Changelog

What we’ve shipped, newest first. Everything here is live in production; where a feature is limited to certain plans, the entry says so.

Last updated

  1. Operator verification for MCP servers and platforms

    Every connected MCP server and platform gets a badge saying who AgentValet could confirm operates its endpoint: Domain verified when it answers over valid HTTPS on its domain, and Listed in MCP Registry when the official MCP Registry also lists it at that address under a namespace bound to the same domain. An operator’s signed identity statement is shown as self-declared. This is identity, not endorsement. Your admins approve a version of each MCP server: AgentValet fingerprints the operator identity and hashes every tool definition, and when either changes, the changed tools are held back from agents until an admin reviews a line-by-line diff and approves. A policy can set a minimum level, require the approved version, or both: by default it only records what would have happened, or you can choose to hold or refuse calls. Adding a server is never blocked, and every governed call records the result, with evidence and manifest hashes, in the audit log and its signed receipt.

    Enterprise.

    • Enterprise
    • Official MCP Registry
    • Observe by default

  1. A signed receipt for every governed decision

    Each allowed, held or refused call is written with a compact signed statement: which agent, which owner approved, which scope, which policy version and rule, which request. Anyone can verify it against our published key set and the broker’s did:web document, for the life of the audit row, with no access to our database. Refusals get receipts too.

    Every plan.

    • ES256 signed JWS
    • Published key set

  2. Recipient controls, an outside-organisation guardrail and one-click approvals

    A grant can now say to whom: allow-list Slack channels or email domains, and have the broker ask first, or refuse, when a message would leave your organisation. Approve or deny from the desktop or mobile notification itself. Stripe gained 28 endpoint-enforced scopes, and the API document is now held to the live route table by a contract test.

    Recipient rules and the outside-organisation guardrail are on Studio and above.

    • Recipient allow-lists
    • External reach
    • OpenAPI contract

  3. did:web identities and TRQP queries

    Every agent can publish a W3C did:web document over its signing key. The same grant-and-policy check that gates every call answers ToIP TRQP v2 authorisation and recognition queries for partners.

    • did:web
    • TRQP v2

  4. One condition per rule, for people who want policy as code

    A single CEL expression on a policy rule, evaluated inside the policy kernel with the request in scope: amount under a limit, only during business hours, skip the ask if a person approved the same thing ten minutes ago. It fails closed, and its trace is recorded in the audit row and the signed receipt.

    Team plan and above.

    • CEL expressions
    • Kernel-evaluated

  5. Consent in the chat, one token per person, traces you can follow

    When an agent hits an MCP server nobody has authorised yet, the consent link lands in the conversation and the call resumes once an admin approves, where the client supports it. One agent serving many people can now hold one upstream token per person, keyed by a salted hash, with a hosted consent link for people who aren’t AgentValet users. Every governed call carries a trace id in its response header, and the broker exposes OpenTelemetry traces and Prometheus metrics.

    • MCP elicitation
    • Per-person tokens
    • OpenTelemetry

  1. Child agents with enforced attenuation, in both SDKs

    An orchestrator issues each worker its own short-lived identity with scopes cut down to a subset of its own, and the broker checks child against parent on every call. Revoke the parent and every child is contained on its next call. Available from the TypeScript and Python clients.

    Children are one level deep: a child can’t issue children of its own.

    • RFC 8693 attenuation
    • TypeScript and Python

  1. Okta SSO, team members, and more than one account per platform

    Access follows your identity provider through a verified domain. Admins control member roles in the app, and members can’t change agents, platforms or grants. Connect two Slack workspaces or three GitHub accounts and grant an agent a specific one. Every connected account is labelled with its real identity, so the audit row says which account acted.

    • Okta
    • Admin and member roles
    • Multi-connection grants

We don’t publish dates for work that hasn’t shipped. If there’s something you need, tell us: [email protected]. Receipts can be checked against our public signing keys.