Changelog
What shipped, newest first. Dates are when the work landed, not when it was announced.
13 dated releases, 43 changes.
Access
Projects are public or private, and the people on one run it
A project is now open to the whole team or restricted to the people named on it, said once on the project rather than by narrowing every member one at a time. Anyone in the team can create a project and runs the one they made: they decide who is on it, which toolkits it holds, and whether it stays. Flipping a project public and back keeps its member list, so the switch costs nobody the list they built.
Access
A project can turn individual actions off
Beside the switch that installs a toolkit there is now one per action, so a project can keep a connector's reads and refuse its deletes for everyone in it. A refusal says the project turned the action off rather than blaming the agent's own grant, which is the difference between a fixable message and a confusing one.
Gateway
An agent never reaches more than the person who owns it
An agent could be narrowed to projects; it can now be narrowed to particular toolkits inside a project, and to particular actions inside a toolkit. More importantly the gateway's two front doors used to disagree: a raw agent key was capped against its owner's access, an OAuth connection was not. Both now ask the same question, so taking somebody off a project takes their agents off it too, whichever way they connect.
Access
Per-person tool grants are gone
Access used to be settable per member, per toolkit, per action. That control has been removed rather than carried forward: narrowing now belongs to the project and to the agent. Anyone who can see a project can call every action it leaves enabled. Existing installs are migrated on boot and no agent key changes what it reaches.
Catalogue
Twenty-five connectors, including Jira, Microsoft, Salesforce and Sheets
The catalogue gained Jira, Confluence, GitLab, Outlook, Teams, Azure, Google Sheets, Search Console, Anthropic, Gemini, Datadog, Grafana, PagerDuty, Kubernetes, Google Cloud, HubSpot, Salesforce, Zendesk, Intercom, Airtable, Snowflake, BigQuery, PostHog, Figma and Shopify. Each carries its own versioned migration, so an install that already exists picks them up on its next boot rather than only new ones getting them. Outlook, Teams and Salesforce need their OAuth applications registered before they can sign in.
Product
A project's URL follows its name
A project created as "New project" and named afterwards used to keep the slug it was born with, and that slug is what agents were told the project was called. Renaming now moves the slug, and the old one is kept as an alias so bookmarks and anything an agent is still passing keep resolving. Existing installs are migrated once, on boot.
Access
Team membership is editable
A workspace can move somebody between admin and member, or remove them, without a database query.
Product
The marketplace remembers which project you came from
Every route into the marketplace now carries the project you were in, so installing lands in the right place rather than in whichever project was first in the list.
Toolkits
The toolkit builder became a conversation
Instead of a form that takes one document, the builder can search the web, read a documentation page, ask you a question with real alternatives, and assemble the toolkit beside the conversation while you watch. Extraction stayed deterministic underneath it, so a model still cannot write an endpoint.
Catalogue
Bitwarden, Infisical and OpenRouter
Three connectors added to the catalogue, each with its own versioned migration so an existing install picks them up on the next boot rather than only new databases getting them.
Catalogue
ElevenLabs, Higgsfield and Google Drive
Three more, on the same terms.
Toolkits
A toolkit can require its guide be read first
Some toolkits assume an order of operations that no input schema can express. Those now mark themselves as requiring a guide, and search results say so, so an agent reads it before its first call rather than after its first failure.
Product
The marketplace split into three sections
Toolkits your team built sit above the catalogue rather than mixed into it, and the separate templates page was retired into the marketplace it duplicated.
Gateway
Tool search can be answered by meaning
Toolkits and their tools carry embeddings, and a search adds a semantic pass on top of lexical ranking when an OpenRouter key is configured and the catalogue has been backfilled. Ranking stays lexical otherwise, and SEMANTIC_SEARCH=off forces it back there without a redeploy.
Gateway
list_toolkits
A search with no query already returned the whole catalogue by name, but only an agent that had read that sentence in a description ever found it. Asking what is installed at all now has a tool of its own.
Gateway
Every protocol revision the gateway serves is answered
2026-07-28, 2025-11-25, 2025-06-18 and 2025-03-26 on one endpoint. Listing only two of them refused Claude's connector with a 400 before it could reach the sign-in, because it opens with 2025-11-25.
Gateway
server/discover is answered before a token
Behind a 401, a client cannot tell a server it must sign into from one it cannot speak to at all. Discovery returns the same versions and capabilities to every caller, and discloses nothing the 401 challenge does not already.
Gateway
The URL says which agent is calling
A client that signs in carries no key, and a key was the only thing that had ever identified the agent, so those connections were attributed to nobody. The gateway now accepts the agent id as a path segment, which is the one thing a person definitely pastes.
Platform
OAuth tokens are verified against the application's own key set
Moving to better-auth 1.7 replaced the bundled MCP provider with the resource-server half of the same library. An access token is now a JWT the deployment signs and verifies against its own JWKS, so a token minted for one deployment is only accepted by that one.
Platform
/api/health says which build is answering
The commit the image was built from is baked in at build time and reported by the health endpoint, so a deploy can be confirmed without archaeology on asset hashes.
Toolkits
A pinned CLI is asked what it can do
CLI introspection reads the tool's own help output during extraction and packaging, rather than guessing its commands from a README that usually documents installation instead of usage.
Product
An error names whose credential was rejected
A rejected credential used to be blamed on whichever one happened to be on screen.
Toolkits
A CLI toolkit installs the binary it needs
The release asset a CLI needs is found, pinned, fetched and verified before installation, and an artefact that is not pinned or not confined is refused rather than run.
Toolkits
Any URL resolves to the repository behind it
A documentation site, a homepage or a package page now resolves to the GitHub repository it belongs to, so a person pasting the link they have does not have to go and find the one we wanted.
Catalogue
Coolify, as a CLI
Offered as a CLI toolkit pinned to a release we checked.
Toolkits
Signing in became an install type
A toolkit's route can declare that it authenticates by signing the user in, and what that needs, rather than OAuth being a special case wired for one connector.
Catalogue
Gmail and Google Calendar
Both connected by signing in, both sharing one connector OAuth client so a single consent covers them, and both leaving the limits to the per-user grant rather than to the connector.
Access
A call can be recorded without keeping what it returned
Key-name redaction cannot mask a message body or a document, because those arrive under ordinary keys. A connector can now declare, per operation, that the response is never written. The call is still recorded in full: person, agent, tool, duration, status, credit.
Toolkits
The review queue got an exit
A template awaiting review can be approved or rejected, and a rejected one stays private.
Catalogue
One product, several ways in
A marketplace app can offer a REST API, an MCP server and a CLI at once, and its card shows every route it offers. Notion was the first to get its REST API alongside its MCP server.
Gateway
A missing credential answers 401, on the right host
With the challenge pointing at the host the client actually asked for, rather than at whatever origin the deployment was configured with.
Product
The project became the unit of scope
And one credential became the unit of configuration, replacing a per-tool arrangement that made two installs of the same product impossible to tell apart.
Catalogue
Clarity, Ploxs and Bash
Three connectors added, each with its own versioned migration.
Platform
Sign in with Google or GitHub
Offered when a provider's client pair is configured, and simply absent otherwise, with email and password as the fallback.
Gateway
Claude can authorize itself
Rather than being handed a key by hand. The connector registers itself, the person approves it in Toolspoke, and it is issued its own token.
Toolkits
Publishing, with verified still meaning verified
A creator can put a toolkit forward, and a badge is granted by review rather than by the act of publishing.
Product
Relaydeck became Toolspoke
The product was renamed throughout.
Platform
Toolspoke owns its sandbox image
Rather than asking the runtime to assemble one, which meant the image a tool ran in was decided somewhere this repository could not see.
Product
Projects
Tools, credentials and sandbox namespaces scoped to a project, with a page to manage them and tests covering the isolation.
Access
One agent key can reach several projects
Or all of them, as a standing grant that picks up a project created after the key was issued.
Platform
Tests and coverage on every pull request
With the database isolated per run, so two jobs on one host cannot adopt or tear down each other's containers.
Toolkits
Deterministic extraction
OpenAPI 2.0 through 3.2 normalised into one canonical document, Postman collections delegated to the same extractor, MCP servers read from their own tools/list, and CLIs read behind a command allowlist. Every capability comes out with an executable binding attached.
Toolkits
A curation pipeline the model cannot lie to
The model triages, names and describes capabilities by id, and every id it returns is resolved back against the extraction output. An id that does not exist fails the build, which is what makes a hallucinated endpoint structurally impossible rather than merely unlikely.
Why there are no version numbers
Toolspoke does not publish version numbers yet, so entries are grouped by the date the work reached the main branch rather than by a release name we made up for the occasion.
Connector additions are dated by the versioned migration that puts them into an install that already exists, which is when a running deployment actually gains them.
For how any of it works, start at the documentation.