What's new

Single permissions under each group — 2026-11-09

New

• On the Permissions page, Cloudflare's groups now open into Cloudflare's own permission groups and each single API operation, with search; grant a whole group, a subgroup or one operation.
• Critical operations stay behind their opt-in, and saving changes only what you touched.

Cloudflare — 2026-11-08

New

• A self-hosted relay can run behind a Cloudflare Tunnel, with no public IP and no open port.
• New Cloudflare integration: zones, DNS, security, certificates, tunnels, Zero Trust, Workers and more; risky areas such as credentials, deletes and billing are separate opt-in permissions.
• Automated IP blocking can block at Cloudflare's edge as an IP Access Rule, removed again when the block expires.

Messages: Close, Don't show again, and Show once — 2026-11-07

New

• In the window after sign-in each message has Close (it comes back at the next sign-in until it expires) and Don't show again.
• When you write a message you choose Until it expires or Show once; the Messages list shows how many saw it and how many chose Don't show again.

Debug mode: approvals — 2026-11-07

New

• With debug mode on, the AI's debug account can approve queued changes in the approvals window, as a policy admin can.

Several passkeys, messages to your people, and a passkey reminder for admins — 2026-11-07

New

• Account > Security: add as many passkeys as you like in one go, name them, rename them, and see for each its kind (for example iCloud Keychain or Windows Hello), whether it is synced, when it was added and when it was last used.
• Administration > Messages: write news or changes for the people of your organisation (superadmins also for everybody), for everyone or administrators only, with an optional end date; people see them after they sign in, and you see how many have read each.
• Administrators without a passkey are reminded at every sign-in to add one, until they have.

Debug mode: checks started from the console — 2026-11-07

New

• With debug mode on, the AI's debug account can now run an integration's connection check and rescan from the console.

Debug mode, and passkey confirmations that say what they confirm — 2026-11-07

New

• Approving a machine now shows exactly what you approve (the execution agent, its name, whether it is permanent and until when), and every passkey confirmation is bound to what it confirms.
• Superadmins can turn on a debug mode under Installation settings: with one passkey tap they let an AI assistant act as a superadmin of this installation, with its own key; one button turns it off, and every act it took is marked and listed.

Every admin approval in one window, split into Mine and All — 2026-11-07

New

• Sign-in methods, the organisation's sign-in policy, the mail server settings and account removals are now saved as "Saved and queued" and approved in the approvals window, like permission changes.
• Each approval step offers only the ways it accepts: changes of how people sign in, of the mail server and removals take a passkey or an authenticator code, never an emailed code, and the window says why.
• Policy admins see two tabs, Mine and All: Approve now and Cancel and remove all act on the open tab only.

MySQL and MariaDB databases — 2026-11-06

New

• Connect a MySQL or MariaDB server through an execution agent: the connection check lists its databases, and you give each person or group Read or Read + Write per database, or for all databases. Schema changes, stored procedures and server administration are separate critical permissions.
• People can use their own MySQL login on your integration, or connect their own database servers under My Connections, when the organisation allows it.

Windows updater: a slow service stop no longer blocks the next update — 2026-11-06

New

• a2m-update.ps1: when a service does not stop in time, it is reported NOT UPDATED and left as it was; it no longer leaves an update-pending marker that made the next run stop the service and refuse.

Host access on Windows execution agents — 2026-11-06

New

• A Windows execution agent can give access to its own machine (diagnostics, files and shell) to people granted it on that machine by name. It is on after an update; A2M_EX_HOST_ACCESS=off in executor.env, or install-executor.ps1 -NoHostAccess, turns it off.
• Host access on an execution agent's machine is a critical permission group: full access, "everyone", "Allow all" and wildcards never include it.

A phone-friendly top menu — 2026-11-06

New

• The top menu now works on phones: a Menu button opens a full-width list on the product site, the sign-in pages and in the app.

Generic MCP with per-person sign-in, and Chrome on execution agents — 2026-11-05

New

• Microsoft Copilot Studio can connect over OAuth once a superadmin turns it on under Security, and turning an AI connector off now takes effect in every organisation at once.
• A REST report can stop when the API marks its answer incomplete, so a scheduled export keeps its last complete file instead of storing a partial one.
• The AI sees a REST API's operations by name, with their descriptions and parameters, and calls them directly.
• A REST connection finds its API's OpenAPI description by itself and warns about a wrong base URL.
• Files of large answers are converted with a fraction of the memory.
• An integration's whole answer can come as a private download: the AI shows a link that opens only for you, signed in, and My downloads lists your files until they expire.
• REST APIs can be report sources, with paging, scheduled CSV exports, dashboards and cross-system reports.
• REST integrations return answers of up to 12,000 characters by default, adjustable per integration and per call up to 64,000; an answer that is cut now says so instead of ending mid-way.
• Generic MCP can use a plain http server on a private address, by an explicit, passkey-confirmed opt-in marked insecure.
• Generic MCP servers that need each person to sign in with OAuth run on execution agents; the sign-in is kept in custody.
• Chrome runs on an execution agent, limited to the integration's allowed websites, with scripts, input, files, network and cookies as separate critical permissions.

Fixes

• Per-operation REST permissions can no longer be stretched to another path with an encoded # or ?.
• A linked server checks your own per-operation REST permissions before forwarding a call.
• A per-operation REST permission can no longer reach the path above it through a path ending in a dot.
• A confirmed permission for one tool of a Generic MCP integration no longer comes back as a new approval after every confirmation.
• Back-to-back calls of an account whose first sign-in is still running wait briefly instead of failing; Generic MCP tool discovery on an execution agent works again.
• The integration page re-checks which execution agents can run it while you edit its address or sign-in.
• A Generic MCP discovery that does not finish in time ends in an error instead of staying at "discovering".

Engine 4, Generic MCP on execution agents, and Portainer secrets behind an opt-in — 2026-11-04

New

• Generic MCP servers run on execution agents: each upstream tool is its own permission, and the server's credential stays in custody.
• Infrastructure shows the version of each Policy & Custody and execution agent.
• Execution agents run engine 4: update an execution agent to this release to use it. Older agents keep running what they ran.
• Home Assistant's inventory, traces, statistics, helpers, users, add-ons and backups run on an execution agent over its WebSocket API, each message priced by its own permission.
• PAN-OS firewalls stored with a username and password can move into custody; the execution agent generates the API key itself.
• GitHub App sign-in, GraphQL priced by the operation it selects, and vCenter SOAP calls priced by what they read run on execution agents.
• Packs can use WebSocket calls, server-sent events and streams, HTTP Digest, SCRAM, NTLM, client certificates and request signers for AWS, Google Cloud Storage, Azure Storage, OAuth 1.0a, JSON Web Tokens, HTTP Message Signatures and DPoP.
• A saved report whose run-as is a service identity runs on host agents behind an execution agent; the service identity still never signs in to the console.

Fixes

• Portainer: stack and container secrets (environment values, logging and volume driver options) are withheld under read; the new critical group Portainer secrets returns them.
• A refused credential release now says why, for example 'sign in again on My Connections'.
• Home Assistant's areas, labels, entities and devices work on large installations behind an execution agent.
• Credential reads for Home Assistant's Supervisor and PAN-OS are explicit critical permission groups, and their secret values are redacted.
• A wrong password never locks a service account: the first sign-in to an unproven account is coordinated across execution agents, and a 401 or 403 alone never holds a credential.
• Every value derived from a secret is redacted from answers in every spelling.
• Confirming PRTG's one-time update no longer brings back 'Also remove' for the same permission.
• The GraphQL read-only check can no longer be fooled into running a mutation by comment or string tricks.

Verified updates, the Updates page, and background runs behind execution agents — 2026-11-02

New

• Administration -> Updates shows what every host agent and execution agent runs, what this server serves, and the verified command that updates each kind of installation.
• Self-hosted Docker servers update with one verified command (a2m-update), and Windows or Linux service agents update with a2m-update.ps1 and a2m-update.sh, rolling back automatically when an update does not prove itself.
• Fresh host-agent installations let the machine owner choose between read-only access and allowing command and file writes.
• Integrations behind an execution-agent-connected host agent (such as Active Directory) now discover, refresh, run scheduled reports and answer federated link calls using an explicit run-as identity.

Fixes

• Execution agents verify their expected Policy & Custody key locally, and workspace execution-agent pairing binds both the signing key and the sealing key under one fingerprint.
• The console's Linux execution-agent installation command and platform help match the flags accepted by the component installer.
• Updates use the published download paths, preserve signed security floors, and detect an interrupted service update before treating it as complete.
• Disabling a saved report’s run-as account prevents further delegated runs; deleting a workspace owner also removes remaining service identities, and incomplete workspace cleanup can be retried.
• Execution agents accept replies signed by either key during an operator-configured Policy & Custody key rotation.

Verified sign-up and complete account removal — 2026-11-01

New

• Signing up now starts with a code sent to your email address: your workspace is created only after you enter it.
• Deleting a person now also removes their account and stored sign-in methods at Policy & Custody; a self-registered workspace is removed with its owner.

Fixes

• Removing or disabling a person at Policy & Custody ends what their existing sessions can do at once.
• Deleting an organisation that uses its own Policy & Custody keeps a list of the accounts it leaves there for the server's operators.
• An administrator acting on another organisation's person who has the same user number now acts on that person only.

Agent security update — 2026-11-01

New

• The host and execution agents use updated network libraries with the latest security fixes.

Self-registered workspaces: email codes and execution agents — 2026-10-31

New

• Self-registered workspaces can sign in with email codes.
• Self-registered workspaces can connect their own execution agent; each one is trusted only after the workspace owner approves it with their passkey.

Fixes

• Execution agents stay trusted past 90 days: their certificates are renewed automatically for the same keys.

Self-registration: a new link — 2026-10-30

New

• If your confirmation link expired before you set up your workspace, you can ask for a new one on the registration page.

Fixes

• Self-registration is more robust when the connection to the shared Policy & Custody is interrupted.

File shares — 2026-10-30

New

• New File share integration: connect an SFTP, SMB or WebDAV share and let your assistant list, read and write files, create folders and move them. Deleting files is its own permission that full access never includes.
• People can add their own file shares under My Connections, if their organisation allows it; their assistant uses them with their own account.
• Reports and dashboards can be delivered to a File share.

Proxmox with an API token — 2026-10-30

New

• A Proxmox VE integration can now sign in with an API token: choose "API token" and enter the token ID (user@realm!name) and its secret. Signing in with a user and password works as before.

Clearer integration forms — 2026-10-29

New

• When you add or edit an integration, the user name now sits directly above its password, optional fields say "(optional)", and each field has a short label with a plain explanation below it.
• Chrome integrations no longer insist on fields that may be left empty.

Fewer false error reports — 2026-10-29

New

• With "Report API errors to the developers" switched on, an execution agent that cannot reach a system is no longer reported as an API error of that system's vendor.

The contact form works again — 2026-10-29

New

• The Contact form (linked from the website and every page footer) and What's new open again on mcp.any2mcp.com; the Contact link led to a "not found" page.

Every DocuWare file cabinet a permission of its own — 2026-10-29

New

• DocuWare: every file cabinet and document tray is now a permission of its own (read and change), beside "All file cabinets" and "All document trays". The list is read again at every refresh, and Policy & Custody decides each call made with the integration's own account; a person's own DocuWare connection keeps DocuWare's own rights. After the update, confirm the proposed "All" permissions on Users -> Permissions.
• The shared Policy & Custody for self-registered workspaces runs as its own container beside the organisation's own, with its own state, keys and settings.

Fixes

• A policy admin without a passkey can confirm a change of the mail settings with an authenticator app or Microsoft.
• Adding a person while the organisation's sign-in policy changes no longer creates an account without a way to sign in: the page says so, and Create account makes it.
• Switching off a sign-in method for the whole server that was refused is undone reliably, even when checking who uses it took long.

A slow sign-in change never lands late — 2026-10-29

New

• A sign-in change that took too long, for example while Policy & Custody answered slowly, can no longer go through after another admin's change was already checked: Policy & Custody refuses it, and the admin prepares it again.

No sign-in setting locks anybody out — 2026-10-28

New

• A sign-in method cannot be switched off while people use it, and no setting can leave anybody without a way to sign in: the change is refused, and the page says who is affected and what to do first.
• Sign-in changes are made one at a time, and a change is confirmed only while this server's sign-in settings and Microsoft sign-in are still as they were when it was prepared.

A service that is down is said; everyone gets their account at once — 2026-10-28

New

• Everyone gets their account at Policy & Custody at once and can use whatever their organisation allows them; a person who signs in with nothing yet is shown so, with the way in beside it.
• The sign-in page says before you try when Policy & Custody is not available, and that signing in with Microsoft is not affected; every page says when this server cannot save anything.

Fixes

• An error is a page that says what happened instead of a bare "Internal Server Error".
• Signing in, a passkey, an invite and confirmations that meet an outage say so instead of "invalid" or "failed", and an outage no longer counts as failed sign-ins against your address.

Sign-in in three levels — 2026-10-28

New

• Every assistant always sees every tool - every integration type, the machine tools, the administration tools and the usage guide - whether or not it may use them, so its tool list never changes and never needs a refresh; what it may actually use is answered live.
• Installation settings say which sign-in methods are possible on this server; each organisation decides on its Organisation page which of them its people may use and what new people start with, confirmed with a passkey or an authenticator code.
• A person's page shows only the sign-in methods that work for them and says why one is off.
• Organisation admins set their own MCP tokens per person (within the server's limit), client keys and report-mail domains.

Fixes

• A person's own token limit can no longer go past the server's limit.
• Deleting an organisation is for superadmins only.

Accounts at Policy & Custody made by themselves; the Organisation page — 2026-10-28

New

• People who sign in with Microsoft get their account at Policy & Custody by themselves, at their sign-in or when an administrator adds them, so their assistants can use the systems kept there as their permissions allow.
• Administration → Organisation gathers an organisation's own settings: its sign-in, its own mail server, its AI access and its rules for everyone. Global Settings is now Installation settings.
• Each organisation's Policy & Custody decides which one-time codes its people may use and what a new person starts with; only a policy admin changes it, with a passkey or an authenticator code.

Fixes

• A person's Permissions page no longer asks for an enrolment link where the person has no account at Policy & Custody: it points to Create account on their page.

Email codes sent through your own execution agent — 2026-10-28

New

• Policy & Custody can send email codes and test mails through your organisation's own execution agent: the mail settings and password stay with Policy & Custody, and changing them needs a policy admin's confirmation.

Shared sign-ins need only management rights; one set of sign-in buttons — 2026-10-27

New

• Sign-in and confirmation buttons are one set: the passkey first, then Microsoft, authenticator app and email code side by side; a code opens one small panel with a single button.
• Public self-registration is off by default on new installations; an installation can switch it on under Security, Registration.

Fixes

• An administrator who manages a Salesforce integration can connect its shared account without being allowed to use Salesforce: the check after Connect is a connection check, not a use of Salesforce.

Accounts without a link, no passwords, and a Salesforce shared account through custody — 2026-10-27

New

• Administrators create each person's account at Policy & Custody directly (Create account, or one batch for everyone on the Users list), see what each person signs in with, and switch email codes and an authenticator app on per person.
• No passwords anywhere: a person signed in with Microsoft confirms an action by signing in with a code, and the password change, reset and set-up pages are gone.

Fixes

• Connecting a shared Salesforce account through Policy & Custody works: the check after Connect no longer refuses an administrator who holds the integration's permission, and saving the Consumer Key and Secret no longer ends with "got a sign-in answer without a session". If your Salesforce integration shows that message, save its Consumer Key and Secret once more, then connect.

Salesforce sign-in kept in custody — 2026-10-27

New

• Salesforce sign-ins now run through Policy & Custody: the shared login an administrator connects and each person's own sign-in on My Connections keep their tokens there, and calls use them on the execution agent.
• Sign in and confirm with a code: beside a passkey and Microsoft, the console signs you in with your authenticator app's code or a code emailed to you (where your organisation's mail goes through an execution agent), and every confirmation takes one code for one action.

Fixes

• Connecting Salesforce by OAuth works again where Policy & Custody keeps the integration's credential: Connect no longer ends with "client identifier invalid". An integration that moved into custody before this update needs its Consumer Key and Secret saved once more before you connect.

Confirm with Microsoft — 2026-10-27

New

• Where your organisation sets it up, you can confirm a waiting approval with a fresh Microsoft sign-in, under your organisation's multi-factor policy, instead of your passkey. It confirms exactly what you selected, and a longer allow you chose is carried with it.
• Your own personal connections are still confirmed with your passkey only, and a Microsoft sign-in can never enrol or recover a passkey.

MikroTik routers over REST — 2026-10-27

New

• A MikroTik router that offers only its REST API can now be moved into custody and run on an execution agent, with the same read and write permission as over its API.

Allow an assistant's call for longer — 2026-10-26

New

• When an assistant's call waits for you, you can allow it once, for 1 hour, for 24 hours or always, for that one token or connector and within the limits your administrator sets. Before the passkey tap you see exactly what you allow.
• Each token's and connector's permissions page lists what it is allowed and until when, and lets you set an allow ahead or take one back.
• Administrators set, for each permission group, how far people may loosen it for their own tokens, under Users > Rules for everyone.

One passkey for every waiting move — 2026-10-26

New

• Approve now in the approvals window confirms every waiting credential move with one passkey tap; the statement lists each credential and where it may be sent.
• The user list has a Deactivate button next to Delete: the person is signed out and their tokens stop working until you activate them again. The last administrator can never be deactivated.
• Several Windows execution agents can run on one machine, each with its own port, and removing one keeps the publisher trust the others need.
• The relay stays responsive when a request body needs a deep check before it is sent.

Custody keeps every change — 2026-10-24

New

• Policy & Custody keeps every change that arrives at the same moment: two people signing in, a sign-in renewing itself while someone saves a connection, or an administrator's command beside the running service no longer lose one of them. A lost renewal had ended that person's connection, and they had to sign in again.
• A credential and the address it belongs to are released from one custody snapshot. Replacing a credential with pc.admin stops its release until Policy & Custody restarts.
• Personal OAuth connections stay bound to the app that issued them. Existing personal OAuth connections need to reconnect once on My Connections; a changed app can never receive an old refresh token.
• A newly paired execution agent becomes healthy without restarting Policy & Custody. Replacing its keys clears the old health proof until the new keys answer a probe.
• The manual pairing bundle includes the certificate name required by a composed execution agent, and the compose guide creates the custody master key safely before first startup.
• Encoded field names cannot disguise a request that changes its method; Policy & Custody and the execution agent both refuse it.

Inherit permissions, one Edit permissions page — 2026-10-23

New

• Every assistant and every token on My Tokens has an Inherit permissions box: ticked, it gets exactly what you are allowed to use and follows it as that changes; unticked, it uses its own settings, which are kept while it inherits. Claude and ChatGPT have it ticked by default. It replaces simple mode.
• One Edit permissions page for Claude, ChatGPT and your tokens, with Allow all, Read-only all and Clear for every system at once (also on Users → Permissions). What you choose on the consent screen when you connect an assistant is saved as that assistant's settings.
• A shared service account whose credential is kept in Policy & Custody (NetBird, Atlassian, Salesforce, Spaceship) can be granted again: its shared capabilities are no longer hidden on Users → Permissions and in the token pickers.

Fixes

• Where god mode gives an assistant or an inheriting token everything in the organisation, My Tokens, the user page and the Edit permissions page now say so, instead of what its own box says.
• Not you? Switch account on the consent screen now signs you out completely, so you can really choose another account.

NetBird Cloud and complete tool descriptions — 2026-10-22

New

• NetBird works with NetBird Cloud as well as a self-hosted server: a service user's access token passes the connection check and shows the NetBird account's domain, and an address that points at a web page instead of the API says what to fix.
• Every tool description and the server instructions fit within the 4,096-character limit AI clients such as Claude Code keep, with the critical-permission warnings always at the top.
• Execution agents now run generic HTTPS engine level 3, ready for integrations that send custom headers or non-JSON bodies while keeping credential redaction across UTF-8, UTF-16 and UTF-32 answers.

Every AI client gets in — 2026-10-22

New

• One AI token can no longer crowd out everyone else: when a token or an organisation has many idle connections open, the oldest idle one is closed to make room, so a new client gets in.
• An AI client whose sign-in has expired is told so and renews it, instead of staying connected without tools. Disabling a person or an organisation now also ends their open connections.

AI clients keep their tools — 2026-10-21

New

• AI clients that connect to your server directly, such as Claude Code, keep their connection and their tools: the connection no longer drops every few seconds.
• After you approve changes in the approvals window, the page shows the new state.

DocuWare: sign in with your AD account — 2026-10-21

New

• DocuWare integrations and My Connections offer a choice: sign in as a DocuWare user, or as an AD user with your Windows password. The password itself is never sent, only a proof over a checked certificate, and a wrong one is not tried again.
• A server address with a typo or a path now says what to fix.

Approve changes together — 2026-10-21

New

• Changes that need your passkey are saved and queued. A bar under the top menu says how many wait, and one window lists them all: remove any of them, or approve every permission and rule change with one passkey.
• The top menu stays visible while you scroll.

Adding an integration — 2026-10-20

New

• Adding an integration that runs only on the generic engine, such as DocuWare, offers your execution agents again.

Approval per permission group — 2026-10-20

New

• Each permission group can now always run or ask first, for your whole organisation: Users, Rules for everyone. Without a setting of its own, a group follows your organisation's rule.
• Critical permissions (deleting, creating credentials, power, mail routing, running scripts, backups, revealing secrets, admin rights) are marked, and your AI assistant is told which actions are critical or will ask first.
• AI tokens no longer carry their own approval setting: approvals are set per permission group and by your organisation's rule.
• When a system refuses a sign-in, the connection check says which credential to check, such as the email and password; a wrong password is tried at most twice before the credential waits until you enter it again.

Steadier passkey confirmations — 2026-10-19

New

• New integration: DocuWare on-premises, through a shared service account or each person's own DocuWare account; deleting and changing users or rights are separate opt-in permissions.
• Confirming a change with your passkey stays correct when two people confirm at the same time; any mismatch with Policy & Custody is shown on the integration's page.

More integrations on your execution agents — 2026-10-18

New

• REST/OpenAPI, GraphQL, GitLab, n8n and PAN-OS integrations now run on your execution agents.
• A change you approve now reliably goes through, even if someone changes permissions in between.
• Private keys never appear in answers from your integrations.
• When a MikroTik router cannot be reached or refuses the sign-in, the integration now says why and what to check.
• SSH connections to a host with a pinned key work again when the host has several kinds of keys.
• Saving an integration change that needs your passkey is one step now: "Save and confirm with passkey".
• Secrets such as BitLocker recovery keys and LAPS passwords stay hidden in Entra and Windows AD answers unless you hold the "Reveal secrets" permission.

Adding integrations — 2026-10-14

New

• Adding a MikroTik, SSH, Atlassian or Spaceship integration offers your execution agents again (they were all refused before anything could be typed).

Atlassian sign-ins and Jira search — 2026-10-14

New

• Jira search works again: Atlassian retired its old search API, and searches and Jira reports now use the new one.
• When an admin changes which Atlassian products an integration covers, people's next sign-in asks for exactly those permissions, Confluence search included. My Connections says when Atlassian granted less than was asked.
• GitHub Enterprise, Salesforce sandboxes and systems installed under a sub-path now work with their usual permissions instead of being refused.

Grandstream UCM — 2026-10-07

New

• Connect a Grandstream UCM phone system: read its status, SIP trunks, inbound and outbound routes, the inbound blacklist, extensions and live channels. Version 1 only reads; the PBX password stays in custody and its secret settings are never shown.

Proxmox Mail Gateway — 2026-10-06

New

• Connect a Proxmox Mail Gateway: quarantine, mail tracking, statistics, filter rules, mail configuration, the mail queue and node health, with read and write chosen per area for each person.
• The Approvals page now shows exactly what a waiting change would send.

One place for permissions, and an approval setting on every token — 2026-10-05

New

• A person's permissions are set in one place again: Users, then the person, then Permissions. The page shows for every system whether Policy & Custody allows it too, and proposes what is missing; a policy admin confirms it with a passkey.
• Every token, including the Claude and ChatGPT connectors, has its own approval setting: the organisation's rule, ask before risky actions, or ask before every change.
• The separate Policy page is gone; the organisation's rules are on the Users page.

SAP HANA queries run on your own execution agent — 2026-10-02

New

• SAP HANA databases can now be reached through an execution agent in your own network. The agent signs in to the database itself, so the service never holds the database password.
• Every HANA query is checked three times to be a single read-only SELECT, and runs in a read-only transaction.
• Long SSH commands, slow web requests and large HANA queries no longer time out early.

Connecting computers through a token-only execution agent is withdrawn for now — 2026-10-01

New

• Today's change that let a computer connect through an execution agent installed with nothing but its token has been withdrawn after a security review. It will come back in a safer form. Active Directory without a stored password stays.

Machines on your own execution agents, and Active Directory without a password — 2026-10-01

New

• A computer can now connect through an execution agent you installed with nothing but its token. It remembers that agent's certificate when it joins and accepts no other one afterwards.
• Active Directory can now run as the Windows account of the agent's service, ideally a managed service account. No AD password then needs to be stored anywhere, and the integration's page shows which account it ran as.

Changing a connection's address and credential works again — 2026-10-01

New

• Saving a new address and credential for a connection that runs on your execution agent no longer ends in an error page. If you saw that error today, save the connection once more.

SSH connections on an execution agent show their real status — 2026-10-01

New

• An SSH connection that runs on your organisation's execution agent is now checked by that agent, so its status says whether it really connects. Before, it always showed an error even though it worked.

The temporary agent on Linux checks what it downloads before running it — 2026-10-01

New

• Starting a temporary agent on Linux now uses a script from the product site. Before it runs anything it downloads, it checks that the download is our signed release, so a relay can no longer swap in a program of its own. My Connections shows the new line.

Signing in to a connected app returns you to your organisation's own address — 2026-10-01

New

• If your organisation signs in at its own address, signing in to a connected app (Atlassian, Microsoft and others) or with Microsoft now brings you back to that address. Before, it brought you to the main address, where you were not signed in, so you ended up on the sign-in page.
• The callback address shown for an app is now the address you are signed in at. Register that one on the app.

A temporary agent: let your assistant work on your own computer for a while — 2026-10-01

New

• My Connections can now start a temporary agent on one of your own computers. Choose whether your assistant may only look or may also run commands and write files, confirm with your passkey, and run the one line it shows on that computer within 15 minutes.
• It is yours alone: nobody else's assistant can use it. It runs in the window you started it in, and when you stop it - Ctrl+C or closing the window - it is removed and nothing stays installed.
• Adding a permanent machine now needs one of your organisation's policy admins.

Sign in with your own Atlassian or Microsoft account on an execution agent — 2026-10-01

New

• On an integration that runs on one of your execution agents, Authenticate on My Connections now signs you in through your tenant's Policy & Custody. It completes the sign-in with the app's secret, keeps your tokens, and renews them when they run out. The relay never sees them; each call your assistant makes receives a short-lived token for that call alone.
• Atlassian (Jira, Confluence, Service Management) and Microsoft Entra, signed in as yourself, work this way. An Entra integration whose people each sign in with their own account can now move to an execution agent.
• An integration's sign-in app moves into Policy & Custody together with its secret, and the address Policy & Custody sends that secret to can never be changed afterwards.

Connect your own account to an integration that runs on an execution agent — 2026-10-01

New

• When an integration runs on one of your execution agents, the API token you connect on My Connections now goes straight into your tenant's Policy & Custody, under your own name. The relay keeps only a note that you are connected, never the token.
• Your assistant's calls through that integration use your own account, and only yours: Policy & Custody decides whose credential a call may use from your own sign-in, so a call made for one person can never use another person's token.
• Disconnecting on My Connections removes your token from Policy & Custody as well.
• NetBird and Atlassian API tokens work this way first. Signing in with your own Atlassian or Microsoft account (OAuth) follows.

Decide what each person may do through Policy & Custody, and approve an assistant's call with your passkey — 2026-09-30

New

• Administration now has a Policy page. It shows what each person may do through your tenant's Policy & Custody, integration by integration and operation by operation, with the risk each operation carries, and whether a person has to approve operations before they run. You can change all of it there.
• Every change is confirmed with a policy admin's passkey, at Policy & Custody itself. The page shows you Policy & Custody's own description of the change before you confirm it, and your confirmation applies to that one change only. The relay you are talking to only carries the request: it cannot make a change on its own, and it keeps no copy.
• Your first policy admin is named once on Policy & Custody itself. After that, admins can add and remove each other from the page, and there is always at least one.
• When an assistant asks for something that needs a person - a critical operation, or any change when your policy asks a person for every change - it no longer simply fails. The request waits on the new Approvals page, showing exactly what will run and where. Approve it with your passkey and ask the assistant to try again: that one call then runs, once. The person whose assistant asked, or a policy admin, can approve it; anyone else cannot, and an approval never carries over to a different call.

Let an assistant use a real browser on one of your own machines — 2026-08-14

New

• You can now connect a Chrome or Chromium browser running on one of your connected machines, and have an assistant use it: open and read pages, take screenshots, fill in forms, click and scroll. Because it is a real browser on a real desktop rather than a hidden one, it stays signed in to the sites you have signed in to, and you can watch what it is doing and take over at any point. Nothing needs to be reachable from the internet — the machine's agent already dials out to the relay, and the browser is reached back down that same connection.
• By default everyone gets their OWN browser, not a shared one. The first time you use it, a browser is started for you with its own profile, so your logins, cookies and history are yours alone and are not visible to anyone else using the same machine. A shared browser is available too, as a separate permission that has to be granted deliberately — useful when a team genuinely wants one common signed-in session, and never something you end up in by accident. If you would rather run the browser yourself, you can point the connection at one you started, and it will attach to that instead.
• Reading pages, navigating, clicking and typing come with ordinary access. Running JavaScript and reading the browser's cookies are separate permissions that must be granted on purpose, and are never included when somebody is given full access to everything else — they are the two that amount to complete control of whatever the browser is signed in to. Cookie values are withheld from results unless explicitly asked for, because a cookie value is usually a live session. You can also restrict a connection to a list of sites, so an assistant can be confined to the places you intend it to go.

Add a connection and your assistants can use it straight away — 2026-08-13

New

• Add a second Proxmox cluster, another router, one more SSH host — and the assistants you have already connected can use it straight away. No reconnecting, no refreshing a connector, no restart. Until now they could not, and the reason was ours: the list of connections each tool would accept was published inside that tool's own description, which Claude and ChatGPT cache and do not re-read on their own. So a system you had just added appeared in the list of what you may use and was then refused by the tool itself — by the assistant's cached copy of the rules, before the request ever reached the server. Nothing you could do from the assistant's side helped, because the half that was already working was the half it could check. That list now lives on the server and is worked out fresh on every single request.
• The same change cuts the other way, and that matters more than the convenience: removing a connection, or taking away somebody's access to one, now takes effect at once. Previously it took effect whenever an assistant next happened to re-read its tools — which, for the same reason, might be a long time.
• Nothing about who may do what changed with it, and we checked the part that could have gone wrong before making the change. A connection you have no access to is refused exactly as before; an operation you may not perform on a connection you can reach is refused exactly as before; read-only access stays read-only. The rule simply moved to the server, where it is applied every time, instead of living in a copy an assistant made earlier. Connections shared with another relay through a server link are authorised by a separate path that never used the published list, and that is now held in place by a test — so if a future change ever routes them differently, it fails loudly rather than quietly weakening the boundary.

Fixes

• Parts of Microsoft Intune that only exist on Microsoft's “beta” interface are easier to find. The relay has been able to reach them for a while, but the tool description an assistant reads did not say so — so when one was asked for device-configuration policies it reported that the connection could not reach them at all, and that a permissions change would be needed. Neither was true. The description now says which parts live there and how to ask for them, and when Microsoft answers “resource not found for the segment” — its wording for asking the wrong interface, which reads as if the thing does not exist — the reply now adds what to do about it. Nothing about who may read what has changed.
• A container or VM you have just created is usable straight away. Access to Proxmox guests is granted per guest, and the list of guests came from a probe that runs on a timer — so a container created between two probes was refused to everyone, including someone with full access, for up to an hour. It read as a permissions fault and was not one: the guest simply was not in the list yet. Creating, cloning or deleting a guest now re-checks the cluster before the tool answers, and says so in its result. Deleting matters just as much as creating here — the same re-check is what withdraws access to a guest that no longer exists, and Proxmox reuses guest numbers, so leaving that until the next timer would let an old permission apply to whatever takes the number next. If the re-check itself fails the guest is still created and the result says so, rather than reporting a failure for work that already happened.
• Full-access mode now reaches Git repositories, as it always claimed to. Someone with it switched on could ask an assistant for Git access and be granted it without complaint, and then the clone or fetch itself answered “Git repository access is not granted”. The cause is worth stating because it was not a missing check but a duplicated one: the Git gateway resolved permissions through its own copy of the logic that decides what a person may reach, and only the other copy had ever been told about full-access mode. Both now share a single implementation, and a test refuses to let either grow its own again. Unchanged on purpose: a deliberately narrow key stays narrow — full-access mode widens what a person may reach, not what every key they ever issued does reach.
• The permissions screen no longer contradicts itself. Full-access mode is worked out fresh on every request and is never written into the permission grid, so the screen showed empty boxes for somebody who in fact held every capability in the organisation — it stated the opposite of the truth, and it cost a real debugging session that concluded the permission system was broken when it was working correctly. The user page and the permissions page now both say so plainly, in place, before the counts.

The server now says who read a stored secret — and a main server can see its installed relays — 2026-08-12

New

• You can now see who has been reading stored secrets, and — the part that mattered — what failed to decrypt. Until now nothing recorded it anywhere: a credential that stopped opening raised an error at whoever happened to ask for it, and no central place noticed, so “five connected systems stopped working overnight, did their credentials stop decrypting?” had no answer. Failures are now reported first and individually, each naming the key it needed. Ordinary use is counted rather than narrated, so the record stays readable instead of becoming a second copy of the access log.
• Every stored secret now has its own encryption key, and the master key only ever touches that. Nothing to configure and nothing changes for you today; what it buys is the ability to move the master key out of the server later — to a hardware security module, a key service, or a passphrase typed at start-up — because it now only has to wrap and unwrap a 44-byte key rather than decrypt every credential and message directly.
• A main server can finally see which of the relays installed from it are alive, what each is actually running, and which are behind. Until now it knew only what it had handed over — the version an installer last downloaded — which a failed install, a restored snapshot or a hand-upgrade all make wrong, and which said nothing about whether the server was still switched on. Each installation reports in every fifteen minutes with its version and a heartbeat. What it sends is deliberately short: facts about the software and counts, never names, addresses or anything about the people using it. A server with no main server says nothing at all, and any installation can be told to stop reporting.

Fixes

• A key rotation no longer leaves credentials behind. Rotation covered eight places secrets are stored and quietly missed five more — the enrolment token and agent credentials for linked servers, the login for an external delivery destination, a tenant's Microsoft sign-in secret, and shared service-account credentials on a connected system. It then reported success and told you the old key could be removed, at which point single sign-on, server-to-server links, delivery destinations and shared logins would all have stopped working. All five are now rotated, including the two that live inside JSON fields where no column-by-column search could have found them.
• A read grant on one SQL Server database no longer reaches instance-wide information. SQL Server exposes both per-database and server-wide catalogues under the same prefix, so someone granted access to a single database could list every login on the server and read its configuration — which the separate SQL Server inventory permission exists to control. Ordinary per-database metadata is unaffected.
• A single installed relay can no longer fill its main server's disk. The new check-in accepted any identifier a caller invented and stored a row for each; there is now a limit per install token. Servers already known keep reporting normally — the limit refuses new registrations rather than removing existing ones, so nobody can push a real server out of the list by registering noise.

Microsoft SQL Server, and an access log that says what each request actually did — 2026-08-11

New

• The master encryption key can now be changed. Until today it could not: every stored secret — the credentials for your connected systems, agent enrolment, what assistants exchanged, the server's own logins — was encrypted with one key and nothing recorded which key, so changing it silently made all of them unreadable. Each secret now carries the identity of the key that sealed it and the server can hold a retired key for reading, which turns a key change into ordinary maintenance: add the new key, run one command to re-seal everything, then drop the old one once the server confirms nothing is left on it. Nothing to do on upgrade, and a secret the server cannot read is reported and left untouched rather than overwritten.
• A simpler mode for a server that hosts a single organisation. Turn it on and the tenant machinery disappears — no tenant list, no name registry, no “which company are you with?” step at sign-in. It is one switch on the same build rather than a separate edition, it changes presentation only (every record stays scoped exactly as before), it can be turned back off, and if the server does have more than one organisation it politely refuses instead of hiding one.
• Microsoft SQL Server is now a connected system. It signs in with a SQL login or with a Windows “DOMAIN\\user” account, over an encrypted connection by default, and either directly or through an agent on your network. What it can do is bounded by what that login can do, and then narrowed by you: permissions are granted one database at a time, with an optional list of the only databases the integration may touch at all. Assistants can list tables and views, describe a table in full (columns, types, defaults, indexes, keys, triggers), check a database's health — space, transaction log, last backup, current blocking — and run bounded read-only queries with safely bound parameters. Running arbitrary T-SQL is possible but takes two separate permissions plus a confirmation on every call. ⚠️ This is a first release with no live-server testing behind it, so point it at something unimportant before anything that matters.
• The MCP access log now records the OPERATION, not just the tool. Because every connected system answers on a single tool now, the log had become a wall of identical lines: reading a user and rewriting a Group Policy both appeared as “winad_call”. There is now an Operation column showing the operation and the system it ran against, the search box finds both, and every row opens a detail panel with the full request: who, from where, which AI token, the result, how long it took, and the request's arguments.
• Arguments are protected before they are stored, not when they are shown. Anything that looks like a credential — by its name, or by its shape inside a command line, a URL or a connection string — is replaced before it reaches the database, and file contents are not kept at all. A new switch in Administration → Settings → Data retention (“Record what each AI request asked for”) turns argument recording off entirely; the operation and the target are always kept, since those are what make the log readable.
• Eleven more systems can be turned into a saved report or a scheduled export by an assistant. Until now only SAP HANA, Salesforce, Atlassian and cross-system queries could be set up that way; VMware vSphere, Active Directory, Microsoft Graph, NetBird, Portainer, Action1, Darktrace, PRTG, PAN-OS, UniFi and the relay's own data had to be done by hand in the web interface. “Put the estate's VM snapshots on a weekly schedule and feed it to Excel” is now a request an assistant can carry out end to end.
• A newly added system, and a newly discovered capability, reach connected assistants immediately instead of after the next hourly check. And an assistant can now ask one system to re-check what it offers (“Refresh”), which is what you want right after changing something at the far end. A capability that appears this way still has to be granted to somebody before it can be used.

Fixes

• A failed check of a system no longer erases what that system can do. If a certificate had expired or a host was briefly unreachable, every capability disappeared from the permission screen — and every tool that depended on it — until a later check succeeded. A temporary fault is not a reason to forget. The last known capabilities are kept and the error is shown beside them.
• VMware snapshot sizes were reported as zero, and a virtual machine's suspended memory image was not counted at all, so a snapshot holding 16 GB looked free. Both are now measured.
• Several pieces of styling that had never actually rendered now do, including a warning on the installer page that was never coloured as one. The new request-detail panel is drawn in the interface's own colours rather than a light-theme fallback.
• Security hardening in the reporting and VMware integrations, found by an automated review of the same day's changes and fixed before release: authoring a saved query can no longer reach an operation the author is not permitted to run, and a malformed response from a VMware server is refused rather than parsed.

One standard shape for every integration, a governed Git gateway, and much more of VMware — 2026-08-10

New

• Every connected system now works the same way: one tool per system that takes the target, the operation and its arguments, plus a companion that explains any operation in full. This replaces one tool per operation — on a busy server that was around 230 tools, now about 83 — which makes assistants faster and considerably less likely to pick the wrong thing. ⚠️ Tool NAMES changed as a result. Nothing was removed: every operation still exists, as a choice on its system's tool. Any assistant instructions of your own that name old tools should be refreshed.
• GitHub and GitLab can now be reached through the relay as ordinary Git over HTTPS — clone, fetch and push with the tools you already use, while the actual account token stays encrypted on the server and is never handed out. Access is granted per repository.
• VMware vSphere gained most of what it was missing. Reading a virtual machine now includes its snapshots; there is an estate-wide snapshot sweep that shows every snapshot with its age and the disk it is holding; and the older, deeper VMware API is available for the things the modern one simply does not expose — alarms, virtual-machine notes, disk layout, and the vCenter event log (who powered off, deleted, reconfigured or signed in). Broad read-only and write permissions for the whole API are available as separate, deliberate grants.
• Microsoft Graph requests can now target Microsoft's beta API, which is where much of Intune still lives — including the Settings Catalog.
• A superadmin can give one person every permission in their tenant with a single switch, instead of ticking capabilities one by one. It resolves live, so a system added tomorrow is included, and setting or clearing it is recorded in the change log.
• An optional setting publishes every kind of integration to assistants, so the tool list stops changing shape as systems come and go. Off by default.

Fixes

• Deleting a person now deletes their workspace documents with them, instead of leaving them behind counting against nobody's allowance. Databases that already had orphaned documents are repaired on upgrade.
• The Git client tools shipped with a server release now actually arrive on the machine.

Workspaces become projects, your assistants' conversations are readable, and fewer tools to choose from — 2026-08-09

New

• My Workspace is now made of PROJECTS. Each person can keep as many named projects as they like, every document is versioned with a note about what changed, and a project can be shared with colleagues as a whole rather than a document at a time.
• A new My AI-to-AI page shows the conversations your assistants have had with each other, including anything they exchanged as a file, so a workflow you set up between two assistants is something you can actually read afterwards.
• The number of tools an assistant has to choose between dropped sharply: the relay's own reporting, workspace and inventory tools were grouped behind one entry point each, and connected machines went from six tools per machine to six in total, with the machine named as an argument. Same capabilities, far less noise — but the NAMES changed, so refresh any instructions of your own that mention them.
• Creating a document in My Workspace no longer requires an assistant — you can do it in the browser.

Fixes

• The connector screens no longer disagree with what a connector can actually do; what is shown is what the server will allow.
• Two Group Policy safety fixes: a per-change preview flag can no longer be overridden by the surrounding request, and reading Resultant Set of Policy now requires write-level Group Policy permission, since it discloses effective settings across a whole machine or user.

Assistants can talk to each other, tenants can be inventoried, and Group Policy editing goes further — 2026-08-08

New

• Two assistants connected to the relay can now exchange messages and files with each other, under a permission that is off until you grant it. Everything they exchange is encrypted at rest and readable by the people involved.
• A read-only inventory of your own tenant is available to assistants: the people, the connected systems, the AI tokens and each person's effective permissions. No secrets of any kind are included, and it is off until granted.
• Group Policy editing gained batched content changes — several settings in one reviewed operation — along with modern Advanced Audit Policy, legacy audit settings, and restricted group membership. Every one of them previews before it writes, and every write is recorded in the change log with the person who made it.
• A linked server can now be unlinked from either side, without needing someone on the other end.

Fixes

• A batch of security hardening from an automated review, and a new internal guarantee that every privileged action in the web interface sits behind the sign-in and two-factor gate — checked automatically from now on, so a new page cannot quietly miss it.

Group Policy: two new permissions, and every directory change is now in the change log — 2026-08-07

New

• Permissions for Group Policy are now three separate decisions instead of one. “Group Policy” still covers policy content — settings, links, status. Two new permissions sit beside it and must be granted in addition to it: “Group Policy SECURITY” for a policy's permissions and security filtering, local Users and Groups membership, and user-rights assignment; and “Group Policy EXECUTION” for scripts, scheduled tasks and services. Both are withheld by default and are never included in a full-access grant, because they decide who becomes an administrator and what runs as SYSTEM on every machine a policy applies to.
• Importing a backed-up policy now requires both of those new permissions as well. A backup is a complete policy, so importing one can set security filtering, local administrator membership and startup scripts in a single step — which is exactly what the two new permissions protect. If you import policies, ask your administrator to grant them.

Fixes

• Every change made to Active Directory or Group Policy through this server is now recorded in the change log — who did it, which policy or object, and whether it was a preview or a real change. Attempts that were refused are recorded too. Nothing was recorded before, because the change log only tracked changes to the server's own data.
• Changes made by an AI assistant are now attributed to the person whose access it used. They previously appeared in the change log as “system”, with no name at all — only changes made through the web interface were attributed. Changes reaching this server from another paired server are labelled as such.

Better emails, and the sign-in page remembers where you were going — 2026-08-06

Fixes

• The email you get when an account is created for you (and the invitation email) were still branded with the old product name, were labelled with the server's internal Linux hostname instead of its real address, described “AI access tokens” rather than simply managing your account, and had no link to the help pages. All rewritten — and the old product name is gone from every other message too, including the password reset, the verification code, the token email and the agent/export notifications.
• Links in emails now sit behind a button or wording like “Set your password” instead of being pasted as a raw address. If your mail system rewrites links for safety (Microsoft SafeLinks and similar), that rewriting is no longer visible to the reader.
• Opening a link to a specific page while signed out took you to the sign-in page — correct — but afterwards dropped you on the home page. You now continue to the page you originally asked for, whether you sign in with a password, a passkey or Microsoft.
• Cancelling a Microsoft sign-in came back to a sign-in page that had lost its passkey and Microsoft buttons (and so did a mistyped password). All sign-in options are always shown now.
• The old product name also appeared in the passkey prompt your browser shows and as the account name in authenticator apps. Both now say Any2MCP. Existing passkeys and existing 2FA codes keep working unchanged — authenticator apps will show the new name for newly added accounts.

Fixes from a full review of yesterday's interface work — 2026-08-06

Fixes

• Seven pages showed a broken “back” link that displayed template code instead of the name of the page it returns to — Remove agent, Proxmox targets, SSH keypair, Edit token access, permissions, delete user and issue token. All fixed, and the test that missed it now checks the rendered page rather than the source.
• The “Terms of Service” link beside the sign-up consent checkbox was broken on every server except the main one — as were “Contact us” on the Help page and “Privacy Policy” in Global Settings. They now open the product's own pages.
• A table wider than the window was cut off with no way to scroll to the last columns. Tables now scroll inside their panel at any window size.
• The menu bar on the public pages was set to stay at the top of the screen while scrolling and never did.
• Mistyping a URL showed a bare error line instead of a proper page with the header, footer and a way back.
• The sign-up page now looks like the sign-in page — same centred card — and headings are one consistent size across the whole app, so a password reset no longer changes heading size from step to step.
• “+ New” buttons in the Reporting section were in three different places depending on the tab; they are all above the list now. Delete buttons had three different looks, one of them plain grey; they all use the same red style. Status messages use the theme's colours, so a colour change applies to them too.
• An administrator could accidentally erase someone's display name by saving a blank one.
• On the sign-in page, Overview, How it works and Integrations now open the any2mcp.com website they belong to; What's new and Contact continue to open the product's own pages.

A way back from every page, and a cleaner sign-in screen — 2026-08-05

New

• Every page you reach by clicking into something — a user, a group, a permission set, an integration, a query, a scheduled export — now has the same “← back” link in the same place, top left above the title. It always returns to the list you came from.
• The footer now spans the full width of the window like the top bar, and it sits at the bottom of the screen even on a short page instead of floating in the middle.
• The sign-in page is now the start page: opening the server's address takes you straight to the login form. (This used to be an option in Global Settings; it is simply how it works now. Signed-in users still go to their own home page.)
• The header now says who is signed in — “Account (Your Name)” in the top right — which matters on a server several people share.

Fixes

• The sign-in page is back to its normal width and no longer scrolls when everything fits on the screen — both were side effects of pinning the footer to the bottom. The sign-in box itself is a little wider now, matching the form width used everywhere else.
• The pre-login page carried a menu of product and marketing links that belonged on the any2mcp.com website, plus copies of the Support, Contact, Terms, Privacy and About pages that nobody maintained per server. Those pages are now served in one place, and the sign-in screen shows only what your server can actually do: sign in, and — if self-registration is enabled — create an account. Everything else is in the Help section once you are signed in.
• What's new stays on your own server, so it lists what this server actually runs, and now links to the newest release notes as well — useful when a server is deliberately a version behind.
• The menu on the sign-in page is the same on every server now: Overview, How it works, Integrations, What's new and Contact, all pointing at the product's own pages, plus your own Login and Create account. The Support page has been retired — what it described is covered properly in the Help section and on the Installer page.

One consistent page layout across the whole admin UI — 2026-08-05

New

• Every page now follows the same small set of patterns instead of its own. Pages whose content is a table — or a query editor — use the full width of your screen; every other page uses one comfortable reading column; and sign-in style screens stay a centred card. Panels always fill their column, and it is the input fields that are kept to a readable length rather than the boxes around them.
• In practice: the agent Manage page, Change password, the group and permission-set forms, the user and integration pages and the confirm screens no longer sit in a narrow 600-pixel column — they look like the rest of the app and their tables finally have room. My Connections and the Help pages use the reading column, since cards and prose gain nothing from extra width. The query, cross-integration query and dashboard editors gained the full width instead.

Lists now use the whole screen — 2026-08-05

New

• Pages whose content is a table — users, tokens, integrations, agents, logs, queries, scheduled exports, dashboards, permission sets and the rest — now widen with your screen instead of stopping at a fixed column. On a large monitor that is roughly 500 more pixels of table and a lot less empty margin. Reading pages (help articles, settings, detail and edit forms) deliberately keep their narrower column: a line of text that runs the full width of a wide monitor is harder to read, not easier.
• Two more pages joined them after a second look: Security and My tokens were still using the narrower column although they show tables like the rest of the Administration section. (The agent Manage page stays narrow on purpose — it is a single-item edit page, built from narrow panels, so extra width would only leave empty space beside them.)

Scheduled exports made by a report maker now actually run — 2026-08-05

Fixes

• A scheduled export set up by someone with the report-maker permission now runs. If they were not an administrator, every run — and every “Run now” — was refused with “job owner no longer authorized for this report”, and no permission you could grant would have fixed it: the check was looking for the report-maker permission on the data system (Salesforce, Atlassian, Microsoft 365, …) instead of where it is actually granted. Authoring and running by hand always worked, which is why this only showed up on the schedule. Scheduling now requires exactly what authoring requires: the report-maker permission, plus permission to read that system — including, for Salesforce, the shared service account a saved report runs as.
• A permission set can now grant a shared service account, not only someone's personal access. Building a Salesforce permission set previously offered the private options only, so “use the shared company account, read-only” could not be handed out through a set. Note that the shared account must also be connected on the integration itself before such a grant does anything.
• The Reporting section's tabs now line up. Queries was rendering in a narrower column than Scheduled exports, Dashboards and Delivery destinations, and the four tab bars disagreed about which tabs to offer someone who is a report maker but not an administrator — two of them led to pages that simply bounced them back.

Fewer surprise e-mails, and a tidier connections page — 2026-08-05

Fixes

• The “your AI token was used for the first time” e-mail no longer fires every time an assistant quietly reconnects. Claude and ChatGPT refresh their access roughly once a day, and each refresh was being read as a brand-new connection. You now get that message once, when a connector is genuinely first used — which is what it was always meant to tell you.
• My Connections now shows only the systems you actually have permission to use. Someone who can use Salesforce but nothing else no longer sees Atlassian, Microsoft or anything else offered for them to connect — connecting an account you can’t call anything with was only confusing.

Manage Windows Active Directory, Group Policy and DNS — 2026-08-03

New

• A new set of tools lets an assistant work with your Windows domain through one connected agent: look up and manage users, groups and computers; read the directory’s structure and health; inspect Group Policy and where it applies; and manage DNS zones and records. Reading and changing are always granted separately.
• The dangerous things are gated. Deleting a directory object needs its own explicit permission; moving or deleting the containers the domain itself depends on is refused; and a DNS server can only be chosen from a list you configure, never named freely by the assistant.
• You can point these at a dedicated domain account, so the assistant acts as that account rather than as the machine it runs on.

Simpler permissions: one row for read and write — 2026-08-03

New

• Where a system used to have two separate permission lines — one to read, one to change — there is now a single row with a Read and a Write box. Nothing about who can do what has changed; it is just less to scan and harder to get wrong. “Look but don’t touch” is still simply ticking Read on its own.

Home Assistant, and UniFi networks, end to end — 2026-08-02

New

• The Home Assistant connection could previously only read states and call one service. It now covers the whole instance — areas, devices, the entity registry, automations and their traces, history and long-term statistics, helpers, and (opt-in) users, add-ons and backups. The everyday “control devices” grant deliberately leaves out locks, alarms and anything that runs arbitrary configured actions.
• UniFi network management now works properly: a full read across sites, devices and clients, plus restarting a device, blocking or reconnecting a client, and turning a wireless network on or off. Passphrases and other secrets stay out of the results unless you grant them explicitly.

Connect an assistant without handing over your permissions — 2026-08-02

New

• You can now let someone sign in and connect their own assistant while you keep control of what that assistant may do. “May sign in” and “may manage access tokens” are separate permissions, so “you connect it, I decide what it can reach” is finally something you can express.
• Sensitive actions — resetting multi-factor, enrolling a passkey, removing an integration — now ask you to re-authenticate with your strongest method first, even when you are already signed in.
• If you deploy servers, you can approve a server’s request to have its connections relayed through here, from the My Servers page.

Send reports and dashboards where your team already works — 2026-08-01

New

• Saved reports and dashboards can now be delivered automatically by e-mail, or into SharePoint, OneDrive, or a synced folder — which also covers consumer OneDrive, Dropbox or Google Drive with no app setup at all. Reports can carry attachments, and a dashboard can go out as a single self-contained web page.
• Every system that holds data of its own — not just the databases — can now be turned into a saved query, put on a schedule, exported as CSV for Power BI or Excel, or shown on a dashboard.
• E-mail delivery can be limited to recipient domains you allow — set for the whole organisation, and optionally narrowed further per team.

Reporting, rebuilt around clearer permissions — 2026-07-29

New

• Building and running saved queries, exports, schedules and dashboards now lives under one “Local permissions” area, with clear control over who may manage each one.
• A single pair of tools now covers every saved query, and a query can state which identity it runs as — so the same report behaves predictably whoever triggers it.
• The relay can reach your machines over SSH itself, tunnelled through the connected agent, so a host you can already reach needs nothing extra installed to run a command or a script.

The Installer tab is now My Servers — 2026-07-28

New

• If you deploy servers, the tab you did it from is now called My Servers and sits next to My Tokens and My Connections. "Installer" was the name of the permission you need, not of what the page shows — which is your own install tokens and the servers you deployed with them. Your existing bookmarks still work.
• More is coming to that page: the servers you installed, their status, and approving a server's request to have its connections relayed through here.

Your organisation gets its own address — 2026-07-28

New

• Your organisation can now have its own web address — something like acme.my.any2mcp.com — instead of sharing ours. The sign-in page there says whose it is, and the name is yours: nobody else can take it, either as a hosted organisation or as a server you run yourself later.
• Renaming is allowed, and the old name is parked for a while afterwards so it cannot be handed to anyone else while your links and bookmarks are still catching up.
• Before you change an address, a read-only report shows exactly what depends on it: which assistant connections have to be re-approved, which reply URLs you have to edit at Microsoft or Atlassian, which machines point at the old hostname. You can download it as a checklist. Running it changes nothing, so it is also just a good way to find out what would be affected.
• If you only know your organisation's name, "My organisation has its own address" on the sign-in page now takes you to the right server.
• Your AI clients can keep using one well-known endpoint even when your own server lives somewhere else — including a server on your own hardware, whose requests are passed through to it. Your own server still checks the token and records the call: nothing about who may do what moves off it.
• The endpoint URL to give an AI client is now printed where you copy the token, instead of leaving you to work it out.

A shorter, clearer tool list for your AI — 2026-07-27

New

• Systems you connect more than once — several Proxmox clusters, or a handful of MikroTik routers — no longer flood the assistant with near-identical tools. Each one now offers a single tool listing the operations you are actually allowed to run, which makes it far less likely to act on the wrong cluster or the wrong router.
• Tools that could act either as you or as a shared company account used to appear twice, and which identity you got depended on spotting a “_shared” suffix. There is now one tool with an “act as” choice — and it only appears when you genuinely hold both identities, so in the normal case there is nothing to choose and nothing to get wrong.
• When you do hold both, the assistant must state which account it is using before it acts. Acting as a shared service account is never a silent default.

Connecting an assistant now shows who is being connected — 2026-07-27

New

• The approval screen for Claude and ChatGPT names the account the connector will act as — the person, their login and e-mail — instead of leaving you to assume. The connector ends up acting as that person, so it should say so.
• A “Not you? Switch account” button signs you out and returns to the same approval screen, so if you are signed in as the wrong account you can change it without starting the whole connection over in the assistant.

Sharper permissions for shared service accounts — 2026-07-27

New

• Salesforce shared-account access can now be granted per object, exactly like a person's own access — “the service account may read Opportunity” rather than only “everything or nothing”. Every other integration already worked this way; Salesforce was the exception.
• The permissions page no longer disagrees with itself: the number next to an integration counts the rows actually shown, and when a section is hidden it now says why — for example, that the person has not connected their own account yet, so what their login can reach is not yet known.
• Capabilities that are already granted are never hidden, whatever the connection state.

Groups — 2026-07-24

New

• New Groups page (Administration → Groups): collect people into a group once, then grant them permission sets and share reports & dashboards in one place — instead of setting access person-by-person.
• Members inherit the group's permission sets live, and a group can be given access to specific dashboards or exports.
• Membership is managed by hand and can optionally mirror a Microsoft Entra group, so the right people are included automatically when they sign in with Microsoft.
• A “Verify name” button next to every Entra-group field (Groups, delivery destinations, and Microsoft sign-in) checks the name against Microsoft live — so a typo can’t silently lock people out.

A clearer Help section — 2026-07-24

New

• Reworked Help: one hub of short, focused how-to articles — connecting Claude or ChatGPT, installing agents, integrations, reporting & dashboards, and administration — now available to everyone who signs in, not just admins.
• Little “i” help links next to the relevant screens jump straight to the matching article.
• Dashboards load faster: the page is cached and only rebuilt when its data or layout changes.

Report delivery, ownership & alerts — 2026-07-23

New

• Delivery destinations: one place to say where a report or dashboard is served or uploaded (SFTP, WebDAV or SMB) — with a shared access policy, so a single login or IP allowlist can open many files.
• Pick exactly who can open each export or dashboard with simple checkboxes: public, an IP allowlist, a username + password, or signed-in users of your organisation (optionally limited to a Microsoft Entra group).
• Ownership you can transfer: reports, scheduled exports, dashboards and agents each have an owner an admin can reassign.
• Optional email alerts when one of your exports, dashboards or agents has a problem — immediately, or as one daily morning summary.
• Link two relay servers together so one can securely use the other's integrations (superadmin).

Dashboards, cross-system reports & easy connectors — 2026-07-22

New

• Cross-integration reports: join data from several systems — e.g. Salesforce pipeline vs. SAP backlog — into one shareable, scheduled report.
• Live HTML dashboards built from your saved reports and served by the relay.
• Permission sets: named, reusable bundles of access you can assign to people instead of ticking boxes each time.
• Connect Claude and ChatGPT with a per-person sign-in (OAuth) — separate read and write toggles, and one-click disconnect.
• New integration: n8n workflow automation.
• New Administration → Security page, with IP access controls for the admin console and the AI endpoint.

Sign in with Microsoft + Salesforce — 2026-07-21

New

• Single sign-on: users can sign in with their Microsoft (Entra) account. Mix Microsoft sign-in and local password + two-factor per person, optionally gated to a Microsoft group.
• New Salesforce integration: query and update (SOQL) as each signed-in user or a shared account, with saved shareable reports and Power BI exports.

Per-person Microsoft access — 2026-07-20

New

• Microsoft Entra / Graph can now act as each signed-in user, so everyone works with their own permissions rather than a single shared identity.

Fixes

• Reliability and security fixes, including keeping long-running Windows agents connected.

Faster SAP setup & Jira / Confluence — 2026-07-19

New

• SAP HANA quick setup: tick business-area module packs (Financials, Sales, Inventory, …) or auto-discover and classify the tables a user may query — no more hand-typing patterns.
• Atlassian Jira & Confluence: read and write as each signed-in user, plus organisation admin tools.

Fixes

• Security hardening of the SAP query guard and several smaller fixes, following an external code review.

Reporting, data scoping & support tooling — 2026-07-18

New

• Reporting server: turn saved SAP reports into scheduled CSV exports that Power BI, Excel or any BI tool can pull directly over HTTPS, each with its own access credentials.
• Query categories for SAP: limit which tables a user may query, grouped by business area.
• Opt-in remote debugging: temporarily let support connect to help diagnose a problem (off by default, time-limited).
• A reporting server can now run on the same host as the main server, and installs/uninstalls independently.
• A "What's new" page on the site so you can see recent updates at a glance.

Fixes

• Reliability, connectivity and installer fixes across reporting and integrations.
• Security hardening of report and integration permissions, following an external code review — tighter checks on who can author reports, how many rows shared reports return, and where stored integration credentials may be sent.

SAP report maker & user-scoped integrations — 2026-07-17

New

• Report maker: build reusable, parameterized read-only SAP reports and share specific reports with the people who need them.
• Microsoft Entra / Graph and the new Jira & Confluence integration can now act as the signed-in user — each person works with their own access.
• Per-integration help pages so each integration explains how to set it up and what it can do.

SAP HANA, SharePoint & themes — 2026-07-16

New

• New SAP HANA integration: read-only reporting over a secure in-network tunnel, including SAP CDS views.
• SharePoint access with a curated allowlist (scope it to specific sites or folders) as part of the Microsoft integration.
• Selectable colour themes for the whole interface (Global Settings → Appearance).

On-prem Windows management & one-command install — 2026-07-15

New

• Unified Windows Active Directory & Group Policy integration: manage users, groups and GPOs through a Windows agent.
• One-command standalone server installer for Debian/Ubuntu, plus copy-paste update & uninstall commands per agent.
• Proxmox: create and remove containers.
• Owner and installer roles with a central main-server hub for larger setups.

Fixes

• Installer, agent update/uninstall and integration-routing fixes.

More integrations & abuse protection — 2026-07-14

New

• New integrations: NGINX Proxy Manager, on-prem Active Directory, and Group Policy.
• Automated brute-force IP blocking, via NGINX Proxy Manager or an on-host firewall.
• Clearer setup errors: missing prerequisites now include a copy-paste install command.

Fixes

• Fixes to integration add/edit/refresh and IP-block ordering.

Connect any API + editable access — 2026-07-13

New

• Generic REST (OpenAPI) and GraphQL integrations — connect virtually any HTTP API.
• Edit an AI token's or connection's access at any time from My Tokens.
• First-use email alert the first time each token or connector is used — an early warning if one leaks.

Accounts, sign-in security & first integrations — 2026-07-12

New

• First integrations: Google Workspace, MikroTik, Darktrace and Palo Alto.
• Passkeys (WebAuthn), mandatory two-factor sign-in, forgot-password, and self-service accounts.
• Connect from Claude's built-in "Add custom connector" (OAuth), with a consent-time scope picker.
• New admin System dashboard, public Terms & Privacy pages, and a high-contrast theme.

The foundation — 2026-07-10

New

• Multi-tenant workspaces, self-registration, and sign-in by email.
• Dial-out agents that connect out over a secure channel — no inbound ports, works behind NAT and firewalls.
• Fine-grained, per-capability access control over exactly what each AI token may do.
• Ephemeral "portable" clients you can start on any machine via an email-confirmed token.