What shipped, and when. Everything here is live. Newest first.
Pro is the team plan
Platform
Pro now includes the controls a team needs. Admins get the People page with invitations, person pages, and Adoption; teams with their own members; access rules by team and person; approval floors for each team; Team setups with bundles and workflows; workspace Activity with CSV and JSONL export; and the alerts bell and each app's tool history, so you see when an app's tools change. Enterprise keeps the company-wide controls: SSO, SCIM, SIEM and OTLP streaming with alert webhooks, custom guardrails and Runtime Security, Inventory with passport discover, and catalog review and rollout. Prices are unchanged. Nothing you set up is deleted when a plan changes: settings that need a higher plan are kept and apply again when that plan returns.
Free is for one person, with unlimited apps
Platform
Free now covers one person with no app limit, and up to 3 automations for scripts and CI that no longer use a person's place. Pro at $15 per member per month is the plan for bringing your team, with the same apps and rules in every agent. Nothing changes for workspaces already on Free: they keep room for 5 people, now with unlimited apps too. No one is removed or signed out by this change, and a workspace with more people than its plan allows keeps all of them; only new people wait for an upgrade.
Workspace approval defaults
Platform
Two things that were hard-coded or personal are now workspace settings. An admin can choose what an interactive agent gets while someone is deciding: hold the call for up to 55 seconds, which is what lets an in-agent prompt release the original call, or return pending at once so the agent retries. And safety brakes now have an admin default: set the least strict Write and Destructive setting people on a team may choose, for all teams or one team at a time. It is a floor, not a choice made for them. Someone whose team floor is Ask sees Allow disabled and can still pick Never, their own stricter preference always wins, and the preference they had is kept, so lowering the floor later gives it straight back.
See the command-line tools your agents reach for
Platform
Agents do plenty of work in a shell that never passes through Passport: gh pr create, git push, railway up, kubectl delete. Run passport hook install --client claude-code --apply and Claude Code reports each one into the same Activity log as everything else, as a row naming the tool, a coarse verb, and whether it was a read, a write, or something destructive. The hook only watches: it never blocks a command, never answers a permission question, and never holds your agent up. It reads the command on your own machine and sends none of it. Not the command line, not its arguments, not its output, not your folder path, and nothing from your environment. Commands it genuinely cannot read, such as a script file or a make target, are recorded as opaque with the shape they took and nothing more.
Discover runs from the passport discover command
Platform
Discover findings now reach Passport from the passport discover command, which is headless, cross-platform, and made for an onboarding script or a scheduled MDM job, and which exits 5 when a managed policy reports a violation. Nothing about what a scan reports changed, and no member has to open anything for their computer to be counted.
Import an OpenAPI spec as a governed app
Platform
Plenty of company systems have an OpenAPI spec and no MCP server. An admin can now paste a spec address or the document itself, review the exact tool list Passport derived (name, method and path, action class, and everything it skipped and why) and add it as an app. Imported tools are ordinary tools: the same passes, per-tool switches, action classes, approvals, guardrails, Activity, and audit trail, on every surface. Action classes come from the HTTP method and a spec can only raise them, never lower them. Every tool is pinned to the reviewed address, credentials stay encrypted and out of tool arguments, and an app imported by address can be re-read later with a full drift record.
Approve an action without leaving your agent
Gateway
When your Safety preference asks about a write or destructive action, Passport now puts the question inside the agent you are already using, on agents that support MCP elicitation. The prompt names the app, the action and its risk class, the account, and a redacted one-line argument summary, and offers approve once, approve for one hour, or deny. Nothing changed for agents that cannot show a prompt: the same approval waits in Passport, and the CLI keeps its explicit pending result. Approvals and Activity now record where consent was collected and which agent install answered.
Every agent has an owner, and an owner's decision follows them
Gateway
An agent key is now a credential a person owns rather than an identity of its own. The owner's Safety choices govern the agent: a call that needs consent returns a pending result and waits in the owner's Approvals queue, where the row names the agent that asked, and a decision is bound to that agent so it can never release another one's call. Keys rotate in place: a replacement is shown once, the agent and its Activity stay put, and no seat is used. Deleting an agent's last key retires it. Deactivating, removing, or signing out a person now revokes every agent key they own, and the gateway refuses a key whose owner is no longer active.
Dynamic MCP clients appear by name
Gateway
Passport now reads standard MCP agent identity metadata and carries the reported name and version into agents, Activity, approvals, and exports instead of showing a generic agent. Reported identity is clearly treated as context: registered-agent policy still relies on the Passport credential, so a claimed name cannot grant access.
Agents can guide you through app sign-in without seeing credentials
Gateway
When an app is not connected or its sign-in expires, Passport now gives the agent a secure Connect or Reconnect action for the right person. Agents with URL interaction support can show it natively; others receive a clear Passport link and retry guidance. Delegated agents can hand the link to their fixed human, while autonomous agents remain unable to create identity-ambiguous sign-ins.
Passport Discover finds direct MCP connections and helps bring them under control
Platform
Passport can now scan supported local agent configuration with explicit consent, group the MCP configurations it finds, capture owner-provided purpose, and guide safe migration behind Passport. Enterprise admins get a privacy-minimized action queue with reporting coverage, approval, migration, and removal decisions; members can execute requested removal locally with an exact backup and sibling-entry verification. Configured does not mean used: the product labels that distinction and retains findings through scan failures.
A focused personal product, with Enterprise controls when needed
Platform
Free and Pro now open into a streamlined Apps, agents, Activity, safety, and setup experience. Enterprise admins keep that same personal workflow and get a separate workspace control plane for catalog policy, people and teams, agent fleet rules, guardrails, SSO, SCIM, and SIEM. Plan enforcement lives on the server, so a downgrade retains configuration without leaving Enterprise controls active.
OAuth clients can register with CIMD or DCR
Gateway
Passport now publishes and consumes Client ID Metadata Documents for secretless OAuth client identity, while retaining Dynamic Client Registration and pre-registered client fallbacks. Redirects, metadata fetches, callback state, and plan/config changes are validated fail-closed before credentials or authorization codes leave Passport.
Passport CLI becomes a first-class governed agent
Gateway
Terminal agents and CI now get a production CLI for login, namespaced discovery, governed calls, connections, resources, and prompts through the same policy and audit pipeline as MCP. The signed-in web app includes a four-step activation path and full CLI setup; doctor, shell completion, deterministic JSON, and verified package checks round out the operator experience.
Catalog trust signals show the evidence behind them
Catalog
Member and admin catalog cards now distinguish official-registry identity, dated point-in-time MCP verification, credential or vendor gates, reviewed permission examples, and observable definition scans. An offline registry canary validates every committed entry without pretending a weekly probe is continuous uptime.
Fail-closed sign-in and recurring resilience drills
Security
Production deployments with email verification disabled are now provider-only: typing an address can never mint a session or workspace. CI enforces the auth and response-header posture, while scheduled drills exercise backup restoration, secret decryption, two-replica Postgres coherence, and concurrent gateway load.
Simpler pricing: Free for 5, Pro, and Enterprise
Platform
The free tier now includes 5 members (up from 3) with the full core product: gateway, passes, and the audit trail. The paid tiers are renamed Pro ($15 per member per month) and Enterprise ($30, adding SSO, SCIM, and SIEM streaming), both self-serve with a card and no sales call.
The catalog now grows itself, adoption-gated
Catalog
Passport auto-nominates apps from the official MCP Registry: domain-verified vendor namespaces are probed live, tool schemas are scanned for injection text, and each toolset is hash-pinned so a silently changed server is caught by the weekly re-verify. New entries only ship when the vendor shows real adoption. The public catalog gained tier filters and per-category counts.
Every agent on the Agents page, one-click where possible
Platform
Claude, Claude Code, Cursor, VS Code, Codex, ChatGPT, and Claude.ai are all first-class. Five install with one click (config written natively, or through the agent's own CLI); ChatGPT and Claude.ai get everything short of the paste: the connector address lands on your clipboard and one button opens the right settings page.
Per-workspace join policy
Security
Joining a workspace is now the workspace's decision: invite-only by default, with an opt-in company-domain policy. Emailed sign-in links are single-use and re-checked at redemption, so a link can never outrank the current policy.
Real workspaces only ever see real MCPs
Security
Demo sandboxes are fully gated out of production deployments. Adding GitHub from the catalog connects the real GitHub MCP endpoint, never canned data. Covered by a dedicated end-to-end test in CI.
Self-serve front door
Platform
Verified email sign-in (a typed address is a claim, not an identity), two-phase workspace signup, transactional email, Stripe billing with a free tier, and this public site, including the browsable app catalog with a page for every app.
Real logos for every app
Catalog
A tiered brand-asset pipeline (curated marks → vendor-published icons → normalized favicons) gives every catalog entry a real mark, served static on the web. CI fails if any app regresses to a bare-letter tile.
Bridge credential rotation is multi-process safe
Platform
Cursor runs one bridge per window; all of them share a rotating single-use credential. Exchanges now serialize across processes and adopt a sibling's rotation instead of replaying it, fixing the 'phantom reconnect' loop.
One-paste ChatGPT connect
Gateway
Passport's gateway is a full OAuth 2.1 protected resource + authorization server: hosted agents connect by pasting one workspace URL, then approving in the browser. Grants are rotating and per-member; no static tokens to copy or leak.
Live tool refresh
Gateway
The bridge pushes toolset changes to running agents within ~15 seconds; no agent restart when an admin approves a new MCP.
Observability and deploy safety
Platform
Prometheus metrics, gateway error-rate paging, a load baseline, an ops runbook with a rehearsed 99-second rollback, and a CI security gate (secret scanning, dependency audit, SAST) on every change.
Official MCP Registry identities on catalog entries
Catalog
Catalog apps carry their domain-verified reverse-DNS identity, source repository, version, and declared credential inputs from the official registry's server.json, matched by endpoint URL so identity can't be spoofed by republishers.
Offboarding, backups, and release hardening
Security
Deactivating a person signs them out everywhere and drops their connected-account grants. Encrypted-at-rest key rotation with a rekey tool, backup + tested restore drills, SSRF guards on every admin-supplied URL, and shared rate limits across the public surface.
Passport goes live
Platform
Multi-tenant cloud on managed infrastructure: the governed gateway, per-member OAuth brokering (sign in once, brokered to every agent), read-only passes, guardrails, and the audit trail.