is now the only review surface, and existing request links for URL targets redirect to the server page.

gram admin@0.2.0

Mon, 17 Aug 2026 09:43:06 GMT

gram admin@0.2.0 adds inline org peek panels, bulk account-type updates, multi-value filters, and row-level disable/trial actions to the admin organizations list. • Adds a peek panel to each row in the admin organizations list, docking a 400px side panel showing account type, trial end, member count, creation date, and both IDs without leaving the page; supports keyboard navigation (Arrow Up/Down to walk rows, Escape to close) and screen-reader announcements. • Adds `account_types`, `trial_states`, and `disabled_states` filter parameters to the organizations list API, each accepting multiple values per request; replaces the single-valued `account_type` and `include_disabled` boolean (which remain supported as a compatibility shim). • Adds multi-value filter controls to the organizations list toolbar — Type (free, pro, enterprise), Trial (six states), and Status (active, disabled, both) — with chosen filters persisted in the URL so views can be shared. • Adds a bulk account-type control to the admin organizations list: ticking multiple rows reveals a strip that counts the selection, lists accepted account types, and requires confirmation before writing. • Adds a summary strip above the organizations table showing total org count (with 7-day new count), trials ending within 7 days (`ending_soon` state), and disabled orgs (with 7-day count); each figure is a clickable filter shortcut. • Adds per-row actions (Disable, Re-enable, Extend trial) accessible from a row menu and from the peek panel footer, allowing platform admins to manage organizations without leaving the list. • Consolidates row controls into a pinned Actions column at the right edge of the organizations table; adds `Alt+click` anywhere on a row as a shortcut to open the peek panel.

gram admin@0.1.2

Mon, 17 Aug 2026 09:43:04 GMT

Admin org endpoints now expose real trial state and end date; dashboard link scopes directly to an org via `redirect` parameter. • Admin organizations and organization detail endpoints now return each organization's real trial state and end date read from the trials table, distinguishing running, ending-soon, expired, demoted, converted, and never-trialled states. • Adds a URL contract using the `redirect` parameter on the login URL to open the customer-facing dashboard already scoped to a chosen organization, replacing the set-a-cookie-and-redirect flow.

gram server@1.11.0

Mon, 17 Aug 2026 09:43:03 GMT

Gram server 1.11.0 adds range-bounded activity totals and independent pagination to assistant sessions. • Adds exact range-bounded activity totals and independent pagination to assistant sessions. • Restricts `agent.getConfiguration` to `org:admin` role, aligning read access with the existing `agent.updateConfiguration` requirement, and hides the Device Agent Configuration tab from non-admins in the dashboard. Breaking changes: • `agent.getConfiguration` now requires `org:admin`; callers with lesser roles that previously could read device agent fleet configuration will receive an authorization error after upgrading.

gram dashboard@0.107.1

Mon, 17 Aug 2026 09:43:01 GMT

Adds browser hardening headers, scopes device agent fleet config to org admins, and improves assistant session pagination. • Adds `Cross-Origin-Resource-Policy: same-origin`, `Cross-Origin-Opener-Policy: same-origin`, and `X-Permitted-Cross-Domain-Policies: none` headers to dashboard HTML responses, set per nginx location block to avoid inherited header loss; static assets under `/assets` and `/external` retain `Access-Control-Allow-Origin: *`. • Restricts viewing device agent fleet configuration (`agent.getConfiguration`) to `org:admin` role, matching the existing write requirement on `agent.updateConfiguration`; hides the Device Agent Configuration tab from non-admins while keeping the Setup tab available to org readers. • Routes `/explore-demo` directly to the demo org's default project so new visitors land on sample data immediately. Breaking changes: • Viewing `agent.getConfiguration` now requires `org:admin`; users without that role who previously could view device agent fleet configuration will lose access.

gram admin@0.1.1

Mon, 17 Aug 2026 09:42:59 GMT

gram admin: organization list view now syncs search and filters to the URL for shareable operator views. • Organization list search and filter state is now persisted in the URL, enabling operators to share exact filtered views with colleagues via URL. • Adds a persistent toolbar row with a Columns control to the organizations list table.

gram server@1.10.0

Mon, 17 Aug 2026 09:42:57 GMT

Gram server 1.10.0 adds a configurable assistant detail panel, a `triggers.listEvents` endpoint, and encrypted OpenRouter key management. • Adds the `triggers.listEvents` endpoint, surfacing recent traffic per trigger with each dispatched event linking to the conversation it was routed to. • New `adminOpenRouterKeys` service and dashboard page lets platform admins list every organization's OpenRouter API keys with credit limit, live usage, and encryption state — with encrypt, enable, and disable actions (enable/disable are audit logged against the owning organization). • Encrypts platform OpenRouter API keys at rest using AES-256-GCM with dual-write during the expand phase; every read path prefers the encrypted copy and lazily back-fills ciphertext for legacy plaintext rows. • Assistant detail panel is now fully configurable in place: overview settings (name, model, concurrency, warm TTL) are editable, and a Sessions tab shows aggregate stats (sessions, messages, cost, tokens) over a selectable time range defaulting to the last 30 days with per-session cost in the list. • Agent sessions routed through LiteLLM retain their LiteLLM association when the agent's own hook stream captures the transcript, matching the LiteLLM platform filter and displaying as ' via LiteLLM' in session list and detail views.

gram dashboard@0.107.0

Mon, 17 Aug 2026 09:42:55 GMT

• Adds a platform-admin `adminOpenRouterKeys` service and dashboard page listing every organization's OpenRouter API keys with credit limit, live usage, and encryption state — with enable, disable, and encrypt actions (enable/disable are audit logged against the owning organization). • Encrypts platform OpenRouter API keys at rest using AES-256-GCM via a dual-write expand phase; all read paths prefer the encrypted copy and lazily backfill ciphertext for legacy plaintext rows.

gram server@1.9.0

Mon, 17 Aug 2026 09:42:53 GMT

Gram server 1.9.0 adds on-demand MCP tool discovery, local assistant runtimes, file attachments, RFC 7009 upstream revocation, and new OTel MCP tracing. • Adds `userSessionIssuersCimdClients.verifyURL` endpoint to probe a client ID metadata document URL for reachability and spec compliance before committing it — rate-limited per project, distinguishing malformed URL, unreachable endpoint, non-JSON body, and spec-violation outcomes. • Emits `gram.mcp.requested_protocol_version` and `gram.mcp.negotiated_protocol_version` OpenTelemetry trace attributes on all five inbound MCP paths, plus a new unsampled `mcp.initialize` counter broken down by revision. • `externalKeys.updateAwsKms` and `externalKeys.updateGcpKms` now cover only `name`, `external_credential_id`, and `customer_grant_reference` — `key_arn`, `resource_name`, and `algorithm` are no longer accepted. • Adds `chat.list` `user_id` filter so callers with project-wide chat visibility can narrow results to a specific Gram user. • Adds a `local` runtime provider for assistants — starts one Docker container per assistant on demand, reuses it across turns, and replaces idle containers when the runtime image is rebuilt, with no Fly.io credentials required. • Revokes Remote Session credentials upstream via RFC 7009: discovers `revocation_endpoint` from the issuer's RFC 8414 metadata and posts the stored token on revoke, covering single-session revoke, bulk revoke, client delete, and the end-user 'Disconnect' flow. • MCP tools are now discovered on demand through a search tool rather than sent in full on every call; MCP servers connect on first use instead of at assistant startup, and dropped connections reseat automatically. • Lets organization admins set an organization-wide automatic remote session refresh policy (Disabled, User controlled, or Required) from the MCP Connections page, with the effective policy surfaced on the OAuth consent screen. • Supports file attachments in the Project Assistant — images, text files, and OpenAPI specs travel with the turn; unreadable files get a short-lived download link. • Propagates retroactive risk-exclusion changes into ClickHouse so creating, updating, disabling, or deleting an exclusion rewrites affected findings' effective state in both ClickHouse and Postgres. • Catalog entries from external MCP registries now carry the registry's linked source repository and published packages, feeding the MCP approval evidence surface. • Caches OAuth client ID metadata documents, honoring upstream `Cache-Control` and `Expires` headers within a 5-minute to 24-hour bound and revalidating with `If-None-Match`. • Scores Watchdog signals from the matched risk policy's configured score and simplifies the signal drawer to a single Create-exclusion action. • Organization names now accept punctuation and any Unicode script, capped at 100 characters (must carry at least two letters or numbers; control characters, bidi overrides, and invisible formatting are still rejected). • Surfaces the supported client that originated an Agent Session routed through LiteLLM while preserving LiteLLM filtering. • Warns when an identity provider duplicates an issuer URL at all three tiers on both create and edit (advisory, never blocks the write). Breaking changes: • `externalKeys.updateAwsKms` and `externalKeys.updateGcpKms` no longer accept `key_arn` / `resource_name` or `algorithm`; changing what a key points to now requires deleting it and creating a new one. • `createGcpKms` now requires a fully-qualified crypto key version path.

gram dashboard@0.106.0

Mon, 17 Aug 2026 09:42:51 GMT

gram dashboard 0.106.0 adds upstream OAuth token revocation via RFC 7009, MCP client ID metadata controls, and file attachments for Project Assistant. • Adds `revocation_endpoint` discovery for Remote Session issuers (via RFC 8414 metadata), enabling upstream credential revocation via RFC 7009 on every session-ending path: single revoke, bulk client revoke, client delete, and the consent screen's per-provider 'Disconnect'. • Exposes MCP server authentication settings to configure which OAuth Client ID Metadata Document clients are accepted: Gram's verified client catalog, any spec-valid client, or none, plus allow-listing additional document URLs with reachability and validity verification. • Adds organization-wide automatic remote session refresh policy (Disabled, User controlled, or Required) configurable by organization admins from the MCP Connections page, surfaced to end users on the OAuth consent screen. • Logout response now sends `Clear-Site-Data: "cookies", "storage"` to drop the session cookie and clear localStorage, sessionStorage, IndexedDB, and Cache Storage across the origin's registrable domain. • Adds a PAYG rate adjustment (%) input to the platform-admin TUM contract price estimator on the billing page, reflecting the uplift or discount across the tier table, blended rate, and committed-vs-PAYG comparison. • Adds a new UI for the Watchdog page. • Skill details split into focused pages for content, usage, feedback, versions, and settings. • Organization names now accept punctuation and any script (Japanese, Chinese, Korean, Cyrillic, Arabic, Hebrew, etc.), capped at 100 characters, with control characters and bidi overrides still rejected. • Chat composer recalls past prompts terminal-style using Up/Down arrow navigation, with history kept in localStorage scoped per project. • Durable block pages now link to the owning project's risk event log. • Agent Sessions routed through LiteLLM now display the originating supported client while preserving LiteLLM filtering. Breaking changes: • `externalKeys.updateAwsKms` and `externalKeys.updateGcpKms` no longer accept `key_arn`, `resource_name`, or `algorithm`; only `name`, `external_credential_id`, and `customer_grant_reference` are accepted, so changing what a key points to now requires deleting it and creating a new one. • `createGcpKms` now requires a fully-qualified crypto key version path.

gram server@1.8.0

Mon, 17 Aug 2026 09:42:48 GMT

Gram server 1.8.0 adds Slack image vision, prompt-injection scanning for skills, and a new `risk.getSignals` endpoint. • Adds `risk.getSignals` API endpoint for finding attribution, backing the internal Watchdog page. • Adds `input_parts` field to turn requests, widening the assistant runtime message representation from plain strings to structured text/image content parts across the Go runtime and Rust runner wire protocol (back-compat in both directions). • Adds `platform_slack_get_file_url` runner tool that mints short-lived sealed download URLs via the Gram server's Slack file proxy, enabling credentialed Slack image retrieval in assistant turns. • Adds `inspect_asset` runner tool that fetches any directly reachable image URL, validates it, and attaches it to the conversation as a user message for vision context in threaded Slack interactions. • Fetches Slack image attachments server-side (up to 4 files, 8 MiB total per turn; png/jpeg/gif/webp, 10 MiB per file) and injects them as `image_url` input parts with `data:` URIs into assistant turns; `data:` URIs are stripped to text placeholders before persistence. • Scans captured skill manifests for prompt injection at capture time and surfaces current-version findings on the skill details page; admins can configure the Prompt Injection policy directly from the Skills page. • Carries Slack file attachment metadata (id, name, mimetype, size) through trigger ingestion into the assistant turn context, with the `files` list addressable from Slack trigger CEL filters.

gram dashboard@0.105.0

Mon, 17 Aug 2026 09:42:46 GMT

Gram dashboard adds prompt-injection scanning for skill manifests, trial-expiry upgrade flow, and a unified page-template layer. • Adds `reveal` prop to `Input` (absorbing the former `PrivateInput` component) for inline secret reveal in forms. • Adds `Card.Dashboard` (replacing `DashboardCard`), `StatTile` (replacing `chart/MetricCard`), and `SegmentedControl` (absorbing `ToggleButton`) to the design-system primitives. • Promotes `SettingsSection` and `DetailSidebarNav` out of the mcp path into `@/components/detail` for reuse across detail pages. • Adds `ResourceListPage`, `DetailPage`, `TabbedPage`, `FormPage`, `SettingsPage`, `OverviewPage`, `WorkbenchPage`, `WizardPage`, `CenteredPage`, and `FullBleedPage` page-template components in `@/components/page-templates`, plus composite widgets `InlineEmptyState`, `StatRow`, `SummaryCard`, and `DetailBody`. • Organizations whose enterprise trial has ended now land on a dedicated upgrade-call page rather than the generic book-a-demo screen; users still inside a trial can reach the same page early via the sidebar countdown. Breaking changes: • The `Modal` and `IconButton` subsystem has been removed. • `PrivateInput` is removed; use `Input` with the new `reveal` prop instead. • `DashboardCard` is removed; use `Card.Dashboard` instead. • `ToggleButton` is removed; use `SegmentedControl` instead. • `Editable` is removed; use `editable-text` instead. • The analytics tile `chart/MetricCard` is renamed to `StatTile`; `MetricCard` now refers solely to the base primitive.

gram server@1.7.0

Mon, 17 Aug 2026 09:42:44 GMT

Gram server 1.7.0 adds RFC 9207 `iss` parameter support and an overhauled MCP Clients and Sessions UI with a new `active_session_count` API field. • Adds `active_session_count` field to the user session clients API, exposing how many active sessions each MCP client holds; clicking the count filters both the Clients and Sessions listings to that client. • The OAuth authorization server now emits the RFC 9207 `iss` parameter on every authorization response (success and error) and advertises `authorization_response_iss_parameter_supported` in its metadata document, satisfying the MCP 2026-07-28 Authorization Response Validation requirement and enabling mix-up attack detection across concurrent flows. • The MCP server Clients and Sessions tab now leads with active counts and renders both listings as searchable, filterable, sortable tables paginated ten rows at a time, with member avatars and creation dates on sessions.

gram dashboard@0.104.0

Mon, 17 Aug 2026 09:42:42 GMT

MCP server dashboard gets searchable, filterable, paginated Clients and Sessions tables with active session counts. • Adds `active_session_count` field to the user session clients API, surfacing how many active sessions each MCP client holds; clicking the count filters both the Clients and Sessions listings to that client.

gram server@1.6.0

Mon, 17 Aug 2026 09:42:40 GMT

Gram server 1.6.0 adds MCP Clients/Sessions tab, provider convergence, agent plugins, and trial auto-demotion. • Removes the legacy OAuth proxy provider system: the `/oauth/*` proxy serving path now returns `invalid_grant`, and the `toolsets.addOAuthProxyServer` / `updateOAuthProxyServer` management endpoints are gone, along with the `remoteSessionClients.cloneClientFromOAuthProxyProvider` and `userSessionIssuers.migrateLegacyGramRegistrations` migration helpers and the `AdditionalCacheKeys` cache fan-out mechanism. • Adds a Convergence tab on platform identity providers, letting platform admins consolidate an organization's remote identity provider onto the shared platform catalog entry — showing how many clients would move and any metadata differences, and re-pointing those clients on consolidation without requiring users to sign in again. • Publishes compatible Cursor and Codex plugins from a shared Agent Plugins 1.0 package and exposes compatibility on plugin responses. • Adds user-opted-in automatic remote session token refresh, with organization-level settings hidden until the feature is enabled. • New enterprise trial signup flow: organizations start a 14-day trial with $50 of chat credits (applied as a ceiling on inference Gram runs on the org's behalf); the billing page shows the credit ceiling for the organization. • An hourly job now auto-demotes expired enterprise trials — returning the org to the free plan, removing it from the whitelist, and disabling its platform model key — writing each demotion to the audit log under `organization:enterprise_trial_demoted`. • Public skill share links now use a verified custom domain, serving the share page and raw `SKILL.md` download at `https:///shared/skills/`, scoped so a domain only serves skills belonging to its own organization. Breaking changes: • The `/oauth/*` proxy serving path is removed: the token endpoint now returns `invalid_grant`, and the authorize and register endpoints are gone — clients holding proxy refresh tokens must re-authorize against their user session issuer. • The `toolsets.addOAuthProxyServer` and `updateOAuthProxyServer` proxy management endpoints are removed. • The `remoteSessionClients.cloneClientFromOAuthProxyProvider` and `userSessionIssuers.migrateLegacyGramRegistrations` migration helpers are removed. • The `oauth/providers` package and the `AdditionalCacheKeys` cache fan-out mechanism are removed.

gram dashboard@0.103.0

Mon, 17 Aug 2026 09:42:39 GMT

Gram dashboard 0.103.0 adds MCP Clients/Sessions tab, provider convergence, opencode fleet management, and custom-domain skill share links. • Adds a Clients and Sessions tab to MCP server detail pages, listing clients registered against the server's session issuer and its active sessions; CIMD-resolved OAuth clients are now distinguished from DCR-registered ones. • Adds `opencode` to the managed tools list on the device agent fleet configuration page, with the same off/user/managed enforcement layer selection as other supported tools. • Reworks the toolset OAuth configuration UI: the 'Configure OAuth' wizard's custom path now provisions a `remote_session_issuer` + `remote_session_client` and links the toolset instead of an OAuth proxy server; the external-OAuth path is unchanged. • Applies a new editorial design language across the dashboard: flat square surfaces with hairline borders, serif display page titles, colorized metric tiles, and a dark-mode chart palette. • Updates the macOS Device Agent setup walkthrough to install from a signed `.pkg` (covering `installer` CLI and MDM Package push), and makes Device Agent the default choice on the 'Instrument agent platforms' onboarding step; Device Agent is now out of preview. • Agent Plugins compatibility status and portable ZIP downloads now appear on plugin list and detail pages.

gram server@1.5.0

Mon, 17 Aug 2026 09:42:36 GMT

gram server 1.5.0 adds ChatGPT compliance import, Microsoft Teams triggers, LiteLLM OTLP ingestion, Codex spend-gate enforcement, and new OAuth client admission controls. • Adds `GET /v1/install/device-agent-macos.pkg` — a stable redirect that resolves the current signed macOS device-agent installer version server-side and 302s to the versioned pkg, so IT-admin instructions never need a hardcoded version URL. • Adds `auth.enterDemo` endpoint to switch any authenticated session into the shared read-only demo organization without requiring membership, with a verb-based write guard backstop and a dashboard `/explore-demo` entry route. • Adds `auth.login` optional `email` and `org_name` parameters: `email` sets WorkOS `login_hint` and `screen_hint=sign-up` for pre-filled sign-up flows; `org_name` stashes a signup intent and creates the organization during the auth callback, recorded as `onboarding_event` / `new_org_created` with `created_via: 'signup'`. • Adds a new `chatgpt_compliance` AI-integration provider that polls workspace-scoped `CONVERSATION_MESSAGE` log files from the OpenAI Compliance Logs Platform and persists them as external chats and messages in the Agent Sessions surface, configured with a workspace UUID. • Adds a `codex_cloud_sessions` schedule on the `chatgpt_compliance` integration that polls the workspace-scoped `CODEX_LOG` compliance feed and imports Codex cloud web-task transcripts as agent sessions under the new `codex-web` chat source. • Extends spend-gate enforcement to Codex and Cursor at parity with Claude: denies over-budget actors on `hooks.codex` (PreToolUse, PermissionRequest, UserPromptSubmit), `hooks.cursor` (preToolUse, beforeMCPExecution, beforeSubmitPrompt), and the unified `hooks.ingest` path for codex and cursor adapters (case-insensitive match). • Adds `userSessionIssuersCimdClients` service to list the curated catalog of verified MCP clients (Claude Code, Claude, VS Code, Zed, Goose, ChatGPT, Codex CLI, Notion, MCPJam, Factory Droid, ToolHive) and manage per-issuer URLs; admission mode (curated catalog, any spec-valid client, or none) is readable and writable on the existing `userSessionIssuers` endpoints. • Adds authenticated OTLP trace ingestion for LiteLLM telemetry. • Adds project-scoped LiteLLM integration provisioning, key rotation, revocation, and lifecycle metadata APIs. • Accepts opt-in LiteLLM OTLP operational metrics without adding them to usage billing or sessions. • Exposes health and attribution diagnostics for provisioned LiteLLM integrations. • Adds Microsoft Teams as an assistant trigger source: Bot Framework activities (messages, reactions, membership and installation updates) posted to a trigger webhook are verified against Microsoft's signing keys and dispatched to assistants with the same CEL-based event type filtering as other webhook triggers. • Adds an OpenRouter platform key lockdown that returns a distinct `inference_disabled` error at key resolution rather than an upstream rejection when a key is locked down, with limit-refresh reinstatement. • Adds `externalCredentials.verifyGcpIam` and `externalCredentials.getGcpSetupInfo` methods for verifying GCP IAM impersonation; scopes the External Services page to org admins behind a new `customer_managed_encryption_keys` entitlement enforced on both `externalCredentials` and `externalKeys`. • Adds `adminRemoteSessions.listGlobalIssuers` and `adminRemoteSessions.getGlobalIssuer` — now returning both platform-owned and tenant-owned client counts — plus a new Platform Admin sidebar section for curating the shared remote identity provider catalog. • Substitutes the OAuth callback URL into the `{{ gram.oauth.callback_url }}` template key in content returned by `mcpRegistries.getSetupDocs`, so `external_markdown` and `speakeasy_markdown` carry a paste-ready redirect URI. • Adds organization-level device-agent remote configuration to the existing agent policy response, with admin management endpoints, versioning, validation, and audit logging. • Meters Codex cloud usage (GitHub code review, web tasks) from the compliance COSTS feed, promoting token counts to `gen_ai.usage.*` for TUM when no OTEL stream is available. • Classifies Codex account identity and billing mode on every capture path (legacy hooks, OTEL logs, ingest adapter), stamping `account_type` from email resolution and resolving org-level `billing_mode` from the `codex_compliance` integration config.

gram dashboard@0.102.0

Mon, 17 Aug 2026 09:42:34 GMT

gram dashboard 0.102.0 adds a live demo org path, org-scoped external services with GCP IAM verification, platform-admin identity provider curation, ChatGPT/Codex compliance imports, and more. • Adds `auth.enterDemo` endpoint to switch any authenticated session into a shared read-only demo org without membership; demo org enforces a fixed read-only scope with a verb-based write guard as backstop, and the dashboard gains an `/explore-demo` entry route and demo banner. • Adds `externalCredentials.verifyGcpIam` to probe that Gram can impersonate a named GCP service account, and `externalCredentials.getGcpSetupInfo` to report the Gram service account that must be granted `roles/iam.serviceAccountTokenCreator`; both are gated behind the new `customer_managed_encryption_keys` entitlement enforced on `externalCredentials` and `externalKeys`. • Adds `adminRemoteSessions.listGlobalIssuers` and `adminRemoteSessions.getGlobalIssuer` — now returning platform-owned and tenant-owned client counts separately — and a new Platform Admin sidebar section for curating the shared remote identity provider catalog (list, create, edit, refresh metadata, delete). • Adds a `chatgpt_compliance` AI-integration provider that polls workspace-scoped `CONVERSATION_MESSAGE` log files and persists them as external chats and messages in the same Agent Sessions surface as the Anthropic compliance import; config takes a workspace UUID, distinct from `codex_compliance` which is per API organization. • Extends spend-gate enforcement to Codex and Cursor at parity with Claude: legacy endpoints `hooks.codex` (PreToolUse, PermissionRequest, UserPromptSubmit) and `hooks.cursor` (preToolUse, beforeMCPExecution, beforeSubmitPrompt), plus the unified `hooks.ingest` path for `codex` and `cursor` adapters (case-insensitive match). • Adds a Device Agent configuration tab for org administrators to configure per-tool enforcement layers, release policy, and reconciliation cadence. • Adds `auth.login` optional `email` and `org_name` params: `email` pre-fills WorkOS login hint and sets `screen_hint=sign-up`; `org_name` stashes a signup intent against the login nonce and creates the org during the auth callback, logging `onboarding_event` / `new_org_created` with `created_via: 'signup'`. • Adds a `/sign-up` page that collects company name before handing off to the identity provider; failed signups return to `/sign-up` rather than `/register`. • Webhooks are now available to every organization (marked Beta) without a preview gate; delivery is controlled solely by the organization's own webhooks toggle. • Shows active trial status — current trial day, remaining days, elapsed progress, and a link to Sales — in project and organization navigation. • Makes Skills table columns sortable from their headers, with 'recently updated' as the default order, and reduces the table to its most useful overview columns with rebalanced widths. • Makes RBAC always on, provisioning built-in roles and grants for new organizations and assigning the first organization user the Admin role. • Project sidebar nav groups now collapse by default with a chevron to pin groups open; only the group containing the current page opens automatically. • Displays enabled warning policies in the Shadow MCP inventory status card. • Connects Figma added from the MCP catalog directly to Figma's official server instead of routing through a proxy.

gram server@1.4.0

Mon, 03 Aug 2026 20:16:31 GMT

gram server 1.4.0 adds an authenticated LiteLLM guardrail endpoint, model-response capture, and allow-all shadow MCP policy enforcement. • Adds `platform_distribute_skill` and `platform_undistribute_skill` MCP tool calls to attach and revoke a skill from a plugin or assistant, and `platform_list_plugins` to resolve a plugin by name to the ID those calls require. • Adds an authenticated LiteLLM Generic Guardrail endpoint that enforces prompt policies before model calls and captures blocked prompts. • Adds 'Block Server' and 'Unblock Server' per-server actions in the shadow MCP inventory that add and remove `risk_policy:block` grants through dedicated inventory endpoints under allow-all policies. • Captures LiteLLM model responses with per-call session and user attribution to support asynchronous risk analysis.

gram dashboard@0.101.0

Mon, 03 Aug 2026 20:16:28 GMT

gram dashboard adds allow-all shadow MCP policy support for inventory, approvals, and block/unblock server actions. • Approval UI skips audience/policy pickers for `allow_all`-policy requests and explains that approval unblocks the server for everyone in the project. • Shadow MCP inventory is now disposition-aware under `allow_all` policies: servers are reported as allowed by default and shown as blocked only when a block rule lists them. • Policy status banner now explains the allow-by-default posture when an `allow_all` policy is active. • Per-server primary action in inventory flips to 'Block Server' / 'Unblock Server' under `allow_all` policies, adding and removing `risk_policy:block` grants through dedicated inventory endpoints.

gram server@1.3.0

Mon, 03 Aug 2026 18:08:26 GMT

gram server 1.3.0 adds allow-all shadow MCP policies, blocked-URL lists, new assistant risk tools, and OpenTelemetry sync metrics. • Adds `shadow_mcp_blocked_urls` to risk policy create/update payloads, enabling proactive blocking of MCP server URLs (including servers not yet observed in project inventory) on allow-all shadow MCP policies; stored as `risk_policy:block` RBAC grants held by the all-users principal. • Enforces allow-all shadow MCP policies in the hook path: every non-Gram-hosted MCP server is permitted unless a `risk_policy:block` grant names its URL; projects are limited to one enabled shadow MCP blocking policy to prevent disposition conflicts. • Adds `platform_list_risk_exclusions` and `platform_create_risk_exclusion` assistant tools to suppress whole classes of risk findings; `platform_create_risk_exclusion` fingerprints exact and regex match values to reuse equivalent existing exclusions. • Adds `platform_mark_risk_false_positive` and `platform_unmark_risk_false_positive` assistant tools to dismiss and restore specific risk findings, gated on org admin permissions and fully audited. • Adds `platform_get_risk_rule_breakdown` assistant tool to answer 'which rules fire most' in a single small call instead of many large paginated responses. • Adds `platform_create_skill` assistant tool to create project skills from complete `SKILL.md` content, using the same validation, versioning, permissions, feature gating, and audit logging as manual skill creation. • Emits new OpenTelemetry metrics `gram.device_integration.sync.outcome` (sync runs by provider and outcome) and `gram.device_integration.sync.auto_pause` (schedules auto-paused after credential-rejection streaks) for the device-integration sync pipeline. • Adds `chatgpt` and `chatgpt-work` sources to the product-surface taxonomy; the compliance importer routes Work rows to the `chatgpt-work` hook source and uses `hook_source` as a summary GROUP BY dimension so the per-product split survives summarization. • Admits `chatgpt:usage` rows (ChatGPT/Work usage and spend from the OpenAI compliance COSTS import) into `attribute_metrics_summaries_mv` and `chat_session_summaries_mv` so ChatGPT tokens count toward tokens-under-management and appear in usage/cost analytics. • Agent-facing risk findings listing now defaults to 25 results and caps at 50, preventing large pages from inflating assistant context during triage. • Project assistant tool calls now render with Claude-style collapsed tool groups, each preceded by a terse activity phrase that becomes the group heading; consecutive batches merge into one advancing group.

gram dashboard@0.100.0

Mon, 03 Aug 2026 18:08:23 GMT

Shadow MCP policy now supports block-all/allow-all postures, and ChatGPT/Work compliance sources land in the product taxonomy. • Shadow MCP policy creation adds a default-disposition choice: 'Block all servers (allow exceptions)' or 'Allow all servers (block exceptions)', with the server selector flipping between allowed and blocked servers to match the chosen posture. • Adds `chatgpt` and `chatgpt-work` hook sources to the product-surface taxonomy, routing ChatGPT Work compliance rows to `chatgpt-work` and standard ChatGPT/unknown surfaces to `chatgpt`, preserving per-product splits across summarization (since `hook_source` is a GROUP BY dimension and summaries outlive raw-row TTL). • Adds a contract value estimator to the TUM Contract section of the billing page (platform admin only), approximating enterprise account value under a committed platform fee with tiered overage or uncommitted pay-as-you-go, based on observed tokens under management. • Project assistant tool calls now render Claude-style with a terse activity phrase heading each collapsed tool group; consecutive batches merge into one advancing group and the global thinking loader hides while a tool group is streaming.

gram server@1.2.0

Fri, 31 Jul 2026 22:26:37 GMT

gram server 1.2.0 adds memory extraction with corpus browser, weekly billing summaries, and MCP setup-doc lookup via `mcpRegistries.getSetupDocs`. • Adds `mcpRegistries.getSetupDocs` to return published setup documentation for an upstream MCP server from the `github.com/speakeasy-api/mcp-setup-docs/go` catalog; a guide can be located by the server's endpoint URL, by its registry specifier as returned by `listCatalog`, or by both — matches are deduplicated by guide slug and returned in descending specificity, and servers with no published guide return an empty list rather than an error. • Adds two managed-assistant tools, `platform_list_docs` and `platform_get_doc`, that expose the ~110 pages under speakeasy.com/docs/ai-control-plane to the project assistant: `platform_list_docs` returns the page index (cached hourly from the docs sitemap) and `platform_get_doc` returns one page's markdown and its public permalink. • Adds selective extraction of high-value, reusable business memories from completed chats, with deduplication of semantic duplicates and an organization-admin corpus browser featuring semantic search, source-transcript navigation, and a content-scope tree with distinct-memory counts. • Adds a `billing.TumComponents` registry that centralises the tokens-under-management token components so the ClickHouse billing measure and a new weekly usage summary email both derive from a single definition. • Adds a weekly usage summary email (sent every Monday via a Temporal sweep) to each organization's billing alert contact, reporting their tokens-under-management total for the active billing cycle with a percent-change badge against the same elapsed point in the previous cycle; organizations with no usage in either window are skipped and sends are deduplicated per organization and run date. • Serves the Risk Events listing from ClickHouse when the `risk-list-from-clickhouse` per-org flag is enabled, preserving existing ordering, filters, and pagination behavior.

gram dashboard@0.99.0

Fri, 31 Jul 2026 22:26:34 GMT

Gram dashboard adds selective business memory extraction with an admin corpus browser and semantic search. • Adds an organization-admin corpus browser with semantic search, source-transcript navigation, and a full content-scope tree showing distinct-memory counts. • Selectively extracts high-value, reusable business memories from completed chats, omitting semantic duplicates to reduce noise in the corpus.

gram server@1.1.0

Fri, 31 Jul 2026 13:56:38 GMT

Gram server 1.1.0 adds OAuth CIMD support for MCP clients and custom domain root routing with OpenAI ownership verification. • Supports OAuth Client ID Metadata Documents (CIMD) on the Gram Session OAuth authorization server, gated per organization behind the `gram-user-session-cimd` feature flag, enabling MCP clients that use a URL-shaped `client_id` (such as Claude Code and VS Code) to complete the OAuth flow without Dynamic Client Registration, including loopback redirects on any port. • Custom domains can now route their root URL (`https://your-domain.com/`) to a default MCP server endpoint — configurable from the custom domain page or the MCP server's own settings — with slug renames automatically updating routing. • Custom domains can serve an OpenAI app-submission verification token at `/.well-known/openai-apps-challenge`, allowing ChatGPT app reviews to verify domain ownership without site changes.

gram dashboard@0.98.0

Fri, 31 Jul 2026 13:56:35 GMT

Custom domains can now route their root URL to a default MCP server and serve OpenAI app-submission verification tokens. • Custom domains can route their root URL (`https://your-domain.com/`) to a designated default MCP server, letting MCP clients connect at the root while browsers see the installation page; renaming the endpoint slug updates routing automatically. • The default MCP server for a custom domain can be set either from the custom domain page or from an individual MCP server's own settings page.