Runlayer

No entries match these filters. Clear filters

1. 2.4.0 (2026-11-03) Nov 3, 2026 · issue 129

   Runlayer adds session search, raw file reads for Microsoft 365, and new agent configuration policy groupings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Prevent users on a self-hosted deployment from seeing an empty session search UI before the indexer is running.
   env copy

   SESSIONS_SEARCH_API_ENABLED=false

   Retrieve the exact bytes of a large file from SharePoint when you need the raw binary content rather than a converted representation.
   json copy

   {
     "tool": "sharepoint_read_file",
     "arguments": {
       "file_id": "<file_id>",
       "format": "raw",
       "allow_large_file": true
     }
   }

   • Search agent sessions from the Sessions page on Runlayer-hosted deployments, or let agents search them through the Runlayer MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools; results cover sessions from October 29, 2026 onward.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • On self-hosted deployments, enable session search by running the session search indexer in write mode; set SESSIONS_SEARCH_API_ENABLED=false on the backend to hide the search UI until the indexer is ready.
   • Read exact file bytes from OneDrive and SharePoint with format: "raw" on onedrive_read_file and sharepoint_read_file, and read files up to 50 MB with allow_large_file.
   • Search agent sessions from the Sessions page on Runlayer-hosted deployments, or let agents search them through the Runlayer MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools; results cover sessions from October 29, 2026 onward.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • On self-hosted deployments, enable session search by running the session search indexer in write mode; set SESSIONS_SEARCH_API_ENABLED=false on the backend to hide the search UI until the indexer is ready.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Slack channel setting in agent configuration policies is renamed to Slack outside approved channels.
2. 2.3.0 (2026-11-02) Nov 2, 2026 · issue 129

   Runlayer adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. spend-breakdown tools, DNS filter block reporting for egress proxy, and Claude Desktop routing through the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Gateway⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Read spend data from the Runlayer MCP using three new tools — get_spend_cost_breakdown (spend per provider and model), get_spend_people_usage (the All users list), and get_spend_department_usage (spend by department) — each requiring the View company metrics permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Runlayer Plugin's search_tools now returns readOnlyHint, destructiveHint, idempotentHint, and openWorldHint as annotations in nested mode, letting agents select read-only tools without enumerating every connector.
   • Self-hosted egress proxy now accepts a list of DNS filter block answers so blocked agent destinations are refused immediately and recorded in response and audit logs.
   • AI Watch now routes eligible users' Claude Desktop through the LLM Gateway when LLM routing is on, with short-lived per-device tokens, budgets, and Sessions.
   • Read spend data from the Runlayer MCP using three new tools — get_spend_cost_breakdown (spend per provider and model), get_spend_people_usage (the All users list), and get_spend_department_usage (spend by department) — each requiring the View company metrics permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

3. 2.2.0 (2026-10-30) Oct 30, 2026 · issue 126

   Runlayer adds update_skill_shares and list_skill_shares MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools for managing skill access, and metric definitions on Control and Usage dashboards.

   • Share skills with teams or people over the Runlayer MCP using the new update_skill_shares tool, which sets permissions or removes access under the same rules as the skill's Share dialog.
   • Inspect current skill access over the Runlayer MCP using the new list_skill_shares tool, with share counts also surfaced in list_skills.
   • Every number card on Control and Usage now shows an ⓘ metric definition explaining what it counts and what the trend arrow compares to.

   3 details in Everything

   • New integration AWS MCP Server connector
4. 2.1.0 (2026-10-30) Oct 30, 2026 · issue 126

   Runlayer adds per-run LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. spend limits ($250 default), agent-change approval flows in chat, Kubernetes audit consumer shard leasing, and in-conversation skill editing.

   • Agents now stop a run once it has spent $250 (or the remaining daily/weekly budget, whichever is lower) when LLM traffic flows through the Runlayer LLM gateway, with the run failing with a named limit error and the agent owner receiving a Slack DM when Budget alerts are on.
   • Runlayer now asks the person in a conversation to approve any agent-initiated change to its own setup (connectors, skills, instructions, subagents, schedules, triggers, webhooks, Slack settings, channel monitors, or adding a workspace connector) before applying it, including changes requested over iMessage and approved in Runlayer.
   • The Kubernetes audit consumer now leases its Kinesis shards using DynamoDB checkpointing; custom {instance}-audit-consumer IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies must allow dynamodb:Query and dynamodb:UpdateItem on the checkpoint table, and dynamodb:DeleteItem scoped to dynamodb:LeadingKeys = workers#*.
   • Handing a task to another agent now returns in about one second instead of about 20 seconds.
   • Agents can now create and update skills directly in conversation without requiring an explicit Runlayer connector or a ZIP file upload.

   5 details in Everything

   • Updated integration Shadow AI inventory — VS Code MCP server discovery
   • Updated integration Shadow AI inventory — GitHub Copilot CLI MCP server discovery
   • Updated integration AI Watch Enforce — GitHub Copilot CLI MCP server policy enforcement
   • Updated integration AI Watch Enforce — VS Code legacy Local chat harness blocking
   └──▷ BREAKING ON UPGRADE

   • !If you wrote a custom {instance}-audit-consumer IAM policy instead of using the published sample, you must now add dynamodb:Query and dynamodb:UpdateItem on the checkpoint table and dynamodb:DeleteItem scoped to dynamodb:LeadingKeys = workers#*, or the consumer will log kinesis_consumer_missing_permissions at startup and exit.
   • !Legacy macOS MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. scripts (AI Watch and Hooks) must be regenerated and redeployed: they now run uv and the Runlayer CLI as the signed-in user instead of root and keep the enrollment key off the command line.
5. 2.0.0 (2026-10-30) Oct 30, 2026 · issue 125

   Runlayer 2.0.0 adds client-IP enforcement via proxy headers and tightens session isolation to block cross-session manipulation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Tell Runlayer how many proxies prepend to X-Forwarded-For in your self-hosted deployment so IP-range policies and rate limits see the correct client address.
   .env copy

   PRE_AUTH_TRUSTED_PROXY_HOPS=2

   • Set PRE_AUTH_TRUSTED_PROXY_HOPS (Terraform: trusted_proxy_hops) to the number of appending proxies in self-hosted deployments with more than one, and CLIENT_IP_HEADER is now honoured only when it carries a single IP address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • A tool call carrying someone else's session ID (via hook payload or x-runlayer-session-id header) can no longer block that session, inject scan results, add security events, or mark an operator Stop as having taken effect in that session's history.
   • Set PRE_AUTH_TRUSTED_PROXY_HOPS (Terraform: trusted_proxy_hops) to the number of appending proxies in self-hosted deployments with more than one, and CLIENT_IP_HEADER is now honoured only when it carries a single IP address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The operator no longer injects AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or AWS_CA_BUNDLE on MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. pods; ExtendDB SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. now uses AWS profile extenddb via EXTENDDB_AWS_PROFILE (credentials under /etc/extenddb-aws, CA on the profile). Custom enable_db images must build the DynamoDB client from that profile when EXTENDDB_AWS_PROFILE is set.
   • !Client IP can no longer be chosen by the caller: rate limits, ip_address on audit events, and the meta.request.ip policy field now use the address your own proxy appended to X-Forwarded-For, never an earlier caller-supplied entry. IP-range policies and per-IP rate limits (including device enrollment) now see one address per office or fleet rather than per workstation.
   • !Self-hosted deployments with more than one appending proxy must set PRE_AUTH_TRUSTED_PROXY_HOPS (Terraform: trusted_proxy_hops) to match; CLIENT_IP_HEADER is honoured only when it carries a single IP address.
   • !A tool call sending someone else's session ID can no longer block that session via 'Block later tool calls when any scanner blocks', add scan results or security events to that session, or mark an operator Stop as having taken effect in it. Hook events naming another session are not recorded into it.
6. 1.42.0 (2026-10-29) Oct 29, 2026 · issue 125

   Runlayer adds iMessage delivery for scheduled agent runs, Outlook folder management, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. budget email alerts, and a model_version field in ToolGuard score API responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Configure LLM budget email alerts so administrators are notified before spend hits the full budget ceiling.
   📍In Settings, go to LLM Gateway › Usage rules, open an existing usage rule that has a total budget set, then open Email alerts and add the percentages (for example 50, 80, 100) at which administrators should be emailed.
   • ToolGuard score API responses now include model_version, identifying the model version expected to score the request — include it when reporting scan results to Runlayer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Set email alerts for LLM budget thresholds by configuring percentages under Settings → LLM Gateway → Usage rules → Email alerts; alerts fire once per percentage per budget window to organization settings administrators.
   • The Microsoft Outlook connector now supports creating mail folders, moving folders, and moving messages between folders — redeploy the connector to get the new tools.
   • Scheduled agent runs set up from an iMessage thread now post each run's result back via iMessage, and those set up from a Slack thread post results back in that thread.
   • ToolGuard score API responses now include model_version, identifying the model version expected to score the request — include it when reporting scan results to Runlayer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Set email alerts for LLM budget thresholds by configuring percentages under Settings → LLM Gateway → Usage rules → Email alerts; alerts fire once per percentage per budget window to organization settings administrators.

   2 more in Everything

7. 1.41.0 (2026-10-29) Oct 29, 2026 · issue 125

   Runlayer adds compact tool discovery control, redacted session timelines, skill risk policy on API writes, and Terraform-managed skills in v1.41.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Keep a Runlayer Plugin in compact tool-discovery mode for an agent harnessagent harnessThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. that loads all tool definitions up front, avoiding the full connector tool listing.
   copy

   $ curl -H 'X-Runlayer-Tool-Exposure: force-initial' https://<your-runlayer-host>/mcp

   Define and version-control a skill and its files in Terraform so that app edits surface as plan diffs and a blocked risk policy fails the apply.
   main.tf copy

   resource "runlayer_skill" "data_lookup" {
     name      = "data-lookup"
     namespace = "finance"
     path      = "skills/data-lookup"
   
     files = {
       "skill.yaml" = file("skills/data-lookup/skill.yaml")
       "handler.py" = file("skills/data-lookup/handler.py")
     }
   }

   • Control compact tool discovery in agent harnessesagent harnessesThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. by sending X-Runlayer-Tool-Exposure: force-initial from any client to keep Runlayer Plugin on search_tools / execute_tool instead of listing every connector tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Runlayer now drops X-Runlayer-User-Email, X-Runlayer-Identity-Token, and other identity-forward headers when a client sends them, so an upstream server only ever sees the ones Runlayer injects; other custom headers (such as a correlation ID) still pass through.
   • Skill risk policy now runs on API writes — creating or updating a skill's files via the API (including from Terraform) is rejected when the skill risk policy blocks the content, and nothing is saved when a write is blocked.
   • Redacted sessions and agent runs now preserve more of their data instead of hiding it: the API and the get_session MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool return the full event timeline (times, event types, tool names, model, tokens) with ***REDACTED*** in place of prompts, responses, tool input/output, and page URLs; the list_sessions and search_session_events MCP tools no longer include the first prompt or generated title in list and search rows; and the get_agent_run_trace MCP tool keeps its steps with placeholder text instead of hiding the timeline entirely.
   • Manage skills and their complete file sets as code with the new runlayer_skill resource in the Terraform provider; changes made in the app appear as a plan diff, and a file set blocked by your skill risk policy fails the apply.

   +3 more show less

   • Terraform provider now marks manual_oauth_client_secret and broker_vendor_client_secret on runlayer_server as sensitive, hiding them in plan and apply output; module outputs that reference them require sensitive = true.
   • Kubernetes operator now rejects MCP servers that combine enable_db with an IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. annotation (eks.amazonaws.com/role-arn) on the MCP ServiceAccount, setting ExtendDBReady=False / IRSAConflict and leaving ExtendDB AWS env off the pod.
   • Google Docs connectors now support copying existing templates with native formatting preserved, inspecting document structure and styles, and attaching comments to specific text ranges — requires redeploying existing Google Docs connectors.
   • Control compact tool discovery in agent harnessesagent harnessesThe software around an AI agent that manages its tools, execution loop, state and limits. It determines how the model's proposed actions are run and checked. by sending X-Runlayer-Tool-Exposure: force-initial from any client to keep Runlayer Plugin on search_tools / execute_tool instead of listing every connector tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Runlayer now drops X-Runlayer-User-Email, X-Runlayer-Identity-Token, and other identity-forward headers when a client sends them, so an upstream server only ever sees the ones Runlayer injects; other custom headers (such as a correlation ID) still pass through.
   • Manage skills and their complete file sets as code with the new runlayer_skill resource in the Terraform provider; changes made in the app appear as a plan diff, and a file set blocked by your skill risk policy fails the apply.
   • Terraform provider now marks manual_oauth_client_secret and broker_vendor_client_secret on runlayer_server as sensitive, hiding them in plan and apply output; module outputs that reference them require sensitive = true.
   • Kubernetes operator now rejects MCP servers that combine enable_db with an IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. annotation (eks.amazonaws.com/role-arn) on the MCP ServiceAccount, setting ExtendDBReady=False / IRSAConflict and leaving ExtendDB AWS env off the pod.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Runlayer now drops X-Runlayer-User-Email, X-Runlayer-Identity-Token, and other identity-forward headers sent by a client — any upstream server or workflow that relied on forwarding these caller-supplied headers will no longer receive them.
   • !manual_oauth_client_secret and broker_vendor_client_secret on runlayer_server are now marked sensitive in Terraform; module outputs that reference them must add sensitive = true or the apply will fail.
   • !MCP servers on Kubernetes that combine enable_db with an IRSA annotation (eks.amazonaws.com/role-arn) on the MCP ServiceAccount are now rejected by the operator (ExtendDBReady=False / IRSAConflict); remove one or the other to restore functionality.
8. 1.40.0 (2026-10-28) Oct 28, 2026 · issue 123

   Runlayer 1.40.0 adds rate-limit policies, artifact secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., waterfall agent timelines, voice over iMessage, and GPT-6.1 Terra support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Cap a noisy connector to 30 tool calls per minute per session to prevent runaway agents from exhausting API quotas.
   📍In the Runlayer console, go to the connector's Policies tab, create a new policy, set Action to Rate limit, choose the '30 calls per minute per session' template, then save. Calls over the limit are refused and appear in the audit log as Tool Call Rate Limited.
   Set a workspace-wide artifact auto-delete rule with a Keep forever override for a sensitive reports folder, so idle drafts are cleaned up while compliance artifacts are retained.
   📍In the Runlayer console, go to Settings → Artifacts, enable the workspace-wide auto-delete rule, then add a per-folder override for the Reports folder set to Keep forever, and save.
   • Adds rate-limit policies letting admins cap tool-call frequency per connector — for example 100 calls per hour per user or 30 calls per minute per session — with Rate limit as a policy action, two rate-limit templates, per-policy badge display, and refused calls logged as Tool Call Rate Limited in the audit log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Blocks artifact publishing when content contains an obvious API key, access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., or private key, telling the agent to redact and republish.
   • Adds Timeline / Waterfall switch to the agent run drawer, charting each tool call as a bar at its real offset from run start with subagent steps nested under their call.
   • Adds GPT-6.1 Terra to the agent model picker for OpenAI providers, with reasoning, image input, and Spend pricing.
   • Adds voice message support over iMessage: send a voice message from Messages and the agent transcribes and replies using the workspace's OpenAI provider.

   +5 more show less

   • Adds workspace-wide artifact auto-delete policies in Settings → Artifacts, with per-folder overrides (for example Keep forever for a folder), archiving idle artifacts first and deleting 30 days later.
   • Deactivated users' MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed devices now block tool calls in Protect and Enforce modes via AI Watch hooks; devices Runlayer cannot match to a user receive the organization's Enforce tool-type blocklist.
   • Scopes plugin, skill install counts on the Metrics page and a connector's most-active-users list to organization-only activity, and rejects date ranges older than 90 days.
   • Adds Clio v1.0 session-topic filter (behind session-topics-clio feature flag) listing 63 Clio subtopics — for example Research and prepare for sales engagements — alongside existing topics on the Sessions page.
   • Session compaction now auto-retries parked sessions after upgrades (at most once per day, up to three retries per session), eliminating most manual support resets.
   • Adds rate-limit policies letting admins cap tool-call frequency per connector — for example 100 calls per hour per user or 30 calls per minute per session — with Rate limit as a policy action, two rate-limit templates, per-policy badge display, and refused calls logged as Tool Call Rate Limited in the audit log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Blocks artifact publishing when content contains an obvious API key, access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., or private key, telling the agent to redact and republish.
   • Adds Timeline / Waterfall switch to the agent run drawer, charting each tool call as a bar at its real offset from run start with subagent steps nested under their call.
   • Adds voice message support over iMessage: send a voice message from Messages and the agent transcribes and replies using the workspace's OpenAI provider.
   • Adds workspace-wide artifact auto-delete policies in Settings → Artifacts, with per-folder overrides (for example Keep forever for a folder), archiving idle artifacts first and deleting 30 days later.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Incident API and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool requests for a time range longer than 7 days now return only the 7 days ending at the range's end date; callers must request longer ranges in 7-day steps.
9. 1.39.0 (2026-10-26) Oct 26, 2026 · issue 122

   Runlayer 1.39.0 adds hosting-type filtering for connectors, cookie masking in approvals, federated agent server scoping, and a 36 MiB MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. request size cap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Filter the Connectors page to show only connectors you can self-host, to audit your local attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
   📍In the Runlayer web app, go to Connectors, open the Hosting filter, and select Local.
   • Adds a Hosting filter on the Connectors page to narrow connectors by type: Local, Remote, or Runlayer Deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Applies cookie masking in approval requests across the web app, Slack, and Microsoft Teams for every cookie field, including fields such as auth_cookie and session_cookie.
   • Enforces server scoping for federated agent accounts (those signed in through an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.): tokens are restricted to the servers they were issued for, the setting shows as on and locked, and existing API keys on those accounts are refused.
   • Limits MCP endpoint request bodies to 36 MiB, returning HTTP 413 for anything larger; sized to allow a full 25 MB artifact upload via create_artifact / update_artifact.
   • Restricts connector URL redirects to within the server's own origin — redirects to another host, another port, or from https:// to http:// are not followed; a same-host http:// → https:// upgrade is still permitted.

   +2 more show less

   • Replaces the Official badge with a Third-party icon on connector cards to mark connectors not built by the service's vendor; removes the Secure badge.
   • Restricts local stdio servers to run only on the user's machine via the Runlayer CLI — Runlayer no longer starts a local stdio server on its own servers when called through the proxy URL.
   • Adds a Hosting filter on the Connectors page to narrow connectors by type: Local, Remote, or Runlayer Deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Limits MCP endpoint request bodies to 36 MiB, returning HTTP 413 for anything larger; sized to allow a full 25 MB artifact upload via create_artifact / update_artifact.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Federated agent accounts (signed in through an identity provider) now have server scoping permanently on and locked — existing API keys on those accounts are refused at the server level; revoke any keys you no longer need before unbinding the account from its identity provider.
   • !Connector URLs that redirect to another host, another port, or from https:// down to http:// are no longer followed — update connector configurations to use the final destination URL directly.
   • !MCP endpoint requests with a body larger than 36 MiB are rejected with HTTP 413 — payloads exceeding this limit must be reduced or split.
   • !Runlayer no longer starts a local stdio server on its own servers when called through the proxy URL — local stdio servers must be run on the user's machine via the Runlayer CLI.
10. 1.38.0 (2026-10-26) Oct 26, 2026 · issue 122

    Runlayer 1.38.0 adds runlayer_agent_trigger in Terraform and exposes MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. resources/templates/list through the gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Define an agent's poll trigger as Terraform code so it is version-controlled and repeatable across environments.
    hcl copy

    resource "runlayer_agent_trigger" "nightly_poll" {
      agent_id     = runlayer_agent.my_agent.id
      trigger_type = "poll"
      event_key    = "nightly"
      account_id   = "<account_id>"
    }

    Verify that a connector's MCP resource templates are now visible to clients via the Runlayer gateway.
    copy

    $ curl -X POST https://<your-runlayer-host>/mcp \
      -H 'Content-Type: application/json' \
      -d '{"jsonrpc":"2.0","id":1,"method":"resources/templates/list","params":{"connector_id":"<connector_id>"}}'

    • Adds runlayer_agent_trigger Terraform resource to manage an agent's event and poll triggers as code; changing trigger_type, event_key, or account_id replaces the trigger (requires agent triggers enabled for the organization).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes MCP resources/templates/list through the Runlayer gateway so clients can list a connector's resource templates from upstream servers.
    • Admins can now delete a connector directly from the ⋯ menu on its connector page, not only from Manage connectors.
    • Renames the personal tab on Agents, Skills, Plugins, and Artifacts pages to Owned by me.
    • Adds runlayer_agent_trigger Terraform resource to manage an agent's event and poll triggers as code; changing trigger_type, event_key, or account_id replaces the trigger (requires agent triggers enabled for the organization).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes MCP resources/templates/list through the Runlayer gateway so clients can list a connector's resource templates from upstream servers.

    2 more in Everything

11. 1.36.0 (2026-10-24) Oct 24, 2026 · issue 120

    Runlayer 1.36.0 lets skill admins detach skills from their source repos and improves Go agent follow-through and ToolGuard recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Enables skill owners and skill admins to detach a skill published with runlayer skills push from its source repository so it can be edited directly in Runlayer, preserving files, version history, and sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Allows editors to detach a skill once its owner is deactivated, preventing orphaned skills when a publisher leaves.
    • After detachment, later pushes from the source repository no longer update the skill, automatic updates are turned off, and pushing a skill with the same name fails until one is renamed.
    • Improves the Go agent to check its own work before marking tasks complete, wait on slow results such as CI or deploys, report the real outcome, and support timed reminders (e.g. 'ping me in 30 min').
    • Retrains the ToolGuard tool-removal model so recommendations are scoped to the tools a deployment actually sends and are proportionate to each agent's tool set, rather than occasionally suggesting removing every tool.
    • Enables skill owners and skill admins to detach a skill published with runlayer skills push from its source repository so it can be edited directly in Runlayer, preserving files, version history, and sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Pushing a skill with the same name as an already-detached skill fails until one of them is renamed.
12. 1.35.0 (2026-10-23) Oct 23, 2026 · issue 119

    Runlayer 1.35.0 adds bulk agent deletion, .xlsx.xlsxThe file format used by Microsoft Excel for spreadsheets, based on the Open XML standard. Cyber tools use it to ingest or export structured tabular data in a format analysts already work with. spreadsheet previews, Stop-effect visibility, and compliance import scope clarity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Clean up a large fleet of decommissioned agents — including their schedules, webhooks, and Slack apps — in a single action rather than one at a time.
    📍In the Runlayer console, go to Agents → Inventory tab, check the disabled agents you want to remove, then choose Delete from the bulk-action menu.
    Deploy the AI Watch Chrome extension via a computer-level MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profile on macOS by copying the generated ExtensionSettings entry directly from Runlayer.
    📍In the Runlayer console, go to Settings → Browser extension, enable 'Chrome extension installed by your policy (macOS)', then copy the ExtensionSettings entry shown and paste it into your MDM Chrome policy profile.
    • Adds bulk deletion of disabled agents from the Agents Inventory tab — select agents, choose Delete, and their schedules, webhooks, and Slack apps are removed in one action; enabled agents are left untouched.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds read-only .xlsx spreadsheet previews in the artifact viewer, with a tab per sheet and the workbook's number formats, colors, and merged cells, so agents' Excel outputs are readable without downloading.
    • Settings → Agent session monitoring now clarifies that a Claude or ChatGPT compliance import covers every user in the connected organization or workspace, including people who have never signed in to Runlayer.
    • The Chrome extension policy page (macOS, AI Watch) now surfaces the Runlayer extension ID, the organization's update URL, and a ready-to-copy ExtensionSettings entry for computer-level MDM Chrome profiles.
    • An agent whose face is an emoji now displays that emoji as its Slack app icon instead of the Runlayer logo.

    +4 more show less

    • Shared environment variable tooltips on hosted connectors now explain whether a value is shared across all users or entered individually per user.
    • Access tooltips on shared agents now describe what access level you hold and who to ask for Can edit permission when a trigger, scheduled task, or connector cannot be added.
    • Admins can now skip all remaining setup checklist steps at once instead of one by one.
    • Agents now automatically publish files they create (decks, documents, spreadsheets, PDFs) to Artifacts and reply with a link, instead of reporting no way to share them.
    • Adds bulk deletion of disabled agents from the Agents Inventory tab — select agents, choose Delete, and their schedules, webhooks, and Slack apps are removed in one action; enabled agents are left untouched.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds read-only .xlsx spreadsheet previews in the artifact viewer, with a tab per sheet and the workbook's number formats, colors, and merged cells, so agents' Excel outputs are readable without downloading.

    7 more in Everything

13. 1.34.0 (2026-10-23) Oct 23, 2026 · issue 117

    Runlayer 1.34.0 adds artifact search in Launcher, audit-log entries for agent run cancels, and Chrome-policy-managed AI Watch extension installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Use your existing Chrome fleet policy to deploy AI Watch without letting Runlayer overwrite or shadow your other managed extensions (e.g. Okta).
    📍In AI Watch browser extension settings, enable Chrome extension installed by your policy, then add the Runlayer entry to your Google Admin or MDM Chrome extension policy. AI Watch will write no Chrome policy of its own, and the device health check will confirm your policy installed the extension.
    • Adds Chrome extension installed by your policy toggle in AI Watch browser extension settings, letting you install AI Watch via Google Admin, Chrome Enterprise Core, or MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. instead of having AI Watch write its own Chrome policy — preventing it from overwriting yours and removing extensions like Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds audit log entries when an agent run is stopped via the API, web app, or Slack, recording who stopped it and whether the sandbox halted.
    • Stopping a session now also cancels all Runlayer Agents runs inside it, including runs you do not own, and only reports Terminated once the agent's runtime confirms.
    • Adds artifact search to the Launcher — find accessible artifacts by title or filename, open them directly, and return to recently opened files.
    • Evaluation replays are now isolated to your organization — a replay can no longer list or call a connector belonging to another organization.
    • Adds Chrome extension installed by your policy toggle in AI Watch browser extension settings, letting you install AI Watch via Google Admin, Chrome Enterprise Core, or MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. instead of having AI Watch write its own Chrome policy — preventing it from overwriting yours and removing extensions like Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds audit log entries when an agent run is stopped via the API, web app, or Slack, recording who stopped it and whether the sandbox halted.
    • Adds artifact search to the Launcher — find accessible artifacts by title or filename, open them directly, and return to recently opened files.

    2 more in Everything

14. 1.33.0 - Artifact notifications and resilient Go (2026-10-22) Oct 22, 2026 · issue 117

    Runlayer 1.33.0 adds an Auto-sync API, v1 deprecation headers, and artifact comment notifications via Slack/Teams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit which of your automation scripts still call unsupported v1 endpoints by inspecting the Deprecation header returned on any v1 API-key request.
    copy

    $ curl -si -H 'Authorization: Bearer <api-key>' https://api.runlayer.com/v1/<endpoint> | grep -i deprecation

    Idempotently enable auto-sync for a specific connector by type and ID without risking duplicate writes.
    copy

    $ curl -X PUT https://api.runlayer.com/v2/auto-sync/<type>/<id> \
      -H 'Authorization: Bearer <api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"auto_sync": true}'

    • Adds an Auto-sync API to read, set, or remove a connector, plugin, or skill's device auto-sync setting by its type and ID, using an idempotent PUT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Deprecation response header to API-key calls made to v1 endpoints, making it easy to identify scripts that still depend on unsupported v1 automation paths.
    • Adds artifact comment notifications via Slack or Teams: mentions, replies, and comments on owned artifacts now trigger a message from the Runlayer assistant linking directly to the artifact.
    • Go now retries failed lookups via alternate routes, checks whether a failed write landed before retrying (preventing duplicates), cites the source of each number in its answers, and executes the next step rather than offering it.
    • Adds an Auto-sync API to read, set, or remove a connector, plugin, or skill's device auto-sync setting by its type and ID, using an idempotent PUT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Deprecation response header to API-key calls made to v1 endpoints, making it easy to identify scripts that still depend on unsupported v1 automation paths.
    • Adds artifact comment notifications via Slack or Teams: mentions, replies, and comments on owned artifacts now trigger a message from the Runlayer assistant linking directly to the artifact.

    1 more in Everything

15. 1.32.0 - Sharing API and MCP session stops (2026-10-21) Oct 21, 2026 · issue 116

    Runlayer 1.32.0 adds a Sharing API, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. session stop/clear tools, and Terraform resources for team members and group bindings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Manage team membership and directory-group bindings as code in Terraform so role assignments are version-controlled and repeatable.
    hcl copy

    resource "runlayer_team_member" "analyst" {
      team_id = runlayer_team.soc.id
      user_id = "user_abc123"
      role    = "member"
    }
    
    resource "runlayer_team_group_binding" "soc_ad_group" {
      team_id  = runlayer_team.soc.id
      group_id = "dir_group_xyz"
    }

    • Adds stop_session and clear_session_stop tools to the Runlayer MCP so agents and automation (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks) can stop a session and clear a stop; requires the same permission as the API, a reason is mandatory, and the audit log records whether the action came from the API or the MCP.
    • Adds runlayer_team_member and runlayer_team_group_binding resources to Terraform provider 1.8.1, enabling role and directory-group membership to be managed as code; applying either resource adopts an already-existing membership or binding.
    • Adds a Sharing API that reads, sets, or removes one principal's access to an agent, skill, or plugin with a single idempotent call keyed by principal.
    • Adds Auto-review and Your review tabs to the run drawer, with draft notes preserved when switching between them.
    • Expands PrivateLinkPrivateLinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. support for Runlayer Deploy connectors beyond four connections, with additional connections using AWS rule capacity shared across deployments.

    +1 more show less

    • Moves session storage compaction to its own ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. service so heavy compaction no longer interrupts new session activity in the Sessions view.
    • Adds stop_session and clear_session_stop tools to the Runlayer MCP so agents and automation (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks) can stop a session and clear a stop; requires the same permission as the API, a reason is mandatory, and the audit log records whether the action came from the API or the MCP.
    • Adds runlayer_team_member and runlayer_team_group_binding resources to Terraform provider 1.8.1, enabling role and directory-group membership to be managed as code; applying either resource adopts an already-existing membership or binding.
    • Adds a Sharing API that reads, sets, or removes one principal's access to an agent, skill, or plugin with a single idempotent call keyed by principal.
    • Adds Auto-review and Your review tabs to the run drawer, with draft notes preserved when switching between them.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Stopping a session via the API now requires a session Runlayer has already recorded — an unknown session ID is refused rather than silently creating a stop record.
16. 1.31.0 - Go deliverables and session layer tags (2026-10-21) Oct 21, 2026 · issue 116

    Runlayer 1.31.0 adds Go deliverable generation, session layer tags, bulk artifact deletion, and Kubernetes session materialization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Identify which layer captured each turn in a multi-layer session to debug duplicate turns during an Agent runtime + LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway recording.
    📍In the Sessions view, open any recorded session → each prompt, response, and tool card now displays a layer tag (Agent runtime, LLM gateway, or Client hook) directly on the card.
    Clean up stale artifacts in bulk instead of deleting them one at a time from the library.
    📍In the Artifacts library, check the checkboxes next to the artifacts you want to remove → select Delete selected to remove them all in one step.
    • Adds layer-capture tags to each prompt, response, and tool card in Sessions, showing which layer (Agent runtime, LLM gateway, or Client hook) captured a turn when more than one layer recorded it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds bulk delete to the Artifacts library, letting you select multiple artifacts and remove them in one step.
    • Adds the exact build commit with a copy button to Settings → General next to the version number.
    • Go now builds and links the finished artifact — table, chart, one-page doc, or file — instead of describing it in chat when asked to compare options, show a trend, plan a trip, or send files.
    • Moves session compaction to its own Deployment on Kubernetes via the Runlayer operator, isolating heavy session work from ingest and allowing Kinesis installs to scale both past one replica.
    • Adds layer-capture tags to each prompt, response, and tool card in Sessions, showing which layer (Agent runtime, LLM gateway, or Client hook) captured a turn when more than one layer recorded it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds bulk delete to the Artifacts library, letting you select multiple artifacts and remove them in one step.
    • Adds the exact build commit with a copy button to Settings → General next to the version number.

    2 more in Everything

17. 1.30.0 - Eval replay and Go follow-through (2026-10-21) Oct 21, 2026 · issue 116

    Adds eval replay with recorded tool results, agent account OAuth connectors, improved Go follow-through, auto-saving run reviews, and an enhanced offline eval run picker.

    • Adds a Replay recorded results option under Tool mocking in agent evals, feeding each matching call its original recorded result so every replay sees identical data while remaining side-effect free.
    • Adds an OAuth connector workflow for agent accounts so admins can attach a connector without linking their own credentials — each user then grants access with their own account.
    • Go now continues completing unfinished parts of a request at the end of a turn instead of prompting whether it should, while still returning decisions involving money, access, data deletion, or messages to the user.
    • Run reviews in the run drawer now auto-save Pass/Fail, notes, and expected output after a pause in typing or on drawer close, replacing the explicit Save button with a Saved indicator.
    • Adds an offline eval run picker with search and filter by status, start date, or topic; shift-click range selection; quick picks for recent failures or topic spreads; and an Ask AI option that returns matching runs with reasons.

    +1 more show less

    • Agent owners now receive a Slack DM when their agent reaches adoption milestones of 3, 5, 10, 25 (and beyond) users, with a distinct message at each milestone.

    6 details in Everything

    • New detection AI dictation app inventory in AI Watch Detect
    • New integration Terraform resources for detections and smart rules
18. 1.29.0 - iMessage agents and recorder detection (2026-10-20) Oct 20, 2026 · issue 115

    Adds iMessage agent channel, GitHub App integration for agents, ExtendDB NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. isolation, RunlayerInstance CR image overrides, and semantic customer versioning.

    • Adds iMessage channel for agents: users can text an agent from Messages on iPhone, iPad, or Mac after linking their number to their Runlayer account; admins choose which agent answers the linked number.
    • Adds GitHub App integration for agents: workspace admins can connect a GitHub App and grant agents access to selected repositories via short-lived tokens.
    • Adds RunlayerInstance CR overrides for ExtendDB init/reset Jobs' helper container images (kubectl, Postgres client, AWS CLI) on self-hosted Kubernetes, removing the need to wait on an operator release.
    • Adds ExtendDB ingress NetworkPolicy for self-hosted deployments that scopes ExtendDB to only the linked MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. namespace.
    • Adds Postgres connection-budget sizing guidance and an image-bump/recovery runbook for self-hosted Kubernetes operators enabling ExtendDB.

    +2 more show less

    • Introduces semantic versioning for customer releases starting at 1.29.0: new major for breaking changes, new minor for new features, new patch for fixes only.
    • Members can no longer remove themselves from a team; only a team owner or workspace admin can remove them, preventing accidental exit from AI Watch policies targeting that team.

    7 details in Everything

    • New detection AI meeting recorder and ambient notetaker detection in AI Watch Detect
    └──▷ BREAKING ON UPGRADE

    • !The separate Goal achieved tile has been removed; goal outcomes and failure reasons are now only available in Agent Insights.
19. 1.28.1575 - Computer-use detection and session stop (2026-10-20) Oct 20, 2026 · issue 115

    Adds session stop controls (Shift+K), scoped agent token enforcement (FF_DISABLE/FF_ENABLE), credential revocation on run end, and redaction-aware stream replay.

    • Security, IT, and Super Admins can stop a live agent session and resume it from the Sessions page session drawer, or with Shift+K, with a required reason and full audit trail.
    • Scoped agent or on-behalf-of tokens (requested with resource) now return 403 invalid_target on out-of-scope servers for all agent accounts; self-hosted operators control this with FF_DISABLE=agent-token-audience-enforcement or FF_ENABLE=agent-token-audience-enforcement.
    • Agent run credentials are revoked the moment a run finishes rather than remaining valid until natural expiry.
    • Agent run live-stream replay enforces workspace redaction rules; viewers must hold the unredact permission and confirm before content is replayed.
    • Agents offer an inline connector card in chat when a needed app is missing, eliminating a settings-page detour.

    +1 more show less

    • Device check-ins and scans no longer write to the shared MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. configuration record, eliminating row contention for large fleets.

    6 details in Everything

    • New detection Computer-use desktop agent detection
    • New detection pip- and npm-installed computer-use tool detection
    • Updated detection AI Watch Detect Capabilities chips for installed AI clients
    • New detection Gemini desktop app inventoried as AI Watch client
    • New integration Microsoft 365 Work IQ connector
    └──▷ BREAKING ON UPGRADE

    • !Scoped agent or on-behalf-of tokens are now rejected with 403 invalid_target on servers outside their declared resource scope for ALL agent accounts — self-hosted operators can revert with FF_DISABLE=agent-token-audience-enforcement.
    • !Exchanging a scoped agent token for an on-behalf-of token now requires a resource within the original token's scope; requests without one return 400 invalid_target.
    • !The MDM configuration card's Last connected label and status badge are removed.
    • !The Turn on Shadow AI detection onboarding step has been removed.
20. announced Oct 19, 2026 · issue 116

    Runlayer agents can now be defined and scheduled as code via a Terraform provider with runlayer_agent and runlayer_agent_schedule resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Define an agent with least-privilege tool access and a network egress policy so security teams can review agent permissions like IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. in a pull request.
    main.tf copy

    terraform {
      required_providers {
        runlayer = {
          source  = "downloads.runlayer.com/runlayer/runlayer"
          version = "~> 1.5"
        }
      }
    }
    
    provider "runlayer" {}
    
    resource "runlayer_agent" "release_notes" {
      name   = "release-notes"
      prompt = trimspace(file("${path.module}/prompts/release-notes.md"))
      model  = "claude-sonnet-5"
      servers = [{
        server_id  = runlayer_server.github.id
        tool_names = ["list_pull_requests", "get_pull_request"]
      }]
      egress_policy = {
        default_action = "deny"
        allow          = ["github.com", "*.githubusercontent.com"]
      }
      env = {
        RELEASE_CHANNEL = "stable"
      }
    }

    Attach a recurring cron schedule to an agent so it runs automatically every Monday morning — change the day with a one-line diff and a reviewed PR.
    schedules.tf copy

    resource "runlayer_agent_schedule" "sprint_digest" {
      agent_id           = runlayer_agent.team["sprint-digest"].id
      name               = "Sprint digest"
      input_prompt       = "Summarize last week's closed issues for the team."
      cron_expression    = "0 9 * * 1"
      schedule_semantics = "local_wall_clock"
      timezone           = "America/New_York"
    }

    Import an existing Runlayer agent into Terraform state by its UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. so all future changes go through plan and review.
    copy

    $ terraform import runlayer_agent.support_triage 9f1c2b7e-...

    • Adds the runlayer_agent Terraform resource (with name, prompt, model, servers using per-connector tool_names, egress_policy, env, tags, example_prompts, and is_disabled, installable from downloads.runlayer.com/runlayer/runlayer version ~> 1.5), the runlayer_agent_schedule resource (since provider 1.5.0) for attaching a cron schedule via agent_id, cron_expression, schedule_semantics, and timezone, the runlayer_server and runlayer_policy resources for managing connectors and policies as code, and egress_policy support on runlayer_agent with default_action and allow fields for per-agent network access policy in version control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the runlayer_server Terraform data source to look up an existing connector by server_id for use in agent definitions, and the runlayer_agent Terraform data source exposing tool_count, skill_count, and env_keys for CI checks against existing agents.
    • Supports terraform import runlayer_agent.<name> <uuid> to bring existing agents under Terraform management.
    • Authenticates the provider via RUNLAYER_API_KEY and RUNLAYER_BASE_URL environment variables.
    • New Terraform provider is available in beta for both Runlayer-hosted and self-hosted deployments, with the full schema under Help → Terraform Reference in the app.

    5 details in Everything

21. 1.28.1480 - Slack stop button and ADK telemetry (2026-10-17) Oct 17, 2026 · issue 112

    Runlayer 1.28.1480 adds a Slack stop button for agents and Google ADKADKGoogle's Agent Development Kit, an open-source framework for building and orchestrating AI agents; cyber tools use it to compose multi-agent workflows with built-in tool-calling and state management. session telemetry via a native Python plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a Slack stop button for agents that have their own Slack app, letting any authorized user halt all in-progress replies in a thread.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Google ADK session telemetry for Python agents via a native plugin (see Hooks SDK) that captures prompts, assistant responses, and tool activity in one conversation, with local tool enforcement and correlation to Runlayer MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. audits.
    • Adds connector search highlighting in Manage connectors, including surfacing the matching description excerpt under the connector name when the match is in the description.
    • Places the current user first, marked (you), in user filters across Sessions, Incidents, Audit Logs, and other list views.
    • Adds a Slack stop button for agents that have their own Slack app, letting any authorized user halt all in-progress replies in a thread.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Google ADK session telemetry for Python agents via a native plugin (see Hooks SDK) that captures prompts, assistant responses, and tool activity in one conversation, with local tool enforcement and correlation to Runlayer MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. audits.

    2 more in Everything

22. 1.28.1446 - Supported clients and card detection (2026-10-16) Oct 16, 2026 · issue 111

    Runlayer 1.28.1446 adds full client visibility for AI Watch policy pickers and connector request approvals via existing shared connectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Check which AI Watch clients and minimum versions are enforceable before authoring a new Enforce or Protect policy.
    📍In the Runlayer console, go to Manage → Endpoints → View supported clients to see every client AI Watch can protect, its minimum required version, and whether enforcement blocks before the tool runs.
    Approve an incoming connector request without granting duplicate access when the requester already has access to one of your shared connectors.
    📍In the Runlayer console, go to Inbox, open the connector request, select an existing connector the requester already has access to (shown as Has access), and approve — no additional policy is created.
    • The View supported clients dialog under Manage → Endpoints now lists every client AI Watch hooks can protect and enforce, including each client's minimum version and whether it blocks before the tool runs only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The Enforce and Protect built-in policy pickers now offer the full AI Watch supported client list.
    • Approve a new connector request using a connector you already built and shared; existing connectors the requester can already access show as Has access and approve the request without adding another policy.
    • The View supported clients dialog under Manage → Endpoints now lists every client AI Watch hooks can protect and enforce, including each client's minimum version and whether it blocks before the tool runs only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Approve a new connector request using a connector you already built and shared; existing connectors the requester can already access show as Has access and approve the request without adding another policy.

    1 more in Everything

23. 1.28.1407 - Detect agents inside IDEs (2026-10-16) Oct 16, 2026 · issue 110

    Runlayer Detect now inventories IDE-native AI agents and their MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and connector policies gain per-tool granularity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Verify that Xcode 26.3+ CodingAssistant MCP servers are now visible in your Detect inventory after upgrading — agents in that folder were previously missed entirely.
    📍In the Runlayer console, go to Detect and filter by IDE to confirm Claude and Codex agents running from the Xcode CodingAssistant folder appear in the agent inventory.
    • Detects IDE-native AI agents that were previously invisible — including Claude and Codex agents in Xcode 26.3+ (from its own CodingAssistant folder), Visual Studio Copilot agent mode, JetBrains AI Assistant, Gemini in Android Studio, GitHub Copilot for Xcode and Eclipse, Firebender, Positron, and PearAI — because none of these read the standalone Claude Code, Codex, or VS Code config files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Recognizes Codex for VS Code, CodeGPT, Qoder CN, Bito, Zencoder, Tabby, twinny, Verdent, Pieces, and the Firebender JetBrains plugin as AI extensions in the Detect inventory.
    • Detects IDE-native AI agents that were previously invisible — including Claude and Codex agents in Xcode 26.3+ (from its own CodingAssistant folder), Visual Studio Copilot agent mode, JetBrains AI Assistant, Gemini in Android Studio, GitHub Copilot for Xcode and Eclipse, Firebender, Positron, and PearAI — because none of these read the standalone Claude Code, Codex, or VS Code config files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

24. 1.28.1396 - Gateway spend tracking and session stop (2026-10-15) Oct 15, 2026 · issue 110

    Adds session stop API, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Gateway spend tab, connector approval intake, idle-connector keep-alive, upstream User-Agent identification, and expanded Runlayer Plugin artifact operations.

    • Adds a Session stop API for Security, IT, and Super Admins to halt a live agent session with a reason; subsequent MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool calls carrying that session's id are denied until an admin clears the stop, with each stop, first denied call, and clear recorded in the audit log.
    • Adds a Settings → LLM Gateway → Spend tab listing every LLM call the gateway reported, with cost, tokens, and charged usage rule, and totals spend by agent run, device, or model over a chosen time range; calls the gateway cannot price show as unpriced rather than $0.
    • Adds connector approval intake so workspace admins can direct employees to an external approval form with custom instructions, with the option to disable native connector submissions.
    • Runlayer Plugin agents can now publish, find, read, edit, and delete artifacts, and delete skills and agents directly, without a separate Runlayer MCP server connection.
    • Runlayer now names the AI client in the User-Agent sent to Streaming HTTP and SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. connectors and identifies itself as Runlayer on OAuth requests, enabling out-of-the-box connectivity to servers that check the calling client or reject OAuth requests without a User-Agent.

    +1 more show less

    • Runlayer now renews an unused connector's sign-in every few days for up to 90 days without use, keeping idle connectors connected.

    6 details in Everything

    • New detection AI Watch Detect: 22 open-source coding harnesses
    • Updated integration Looker and LaunchDarkly MCP connectors — generally available
25. 1.28.1381 - Secret stores and agent eval scoring (2026-10-15) Oct 15, 2026 · issue 110

    Adds secret stores (AWS Secrets Manager), agent eval scoring, Terraform-managed scanner/AI Watch defaults, plugin-scoped tokens, and hardened connector sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..

    • Adds secret stores: keep connector credentials in your own AWS Secrets Manager and reference them in connector headers and environment variables; workspace admins manage stores under Settings.
    • Adds Matches expected output eval scorer for agent runs — save the expected answer on a reviewed run, then replay it to regression-test prompt and model changes.
    • Adds runlayer_security_scanner_settings Terraform resource to manage organization-wide security scanner defaults as code; self-hosted deployments require backend 1.28.1220 or later.
    • Adds runlayer_ai_watch_enforce_entry Terraform resource to manage each AI Watch Enforce allowlist or Protect denylist entry (remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. URL, stdio package, or built-in) as code; self-hosted deployments require backend 1.28.1171 or later.
    • Adds PATCH /ai-watch/policy-rules/{id} to edit the organization-wide AI Watch policy, now an editable default (Monitor with Sessions off) rather than a computed value; the rule list shows which deployments differ from it.

    +7 more show less

    • Adds components.extendDB opt-in to Kubernetes operator deployments to provision DynamoDB-compatible token storage via ExtendDB on the instance Postgres (Preview; requires botocore >= 1.31 / boto3 >= 1.28 or JS v3 / Java 2 / Go v2 and AWS_ENDPOINT_URL_DYNAMODB injection).
    • Adds plugin-scoped on-behalf-of tokens for strict-mode agent accounts, scoped to a plugin's OAuth connectors that already have a session grant.
    • Connector environment variables: stdio connectors no longer accept dynamic-loader variables (LD_*, DYLD_*, GCONV_PATH) in their environment or inherit list.
    • Hosted stdio connectors (npx, uvx, uv) now accept only a defined allowlist of package-selection options and UV_* / npm_config_* environment variable names; file-reading options (--env-file, --userconfig), filesystem path values, and variables such as HOME, PATH, PREFIX, XDG_*, NODE_PATH, and PYTHONPATH are refused for hosted runners.
    • Exposed paths listed in service.expose on deployed MCP servers no longer receive users' Runlayer cookies or set cookies, and their responses run in a sandboxed context blocking scripts and forms.
    • Tool Output Offloading: jq filters AI clients run on offloaded outputs are now sandboxed and cannot read server environment variables or files.
    • Local connectors now run only on the user's machine through the Runlayer CLI; the gateway refuses to start or dial them on any proxy path.

    12 details in Everything

    • New detection AI Watch Detect: second wave of vendor coding agents with China-based default endpoints
    └──▷ BREAKING ON UPGRADE

    • !The gateway refuses to start or dial connectors configured for local deployment on any proxy path; a direct POST /api/v1/proxy/{id}/mcp call to one is recorded as a security violation and can end the caller's session.
    • !stdio connectors that carry LD_*, DYLD_*, or GCONV_PATH variables in their environment or inherit list will be refused at launch.
    • !Hosted stdio connectors (npx, uvx, uv) that pass file-reading options (--env-file, --userconfig), filesystem path values, or disallowed environment variable names (HOME, PATH, PREFIX, XDG_*, NODE_PATH, PYTHONPATH) are refused on save and at launch.
26. announced Oct 14, 2026 · issue 109

    Runlayer adds per-agent network access policies — allow/block lists enforced at the network layer for every agent sandbox connection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Restrict a finance agent to only its required external hosts, preventing exfiltration to arbitrary endpoints even if the agent is prompt-injected.
    📍In the agent's settings, set the network access policy mode to Allow list and add entries such as api.salesforce.com and *.hubspot.com. All other outbound connections from the agent sandbox are denied.
    • Adds per-agent network access policies with three modes — Unrestricted, Allow list, and Block list — configurable in each agent's settings or via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Writes every connection attempt to the audit log with the run, agent, host, and outcome, without logging sensitive data such as request bodies or credentials.
    • Fails closed: if a network policy cannot be enforced, the agent does not run.
    • Network access policies are available for Runlayer-hosted agents and self-hosted AWS deployments.

    4 details in Everything

27. 1.28.1284 - Vendor agent detection and thread replies (2026-10-13) Oct 13, 2026 · issue 108

    Session Grants API gains single-grant fetch by ID; agents reply to own Slack thread posts without @mention when Thread follow-ups is Anyone in the thread.

    • Adds GET by ID to the Session Grants API so automation can fetch a single session grant in the same shape returned by create/update, without listing all grants for an agent account.
    • Enables agents to answer replies to their own Slack posts (for example, scheduled-run updates) without an @mention when Thread follow-ups is set to Anyone in the thread.

    2 details in Everything

    • New detection Vendor coding agent MCP server detection — first wave
    • New detection WSL per-user MCP config file detection for cross-platform coding agent clients
28. 1.28.1271 - Bot thread monitoring and unified sessions (2026-10-13) Oct 13, 2026 · issue 108

    Runlayer 1.28.1271 adds bot thread monitoring, headless OAuth via --no-browser, new API endpoints for webhooks, routing rules, and a DoorDash connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Authorize a local HTTP/SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector on a headless server where no browser is available, then complete the OAuth flow over SSH with curl.
    copy

    $ runlayer run --no-browser

    • Adds runlayer run --no-browser flag for headless OAuth, letting you authorize local HTTP/SSE connectors on a browserless host and complete login with curl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a GET endpoint to read a single agent webhook by its ID; webhook creation now returns fields at the top level of the response (nested webhook object still returned for existing integrations).
    • Adds API support for setting a routing rule's evaluation position when creating or updating it, enabling automation to manage LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway rule order one rule at a time.
    • Adds API endpoints that return stored scanner overrides for an MCP client, a local tool family, or a single local tool in the same shape that updating them returns.
    • Adds API support for setting hidden clients in the same request that updates other organization settings.

    +5 more show less

    • Adds API support for setting a skill's tags and (for skill admins) marking it verified at creation time, without a follow-up update.
    • Adds Servers API response parity: creating or updating a server now returns the same response as fetching it, including access level and allowed clients.
    • Adds Teams API calls to fetch a single group bound to a team and bind a group in one idempotent call by group ID.
    • Adds Also evaluate their replies in a thread option to Slack channel monitors, enabling monitors to act on bot or app replies inside a thread (one reply per thread triggers a run).
    • Adds Add me as collaborator button in an agent's Slack settings, letting workspace admins become collaborators on a Runlayer-managed Slack app.
    • Adds runlayer run --no-browser flag for headless OAuth, letting you authorize local HTTP/SSE connectors on a browserless host and complete login with curl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds API endpoints that return stored scanner overrides for an MCP client, a local tool family, or a single local tool in the same shape that updating them returns.
    • Adds Also evaluate their replies in a thread option to Slack channel monitors, enabling monitors to act on bot or app replies inside a thread (one reply per thread triggers a run).
    • Adds Add me as collaborator button in an agent's Slack settings, letting workspace admins become collaborators on a Runlayer-managed Slack app.

    6 more in Everything

29. 1.28.1233 - Claude subscriptions and policy impact checks (2026-10-12) Oct 12, 2026 · issue 108

    Runlayer: Adds runlayer_plugin Terraform resource to define plugins with their connectors and skills as code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds runlayer_agent_schedule Terraform resource to deploy an agent's cron schedules alongside the agent itself.
    • Adds a new endpoint to return a single LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway usage rule by ID.
    • Adds a new endpoint to fetch a single LLM gateway virtual key by ID (secret shown only at creation).

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Updating a tool's security settings now returns the scanner overrides (tool name plus settable fields) instead of the full stored settings row — automation that parsed the previous full-row response will need to be updated.
30. 1.28.1233 (2026-10-12) Oct 12, 2026 · issue 106

    New Terraform resources for plugins, schedules, teams, org settings, policy attributes, and AI Watch; new single-resource API endpoints across gateway, MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., OAuth, and AI providers; pre-save policy impact checks.

    • Adds runlayer_plugin resource to the Terraform provider to define plugins with their connectors and skills as code.
    • Adds runlayer_agent_schedule resource to the Terraform provider to deploy an agent's cron schedules alongside the agent itself.
    • Adds runlayer_team and runlayer_organization resources to the Terraform provider to manage teams and organization settings as code.
    • Adds runlayer_policy_attribute_setting resource to the Terraform provider to define policy-referenceable attributes as code.
    • Adds Terraform provider resources to manage AI Watch enforcement settings, per-user AI Watch policies, and per-tool scanner overrides on a connector.

    +18 more show less

    • Adds a new endpoint to read a single AI Watch enforce entry by ID, and endpoints to list, read, or delete a single user's scoped AI Watch policies.
    • Adds a new endpoint to return one tool's stored scanner overrides; updating a tool's security settings now returns those overrides (tool name plus settable fields) instead of the full stored settings row.
    • Adds a new endpoint to return a server's stored scanner overrides in the same shape that updating them returns.
    • Adds a new endpoint to return a single LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway usage rule by ID, in the same shape as create/update responses.
    • Adds a new endpoint to fetch a single LLM gateway virtual key by ID, in the same shape as list and update endpoints.
    • Adds a new endpoint to fetch a single MDM configuration by ID, returning the same details as updating it.
    • Adds a new endpoint to fetch a single pre-registered OAuth client by ID, in the same shape as the update response.
    • Adds a new endpoint to return a single private connection by ID, in the same shape as list and delete endpoints.
    • Adds a new endpoint to fetch a single AI provider by ID, in the same shape as create and update responses (API key is masked, never returned).
    • Adds a new endpoint to read and set the organization's recommended agent model as a single setting.
    • Adds a new endpoint to return a package's update policy in the same shape as the update response, including org defaults.
    • Adds a new endpoint to return a single LLM gateway routing rule by ID, in the same shape as create/update responses.
    • Adds endpoints to fetch a single team member and to add a member or set their role in one idempotent call by user ID.
    • Updates the Skills API to create or update a skill with its complete set of files in one request and read every file's content back.
    • Updates the Teams API so creating or updating a team returns the same details as fetching it, including shared skill, plugin, agent, and artifact counts.
    • The Runlayer Assistant, policy builder chat, and any MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client can now test a policy impact before it is saved, showing who gains or loses which access by name with divergent cases called out first.
    • Creating or editing a policy through Runlayer tools now returns the access impact (who gains or loses which access) before the change is saved, and holds back changes where some users' access moves the opposite direction until the agent acknowledges the result.
    • LLM Gateway now routes image generation requests (/v1/images/*) through the gateway.

    23 details in Everything

    • New detection 'Claw' family personal agent detection
    • New integration Muse Code hook integration
    • New integration Bring-your-own Claude subscription via LLM Gateway
    • New supported platform GPT-6.1 Sol model support for agents
31. announced Oct 12, 2026 · issue 109

    Runlayer adds enterprise governance for Meta Muse, including a single MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway endpoint, shadow AI discovery, and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-exportable audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a single Runlayer plugin endpoint that routes all Muse tool calls through Runlayer's MCP gateway, replacing ungoverned per-connector MCP setups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds shadow AI discovery that detects when Muse is used inside company systems without Runlayer governance and surfaces per-employee activity.
    • Adds on-behalf-of authentication for Muse, with employee identity sourced from your IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. so Muse acts within that person's permissions only.
    • Adds fine-grained policy and human-approval rules for Muse tool calls — including example controls such as blocking Gmail sends to external domains.
    • Adds audit logging of every Muse tool call, exportable to a SIEM.

    +2 more show less

    • Adds runtime security scanning of every Muse tool call for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., credential exposure, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
    • Supports governing Muse across 18,000+ MCPs plus custom connectors for internal systems through a single approved endpoint.

    7 details in Everything

32. 1.28.1158 - Slack bot triggers and Deploy autoscaling (2026-10-10) Oct 10, 2026 · issue 108

    Runlayer 1.28.1158 adds Slack bot filtering, Deploy autoscaling via infrastructure.scaling, AI Watch browser-extension and Office add-in detection, and signed support-acces⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Supply Runlayer's public signing keys for signed support-access on a Kubernetes deployment before upgrading.
    runlayer-app Secret copy

    # In the runlayer-app Secret
    DEBUG_OPS_REQUEST_SIGNING_JWKS='{"keys":[{...}]}'

    Restrict a Slack channel monitor to trigger only from a specific alerting bot, selected from recently active bots in that channel.
    📍In the channel monitor settings, enable Respond to messages from bots, select Only specific bots and apps, then pick your alerting bot from the list of recently active bots or paste a link to one of its messages.
    • Adds infrastructure.scaling config to run Runlayer Deploy MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers as multiple replicas — fixed count or CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./network autoscaled — with each MCP session pinned to one replica.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds DEBUG_OPS_REQUEST_SIGNING_JWKS environment variable (Kubernetes runlayer-app Secret) and debug_ops_request_signing_jwks Terraform input (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) to supply Runlayer's trusted public signing keys for signed, encrypted diagnostic support-access requests.
    • Adds long-lived API keys for agent accounts, creatable from the Manage API keys menu, usable on the MCP gateway in place of the client credentials flow — unavailable when Require DPoP, Strict mode, or Enforce audience is on.
    • Adds AI Watch Detect inventory of browser extensions across Chrome, Edge, Brave, Chromium, and Firefox profiles, surfacing AI extensions (including Claude in Chrome, ChatGPT browser control, Perplexity, Grammarly, Browser MCP, Playwright MCP Bridge, and meeting recorders) on the Shadow AI page with store, enabled state, install method, and sideload status.
    • Adds AI Watch Detect inventory of Office add-ins for Excel, Word, PowerPoint, Outlook, and OneNote on Windows and macOS, surfacing AI add-ins (including Claude for Excel/Word/PowerPoint/Outlook and the ChatGPT add-in) on the Shadow AI page with publisher, version, host application, store origin, and sideload status.

    +5 more show less

    • Adds per-bot filtering to Slack channel monitors — choose Respond to messages from bots to respond to all bots/apps or only named ones selected from recently active bots or a message link; noisy bots are rate-limited per channel and the agent never triggers itself.
    • Adds admin control to set the model, provider (including OpenAI-compatible gateways), and model settings for the Runlayer Assistant from Settings → AI Providers.
    • Adds audit-log events for prompt discovery via connectors (listing a connector's prompts through Runlayer), matching existing coverage for tools and resources; events also appear in SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. exports.
    • Adds OAuth Scopes policy conditions that always reflect the scopes the upstream provider granted, not the scopes an MCP client requested at reconnect.
    • Shows readable model names for custom Bedrock inference-profile ARNs in the model picker (e.g. Claude Sonnet 4.5 (inference profile)), requiring bedrock:GetInferenceProfile on the provider's role.
    • Adds infrastructure.scaling config to run Runlayer Deploy MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers as multiple replicas — fixed count or CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./network autoscaled — with each MCP session pinned to one replica.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds DEBUG_OPS_REQUEST_SIGNING_JWKS environment variable (Kubernetes runlayer-app Secret) and debug_ops_request_signing_jwks Terraform input (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) to supply Runlayer's trusted public signing keys for signed, encrypted diagnostic support-access requests.
    • Adds long-lived API keys for agent accounts, creatable from the Manage API keys menu, usable on the MCP gateway in place of the client credentials flow — unavailable when Require DPoP, Strict mode, or Enforce audience is on.
    • Adds AI Watch Detect inventory of browser extensions across Chrome, Edge, Brave, Chromium, and Firefox profiles, surfacing AI extensions (including Claude in Chrome, ChatGPT browser control, Perplexity, Grammarly, Browser MCP, Playwright MCP Bridge, and meeting recorders) on the Shadow AI page with store, enabled state, install method, and sideload status.
    • Adds AI Watch Detect inventory of Office add-ins for Excel, Word, PowerPoint, Outlook, and OneNote on Windows and macOS, surfacing AI add-ins (including Claude for Excel/Word/PowerPoint/Outlook and the ChatGPT add-in) on the Shadow AI page with publisher, version, host application, store origin, and sideload status.

    +2 more show less

    • Adds per-bot filtering to Slack channel monitors — choose Respond to messages from bots to respond to all bots/apps or only named ones selected from recently active bots or a message link; noisy bots are rate-limited per channel and the agent never triggers itself.
    • Adds admin control to set the model, provider (including OpenAI-compatible gateways), and model settings for the Runlayer Assistant from Settings → AI Providers.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !ECS deployments must supply Runlayer's trusted public signing keys via the debug_ops_request_signing_jwks Terraform input before upgrading — missing or unusable keys disable all diagnostic support access.
    • !Kubernetes deployments must set DEBUG_OPS_REQUEST_SIGNING_JWKS in the runlayer-app Secret before upgrading — missing or unusable keys disable all diagnostic support access.
    • !The AI Watch backend must be upgraded before the AI Watch endpoint; unrecognized browser extensions and Office add-ins remain hidden until both sides are updated.
33. 1.28.1158 (2026-10-10) Oct 10, 2026 · issue 101

    Runlayer 1.28.1158 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server autoscaling, agent-account API keys, Office add-in Shadow AI detection, and signed support-access encryption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Provide signed-support-access signing keys to a Kubernetes deployment so diagnostic requests remain available after upgrading.
    yaml copy

    apiVersion: v1
    kind: Secret
    metadata:
      name: runlayer-app
    stringData:
      DEBUG_OPS_REQUEST_SIGNING_JWKS: '<jwks-json>'

    Create a long-lived API key for an agent account to authenticate against the MCP gateway without the client credentials flow.
    📍In the Runlayer console, go to the agent account's detail page → Manage API keys → Create key. Copy the returned key and use it as a bearer token when calling the MCP gateway.
    • Adds infrastructure.scaling to the infrastructure module for scaling deployed MCP servers at a fixed replica count or autoscaled on CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and network use, with each MCP session pinned to one replica.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds long-lived API keys for agent accounts, creatable from the Manage API keys menu, usable on the MCP gateway in place of the client credentials flow; unavailable when Require DPoP, Strict mode, or Enforce audience is on.
    • Adds DEBUG_OPS_REQUEST_SIGNING_JWKS (Kubernetes Secret) and debug_ops_request_signing_jwks Terraform input (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) to supply trusted public signing keys for signed, encrypted support-access diagnostic requests; missing or unusable keys disable diagnostic access entirely.
    • AI Watch Detect now inventories Office add-ins (Excel, Word, PowerPoint, Outlook, OneNote) on Windows and macOS and surfaces AI ones — including Claude for Excel/Word/PowerPoint/Outlook and the ChatGPT add-in — on the Shadow AI page, reporting publisher, version, host application, store origin, and sideload status.
    • AI Watch Detect now inventories browser extensions across Chrome, Edge, Brave, Chromium, and Firefox profiles and surfaces AI ones — including Claude in Chrome, ChatGPT browser control, Perplexity, Grammarly, Browser MCP, Playwright MCP Bridge, and meeting recorders — on the Shadow AI page, reporting store, enabled state, installation method, and whether sideloaded.

    +5 more show less

    • Adds bot-filtering to Slack channel monitors: with Respond to messages from bots on, monitors can be scoped to specific bots or apps selected by name from recently-posting bots or by message link, instead of requiring Slack app IDs.
    • Prompt discovery (listing a connector's prompts via Runlayer) now records audit events visible in the audit log and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. exports, consistent with existing tool and resource listing events.
    • Admins can now select the model, provider (including an OpenAI-compatible gateway), and model settings for the Runlayer Assistant from Settings → AI Providers.
    • Subagents running on the Pi harness now inherit the parent agent's sandbox guidance, memory context, and skills, and can browse, use memory, and recover connectors.
    • OAuth Scopes policy conditions now always reflect scopes granted by the upstream provider, not those requested by a reconnecting MCP client.
    • Adds infrastructure.scaling to the infrastructure module for scaling deployed MCP servers at a fixed replica count or autoscaled on CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and network use, with each MCP session pinned to one replica.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds long-lived API keys for agent accounts, creatable from the Manage API keys menu, usable on the MCP gateway in place of the client credentials flow; unavailable when Require DPoP, Strict mode, or Enforce audience is on.
    • Adds DEBUG_OPS_REQUEST_SIGNING_JWKS (Kubernetes Secret) and debug_ops_request_signing_jwks Terraform input (ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.) to supply trusted public signing keys for signed, encrypted support-access diagnostic requests; missing or unusable keys disable diagnostic access entirely.
    • AI Watch Detect now inventories Office add-ins (Excel, Word, PowerPoint, Outlook, OneNote) on Windows and macOS and surfaces AI ones — including Claude for Excel/Word/PowerPoint/Outlook and the ChatGPT add-in — on the Shadow AI page, reporting publisher, version, host application, store origin, and sideload status.
    • AI Watch Detect now inventories browser extensions across Chrome, Edge, Brave, Chromium, and Firefox profiles and surfaces AI ones — including Claude in Chrome, ChatGPT browser control, Perplexity, Grammarly, Browser MCP, Playwright MCP Bridge, and meeting recorders — on the Shadow AI page, reporting store, enabled state, installation method, and whether sideloaded.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !ECS deployments must supply Runlayer's trusted public signing keys via the Terraform debug_ops_request_signing_jwks input before upgrading; the backend must be upgraded before the AI Watch endpoint or unrecognized add-ins and extensions will stay hidden.
    • !Kubernetes deployments must set DEBUG_OPS_REQUEST_SIGNING_JWKS in the runlayer-app Secret before upgrading; missing or unusable keys disable all diagnostic support access.
34. 1.28.1115 - Agent inventory and artifact folders (2026-10-09) Oct 9, 2026 · issue 108

    Adds agent Inventory tab with bulk management, artifact folders via set_artifact_folder/create_artifact, per-user hook daemon on by default, custom model pricing in Settings → AI Providers, and policy-aware audit logs.

    • New supported platformAdds Inventory tab to the Agents page for bulk model upgrades and disables, replacing the Unused tab.
    • Adds artifact folder organization with set_artifact_folder tool and folder option on create_artifact, browsable from the Artifacts page.
    • Updated detectionEnables per-user hook daemon by default on enrolled macOS and Windows devices; verify with aiwatch daemon status.
    • Lets admins configure input, output, cache-read, and cache-write prices per custom model in Settings → AI Providers.
    • Adds Allowed by row to audit log tool-call details, listing policies that permitted each allowed call.

    +4 more show less

    • Extends Run now to all users a scheduled task runs for, not only editors.
    • Extends agent run failure Slack DM alerts to webhook-triggered runs; toggle renamed to Run failures, on by default.
    • Deactivated users' in-progress agent runs can no longer post or react in Slack.
    • workspace removed as a default allowed built-in MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for Claude Code; must be re-added explicitly.

    9 details in Everything

    • New detection Grok Bot desktop app detection
    • New detection Meta Muse desktop app detection
    • New detection Meta Muse Code terminal agent scanning
    • Retired detection Legacy macOS Detect script-based agent retired by installer
    • New integration Muse web app session tracking in browser extension
    └──▷ BREAKING ON UPGRADE

    • !workspace is no longer a default allowed built-in MCP server for Claude Code and has been removed from existing custom allowed lists — add it back explicitly in Enforce policy only if you accept that a user's own Claude Desktop MCP server can take that name.
35. 1.28.1115 (2026-10-09) Oct 9, 2026 · issue 098

    Adds artifact folders, agent inventory tab, per-user hook daemon, custom model pricing, Claude Haiku 5.5 support, and richer audit-log policy attribution.

    • Adds folder option on create_artifact and the new set_artifact_folder tool so agents can file published artifacts into nested folder paths using / as a separator.
    • Adds aiwatch daemon status shell command to check whether the per-user hook daemon is running on enrolled macOS and Windows devices.
    • Adds an Inventory tab on the Agents page listing every editable agent with owner, model, recent runs, and upkeep issues (idle, never run, newer model available, owner left), with bulk model-upgrade and bulk-disable actions; replaces the Unused tab.
    • Adds per-custom-model input, output, cache-read, and cache-write price configuration under Settings → AI Providers so agent-run cost and budget limits price custom models correctly.
    • Adds Claude Haiku 5.5 as a selectable agent model via the Anthropic API or AWS Bedrock, with adaptive thinking effort settings.

    +6 more show less

    • Adds Run now action on scheduled tasks for every person the task runs as, even users without edit access.
    • Adds Allowed by row to audit-log entries for allowed tool calls and resource reads, listing the policies that permitted them with links to each policy.
    • Adds per-user hook daemon enabled by default on enrolled macOS and Windows devices, giving Claude Code, Codex, and other hook-driven clients faster responses without spawning a new process per call; Cursor and Goose hooks now carry a 120 s timeout.
    • Adds Slack DM failure alerts for agents without their own Slack app when any webhook or scheduled run fails (not only failed-to-start runs); the toggle is renamed Run failures and is on by default.
    • Adds a unified, searchable agent model picker that groups models by AI provider with starred favorites and an inline reasoning-effort menu.
    • Adds Slack channel monitor option to receive messages from other apps' bots (off by default for new monitors).

    11 details in Everything

    • New detection Grok Bot desktop app detection (xAI)
    • New detection Meta Muse desktop app detection (macOS)
    • New detection Meta Muse Code terminal agent scanning
    • Updated detection ChatGPT desktop app version reporting on Windows
    • New detection Muse web app (muse.ai) session detection via browser extension
    • Retired detection Legacy macOS Detect script-based agent (com.runlayer.scan) retired by installer
    └──▷ BREAKING ON UPGRADE

    • !The workspace built-in MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server is no longer trusted by default for Claude Code and is removed from existing custom allowed lists; add it back explicitly only if your policy accepts it.
36. 1.28.1078 - Agent usage feed and faster hooks (2026-10-07) Oct 7, 2026 · issue 108

    Runlayer 1.28.1078 adds a GET /api/v1/agents/metrics/usage feed and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools for agent usage reporting, plus faster Monitor-mode hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull token and cost usage for all agents into a data warehouse or BI tool on a schedule.
    copy

    $ curl -s -H "Authorization: Bearer <token>" https://app.runlayer.com/api/v1/agents/metrics/usage

    Ask your AI client to list who is consuming each agent and how many tokens they have used, using the new MCP tools.
    📍Use the get_agent_usage_report tool (via Runlayer MCP) to retrieve creator, consumer, sharing, and token usage for all agents; then call list_agent_usage_consumers to break down consumers per agent.
    • Adds GET /api/v1/agents/metrics/usage endpoint to pull every agent's creator, consumers, sharing, and token and cost usage into a BI tool or data warehouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds get_agent_usage_report and list_agent_usage_consumers tools to the Runlayer MCP so AI clients can query agent usage directly.
    • Reduces latency in AI Watch Monitor mode by delivering tool-call hook answers before output scanning runs, so coding-agent sessions no longer block on scanner latency per tool call.
    • Adds sorting to the Artifacts page by newest, oldest, most recently updated, or least recently updated.
    • Adds a clickable failed-runs count under the Success rate on an agent's Monitor tab that opens Sessions pre-filtered to failed runs.
    • Adds GET /api/v1/agents/metrics/usage endpoint to pull every agent's creator, consumers, sharing, and token and cost usage into a BI tool or data warehouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds get_agent_usage_report and list_agent_usage_consumers tools to the Runlayer MCP so AI clients can query agent usage directly.

    3 more in Everything

37. 1.28.1078 (2026-10-07) Oct 7, 2026 · issue 097

    Runlayer adds GET /api/v1/agents/metrics/usage and two MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools for agent usage reporting, plus artifact sort controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull per-agent token and cost usage into a data warehouse or BI dashboard for chargeback or governance reporting.
    copy

    $ curl -H 'Authorization: Bearer <token>' 'https://app.runlayer.com/api/v1/agents/metrics/usage'

    • Adds GET /api/v1/agents/metrics/usage endpoint to pull every agent's creator, consumers, sharing, and token and cost usage into a BI tool or data warehouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds get_agent_usage_report and list_agent_usage_consumers MCP tools in Runlayer MCP so AI clients can query agent usage, sharing, and token data directly.
    • Adds sorting to the Artifacts page by newest, oldest, most recently updated, or least recently updated.
    • Adds a clickable failed-runs count under Success rate on an agent's Monitor tab that opens Sessions filtered to failed runs.
    • Improves AI Watch Monitor mode so tool-call hooks receive their answer before output scanning runs, removing scanner latency from every tool-call round-trip in coding-agent sessions.
    • Adds GET /api/v1/agents/metrics/usage endpoint to pull every agent's creator, consumers, sharing, and token and cost usage into a BI tool or data warehouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds get_agent_usage_report and list_agent_usage_consumers MCP tools in Runlayer MCP so AI clients can query agent usage, sharing, and token data directly.

    3 more in Everything

38. 1.28.1073 - Scoped AI Watch policies, allowed agents (2026-10-07) Oct 7, 2026 · issue 108

    Adds scoped AI Watch policy rules API, plugin-scoped agent tokens, allowed-agent handoff controls, schedule_continuation for agents, and artifact embed links.

    • Adds GET /ai-watch/policy-rules/check?device_id=… to preview the effective AI Watch policy a specific machine receives before applying changes.
    • Adds the /ai-watch/policy-rules API to set AI Watch mode, session capture, browser controls, detection phases, and scan bounds per team, group, user, or device without a separate deployment.
    • Adds plugin-scoped agent on-behalf-of tokens by passing a plugin's MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. URL as resource, restricting the token to that plugin's endpoint only.
    • Adds Allowed agents section on an agent's detail page so each user of a shared agent can choose which agents it may hand work to on their behalf.
    • Adds schedule_continuation for agents to end a run and resume the same conversation after a delay of 1 minute to 24 hours.

    +8 more show less

    • Adds webhook source allowlists for self-hosted ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. deployments to permit integration source IP ranges for agent webhook invocation.
    • Adds Approve always option on agent handoff prompts, which adds the agent to Allowed agents so future handoffs skip the approval prompt.
    • Adds /artifacts/<id>/embed link to share an artifact full-screen without the Runlayer header.
    • Batches AI Watch hook telemetry to disk and delivers up to 100 events per request, surviving daemon restarts and short outages.
    • Reduces AI Watch inventory to a single request per scan, uploading content only when Runlayer has not seen it before.
    • Skips redundant hook round trips in AI Watch Protect mode for tool calls already routed through the Runlayer gateway.
    • Masks redacted tool-call inputs in the run transcript on Pi agents when a scanner's Mask action redacts a secret.
    • Hides tokens, keys, and credential-like values in approval requests in the web app, Slack, and Microsoft Teams.

    13 details in Everything

    • New integration TheirStack MCP connector
    • New supported platform Island Enterprise Browser extension support
    └──▷ BREAKING ON UPGRADE

    • !An agent account with no Runlayer-hosted agent behind it (an external agent using client credentials) can no longer call run_agent.
    • !Scheduled and triggered agent handoffs now hand off only to agents listed in Allowed agents; targets from the prior 30 days are auto-added up to 50 per person and calling agent.
39. 1.28.1019 - Voice messages and agent handoff approvals (2026-10-06) Oct 6, 2026 · issue 108

    Runlayer 1.28.1019 adds in-chat voice input, agent handoff approvals, and Bedrock connection validation with model selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Scope your Bedrock provider to only the models your account has actually enabled, so users cannot attempt to invoke unavailable models.
    📍In your AWS IAM role for Runlayer, add the following permissions, then go to Runlayer › AI Providers › AWS Bedrock › Validate connection: - bedrock:ListFoundationModels - bedrock:ListInferenceProfiles - bedrock:GetFoundationModelAvailability Runlayer will list your enabled models with all checked by default; uncheck any you want to hide.
    Send a voice prompt to an agent without typing, useful when dictating a long or complex task during an active conversation.
    📍In an open agent chat, click the microphone icon in the message box, speak your prompt, then click stop. Runlayer transcribes the audio using your workspace OpenAI provider into the message box for review before you send.
    Review all runs a specific scheduled task has started, without manually filtering the Sessions tab.
    📍Open the agent › Scheduled tasks › click the task › in the edit dialog, click View runs. The Sessions tab opens pre-filtered to only the runs that task triggered.
    • Adds bedrock:ListFoundationModels, bedrock:ListInferenceProfiles, and bedrock:GetFoundationModelAvailability IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions to AWS Bedrock provider setup, enabling Validate connection to check the role and list only the models your account has enabled in that Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds agent handoff approvals: when in a conversation, an agent hands work to another agent only after you approve, showing the target agent and owner, the task it will send, and the agent's summary of what it shares and expects back.
    • Adds in-chat voice input — click the microphone in the message box, speak, then click stop; Runlayer transcribes the recording into the message box using your workspace's OpenAI provider.
    • Adds a View runs button to a scheduled task's edit dialog, opening the agent's Sessions tab filtered to runs that task started.
    • Moves run limits and cost budgets from the agent's Settings tab to the Monitor tab as a Limits card showing usage against each limit, with an Edit limits button.

    +2 more show less

    • Moves run-result and budget-alert DMs for agents with their own Slack app to a new Notifications section in the app's Slack settings; Run results now also controls the scheduled run failure DM.
    • Adds approval requirement for setting up or changing a schedule, trigger, webhook, or Slack channel monitor from within a conversation.
    • Adds bedrock:ListFoundationModels, bedrock:ListInferenceProfiles, and bedrock:GetFoundationModelAvailability IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions to AWS Bedrock provider setup, enabling Validate connection to check the role and list only the models your account has enabled in that Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds agent handoff approvals: when in a conversation, an agent hands work to another agent only after you approve, showing the target agent and owner, the task it will send, and the agent's summary of what it shares and expects back.
    • Adds in-chat voice input — click the microphone in the message box, speak, then click stop; Runlayer transcribes the recording into the message box using your workspace's OpenAI provider.
    • Adds a View runs button to a scheduled task's edit dialog, opening the agent's Sessions tab filtered to runs that task started.
    • Adds approval requirement for setting up or changing a schedule, trigger, webhook, or Slack channel monitor from within a conversation.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The agent's Settings tab is removed; run limits and cost budgets are now on the Monitor tab under a Limits card.
40. 1.28.1019 (2026-10-06) Oct 6, 2026 · issue 096

    Runlayer 1.28.1019 adds voice input to agent chat, agent handoff approvals, and live Bedrock model validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Grant a Bedrock IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role the minimum permissions needed so Runlayer can validate the connection and enumerate only the models your account has actually enabled.
    json copy

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "bedrock:ListFoundationModels",
            "bedrock:ListInferenceProfiles",
            "bedrock:GetFoundationModelAvailability"
          ],
          "Resource": "*"
        }
      ]
    }

    Approve an agent handoff mid-conversation so one agent can delegate a task to a second agent, with full visibility of the target agent, its owner, and the task being sent.
    📍1. In an active agent conversation, wait for the handoff approval prompt to appear. 2. Review the target agent name, its owner, and the truncated task summary. 3. Click Approve to allow the handoff, or Deny to cancel it and continue in the current agent.
    Use voice input to query an agent when typing is impractical — useful during live investigations or hands-free triage sessions.
    📍1. Open an agent's chat view. 2. Click the microphone icon in the message box and speak your query. 3. Click Stop — Runlayer transcribes the audio using your workspace's OpenAI provider. 4. Edit the transcribed text if needed, then send.
    • Adds bedrock:ListFoundationModels, bedrock:ListInferenceProfiles, and bedrock:GetFoundationModelAvailability IAM actions to the AWS Bedrock provider setup, enabling live connection validation that lists and checks only the models your account has enabled in that Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds voice input to agent chat: click the microphone in the message box, speak, then click stop — Runlayer transcribes the recording into the message box using your workspace's OpenAI provider.
    • Adds an approval gate for agent handoffs: before an agent passes work to another agent mid-conversation, the user must approve, with the target agent, its owner, and the task shown.
    • Adds approval gate coverage to schedule, trigger, webhook, and Slack channel monitor changes made from within a conversation.
    • Adds a View runs button to a scheduled task's edit dialog, opening the agent's Sessions tab filtered to runs that task started.

    +3 more show less

    • Moves run limits and cost budgets from the Settings tab to a Limits card on the Monitor tab, with an Edit limits button showing usage against each limit.
    • Adds a Notifications section in the Slack app settings for agents with their own Slack app, consolidating run-result and budget-alert DMs; Run results now also controls the scheduled run failure DM.
    • Adds save confirmation to agent settings changes, explaining side effects (such as Code mode turning Procedures off) and showing the actual reason when a save fails.
    • Adds bedrock:ListFoundationModels, bedrock:ListInferenceProfiles, and bedrock:GetFoundationModelAvailability IAM actions to the AWS Bedrock provider setup, enabling live connection validation that lists and checks only the models your account has enabled in that Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds voice input to agent chat: click the microphone in the message box, speak, then click stop — Runlayer transcribes the recording into the message box using your workspace's OpenAI provider.
    • Adds an approval gate for agent handoffs: before an agent passes work to another agent mid-conversation, the user must approve, with the target agent, its owner, and the task shown.
    • Adds approval gate coverage to schedule, trigger, webhook, and Slack channel monitor changes made from within a conversation.
    • Adds a View runs button to a scheduled task's edit dialog, opening the agent's Sessions tab filtered to runs that task started.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The agent's Settings tab is removed; run limits and cost budgets are now on the Monitor tab under the Limits card.
41. docs update Oct 3, 2026 · issue 093

    Runlayer: Requires topicCpu.rev to be configured for Procedures — creating or validating a Procedure without it returns 503.

    └──▷ USE IT
    Enable the self-hosted Rev decision model so the Runlayer Operator runs local risk scoring instead of calling an external service.
    yaml copy

    images:
      topicCpuRev: REGISTRY/toolguard:runlayer-rev-guard-TAG
    
    topicCpu:
      rev:
        enabled: true
        gunicornWorkers: 1

    Inject additional environment variables into every backend-image workload without conflicting with operator-managed names.
    yaml copy

    extraEnv:
      - name: MY_CUSTOM_VAR
        value: "my-value"
      - name: ANOTHER_VAR
        value: "another-value"

    Configure the OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. observability sidecar to export telemetry health metrics to a reachable collector endpoint.
    yaml copy

    observability:
      otlp:
        endpoints:
          - name: runlayer-metrics
            protocol: http
            endpoint: http://otel-collector.monitoring.svc:4318

42. 1.28.991 - Agent handoffs and delegation review (2026-10-02) Oct 2, 2026 · issue 108

    Runlayer 1.28.991 adds agent-to-agent handoffs, Cursor billing integration, named env-var inheritance for local MCPs, and a delegation review policy template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Require human approval for every agent-to-agent delegation — including scheduled runs — before it executes, to enforce a governance boundary in multi-agent workspaces.
    📍In the Runlayer console, go to Policies and create a new policy using the Review agent delegation template, then attach it to the workspace or the agents you want gated.
    Pass a user's local GitHub token and Node options into a local MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. without storing the values in Runlayer — useful when the MCP needs per-user credentials at runtime.
    📍On the local stdio connector settings page, add GH_TOKEN and NODE_OPTIONS to the list of inherited environment variables, then save. Runlayer stores only the names; values are read from each user's shell when runlayer run starts the MCP.
    • Adds GH_TOKEN, NODE_OPTIONS, and other named environment variables to the inherit list on a local stdio connector so runlayer run copies each user's shell values into the MCP process without storing the values server-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Can hand work to other agents toggle in agent settings to control whether an agent can discover and delegate tasks to other agents.
    • Adds a Review agent delegation policy template under Policies so workspaces with approval policies can require approval for every agent-to-agent run, including scheduled ones.
    • Adds a Cursor Team or Enterprise billing API key connection under Settings → Integrations, with key verification on save, key erasure on disconnect, and preserved historical usage.
    • Adds skill usage analytics — daily trends, totals, and top users — accessible through the Runlayer connector, scoped to the skill's editor permissions.

    +1 more show less

    • Adds plain-language explanations to Block bypassed tool calls in a session, describing why the block did not take effect and how to prevent similar calls.
    • Adds GH_TOKEN, NODE_OPTIONS, and other named environment variables to the inherit list on a local stdio connector so runlayer run copies each user's shell values into the MCP process without storing the values server-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Can hand work to other agents toggle in agent settings to control whether an agent can discover and delegate tasks to other agents.
    • Adds a Review agent delegation policy template under Policies so workspaces with approval policies can require approval for every agent-to-agent run, including scheduled ones.
    • Adds a Cursor Team or Enterprise billing API key connection under Settings → Integrations, with key verification on save, key erasure on disconnect, and preserved historical usage.
    • Adds skill usage analytics — daily trends, totals, and top users — accessible through the Runlayer connector, scoped to the skill's editor permissions.

    1 more in Everything

43. 1.28.991 (2026-10-02) Oct 2, 2026 · issue 093

    Runlayer 1.28.991 adds agent delegation approval policies, Cursor billing integration, and environment variable inheritance for local MCPs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enforce human approval on every agent-to-agent handoff, including scheduled runs, to satisfy change-control requirements.
    📍In the Runlayer console, go to Settings → Policies and add a new policy using the Review agent delegation template, then save and apply it to the workspace.
    Propagate a developer's local GitHub token into an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. without storing the value in Runlayer — ideal for local stdio connectors that need per-user credentials.
    📍On the local stdio connector configuration, add GH_TOKEN to the list of named environment variables to inherit; runlayer run will then copy the value from each user's shell at runtime.
    Connect a Cursor Enterprise account to sync billing data into Runlayer for unified usage tracking.
    📍In the Runlayer console, go to Settings → Integrations, paste the Cursor Enterprise billing API key and the matching Cursor organization ID, then click Connect. Runlayer verifies the key before saving.
    • Adds GH_TOKEN, NODE_OPTIONS, and other named environment variables to local stdio connectors so admins can list variables that runlayer run copies from each user's shell into the MCP process — values are never sent to Runlayer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Review agent delegation policy template requiring approval for every agent-to-agent run, including scheduled ones, in workspaces with approval policies.
    • Enables workspace admins to connect or disconnect a Cursor Team or Enterprise billing API key from Settings → Integrations, with key verification before saving and key erasure on disconnect.
    • Adds a Can hand work to other agents toggle in each agent's settings to control whether it can discover and delegate tasks to other agents.
    • Exposes skill usage totals, daily trends, and top users through the Runlayer connector by asking connected agents.

    +1 more show less

    • Adds plain-language explanations to tool calls marked Block bypassed in a session, describing why the block did not take effect and how to stop similar calls.
    • Adds GH_TOKEN, NODE_OPTIONS, and other named environment variables to local stdio connectors so admins can list variables that runlayer run copies from each user's shell into the MCP process — values are never sent to Runlayer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Review agent delegation policy template requiring approval for every agent-to-agent run, including scheduled ones, in workspaces with approval policies.
    • Enables workspace admins to connect or disconnect a Cursor Team or Enterprise billing API key from Settings → Integrations, with key verification before saving and key erasure on disconnect.
    • Exposes skill usage totals, daily trends, and top users through the Runlayer connector by asking connected agents.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !On AgentCore, the agent sandbox AWS role no longer has sts:AssumeRole permission — it is now limited to pulling the sandbox image and writing runtime logs; any agent code that relied on sts:AssumeRole inside the sandbox will fail.
44. docs update Oct 2, 2026 · issue 092

    Runlayer: Adds additional_tags input to apply extra tags to deployment workload resources, with explicit caller opt-in required; aws-apn-id must use the format pc:<Marketplace product code> and must not replace a provider default_tags value.

    └──▷ USE IT
    Enable the Rev self-hosted decision model sidecar on an m7i.2xlarge instance with 2 concurrent workers, fitting within the 30720 MiB task memory budget.
    hcl copy

    enable_runlayer_rev         = true
    enable_runlayer_topic_cpu   = true
    runlayer_rev_image_tag      = "runlayer-rev-guard-v202609292007"
    runlayer_rev_gunicorn_workers = 2
    runlayer_rev_memory         = 8192
    runlayer_rev_cpu_share      = 0.25
    runlayer_rev_timeout        = 10

    Attach an OTel CollectorOTel CollectorAn OpenTelemetry vendor-neutral agent, maintained by the CNCF, that receives, processes, and exports telemetry data (traces, metrics, logs) so tools avoid coupling to a specific observability backend. sidecar to backend and worker tasks to forward telemetry to a customer-owned OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. endpoint, while decoupling flow-trace collection from export transport.
    hcl copy

    otel_collector = {
      enabled         = true
      export_endpoint = "grpc://otel.internal.example.com:4317"
    }
    runlayer_obs_otel_enabled          = true
    FLOW_TRACE_COLLECTION_ENABLED      = true
    FLOW_TRACE_ADAPTIVE_SAMPLING_ENABLED = true

    Keep a stable NAT Elastic IP for sandbox egress in proxy_only mode so third-party allowlists don't break when proxy tasks are replaced.
    hcl copy

    sandbox_egress_mode                  = "proxy_only"
    sandbox_egress_proxy_keep_nat_gateway = true

    • Adds sandbox_egress_proxy_keep_nat_gateway to retain the module-created AgentCore consumer VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. NAT gateway in sandbox_egress_mode = 'proxy_only', keeping proxy tasks in private subnets behind the NAT Elastic IP for stable egress IPs.

    1 detail in Everything

45. 1.28.979 - Interactive agent cards and private previews (2026-10-02) Oct 2, 2026 · issue 108

    Runlayer 1.28.979 adds interactive agent cards, PagerDuty triggers, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. schedule/trigger/webhook editing, private artifact previews, and agent failure analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull audit events for a single agent session without paging the full audit window — useful during an incident investigation.
    copy

    $ list_audit_logs(rl_session_id="ses_01abc123def")

    Review per-person token spend across the whole org, including a catch-all row for contributors outside the top 30.
    copy

    $ get_agent_token_usage(group_by="actor")

    • Adds rl_session_id to the list_audit_logs MCP tool for fetching a single session's audit activity without paging the full window, and group_by=actor to get_agent_token_usage, returning an Other actors row for everyone past the top 30 so per-person spend always totals to the org.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds update_agent_schedule, update_agent_trigger, and update_agent_webhook MCP tools to edit existing schedules, triggers, and webhooks in place — preserving webhook URLs.
    • Adds PagerDuty triggers so agents can start when a PagerDuty incident is triggered, acknowledged, reassigned, or has its priority changed.
    • Adds interactive agent cards in chat that let agents present inline decision cards (approve a plan, add a connector) and continue the conversation from the user's choice; private artifact previews in agent chat for generated reports or visuals visible only to you, expiring unless you choose Save artifact; and brings agent cards and artifact previews to Slack and Microsoft Teams with inline button responses that continue the agent in the same thread.
    • Adds file attachments in the agent playground — images, PDFs, Office documents, and text files via paperclip, paste, or drag-and-drop.

    +5 more show less

    • Adds agent failure analysis: mark runs Pass or Fail with a note from the run drawer, then use Analyze failures on the Evals tab to group failing notes into categories and start an offline eval from any category.
    • Adds a Usage & edits panel to the skill page showing uses, unique users, and edits over the last 7, 30, or 90 days, with edit markers on the usage chart and top-users breakdown.
    • Extends AgentGuard to score sessions from devices in AI Watch Monitor mode, surfacing detections as alerts without blocking tool calls.
    • Adds Claude Code subagent token usage (Explore, Plan, and custom agents) to Sessions and the Usage page, attributed to the parent session and priced per model (requires the updated Runlayer CLI / AI Watch hook); analytics grouping by department and person with drill-down into department or group spend and per-run output visibility; a Status filter on the Sessions tab, with Analytics → Agents → Top erroring agents now linking to that agent's Sessions tab filtered to failed runs; and a model cost breakdown filter by provider with matching row count display.
    • Adds Slack support for .zip, .mp4, and .mov file attachments (up to 100 MB), landing files in the agent's workspace for unpacking or inspection.
    • Adds rl_session_id to the list_audit_logs MCP tool for fetching a single session's audit activity without paging the full window, and group_by=actor to get_agent_token_usage, returning an Other actors row for everyone past the top 30 so per-person spend always totals to the org.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds update_agent_schedule, update_agent_trigger, and update_agent_webhook MCP tools to edit existing schedules, triggers, and webhooks in place — preserving webhook URLs.
    • Adds PagerDuty triggers so agents can start when a PagerDuty incident is triggered, acknowledged, reassigned, or has its priority changed.
    • Adds interactive agent cards in chat that let agents present inline decision cards (approve a plan, add a connector) and continue the conversation from the user's choice; private artifact previews in agent chat for generated reports or visuals visible only to you, expiring unless you choose Save artifact; and brings agent cards and artifact previews to Slack and Microsoft Teams with inline button responses that continue the agent in the same thread.
    • Adds file attachments in the agent playground — images, PDFs, Office documents, and text files via paperclip, paste, or drag-and-drop.

    +2 more show less

    • Adds agent failure analysis: mark runs Pass or Fail with a note from the run drawer, then use Analyze failures on the Evals tab to group failing notes into categories and start an offline eval from any category.
    • Adds a Usage & edits panel to the skill page showing uses, unique users, and edits over the last 7, 30, or 90 days, with edit markers on the usage chart and top-users breakdown.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The procedures_validator input in the Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. module is deprecated and ignored; procedure validation now runs in the agent sandbox and requires enable_runlayer_agents with the AgentCore runtime. Setting procedures_validator causes terraform plan to warn; it will stop being accepted in the next major module version.
    • !If you run both the local Claude Code hook and Anthropic inference hooks simultaneously, reported Claude Code spend may drop because turns previously counted once per feed are now deduplicated.
46. 1.28.979 (2026-10-02) Oct 2, 2026 · issue 092

    Runlayer 1.28.979 adds PagerDuty triggers, AgentGuard Monitor mode, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. session filtering, inline agent cards in Slack/Teams, and agent failure analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull audit logs for a single agent session in MCP without paging the full audit window.
    copy

    $ list_audit_logs(rl_session_id="sess_abc123")

    Break down per-person token spend across the full org, including a catch-all row for users outside the top 30.
    copy

    $ get_agent_token_usage(group_by="actor")

    • Adds rl_session_id parameter to list_audit_logs MCP tool so agents can retrieve a single session's activity without paging the full audit window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds update_agent_schedule, update_agent_trigger, and update_agent_webhook MCP tools to edit existing schedules, triggers, and webhooks in place without deleting and recreating them.
    • Adds group_by=actor support to get_agent_token_usage MCP tool, now returning an Other actors row for everyone past the top 30 so per-person spend always totals to the org.
    • Adds PagerDuty triggers: agents can now start when a PagerDuty incident is triggered, acknowledged, reassigned, or has its priority changed.
    • Adds AgentGuard in Monitor mode: scores sessions from devices in AI Watch Monitor mode and surfaces detections as alerts without ever blocking tool calls.

    +15 more show less

    • Adds agent failure analysis: mark agent runs Pass or Fail with a note from the run drawer, then use Analyze failures on the Evals tab to group failing notes into categories and launch an offline eval from any category.
    • Adds interactive inline decision cards in agent chats: agents can request approvals or connector sign-ins through cards answered inline, with the conversation continuing from the choice.
    • Adds private artifact previews in chat: agents can display generated reports or visuals visible only to the recipient, expiring unless saved via Save artifact.
    • Adds agent cards and artifact previews in Slack and Microsoft Teams, with inline button responses that keep the agent continuing in the same thread.
    • Adds file attachment support in the agent playground: attach images, PDFs, Office documents, and text files via paperclip, paste, or drag and drop.
    • Adds support for .zip, .mp4, and .mov file attachments in Slack agents (up to 100 MB), landing files in the agent's workspace for unpacking or inspection.
    • Adds Claude Code subagent token usage to Sessions and the Usage page, attributed to the parent session and priced per model; requires the updated Runlayer CLI / AI Watch hook.
    • Adds Running vs Idle status to open sessions: sessions show Running while events arrive and Idle with last-activity time once quiet.
    • Adds Top erroring agents drill-through in Analytics: clicking an agent opens its Sessions tab filtered to failed runs, and Sessions gains a new Status filter.
    • Adds analytics grouping by department and person: group ROI artifacts by department or individual, see which outputs an agent run produced, and drill into spend.
    • Adds instruction-change tracking in agent chat: when an agent changes its own instructions the chat shows a diff with an Undo button to restore the previous version.
    • Adds Skill Usage & edits panel: shows uses, unique users, and edits over 7, 30, or 90 days with edit markers on the usage chart, full edit history with diff links, and top users.
    • Adds Claude.ai compliance imports via read:compliance_user_data scope on a claude.ai Compliance Access Key, continuing imports after Anthropic's September 22 listing change.
    • Adds model cost filtering by provider in detailed usage calculations, showing the matching row count.
    • Adds duplicate GitHub skill URL detection: importing a skill from a URL already in the workspace flags it on the review step and offers Update from source instead of creating a second copy.
    • Adds rl_session_id parameter to list_audit_logs MCP tool so agents can retrieve a single session's activity without paging the full audit window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds update_agent_schedule, update_agent_trigger, and update_agent_webhook MCP tools to edit existing schedules, triggers, and webhooks in place without deleting and recreating them.
    • Adds PagerDuty triggers: agents can now start when a PagerDuty incident is triggered, acknowledged, reassigned, or has its priority changed.
    • Adds AgentGuard in Monitor mode: scores sessions from devices in AI Watch Monitor mode and surfaces detections as alerts without ever blocking tool calls.
    • Adds agent failure analysis: mark agent runs Pass or Fail with a note from the run drawer, then use Analyze failures on the Evals tab to group failing notes into categories and launch an offline eval from any category.

    +8 more show less

    • Adds interactive inline decision cards in agent chats: agents can request approvals or connector sign-ins through cards answered inline, with the conversation continuing from the choice.
    • Adds private artifact previews in chat: agents can display generated reports or visuals visible only to the recipient, expiring unless saved via Save artifact.
    • Adds agent cards and artifact previews in Slack and Microsoft Teams, with inline button responses that keep the agent continuing in the same thread.
    • Adds file attachment support in the agent playground: attach images, PDFs, Office documents, and text files via paperclip, paste, or drag and drop.
    • Adds Running vs Idle status to open sessions: sessions show Running while events arrive and Idle with last-activity time once quiet.
    • Adds instruction-change tracking in agent chat: when an agent changes its own instructions the chat shows a diff with an Undo button to restore the previous version.
    • Adds Skill Usage & edits panel: shows uses, unique users, and edits over 7, 30, or 90 days with edit markers on the usage chart, full edit history with diff links, and top users.
    • Adds Claude.ai compliance imports via read:compliance_user_data scope on a claude.ai Compliance Access Key, continuing imports after Anthropic's September 22 listing change.

    7 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The procedures_validator input to the Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. module is deprecated and ignored; procedure validation now runs in the agent sandbox and requires enable_runlayer_agents with the AgentCore runtime. Setting procedures_validator causes terraform plan to warn; it will stop working in the next major module version.
    • !If you run both the local Claude Code hook and Anthropic inference hooks, reported Claude Code spend may decrease because turns previously counted once per feed are now deduplicated.
47. docs update Oct 2, 2026 · issue 092

    Runlayer: Adds additional_tags input to attach extra tags to deployment workload resources, with explicit opt-in required for partner attribution via the aws-apn-id tag using the pc:<Marketplace product code> format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable the self-hosted Rev decision model alongside a tuned memory budget and timeout so the backend can query it without blocking the hot path.
    hcl copy

    enable_runlayer_rev        = true
    enable_runlayer_topic_cpu  = true
    runlayer_rev_image_tag     = "runlayer-rev-guard-v202609292007"
    runlayer_rev_gunicorn_workers = 2
    runlayer_rev_memory        = 8192
    runlayer_rev_timeout       = 10

    Scope a per-service environment variable to the backend task only, without leaking it to the worker or consumers.
    hcl copy

    additional_backend_only_env_vars = {
      ECS_TASK_PROTECTION_ENABLED = "true"
    }

    • Adds additional_backend_only_env_vars input for non-sensitive environment variables scoped exclusively to the backend service task, excluding the worker, consumers, and backend migration task — useful for per-service settings like ECS_TASK_PROTECTION_ENABLED.
    • Adds FLOW_TRACE_COLLECTION_ENABLED control (defaults to runlayer_obs_otel_enabled) to decouple backend flow-metric generation from export transport.
    • Adds FLOW_TRACE_ADAPTIVE_SAMPLING_ENABLED for adaptive sampling on hot-path flow traces as an independent cost lever, operative even when remote export is disabled.
    • Adds runlayer_rev_cpu_share input (strictly between 0 and 1) to reserve a fractional CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. share for the Rev container from the slow pool's remainder.

    4 details in Everything

48. docs update Oct 2, 2026 · issue 092

    Runlayer Terraform module gains additional_tags input for deployment metadata and clarifies agent sandbox requirement for Procedures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Tag all Runlayer-managed workload resources with environment and team metadata for cost attribution and audit.
    hcl copy

    additional_tags = {
      environment = "production"
      team        = "platform"
    }

    • Adds additional_tags input (string map, default {}) to the Terraform module to apply deployment metadata tags to directly managed workload resources; resource identity tags take precedence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Procedure creation and validation now requires an agent runtime (with AgentCore); without it, both operations return 503.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Creating or validating a Procedure without an agent runtime (with AgentCore) now returns 503 instead of succeeding.
49. docs update Oct 2, 2026 · issue 092

    Runlayer Operator gains extraEnv, opt-in topicCpu.rev self-hosted decision model, and OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. sidecar support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable the opt-in Rev self-hosted decision model so the operator wires RUNLAYER_REV_ENDPOINT_URL and RUNLAYER_REV_TIMEOUT into backends automatically.
    yaml copy

    topicCpuRev:
      image: REGISTRY/toolguard:runlayer-rev-guard-TAG
    
    topicCpu:
      rev:
        enabled: true
        gunicornWorkers: 2

    Inject deployment-wide environment variables into every backend-image workload without risking silent overrides of operator-managed names.
    yaml copy

    extraEnv:
      - name: MY_CUSTOM_VAR
        value: "my-value"
      - name: ANOTHER_VAR
        value: "another-value"

    Configure the OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. endpoint so the OpenTelemetry sidecar exports its health metrics only to the Runlayer-monitored endpoint.
    yaml copy

    observability:
      otlp:
        endpoints:
          - name: runlayer-telemetry
            protocol: http
            url: http://<otlp-collector-host>:4318

    • Adds extraEnv config key to inject extra environment variables into every backend-image workload; unlike the ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. module's additional_backend_env_vars, any name the operator sets itself is rejected rather than silently overridden.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds topicCpu.rev opt-in self-hosted decision model (POST /predict/runlayer-rev) backed by the topicCpuRev image (REGISTRY/toolguard:runlayer-rev-guard-TAG); enabling it sets RUNLAYER_REV_ENDPOINT_URL and RUNLAYER_REV_TIMEOUT on backends, requires topicCpu.rev.enabled: true and the images.topicCpuRev image, and needs Procedures also configured or Procedure create/validate calls return 503.
    • Adds topicCpu.rev.gunicornWorkers setting to control worker count for the Rev model; memory must be at least (workers + 1) * 2560 MiB (default resource profile: 5632Mi request / 6144Mi limit).

    3 details in Everything

50. docs update Oct 2, 2026 · issue 092

    Runlayer adds Claude.ai chat import via Anthropic Compliance Access Keys, covering Claude Science, Claude for Microsoft 365, and Claude in Chrome (beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for importing Claude.ai chats by pasting an Anthropic sk-ant-api01-… Compliance Access Key (scoped read:compliance_user_data) into Runlayer under Settings → Claude.ai Web (expand Claude.ai Web under Web clients).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds optional Anthropic organization ID filtering (UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. or org_… form) on Claude.ai imports to limit which organizations' chats are pulled.
    • Adds beta import of prompts and replies from Claude Science, Claude for Microsoft 365, and Claude in Chrome — sources that Runlayer hooks cannot capture — using the same read:compliance_user_data Compliance Access Key; requires UUID-form org IDs to filter by organization and must be enabled by the Runlayer account team.

    3 details in Everything

51. 1.28.944 - Configurable invisible character detection (2026-10-01) Oct 1, 2026 · issue 108

    Per-category invisible character actions (Allow/Alert/Mask/Block) are now overridable at the connector, client, local-tool family, or individual tool level.

    • New detectionUpdated detectionSplits invisible character detection into distinct categories — Hidden characters, ANSI colour codes, Control characters, Isolated zero-width characters, C1 control characters, and Encoded hidden text — each configurable with its own action (Allow, Alert, Mask, or Block).
    • Enables per-category action overrides at the connector, client, local-tool family, or individual tool level, mirroring the existing PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.-type override model.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Terminal-noise incidents previously dismissed under HIDDEN_CHARS are not transferred to the new CONTROL_CHARS category — prior dismissals are lost and must be re-applied.
52. 1.28.944 (2026-10-01) Oct 1, 2026 · issue 092

    Runlayer 1.28.944 splits invisible character detection into per-category actions — Allow, Alert, Mask, or Block — with fine-grained overrides.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Splits invisible character detection into distinct categories — ANSI colour codes, Hidden characters, Control characters, Isolated zero-width characters, C1 control characters, and Encoded hidden text — each with its own action (Allow, Alert, Mask, or Block) configurable globally and overridden per connector, client, local-tool family, or tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an ANSI colour codes category (allowed by default) so colourised output from tools like git, lefthook, and pytest no longer triggers hidden-character events.
    • Adds three opt-in strict categories for connectors whose output should never carry invisible text: Isolated zero-width characters, C1 control characters, and Encoded hidden text (covering Unicode tags, invisible operators, unbalanced bidi isolates, and dense zero-width sequences), all allowed by default until explicitly enabled.
    • Concealing sequences (SGR conceal, background colours, OSC hyperlinks and clipboard writes), bidi overrides, and zero-width runs are consolidated under a Hidden characters category that cannot be switched off.
    • Incidents now report the specific category that fired and group terminal-noise events under CONTROL_CHARS instead of HIDDEN_CHARS, so prior dismissals of terminal-noise incidents do not transfer.
    • Splits invisible character detection into distinct categories — ANSI colour codes, Hidden characters, Control characters, Isolated zero-width characters, C1 control characters, and Encoded hidden text — each with its own action (Allow, Alert, Mask, or Block) configurable globally and overridden per connector, client, local-tool family, or tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an ANSI colour codes category (allowed by default) so colourised output from tools like git, lefthook, and pytest no longer triggers hidden-character events.
    • Adds three opt-in strict categories for connectors whose output should never carry invisible text: Isolated zero-width characters, C1 control characters, and Encoded hidden text (covering Unicode tags, invisible operators, unbalanced bidi isolates, and dense zero-width sequences), all allowed by default until explicitly enabled.
    • Concealing sequences (SGR conceal, background colours, OSC hyperlinks and clipboard writes), bidi overrides, and zero-width runs are consolidated under a Hidden characters category that cannot be switched off.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Terminal-noise incidents are now grouped under CONTROL_CHARS instead of HIDDEN_CHARS; prior dismissals of those incidents do not transfer to the new grouping.
53. 1.28.943 - Agent web browsing and output analytics (2026-10-01) Oct 1, 2026 · issue 108

    Adds RunlayerInstance.spec.extraEnv, OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. sidecar health export, list_teams MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool, eval judge agreement, and universal agent web browsing.

    • Adds RunlayerInstance.spec.extraEnv to the Kubernetes operator CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. to append environment variables to every backend-image workload (backend, worker, migration job, consumers) for settings the CRD has no dedicated field for.
    • Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. collector sidecar health metric export in the Kubernetes operator — queue depth, send failures, and receiver refusals — published to endpoints named runlayer-* using protocol: http.
    • Adds list_teams tool to Runlayer MCP for listing workspace teams.
    • Extends list_agents in Runlayer MCP to filter by drafts, tags, disabled status, team, and All Workspace, and to sort by name, last used, or run count.
    • Enables AI output analytics (Output view in Analytics) for all users without requiring admin activation — tracks pull requests, documents, and other artifacts produced by AI sessions.

    +5 more show less

    • Adds a Most / Least toggle to the Top active accounts card on Analytics → Overview, surfacing the least-active users (including those with zero actions) in the selected range.
    • Adds judge agreement tracking to agent eval comparative scorers — each scorer now shows a confusion matrix and a verdict-match rate against your labels, with a warning when too few cases are labelled.
    • Gives every agent a real browser automatically; per-agent Web browsing toggle is removed — use the agent's network access policy to control site reach.
    • Adds connector search link for admins in My Connectors to jump directly to Manage connectors, including connectors not granted to the admin.
    • Enforces connector tool selection at the gateway — a connector with zero tools selected on an agent now grants that agent zero tools, closing a gap where agent-credentialed requests could previously call every tool on the connector.

    10 details in Everything

    • New integration SkillGuard skill security scoring
    └──▷ BREAKING ON UPGRADE

    • !The enable_web_fetch API field and Terraform field are removed — all agents now have web browsing unconditionally; use the agent network access policy to restrict site access instead.
    • !OpenTelemetry collector sidecar health metrics are published ONLY to endpoints named runlayer-* with protocol: http; endpoints with any other name never receive these metrics.
54. 1.28.943 (2026-10-01) Oct 1, 2026 · issue 092

    Runlayer 1.28.943 adds Kubernetes extraEnv injection, OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. sidecar health export, SkillGuard security scoring, and expanded MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. agent filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Inject a custom environment variable (e.g. an internal API base URL) into all Runlayer backend workloads when the CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. has no dedicated field for it.
    yaml copy

    spec:
      extraEnv:
        - name: INTERNAL_API_BASE
          value: "https://internal.example.com"

    Expose OTel collector sidecar health metrics so Runlayer can monitor your Kubernetes deployment's telemetry pipeline — endpoint name must start with runlayer- and use HTTP.
    yaml copy

    endpoints:
      - name: runlayer-otel-health
        protocol: http
        port: 8888

    • Adds RunlayerInstance.spec.extraEnv to the Kubernetes CRD to append environment variables to every backend-image workload (backend, worker, migration job, consumers) for settings the CRD has no dedicated field for.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. collector sidecar health metric export to endpoints named runlayer-* (protocol: http) covering export queue depth, send failures, and receiver refusals — mirroring ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. telemetry monitoring for Kubernetes deployments.
    • Adds SkillGuard as the engine for skill security scanning, with findings that highlight the specific source lines the model flagged.
    • Expands list_agents in Runlayer MCP to filter by drafts, tags, disabled status, team, and All Workspace, and to sort by name, last used, or run count.
    • Adds a list_teams tool to Runlayer MCP.

    +4 more show less

    • Enables AI output analytics (the Output view in Analytics) for all workspaces without requiring admin activation.
    • Adds a Most / Least toggle to the Top active accounts card on Analytics → Overview, letting admins surface users with the fewest actions in a selected range.
    • Adds per-scorer confusion matrix and labelling-confidence warning to comparative scorers on eval runs, showing how often each scorer's verdicts match human labels.
    • Enables agent browsing by default for all agents; web access is now governed by the agent's network access policy rather than a per-agent toggle.
    • Adds RunlayerInstance.spec.extraEnv to the Kubernetes CRD to append environment variables to every backend-image workload (backend, worker, migration job, consumers) for settings the CRD has no dedicated field for.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. collector sidecar health metric export to endpoints named runlayer-* (protocol: http) covering export queue depth, send failures, and receiver refusals — mirroring ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. telemetry monitoring for Kubernetes deployments.
    • Adds a list_teams tool to Runlayer MCP.

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The per-agent Web browsing toggle is removed; web access is now controlled entirely by the agent's network access policy.
    • !The enable_web_fetch API field and Terraform field are removed.
    • !OpenTelemetry collector sidecar health metrics are exported ONLY to endpoints named runlayer-* using protocol: http; endpoints with any other name never receive these metrics.
55. 1.28.933 - Organization LLM budget covers agents (2026-10-01) Oct 1, 2026 · issue 108

    Org LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. budget now enforces spend limits across agent runs and virtual keys, not just devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Extends the organization usage rule's total budget to cover agent runs and virtual keys, halting both at the LLM gateway once the budget is exhausted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Uninstalling AI Watch on macOS and Windows now removes LLM routing from Claude Code and Codex managed settings, returning retired devices to their normal provider.
    • Extends the organization usage rule's total budget to cover agent runs and virtual keys, halting both at the LLM gateway once the budget is exhausted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

56. 1.28.933 (2026-10-01) Oct 1, 2026 · issue 092

    Organization LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. budget enforcement now extends to agent runs and virtual keys, blocking both at the gateway when the limit is spent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

57. docs update Oct 1, 2026 · issue 091

    Runlayer adds self-hosted Rev decision model, OTel CollectorOTel CollectorAn OpenTelemetry vendor-neutral agent, maintained by the CNCF, that receives, processes, and exports telemetry data (traces, metrics, logs) so tools avoid coupling to a specific observability backend. sidecar, and procedures-validator sidecar to ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. TerraformTerraformAn open-source infrastructure-as-code tool by HashiCorp that provisions cloud and on-premises resources through declarative configuration files, letting cyber tools automate and version-control their deployment environments. inputs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Deploy the self-hosted Rev decision model on an m7i.2xlarge with 2 workers, sized to fit alongside the slow and fast containers within the 30720 MiB instance limit.
    hcl copy

    enable_runlayer_rev        = true
    enable_runlayer_topic_cpu  = true
    runlayer_rev_image_tag     = "runlayer-rev-guard-v202609292007"
    runlayer_rev_gunicorn_workers = 2
    runlayer_rev_memory        = 8192
    runlayer_rev_cpu_share     = 0.20
    runlayer_rev_timeout       = 10

    Enable the OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Collector sidecar and forward telemetry to a customer-owned OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. endpoint, while keeping Runlayer-side export configured separately.
    hcl copy

    otel_collector = {
      export_endpoint = "otel-collector.internal:4317"
    }

    Attach a procedures-validator sidecar to the serving backend, pinned to a specific digest, with custom CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and memory reservations.
    hcl copy

    procedures_validator = {
      image  = "registry.example.com/procedures-validator@sha256:abc123"
      cpu    = 256
      memory = 1024
    }

    • Adds enable_runlayer_rev Terraform input to run Rev, Runlayer's self-hosted decision model, as a third container (runlayer-topic-cpu-rev) in the topic CPU task, exposing POST /predict/runlayer-rev on NLB port 8082 and setting RUNLAYER_REV_ENDPOINT_URL and RUNLAYER_REV_TIMEOUT on the backend; requires enable_runlayer_topic_cpu = true.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds runlayer_rev_image_tag Terraform input to specify the Rev container image (Rev-only ToolGuard profile runlayer-rev-guard-v<model_version>, built with image_profile=rev); tag must start with runlayer-rev-guard-v (e.g. runlayer-rev-guard-v202609292007).
    • Adds runlayer_rev_gunicorn_workers Terraform input to control Rev container concurrency (range 1–6); each worker loads its own fp32 encoder (~2.5–2.7 GiB RSS) and serializes forwards, with the recycler briefly running workers+1.
    • Adds runlayer_rev_memory Terraform input to set the hard memory limit (MiB) for the Rev container; must be at least (workers + 1) * 2560 MiB to accommodate recycler overlap.
    • Adds runlayer_rev_cpu_share Terraform input to set the fractional CPU units reserved for the Rev container (soft floor, taken from the slow pool's remainder); fast share + Rev share must stay below 1 unless an absolute override is set.

    +3 more show less

    • Adds runlayer_rev_timeout Terraform input to set the backend HTTP client timeout in seconds per Rev decision request (RUNLAYER_REV_TIMEOUT), range 1–60; matches operator field topicCpu.rev.timeoutSeconds.
    • Adds an optional OTel Collector sidecar for backend and worker ECS tasks; when enabled, adds a second container receiving telemetry via localhost:4317, with export_endpoint set to the customer-owned OTLP gRPC endpoint (loopback values are rejected at plan time); Runlayer-side export is configured separately via runlayer_obs_otel_* inputs.
    • Adds procedures_validator Terraform input for an optional procedures-validator sidecar on the serving backend task; accepts object({ image = string, cpu = optional(number, 128), memory = optional(number, 512) }) with image required to be explicitly tagged or digest-pinned.

    8 details in Everything

58. announced Oct 1, 2026 · issue 093

    Runlayer launches Sessions & Shadow AI: proactive skill/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. scanning, AI Watch client, and browser extension across Mac, Windows, and Linux⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Introduces AI Watch, a lightweight endpoint client that detects and logs all employee AI activity across clients, agents, MCPs, skills, and tool calls on Mac, Windows, and Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds proactive scanning of skill files and MCP servers at installation time — before execution — detecting prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and guardrail bypass techniques.
    • Ships a browser extension with AI Watch to cover browser-based AI sessions, supporting Google Chrome, Mozilla Firefox, and Microsoft Edge.
    • Supports deployment of AI Watch via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. providers including Jamf, Workspace ONE, and Intune for enterprise-scale rollout.
    • Provides full agent session logs with turn-by-turn visibility across user inputs, AI reasoning steps, MCP tool calls, and actions, with in-line alerts on high-risk behavior.

    +1 more show less

    • Enables deterministic policies to block high-risk skills and tool calls proactively, preventing execution of malicious AI artifacts.

    6 details in Everything

59. 1.28.911 - Shadow AI dashboard drill-downs (2026-09-30) Sep 30, 2026 · issue 108

    Shadow AI dashboard drill-downs now link to filtered Detail tables with shareable URLs, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gains artifact custom-link management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Share a pre-filtered Shadow AI details view with a teammate — copy the URL after drilling into a risk level row and send it directly.
    📍In the Shadow AI dashboard, click a skill risk level or managed connector row to open the Details table, then copy the URL from the browser address bar and share it.
    • Clicking a row on a Shadow AI dashboard card (skill risk level or managed connector) now opens the Details table with matching filters applied.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Details table filters are persisted in the page URL, enabling shareable filtered views and a functioning Back button that returns to the originating dashboard tab.
    • Assistants and agents can now set, change, or remove an artifact's custom link, and open an artifact from its custom link, through Runlayer MCP.
    • Clicking a row on a Shadow AI dashboard card (skill risk level or managed connector) now opens the Details table with matching filters applied.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Assistants and agents can now set, change, or remove an artifact's custom link, and open an artifact from its custom link, through Runlayer MCP.

    1 more in Everything

60. 1.28.911 (2026-09-30) Sep 30, 2026 · issue 091

    Runlayer 1.28.911 adds artifact custom-link management via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and shareable URL-persisted Details filters for Shadow AI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Enables assistants and agents to set, change, remove, and open an artifact by its custom link through Runlayer MCP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Persists Shadow AI Details table filters in the page URL so filtered views can be shared directly, with Back returning to the originating dashboard tab.
    • Collapses the Connected Agent Apps list on the Integrations page by default with a count, preventing long page loads in large Slack workspaces.
    • Enables assistants and agents to set, change, remove, and open an artifact by its custom link through Runlayer MCP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

61. docs update Sep 30, 2026 · issue 090

    Runlayer Terraform module gains AgentCore VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./PrivateLinkPrivateLinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. networking inputs and scan-budget timeout controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Deploy AgentCore over a module-created private VPC with PrivateLink, letting the module auto-derive all subnets from the default CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. block.
    hcl copy

    runlayer_agentcore_network_mode          = "VPC"
    enable_privatelink                        = true
    runlayer_agentcore_consumer_vpc_cidr_block = "10.112.0.0/20"

    Bring an existing VPC and specific private subnets for the AgentCore consumer endpoint instead of letting the module create one.
    hcl copy

    runlayer_agentcore_network_mode              = "VPC"
    enable_privatelink                            = true
    runlayer_agentcore_consumer_vpc_id            = "vpc-0abc12345def67890"
    runlayer_agentcore_consumer_private_subnet_ids = ["subnet-0aaa111", "subnet-0bbb222"]

    • Adds runlayer_agentcore_consumer_vpc_id with runlayer_agentcore_consumer_private_subnet_ids Terraform inputs to bring an existing VPC for the AgentCore consumer endpoint.
    • Adds runlayer_agentcore_consumer_vpc_cidr_block Terraform input (defaults to 10.112.0.0/20) to let the module create a dedicated AgentCore consumer VPC, which connects only via PrivateLink and may overlap other VPC ranges.
    • Adds public subnet CIDR input for NAT egress in the module-created AgentCore consumer VPC, one per AZ; when left unset alongside the private list, subnets are auto-derived from the first half of the consumer CIDR block (starting at 10.112.0.0/24).
    • Enforcement scans now draw their timeout from the workspace scan latency budget (Security Scanners -> Scan budgets, range 50 ms–300 s, configurable fail-open or fail-closed); a ToolGuard backend timeout also governs tool-list scans, analyze, and models requests, all of which fail open on timeout.
    • Adds runlayer_agentcore_consumer_vpc_id with runlayer_agentcore_consumer_private_subnet_ids Terraform inputs to bring an existing VPC for the AgentCore consumer endpoint.
    • Adds runlayer_agentcore_consumer_vpc_cidr_block Terraform input (defaults to 10.112.0.0/20) to let the module create a dedicated AgentCore consumer VPC, which connects only via PrivateLink and may overlap other VPC ranges.
    • Adds public subnet CIDR input for NAT egress in the module-created AgentCore consumer VPC, one per AZ; when left unset alongside the private list, subnets are auto-derived from the first half of the consumer CIDR block (starting at 10.112.0.0/24).

    1 more in Everything

62. docs update Sep 30, 2026 · issue 090

    Runlayer agents can now DM any person by email from webhook, schedule, or API runs — no Slack user ID needed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Have a webhook-triggered run DM a ticket assignee when the agent finishes, by passing their email in the payload instead of looking up a Slack user ID.
    📍Steps: In your webhook payload, include the assignee email (e.g. assignee_email: alice@example.com). In the agent prompt, write: 'When done, DM the ticket assignee at the assignee_email from the payload with a summary.' Runlayer resolves the email to the linked Slack account automatically.
    • Enables agents started by webhook, schedule, or API to send Slack DMs to any person addressed by email (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ assignee_email in the webhook payload) — no Slack user ID required.
    • Supports addressing the run owner directly in playground prompts (e.g. 'DM me the summary when you're done') so the agent resolves the sender automatically.
    • Enables agents started by webhook, schedule, or API to send Slack DMs to any person addressed by email (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ assignee_email in the webhook payload) — no Slack user ID required.

    1 more in Everything

63. docs update Sep 30, 2026 · issue 090

    Runlayer adds a Platform Analytics section with artifact view metrics, unique visitor counts, and source breakdowns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Check which artifacts are getting the most traction across your org, and where views are coming from (app, Slack, or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client).
    📍In the Runlayer console, navigate to Platform Analytics › Artifacts. Ensure your account has the View Company Metrics permission (Analytics Admin). Review Most viewed artifacts, Artifact views over time, and Views by source for the desired date range.
    • Adds an Artifacts analytics section showing Artifact views, Unique visitors, Artifacts viewed, Artifact views over time, Most viewed artifacts, and Views by source (broken down by app, Slack, or MCP client).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Users with View Company Metrics (such as Analytics Admin) see org-wide counts, the chart, and Views by source; others see metrics only for artifacts they created.
    • Most viewed artifacts shows artifact titles org-wide only when the viewer also has Manage Agents; otherwise it appears as Your most viewed artifacts and is scoped to the viewer's own artifacts.

    3 details in Everything

64. 1.28.902 - Artifact view analytics and custom links (2026-09-30) Sep 30, 2026 · issue 108

    Runlayer 1.28.902 adds artifact view analytics, custom artifact links, editable LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Gateway routing rules, Slack DMs from any agent run, and AI-generated agent icons.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Create a new agent that is Slack-enabled from the start, now that Slack setup is opt-in.
    json copy

    { "name": "ops-assistant", "enable_channels": ["slack"] }

    Restore the old per-IP failover connect behaviour for AI Watch hooks in environments where the new happy-eyeballs logic causes unexpected timeouts.
    .env copy

    RUNLAYER_HAPPY_EYEBALLS=0

    Add Slack to an agent that was created without it, now that Slack setup is decoupled from agent creation.
    json copy

    { "agent_id": "<agent_id>", "enable_channels": ["slack"] }

    • Adds enable_channels=["slack"] parameter to the create_agent MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool to opt in to Slack app creation; agents created without it no longer receive a Slack app or slack_app_created event, and Slack can be added later via update_agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds RUNLAYER_HAPPY_EYEBALLS=0 environment variable to restore previous per-IP connect behaviour for AI Watch hooks when the network path to Runlayer is unavailable.
    • Adds an artifact views counter in the artifact header showing who opened it and whether they arrived from Runlayer, Slack, or an MCP client, plus an org-wide Artifacts tab in Analytics for admins showing the most viewed artifacts.
    • Admins can now edit existing LLM Gateway routing rules' pattern, target, and condition in place, and edit a virtual key's name, spend budget, and over-budget behaviour from Settings → LLM Gateway without rotating the key.
    • Slack DMs from any agent run: agents started from the playground, a webhook, or a schedule can now DM people on Slack by email address.

    +2 more show less

    • AI-generated agent icons: the agent icon picker gains a Generate tab that creates an icon from the agent's name, instructions, and workspace; requires an OpenAI API key.
    • Agent run token accounting now covers cache read, cache write, and reasoning tokensreasoning tokensIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens.: the Agent Monitor's Tokens tile counts them alongside input and output with a model pricing hover card listing the cache write price per million tokens, and a finished run's status strip shows input, output, and cached token counts next to its cost with a hover breakdown including cache writes and reasoning tokens.
    • Adds enable_channels=["slack"] parameter to the create_agent MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool to opt in to Slack app creation; agents created without it no longer receive a Slack app or slack_app_created event, and Slack can be added later via update_agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds RUNLAYER_HAPPY_EYEBALLS=0 environment variable to restore previous per-IP connect behaviour for AI Watch hooks when the network path to Runlayer is unavailable.
    • Adds an artifact views counter in the artifact header showing who opened it and whether they arrived from Runlayer, Slack, or an MCP client, plus an org-wide Artifacts tab in Analytics for admins showing the most viewed artifacts.
    • AI-generated agent icons: the agent icon picker gains a Generate tab that creates an icon from the agent's name, instructions, and workspace; requires an OpenAI API key.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !get_skill and get_skill_file plugin skill tools no longer accept the old query, skill, and file arguments — only skill_id (and file_id for files) are accepted; clients holding an older tool list receive an error directing them to use search_skills instead.
    • !The create_agent MCP tool no longer creates a Slack app by default; callers that relied on automatic Slack app creation must now pass enable_channels=["slack"] explicitly.
65. 1.28.902 (2026-09-30) Sep 30, 2026 · issue 090

    Runlayer 1.28.902 adds artifact view analytics, custom artifact links, in-place LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Gateway rule editing, AI-generated agent icons, and Slack DMs from any agent run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Create a new agent via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. without automatically provisioning a Slack app, then add Slack explicitly afterward.
    copy

    $ # Create agent with no Slack app
    create_agent name='Cost Watcher' instructions='Monitor spend and alert on anomalies.'
    
    # Later, opt in to Slack
    update_agent agent_id='<agent_id>' enable_channels=['slack']

    Navigate to the org-wide artifact analytics view to identify which artifacts are most accessed and from which surfaces (Runlayer, Slack, MCP).
    📍In the Runlayer console, go to Analytics › Artifacts tab to view the most-viewed artifacts across your organisation, including per-artifact visitor counts and source breakdown.
    • Adds enable_channels=["slack"] parameter to the create_agent MCP tool so Slack app provisioning is now opt-in; use update_agent to add Slack later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds RUNLAYER_HAPPY_EYEBALLS=0 environment variable to restore previous per-IP connect behaviour when the network path to Runlayer is down.
    • Adds artifact view analytics — a views counter in the artifact header shows how many people opened the artifact, who they were, and whether they arrived via Runlayer, Slack, or an MCP client.
    • Adds an org-wide Artifacts tab in Analytics for admins showing the most-viewed artifacts across the organisation.
    • Adds custom artifact links so an artifact can be given a readable address (e.g. /artifacts/kpi-dashboard) from its ⋯ menu, with the original link remaining valid.

    +6 more show less

    • Adds a Generate tab to the agent icon picker that creates an icon from the agent's name, instructions, and workspace; requires an OpenAI API key.
    • Enables agents started from the playground, a webhook, or a schedule to DM people on Slack by email, so DM me when done requests work outside Slack.
    • Enables in-place editing of LLM Gateway routing rules — admins can now change the pattern, target, and condition of an existing rule without deleting and re-adding it.
    • Enables in-place editing of LLM Gateway virtual keys — admins can change a key's name, spend budget, and over-budget behaviour from Settings → LLM Gateway without changing the key itself.
    • Expands Agent Monitor token accounting to include cache read, cache write, and reasoning tokensreasoning tokensIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens. in the Tokens tile and the model pricing hover card.
    • Adds input, output, and cached token counts with cost to the finished agent run's status strip, with a hover breakdown including cache writes and reasoning tokens.
    • Adds enable_channels=["slack"] parameter to the create_agent MCP tool so Slack app provisioning is now opt-in; use update_agent to add Slack later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds RUNLAYER_HAPPY_EYEBALLS=0 environment variable to restore previous per-IP connect behaviour when the network path to Runlayer is down.
    • Adds artifact view analytics — a views counter in the artifact header shows how many people opened the artifact, who they were, and whether they arrived via Runlayer, Slack, or an MCP client.
    • Adds an org-wide Artifacts tab in Analytics for admins showing the most-viewed artifacts across the organisation.
    • Adds custom artifact links so an artifact can be given a readable address (e.g. /artifacts/kpi-dashboard) from its ⋯ menu, with the original link remaining valid.

    +1 more show less

    • Adds a Generate tab to the agent icon picker that creates an icon from the agent's name, instructions, and workspace; requires an OpenAI API key.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !get_skill and get_skill_file plugin skill tools no longer accept the old query and skill / file arguments — only skill_id (and file_id for files) are accepted; clients holding an older tool list receive an error directing them to use search_skills instead.
    • !The create_agent MCP tool no longer provisions a Slack app or emits a slack_app_created event unless enable_channels=["slack"] is passed in the call.
66. docs update Sep 29, 2026 · issue 089

    Runlayer adds a standalone session-search indexer, flow-trace collection toggles, and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./PrivateLinkPrivateLinkAn AWS networking feature that exposes a service over a private endpoint inside a VPC, so traffic never traverses the public internet, giving cyber tools a way to integrate with cloud services without opening public routes. networking controls for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable the session-search indexer in soak mode first so you can validate extraction metrics before committing real index writes.
    hcl copy

    enable_session_search_indexer     = true
    enable_hook_events_pipeline       = true
    session_search_index_mode         = "shadow"
    session_search_indexer_config     = {
      cpu    = 512
      memory = 2048
    }

    Promote to write mode and tune flush frequency without changing the module, using the FF_ENABLE flag to bypass per-org feature gates in staging.
    hcl copy

    session_search_index_mode = "write"
    session_search_indexer_extra_env = {
      SESSIONS_SEARCH_FLUSH_SECONDS = "5"
      FF_ENABLE                     = "session-search-ingest"
    }

    Decouple flow-trace collection from OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. export and enable adaptive sampling to reduce cost on high-throughput paths.
    hcl copy

    FLOW_TRACE_COLLECTION_ENABLED          = true
    FLOW_TRACE_ADAPTIVE_SAMPLING_ENABLED   = true

    • Adds FLOW_TRACE_COLLECTION_ENABLED environment variable to enable or disable backend flow-metric generation independently of export transport; defaults to runlayer_central_otel_enabled || runlayer_obs_otel_enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds FLOW_TRACE_ADAPTIVE_SAMPLING_ENABLED as an independent cost lever that sheds local step-recording work even when remote export is off.
    • Adds runlayer_agentcore_network_mode Terraform input requiring PUBLIC or VPC; VPC mode requires enable_privatelink = true and either runlayer_agentcore_consumer_vpc_id with runlayer_agentcore_consumer_private_subnet_ids, or runlayer_agentcore_consumer_vpc_cidr_block with matching private and public subnet CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. lists.
    • Adds enable_session_search_indexer Terraform input to deploy a standalone Kinesis consumer that extracts searchable text, entities, and findings from hook events and writes the session-search index tables in Postgres; opt-in, default off, requires enable_hook_events_pipeline = true.
    • Adds session_search_indexer_config Terraform input to configure cpu (minimum 256) and memory (minimum 1024) for the session-search indexer ECS service.

    +2 more show less

    • Adds session_search_index_mode Terraform input (values: off, shadow, write) to control indexer behaviour: shadow parses and extracts without writing, write enables real index writes and the coverage-gap alarm, off scales the ECS service to 0 while preserving checkpoint state.
    • Adds session_search_indexer_extra_env Terraform input for passthrough environment variables (keys must start with SESSIONS_SEARCH_ or be FF_ENABLE/FF_DISABLE) to tune indexer knobs such as SESSIONS_SEARCH_FLUSH_SECONDS and SESSIONS_SEARCH_MAX_ROWS_PER_SECOND without a module change.

    7 details in Everything

67. 1.28.869 (2026-09-29) Sep 29, 2026 · issue 089

    Runlayer 1.28.869 adds AI browser inventory, obs-only flow metrics opt-out, Claude Sonnet 5.5 for agents, and connector event triggers for all workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Opt out of automatic flow-metric collection when running obs-only OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. export without tooling export, to avoid unexpected data ingestion.
    hcl copy

    flow_metrics_collection_enabled = false

    • Adds flow_metrics_collection_enabled = false Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. config key to opt out of backend flow-metric collection when observability OTLP export is on and tooling export is off (collection now defaults on in that mode).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • AI Watch Detect now inventories 16 standalone AI browsers built on Chromium — including Perplexity Comet, Dia, Opera Neon, ChatGPT Atlas, Norton Neo, and BrowserOS — on macOS, Windows, and Linux, counting a browser as installed only when its own installation is found.
    • AI Watch Detect inventories 16 more standalone AI browsers — including Fellou, Strawberry Browser, Kahana Oasis, and kweo — on macOS, Windows, and Linux.
    • Agents can now run on Claude Sonnet 5.5 via the Anthropic API or AWS Bedrock, with adaptive thinking effort settings.
    • Connector event triggers — such as a new Gmail label, Linear issue, or Google Drive file — are now available for agents in every workspace without requiring an access request.

    +1 more show less

    • Adds a Fetch deployments button when adding or editing an Azure Foundry AI provider, automatically listing models served by the endpoint and populating deployment names.
    • Adds flow_metrics_collection_enabled = false Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. config key to opt out of backend flow-metric collection when observability OTLP export is on and tooling export is off (collection now defaults on in that mode).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • AI Watch Detect now inventories 16 standalone AI browsers built on Chromium — including Perplexity Comet, Dia, Opera Neon, ChatGPT Atlas, Norton Neo, and BrowserOS — on macOS, Windows, and Linux, counting a browser as installed only when its own installation is found.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !With observability OTLP export on and tooling export off, backend flow-metric collection now defaults on — operators who did not previously collect flow metrics in this configuration must explicitly set flow_metrics_collection_enabled = false in their Terraform ECS inputs to opt out.
68. docs update Sep 29, 2026 · issue 089

    Runlayer Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. module gains sandbox egress proxy, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. export consumers, and new config inputs for AZ selection and secret-store identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable the identity-aware egress proxy for agent sandboxes so outbound traffic is filtered by organization policy rather than allowed directly through NAT.
    hcl copy

    sandbox_egress_mode                  = "proxy"
    runlayer_agentcore_network_mode      = "VPC"
    sandbox_egress_proxy_dns_servers     = ["1.1.1.1", "8.8.8.8"]
    sandbox_egress_proxy_egress_ports    = [443, 8080]
    sandbox_egress_proxy_platform_allow_hosts = ["*.mycompany.internal"]

    Ship audit-log SIEM data to a downstream system by enabling the standalone Kinesis consumer ECS service with enough capacity for production-volume audit records.
    hcl copy

    audit_log_siem_export_kinesis_consumer_config = {
      enabled       = true
      cpu           = 512
      memory        = 1024
      desired_count = 2
    }

    Route critical CloudWatch alarms to an internal Slack relay SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. topic alongside the default alerting path.
    hcl copy

    critical_alerts_extra_sns_topic_arns = [
      "arn:aws:sns:us-east-1:123456789012:slack-critical-relay"
    ]

    • Adds sandbox_egress_mode Terraform input (values: direct, proxy, proxy_only) to control how AgentCore sandboxes reach the internet, with direct as the default; proxy and proxy_only require runlayer_agentcore_network_mode = VPC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sandbox_egress_proxy_image_uri input to override the sandbox egress proxy container image; must include an explicit tag or digest.
    • Adds sandbox_egress_proxy_dns_servers input (default ["1.1.1.1", "8.8.8.8"]) to set upstream IPv4 DNS resolvers used by the sandbox egress proxy for destination lookups.
    • Adds sandbox_egress_proxy_platform_allow_hosts input to specify additional platform host patterns the egress proxy permits, using the same grammar as agent policies (host, *.host, optional :port).
    • Adds sandbox_egress_proxy_egress_ports input (default [443]) to declare extra TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. destination ports the egress proxy security group may open to the internet.

    +7 more show less

    • Adds secret_stores_allow_aws_workload_identity input to allow AWS secret stores without a role ARN to use the backend ECS task role; intended for single-org self-hosted deployments only.
    • Adds critical_alerts_extra_sns_topic_arns input to fan out critical alarms to extra SNS topics (e.g. an internal Slack relay), capped at 3 extra topics when ToolGuard alarms are enabled (4 when enable_monitoring or critical_alerts_enabled is off).
    • Adds audit_log_siem_export_kinesis_consumer_config input to configure a standalone audit-log SIEM export ECS service that exports enriched SIEM objects from the audit-log Kinesis stream; requires cpu >= 256, memory >= 512, desired_count >= 1.
    • Adds session_materializer_config input to configure a standalone session-materializer Kinesis consumer ECS service that reads the hook-events stream and performs segment compaction; requires cpu >= 256, memory >= 3072, desired_count >= 0.
    • Adds cold_analyzers_consumer_config input to configure a standalone cold-analyzers Kinesis consumer ECS service that reads the hook-events stream; requires cpu >= 256, memory >= 2048, desired_count >= 0.
    • Adds session_siem_export_kinesis_consumer_config input to configure a standalone session SIEM export ECS service that writes gzipped NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. to a managed or external S3 bucket; requires cpu >= 256, memory >= 2048, desired_count >= 1.
    • Documents availability-zone selection for the main VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., RDS, and the AgentCore consumer VPC, with the plan failing if a listed AZ is not supported in AgentCore.
    • Adds sandbox_egress_mode Terraform input (values: direct, proxy, proxy_only) to control how AgentCore sandboxes reach the internet, with direct as the default; proxy and proxy_only require runlayer_agentcore_network_mode = VPC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sandbox_egress_proxy_image_uri input to override the sandbox egress proxy container image; must include an explicit tag or digest.
    • Adds sandbox_egress_proxy_dns_servers input (default ["1.1.1.1", "8.8.8.8"]) to set upstream IPv4 DNS resolvers used by the sandbox egress proxy for destination lookups.
    • Adds sandbox_egress_proxy_platform_allow_hosts input to specify additional platform host patterns the egress proxy permits, using the same grammar as agent policies (host, *.host, optional :port).
    • Adds sandbox_egress_proxy_egress_ports input (default [443]) to declare extra TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. destination ports the egress proxy security group may open to the internet.

    +6 more show less

    • Adds secret_stores_allow_aws_workload_identity input to allow AWS secret stores without a role ARN to use the backend ECS task role; intended for single-org self-hosted deployments only.
    • Adds critical_alerts_extra_sns_topic_arns input to fan out critical alarms to extra SNS topics (e.g. an internal Slack relay), capped at 3 extra topics when ToolGuard alarms are enabled (4 when enable_monitoring or critical_alerts_enabled is off).
    • Adds audit_log_siem_export_kinesis_consumer_config input to configure a standalone audit-log SIEM export ECS service that exports enriched SIEM objects from the audit-log Kinesis stream; requires cpu >= 256, memory >= 512, desired_count >= 1.
    • Adds session_materializer_config input to configure a standalone session-materializer Kinesis consumer ECS service that reads the hook-events stream and performs segment compaction; requires cpu >= 256, memory >= 3072, desired_count >= 0.
    • Adds cold_analyzers_consumer_config input to configure a standalone cold-analyzers Kinesis consumer ECS service that reads the hook-events stream; requires cpu >= 256, memory >= 2048, desired_count >= 0.
    • Adds session_siem_export_kinesis_consumer_config input to configure a standalone session SIEM export ECS service that writes gzipped NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. to a managed or external S3 bucket; requires cpu >= 256, memory >= 2048, desired_count >= 1.

    1 more in Everything

69. docs update Sep 29, 2026 · issue 089

    Runlayer Terraform module gains Bedrock provider fan-out for Slack monitors and a sandbox egress proxy mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable the sandbox egress proxy for all organizations before cutting over to proxy-only mode to avoid a gap in sandbox internet access.
    hcl copy

    additional_backend_env_vars = { FF_ENABLE = "<flags already forced>,sandbox-egress-proxy" }

    After the backend rollout completes, enforce proxy-only egress so no sandbox run bypasses the proxy.
    hcl copy

    sandbox_egress_mode = "proxy_only"

    • Adds BEDROCK_ENABLED support to the agent-event-trigger consumer, granting nonstreaming bedrock:InvokeModel access to Claude foundation models and deployment-account Claude inference profiles for legacy platform fallback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sts:AssumeRole grants scoped to arn:aws:iam::*:role/runlayer-bedrock-* and arn:aws:iam::*:role/RunlayerBedrock* so the ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. task role can assume saved Bedrock provider roles for Slack monitors.
    • Adds sandbox_egress_mode = "proxy_only" Terraform setting to route all sandbox internet traffic exclusively through the egress proxy.
    • Adds FF_ENABLE flag sandbox-egress-proxy (set via additional_backend_env_vars) to enable the sandbox egress proxy per organization before switching to proxy_only mode.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Updating the consumer image alone does not install the new bedrock:InvokeModel IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permission — the Terraform module must also be upgraded and applied, or the permission will be missing after rollout.
    • !Setting sandbox_egress_mode = "proxy_only" without first enabling the sandbox-egress-proxy feature flag (via additional_backend_env_vars / FF_ENABLE) and waiting for the backend rollout will leave organizations without the flag without sandbox internet access for several minutes.
70. docs update Sep 29, 2026 · issue 089

    Runlayer adds a unified policy engine extending POST /api/v1/policies to agents, skills, plugins, artifacts, teams, and org-level actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Grant a support group permission to view and run a specific triage agent, using the new unified policy body shape.
    copy

    $ curl -s -X POST "$RUNLAYER_URL/api/v1/policies" \
      -H "x-runlayer-api-key: $API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "principal": { "type": "group", "ids": ["'$GROUP_ID'"] },
        "kind": "permission",
        "effect": "allow",
        "resource": { "type": "agent", "ids": ["'$AGENT_ID'"] },
        "actions": ["view", "run"],
        "description": "Support group can run the triage agent",
        "conditions": []
      }' | jq '{id, principal, effect, resource, actions}'

    Block a specific group from accessing a skill that is otherwise shared with the whole organization, using an explicit org-allow plus group-deny pair.
    copy

    $ # Step 1: allow the whole org
    curl -s -X POST "$RUNLAYER_URL/api/v1/policies" \
      -H "x-runlayer-api-key: $API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "principal": { "type": "org" },
        "kind": "permission",
        "effect": "allow",
        "resource": { "type": "skill", "ids": ["'$SKILL_ID'"] },
        "actions": ["view", "use"],
        "conditions": []
      }'
    
    # Step 2: explicitly deny the restricted group (deny beats allow)
    curl -s -X POST "$RUNLAYER_URL/api/v1/policies" \
      -H "x-runlayer-api-key: $API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "principal": { "type": "group", "ids": ["'$RESTRICTED_GROUP_ID'"] },
        "kind": "permission",
        "effect": "deny",
        "resource": { "type": "skill", "ids": ["'$SKILL_ID'"] },
        "actions": ["*"],
        "conditions": []
      }'

    Delegate agent-creation rights to a Finance team by granting the create_agent org-level action to an attributes-matched principal.
    copy

    $ curl -s -X POST "$RUNLAYER_URL/api/v1/policies" \
      -H "x-runlayer-api-key: $API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "principal": { "type": "attributes", "attributes": { "department": "Finance" } },
        "kind": "permission",
        "effect": "allow",
        "resource": { "type": "org" },
        "actions": ["create_agent"],
        "description": "Finance staff can create agents",
        "conditions": []
      }' | jq '{id, principal, resource, actions}'

    • Extends POST /api/v1/policies with a unified body shape that targets agent, skill, plugin, artifact, agent_account, team, and org resource types, alongside the existing connector shape.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds effect (replacing connector-shape action), resource ({ "type": "<type>", "ids": [...] }, { "type": "<type>", "all": true }, or { "type": "org" }), and actions (list of action names) fields to the unified policy body.
    • Introduces team and org principal types (unified shape only), and an owner principal that resolves to whoever owns the resource being checked.
    • Defines a full action vocabulary per resource type: connector adds use, call_tool:*, call_tool:<name>, read_resource:*, read_resource:<uri>, edit_security, run_diagnostics, view_metrics; agent adds run, view_runs_own, view_runs_all; artifact adds download; team adds join, share_assets; org exposes admin capabilities including manage_admins, view_audit_logs_all, view_unredacted_content, manage_security_policies, manage_policies, create_connector, create_agent, and more.
    • Adds named preset bundles — Viewer, Editor, and Manager — that expand to concrete action sets: Viewer grants view plus the type's consume action; Editor adds edit and share; Manager adds manage_access.

    +2 more show less

    • Enforces explicit-deny semantics: any matching deny policy overrides all allow policies including owner and share grants, affecting open, run, call, and download operations in real time.
    • Returns error code unified_policy_engine_inactive when a unified-shape request targets a non-connector resource whose workspace has not yet been migrated to the unified policy store.

    7 details in Everything

71. 1.28.845 (2026-09-28) Sep 28, 2026 · issue 089

    Runlayer 1.28.845 adds OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. API key ingestion for AI clients, Pi integration, and MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-only Shadow AI Scan key minting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Set up OTLP telemetry ingestion from Claude Code into Runlayer by creating a write-only OTLP Telemetry API key scoped to OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. only.
    📍In the Runlayer console, go to Organization API keys → Create key, select the OTLP Telemetry permission (must be the only permission), then configure your Claude Code exporter to send logs, metrics, and traces to your Runlayer OTLP endpoint using the generated key.
    Connect an Oh My Pi agent to Runlayer governance in one step, routing its MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools through Runlayer policy enforcement.
    copy

    $ /mcp add

    • Adds a new write-only OTLP Telemetry organization API key permission for OpenTelemetry ingestion (logs, metrics, traces) from AI clients such as Claude Code, Claude Cowork, and Glean; created from the Organization API keys page and must be the key's only permission — cannot use the AI Watch scan or hook endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Restricts Shadow AI Scan key creation to the MDM configuration wizard only; the Organization API keys page no longer offers the Shadow AI Scan role, and the API rejects hand-created keys with it, ensuring every key links devices and scan data to a configuration card.
    • Adds a Pi integration guide enabling agents built on Pi to route MCP tools through Runlayer, enforce policy on local tools like bash, and record activity in Sessions.
    • Adds an Oh My Pi (omp) tab in the connector setup guide with a one-line /mcp add command that signs in and saves the connector.
    • Adds generated chat titles to an agent's chat list, replacing the first prompt, with rename available from the ⋯ menu.

    +3 more show less

    • Adds redirect URI approval guidance — the approval screen now shows the path Settings → General → OAuth redirect URIs and lets members copy a shareable link for their admin.
    • Speeds up AI Watch scans by batching artifact reporting in requests of up to 25 artifacts instead of one request per artifact, reducing traffic against the Runlayer deployment.
    • Skips unchanged plugins already held by the server for the same window as skills, cutting repeat uploads on every scheduled scan tick.
    • Adds a new write-only OTLP Telemetry organization API key permission for OpenTelemetry ingestion (logs, metrics, traces) from AI clients such as Claude Code, Claude Cowork, and Glean; created from the Organization API keys page and must be the key's only permission — cannot use the AI Watch scan or hook endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Pi integration guide enabling agents built on Pi to route MCP tools through Runlayer, enforce policy on local tools like bash, and record activity in Sessions.
    • Adds an Oh My Pi (omp) tab in the connector setup guide with a one-line /mcp add command that signs in and saves the connector.
    • Adds generated chat titles to an agent's chat list, replacing the first prompt, with rename available from the ⋯ menu.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Organization API keys page no longer offers the Shadow AI Scan role, and the API rejects hand-created keys with that role; Shadow AI Scan keys must now be minted through the MDM configuration wizard.
72. changelog Sep 26, 2026 · issue 086

    Runlayer: Adds Claude Opus 5.5 support for agents through the Anthropic API or AWS Bedrock, with adaptive thinking effort settings.

    └──▷ TRY IT
    Confirm which org or enrollment API key a managed device is actually using before troubleshooting an enrollment failure.
    copy

    $ aiwatch config show

    Create an agent via Runlayer MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and skip Slack setup in one call, useful for headless or CI-provisioned agents that should not have a Slack presence.
    json copy

    {
      "name": "data-pipeline-agent",
      "enable_channels": []
    }

    Lock down an access policy so it only applies when a client connected via device-code registration, not pre-registered or manually issued credentials.
    json copy

    {
      "condition": {
        "field": "meta.client.kind",
        "operator": "equals",
        "value": "dcr"
      }
    }

    • Adds GPT-6 Sol and GPT-6 Luna model support for agents on the OpenAI provider.
    • Adds channel-only mode for Slack agents so admins can turn off direct messages; users who DM the agent are redirected to mention it in a channel.
    • Adds queued agent messages so follow-ups sent while an agent is working run in order, with the ability to edit, reorder, or remove queued messages.
    • Adds shareable, bookmark-able filtered Policies views for admins, and connector notices now deep-link to Policies filtered to the relevant connector.
    • Adds Gemini support through OpenAI-Compatible providers pointed at generativelanguage.googleapis.com, sending API keys in the format Google expects rather than as a Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..

    +2 more show less

    • Adds Shadow AI access controls limiting saved Shadow AI skill and plugin files to resource managers and security or analytics reviewers; organization-wide Shadow AI REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and MCP tools now require organization-wide audit log access.
    • Enables Slack setup for agents through Runlayer MCP without requiring an elevated role, for any user who can edit the agent.
    • Adds channel-only mode for Slack agents so admins can turn off direct messages; users who DM the agent are redirected to mention it in a channel.
    • Adds queued agent messages so follow-ups sent while an agent is working run in order, with the ability to edit, reorder, or remove queued messages.
    • Adds shareable, bookmark-able filtered Policies views for admins, and connector notices now deep-link to Policies filtered to the relevant connector.
    • Adds Gemini support through OpenAI-Compatible providers pointed at generativelanguage.googleapis.com, sending API keys in the format Google expects rather than as a Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
    • Adds Shadow AI access controls limiting saved Shadow AI skill and plugin files to resource managers and security or analytics reviewers; organization-wide Shadow AI REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and MCP tools now require organization-wide audit log access.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !AI Watch Enforce now blocks MCP launchers whose --host does not point at your Runlayer deployment or that name an unknown or disabled connector; previously allowlisted launchers from the Shadow AI activity view that fall into these categories are also blocked and can no longer be allowlisted from that view.
    • !Slack channel monitors no longer post a reply for every run — silent runs are suppressed. The reply-behavior setting that previously controlled this is removed.
73. docs update Sep 26, 2026 · issue 086

    Runlayer: Adds backend_desired_count input to override the backend service's initial desired_count without replacing the full services_configurations map; seeds only services never previously created, with Application Auto Scaling owning the live count afterwards.

    └──▷ USE IT
    Set per-role Aurora CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. alarms and an ACU ceiling alarm so a saturated writer or a single hot reader pages before the cluster is fully pinned.
    hcl copy

    rds_writer_cpu_utilization_threshold = 75
    rds_reader_cpu_utilization_threshold = 85
    rds_writer_acu_utilization_threshold = 90

    Inject a private CA bundle so backend and worker HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. clients trust an internal PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. without rebuilding the container image.
    hcl copy

    trusted_ca_pem = file("${path.module}/certs/internal-ca-bundle.pem")

    Temporarily pause ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. task-replacement loops on a ToolGuard service where worker-recycle drain flips /health to 503 and every task owns a whole GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference..
    hcl copy

    runlayer_tool_guard_health_check_grace_period_seconds = 2147483647

    └──▷ BREAKING ON UPGRADE

    • !AWS provider must be >= 6.64.0, < 7.0.0; upgrade any older AWS provider selection in your dependency lock file before running terraform plan after upgrading this module.
74. docs update Sep 26, 2026 · issue 086

    Runlayer adds write-only OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. telemetry ingestion for AI clients including Claude Code and Glean.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable OTLP telemetry collection from an AI client (e.g. Claude Code) by provisioning an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed API key — the only way to obtain the write-only OTLP scope.
    📍In the Runlayer console, go to Settings → MDM configuration and apply a configuration targeting your AI client fleet. Runlayer will automatically mint API keys with the OTLP Telemetry scope for each enrolled device.
    • Adds automatic API key minting via Settings → MDM configuration for AI Watch scan, hook, and OTLP submissions — keys with this scope cannot be created manually.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

75. 1.28.811 (2026-09-25) Sep 25, 2026 · issue 086

    Runlayer 1.28.811 adds per-entry MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. policy management with search/pagination and a minimal environment for local MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds minimal environment isolation for local MCP servers: runlayer run now starts local MCP servers with only the connector's configured variables plus proxy, TLS, and locale settings, instead of inheriting the full AI client environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds per-entry management to Enforce/Protect policy lists for allowed and denied MCP URLs, local packages, and built-in servers, with search and pagination instead of a single bulk save — and lets Shadow AI overview add a discovered MCP straight to the allowlist.
    • Splits an agent's Slack settings into four sections (Replies, Channel access, Monitoring, and Sending) navigable from the left panel, with Channel monitoring showing channels and condition only while active.
    • Adds minimal environment isolation for local MCP servers: runlayer run now starts local MCP servers with only the connector's configured variables plus proxy, TLS, and locale settings, instead of inheriting the full AI client environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

76. changelog Sep 25, 2026 · issue 085

    Runlayer: Adds Figma's remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server to the catalog (now generally available), with OAuth app registration and per-user Figma account connection.

    └──▷ TRY IT
    Verify which org API key or enrollment key AI Watch is using on a managed device without exposing the full secret.
    copy

    $ aiwatch config show

    • Adds create_artifact tool behavior alignment: artifacts an agent creates with the Runlayer MCP create_artifact tool now follow that agent's Artifact sharing setting.
    • Adds agents-on-Amazon-Bedrock support for OpenAI models (gpt-6 Astra and global./us./eu.-prefixed OpenAI model IDs); a bare openai.gpt-6… ID is automatically served under its global. inference profile.
    • Adds Top spenders drilldown linking to a searchable, paginated view of every user's model spend or token usage.
    • Adds AI Watch client config backups for all supported clients (Cursor, VS Code, Codex, Gemini CLI, and others), retaining only the 5 most recent backups per file.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !AI Watch Enforce now blocks MCP launchers whose --host does not point at your Runlayer deployment, names an unknown or disabled connector, or carries unsupported options — and these launchers can no longer be allowlisted from the Shadow AI activity view.
    • !Saved Shadow AI skill and plugin files are now restricted to resource managers and security or analytics reviewers; organization-wide Shadow AI REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and MCP tools now require organization-wide audit log access.
77. docs update Sep 25, 2026 · issue 085

    Runlayer Terraform ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. module adds per-role Aurora CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./ACU alarms, trusted-CA injection, and a ToolGuard health-check grace period input⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Set per-role Aurora CPU thresholds so writer and reader alarms fire independently — useful when a pinned writer saturates while an idle replica would mask a cluster-average alarm.
    hcl copy

    rds_writer_cpu_utilization_threshold = 75
    rds_reader_cpu_utilization_threshold = 85
    rds_writer_acu_utilization_threshold = 90

    Inject a private CA bundle so backend and worker HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. clients trust an internal PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. without rebuilding the container image.
    hcl copy

    trusted_ca_pem = file("${path.module}/certs/internal-ca-bundle.pem")

    Pin the ToolGuard ECS health-check grace period to int32 max as a stopgap when ECS loops on task replacement due to /health returning 503 during worker-recycle drain.
    hcl copy

    runlayer_tool_guard_health_check_grace_period_seconds = 2147483647

    • Adds rds_writer_cpu_utilization_threshold input to fire a writer-cpu CloudWatch alarm when Aurora WRITER CPUUtilization exceeds the threshold for 3 consecutive 5-minute periods, evaluated on the Role = WRITER dimension rather than the cluster average.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds rds_reader_cpu_utilization_threshold input to fire a per-instance reader-cpu alarm gated on AuroraReplicaLag, so it tracks role swaps on failover and avoids masking a saturated reader behind an idle one.
    • Adds rds_writer_acu_utilization_threshold input to fire a writer-acu alarm when Aurora Serverless v2 ACUUtilization hits or exceeds the threshold for 6 consecutive 5-minute periods; alarm is only created when database_config.min_capacity < max_capacity.
    • Adds trusted_ca_pem input accepting a PEM bundle of additional trusted CA certificates, merged with the image public roots for backend, shared worker, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. execution worker HTTPS clients; private keys are rejected.
    • Adds runlayer_tool_guard_health_check_grace_period_seconds input (0–2147483647) to override the ECS health-check grace period for the ToolGuard service, defaulting to 900 s to cover GRID driver install and model load.

    +3 more show less

    • Adds a dedicated security group input for ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. API, ECR DKR, CloudWatch Logs, and Secrets Manager interface endpoint ENIs used by tunnel tasks when connecting through an existing VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware..
    • Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. fleet autoscaling with a second target-tracking policy on fleet-average GPU utilization (target 60 %, 60 s metric cadence) alongside a 900 s scale-in cooldown; predictive scaling is automatically disabled in unsupported regions with a plan warning.
    • Requires AWS provider >= 6.64.0, < 7.0.0 for alarm warm-up used by ToolGuard registration monitoring; the dependency lock file must be updated before planning.
    • Adds rds_writer_cpu_utilization_threshold input to fire a writer-cpu CloudWatch alarm when Aurora WRITER CPUUtilization exceeds the threshold for 3 consecutive 5-minute periods, evaluated on the Role = WRITER dimension rather than the cluster average.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds rds_reader_cpu_utilization_threshold input to fire a per-instance reader-cpu alarm gated on AuroraReplicaLag, so it tracks role swaps on failover and avoids masking a saturated reader behind an idle one.
    • Adds rds_writer_acu_utilization_threshold input to fire a writer-acu alarm when Aurora Serverless v2 ACUUtilization hits or exceeds the threshold for 6 consecutive 5-minute periods; alarm is only created when database_config.min_capacity < max_capacity.
    • Adds trusted_ca_pem input accepting a PEM bundle of additional trusted CA certificates, merged with the image public roots for backend, shared worker, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. execution worker HTTPS clients; private keys are rejected.
    • Adds runlayer_tool_guard_health_check_grace_period_seconds input (0–2147483647) to override the ECS health-check grace period for the ToolGuard service, defaulting to 900 s to cover GRID driver install and model load.

    +2 more show less

    • Adds a dedicated security group input for ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. API, ECR DKR, CloudWatch Logs, and Secrets Manager interface endpoint ENIs used by tunnel tasks when connecting through an existing VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware..
    • Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. fleet autoscaling with a second target-tracking policy on fleet-average GPU utilization (target 60 %, 60 s metric cadence) alongside a 900 s scale-in cooldown; predictive scaling is automatically disabled in unsupported regions with a plan warning.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The module now requires AWS provider >= 6.64.0, < 7.0.0; any older AWS provider version pinned in your dependency lock file must be upgraded before running terraform plan.
78. docs update Sep 25, 2026 · issue 085

    Runlayer: Adds GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. utilization autoscaling via a second target-tracking policy on the RunlayerToolGuard/GPUUtilization CloudWatch metric (target 60%, Environment dimension, Average statistic), complementing the existing CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. policy so the fleet scales on whichever signal is higher.

    └──▷ USE IT
    Trust a corporate private CA for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server TLS connections in an ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. self-hosted deployment.
    hcl copy

    trusted_ca_pem = file("${path.module}/company-ca.pem")

    Roll out the authenticated egress proxy in stages to enforce per-agent network access policies on sandbox internet traffic.
    hcl copy

    sandbox_egress_mode                = "proxy_only"
    sandbox_egress_proxy_egress_ports  = [443, 8443]
    sandbox_egress_proxy_image_uri     = ".../runlayer/sandbox-egress-proxy:1.28.500"

    Enable Microsoft Teams integration by supplying all five required environment values to the ECS module.
    hcl copy

    ms_teams_app_client_secret     = var.ms_teams_app_client_secret
    # remaining values passed via TF_VAR_* or tfvars:
    # MS_TEAMS_APP_CLIENT_ID         = "00000000-0000-0000-0000-000000000000"
    # MS_TEAMS_RUNLAYER_TENANT_ID    = "00000000-0000-0000-0000-000000000000"
    # MS_TEAMS_AZURE_SUBSCRIPTION_ID = "00000000-0000-0000-0000-000000000000"
    # MS_TEAMS_AZURE_RESOURCE_GROUP  = "runlayer-ms-teams-bots"
    # MS_TEAMS_APP_URL               = "https://<domain_name>"

    • Adds sandbox_egress_mode Terraform variable (values proxy and proxy_only) and sandbox_egress_proxy_egress_ports / sandbox_egress_proxy_image_uri variables to route ECS sandbox internet traffic through an authenticated egress proxy enforcing per-agent network access policies.
    • Adds container_insights = "enabled" pairing requirement for GPU predictive scaling; terraform plan warns when Container Insights is not enabled alongside the GPU policy.
    • Accelerates ToolGuard GPU metric publishing from every 5 minutes to every 60 seconds, enabling finer-grained GPU autoscaling decisions.
    • Adds sandbox_egress_mode Terraform variable (values proxy and proxy_only) and sandbox_egress_proxy_egress_ports / sandbox_egress_proxy_image_uri variables to route ECS sandbox internet traffic through an authenticated egress proxy enforcing per-agent network access policies.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading changes the ToolGuard launch template on every GPU profile and triggers an ASG rolling instance refresh, replacing hosts and restarting tasks (each restart reloads the model); expect a capacity dip per replacement batch.
    • !MS_TEAMS_APP_URL (the domain name) is effectively immutable after agents are provisioned — changing it orphans existing Azure Bot resources until each is deleted and recreated.
79. docs update Sep 25, 2026 · issue 085

    Runlayer agents gain granular Slack messaging controls: separate toggles for DMs, channel posts, and inbound direct messages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Lock down an agent so it only responds to channel mentions and thread follow-ups, preventing users from bypassing audit trails via direct messages.
    📍In the agent's Slack settings, go to Inbound messaging controls and turn off Direct messages to the agent and Replies. Under Sending, confirm Direct messages to people and Channel posts are set to off.
    • Adds Direct messages to people and Channel posts switches (both default off) under Sending in the agent's Slack settings to control whether the agent can initiate DMs or post to channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

80. docs update Sep 25, 2026 · issue 085

    Runlayer: Adds a browser extension to monitor and protect AI web chats in Chrome, Edge, and Firefox.

    • Adds JumpCloud deployment support for AI Watch on macOS (.pkg) and Windows (.msi) via JumpCloud Private Repo, shipping Detect, endpoint modes, and Sessions in one package per OS.

    1 detail in Everything

81. 1.28.811 Sep 25, 2026 · release notes

    Runlayer 1.28.811 adds per-entry Enforce/Protect policy management, improved agent Slack UI, and clearer network deny messages.

    • runlayer run now starts local MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers with a minimal environment (connector variables + proxy/TLS/locale) instead of passing through the AI client's entire environment
    • Manage Enforce/Protect policy lists (allowed/denied MCP URLs, local packages, built-in servers) one entry at a time with search and pagination via the UI or API
    • Agent Slack settings page splits into four sections: Replies, Channel access, Monitoring, and Sending
    • Network deny messages for blocked hook verification requests now explicitly identify the blocking component (firewall, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., etc.) and point to the relevant client

    4 details in Everything

82. 1.28.780 (2026-09-24) Sep 24, 2026 · issue 085

    Runlayer 1.28.780 adds Google AI Studio, JumpCloud MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. deployment, on-demand agent tools, and inline approval decisions in agent chats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Confirm which org API key or enrollment key AI Watch is using on a managed device before troubleshooting enrollment issues.
    copy

    $ aiwatch config show

    Skip Slack setup when programmatically creating an agent via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. so it is immediately usable without requiring Slack connector access.
    copy

    $ enable_channels=[]

    Add the Google AI Studio provider so agents can be backed by Gemini models.
    📍In Runlayer, go to Settings → AI Providers, select Google AI Studio, paste your Gemini API key, and enter the model IDs you want available to agents.
    • Adds aiwatch config show command, displaying managed org API keys as a prefix (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ rl_org_Ab1C2d3...) and enrollment keys as prefix plus last four characters, to confirm which key a device is using.
    • Deploys AI Watch to macOS and Windows through JumpCloud from the MDM configuration wizard, with pre-filled configuration profiles and Private Repo Command Line Options for the signed MSI.
    • AI Watch Enforce now treats a local runlayer run MCP launcher as Runlayer-managed only when its --host points at your Runlayer deployment and names an active connector; launchers without --host, aimed at another host, or naming an unknown/disabled connector are blocked.
    • Adds a dedicated Google AI Studio provider so agents can run on Google Gemini models — configure via Settings → AI Providers with your Gemini API key and model IDs.
    • Enables inline approve/deny of agent tool-call approval requests directly in Agent Playground, Runlayer Assistant, and Home Build, with the agent continuing in the same conversation after the decision.

    +12 more show less

    • Pi agents discover connector tools on demand, keeping unused tool definitions out of the model's context.
    • Supports interactive HTML Artifact previews inside Slack using existing Runlayer permissions (requires embeds enabled for the workspace's Runlayer app).
    • Surfaces artifacts (interactive apps, images, videos, documents) inline in agent chat directly under the agent's answer, openable full-page from the caption.
    • Adds a Slack badge on an agent's Sessions tab that links directly to the Slack message or thread that started a given run.
    • Allows deleting a skill even when agents use it, with a confirmation dialog listing the affected agents.
    • Slack channel monitors now reply only when the agent has something useful to add, with silent runs still appearing in activity.
    • Run details for Slack channel monitor-triggered runs now show the channel, the message reacted to, and why it matched the monitor's condition.
    • Adds recommended per-tool security scanner settings for 39 more connectors, reviewable and applicable via a dialog on the connector page after adding from the catalog.
    • Every agent account now has an accountable owner shown in the account summary, with the creator set as owner by default.
    • Supports enable_channels=[] parameter when creating an agent through MCP to skip Slack setup.
    • Adds persistent, named Runlayer Assistant sessions resumable from History as you navigate Runlayer.
    • Agent run panel on the Sessions tab now leads with live status, elapsed time, cost, and failure reason alongside the Retry action.
    • Adds aiwatch config show command, displaying managed org API keys as a prefix (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ rl_org_Ab1C2d3...) and enrollment keys as prefix plus last four characters, to confirm which key a device is using.
    • Deploys AI Watch to macOS and Windows through JumpCloud from the MDM configuration wizard, with pre-filled configuration profiles and Private Repo Command Line Options for the signed MSI.
    • Adds a dedicated Google AI Studio provider so agents can run on Google Gemini models — configure via Settings → AI Providers with your Gemini API key and model IDs.
    • Enables inline approve/deny of agent tool-call approval requests directly in Agent Playground, Runlayer Assistant, and Home Build, with the agent continuing in the same conversation after the decision.
    • Supports interactive HTML Artifact previews inside Slack using existing Runlayer permissions (requires embeds enabled for the workspace's Runlayer app).

    +5 more show less

    • Adds a Slack badge on an agent's Sessions tab that links directly to the Slack message or thread that started a given run.
    • Run details for Slack channel monitor-triggered runs now show the channel, the message reacted to, and why it matched the monitor's condition.
    • Every agent account now has an accountable owner shown in the account summary, with the creator set as owner by default.
    • Supports enable_channels=[] parameter when creating an agent through MCP to skip Slack setup.
    • Adds persistent, named Runlayer Assistant sessions resumable from History as you navigate Runlayer.

    7 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The reply-behavior setting for Slack channel monitors is removed; monitors now only reply when the agent has something useful to add, with no option to restore the previous post-every-run behavior.
    • !AI Watch Enforce no longer allows runlayer run MCP launchers without --host, aimed at another host, naming an unknown or disabled connector, or carrying unsupported options — and they can no longer be allowlisted from the Shadow AI activity view.
83. changelog Sep 24, 2026 · issue 084

    Runlayer adds Claude Opus 5.5, GPT-6 models, DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key.-bound agent tokens, calendar budget windows, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. trigger management, and a Gmail label trigger across this release cycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Route a Gemini model through an OpenAI-Compatible provider when you want to use Google Gemini from an agent that already targets an OpenAI-style endpoint.
    📍In the Runlayer console, go to Providers › Add Provider › OpenAI-Compatible, set the base URL to https://generativelanguage.googleapis.com, and paste your Google API key. Runlayer will send it as a Google API key rather than a Bearer token. Then select the provider when creating or editing your agent.
    Enforce DPoP binding on a high-privilege agent so its tokens cannot be replayed if intercepted.
    📍In the Runlayer console, open the agent › Settings › Security, enable Require DPoP, then re-issue the agent-account token with a DPoP key bound at issuance. The MCP proxy will reject any token presented without a valid DPoP proof.
    • Adds DPoP-bound agent tokens: agent-account tokens can be bound to DPoP keys at issuance and enforced at the MCP proxy, with a per-agent require DPoP flag and admin UI.
    • Adds calendar-based budget windows to LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway usage rules, enabling monthly or other calendar-period caps.
    • Adds max_completion_tokens in place of the legacy max_tokens parameter for Azure Foundry agents on gpt-5-family deployments.
    • Adds a Gmail label-added poll trigger that fires an agent when a label is added to a Gmail message.
    • Adds Trigger management over MCP: create, list, and delete agent triggers through Runlayer MCP tools.

    +21 more show less

    • Adds Salesforce connector to the catalog, carrying the Salesforce server's own tool schemas so agents and triggers call its tools with the correct arguments; setup guide documents the required OAuth scope and INVALID_SCOPES recovery.
    • Adds Vercel integration available through the OAuth broker.
    • Adds zip skill import: create a multi-file skill by importing a single zip file.
    • Adds View as permission group capability for Super Admins to view the workspace as any permission group.
    • Adds per-tool enrollment diff in the recommended security-setting enrollment flow, showing the effective per-tool diff with scan-direction safety checks before applying.
    • Adds Run schedules on demand: run a schedule immediately and retry failed scheduled runs from the schedule list.
    • Adds Slack thread following: after being mentioned, an agent can continue following the conversation in that thread without requiring another mention.
    • Adds inline video artifact playback in the run view, with the artifact size limit raised to 25 MB.
    • Adds sessions timeline with skipped Slack messages: the agent Sessions list now shows messages the agent chose to skip alongside runs, and search covers both.
    • Adds login-host badge on managed devices when a user's login host differs from the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed host.
    • Adds OAuth token redaction in audit log details.
    • Adds Agent Discovered as a named audit event type for agents found by AI Watch device scans, including back-filling previously recorded Unknown Event rows.
    • Adds google-docs edit_table tool support for setting multiple table cells in one call via set_cells.
    • AI Watch scan exit status now exits 0 with a Submitted; server marked surfaces incomplete warning (naming each surface and reason) for scans the server accepted but could not fully attribute, instead of exiting 3 as Could not submit.
    • Adds Slack progress cards for long agent runs: agents spending more than a few minutes on one step continue progress on a fresh card without showing a warning icon.
    • Adds Playground Stop button that cancels the active run.
    • Adds Runs continue after approval for MCP- and REST-triggered agent runs, and allows continuing your own run from any surface.
    • Skill scanning now catches combined short-flag recursive deletes such as rm -rf.
    • Adds richer audit events: managed Slack provisioning is audited, and agent-run tool-call audit events carry the agent and run IDs.
    • Model picker hover cards now show pricing and context data from the LiteLLM catalog.
    • The agent channel intro message is now off by default, configurable per agent.
    • Adds DPoP-bound agent tokens: agent-account tokens can be bound to DPoP keys at issuance and enforced at the MCP proxy, with a per-agent require DPoP flag and admin UI.
    • Adds calendar-based budget windows to LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway usage rules, enabling monthly or other calendar-period caps.
    • Adds a Gmail label-added poll trigger that fires an agent when a label is added to a Gmail message.
    • Adds Trigger management over MCP: create, list, and delete agent triggers through Runlayer MCP tools.
    • Adds Salesforce connector to the catalog, carrying the Salesforce server's own tool schemas so agents and triggers call its tools with the correct arguments; setup guide documents the required OAuth scope and INVALID_SCOPES recovery.

    +9 more show less

    • Adds Vercel integration available through the OAuth broker.
    • Adds zip skill import: create a multi-file skill by importing a single zip file.
    • Adds View as permission group capability for Super Admins to view the workspace as any permission group.
    • Adds Run schedules on demand: run a schedule immediately and retry failed scheduled runs from the schedule list.
    • Adds Slack thread following: after being mentioned, an agent can continue following the conversation in that thread without requiring another mention.
    • Adds inline video artifact playback in the run view, with the artifact size limit raised to 25 MB.
    • Adds login-host badge on managed devices when a user's login host differs from the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed host.
    • Adds OAuth token redaction in audit log details.
    • Adds Playground Stop button that cancels the active run.

    12 more in Everything

84. docs update Sep 23, 2026 · issue 083
    └──▷ USE IT
    Trust a corporate private CA for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxies in your ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. Runlayer deployment by passing your CA bundle to the Terraform module.
    main.tf copy

    module "runlayer" {
      source          = "runlayer/ecs"
      version         = ">= 6.64.0, < 7.0.0"
      trusted_ca_pem  = file("${path.module}/company-ca.pem")
      # ... other required variables
    }

    Enable Microsoft Teams bot integration on a self-managed ECS deployment by supplying all five required Teams variables to the Terraform module.
    main.tf copy

    module "runlayer" {
      source                       = "runlayer/ecs"
      version                      = ">= 6.64.0, < 7.0.0"
      ms_teams_app_client_secret   = var.ms_teams_app_client_secret  # via TF_VAR_ms_teams_app_client_secret
      # remaining four values supplied as environment variables:
      # MS_TEAMS_APP_CLIENT_ID              = "00000000-0000-0000-0000-000000000000"
      # MS_TEAMS_RUNLAYER_TENANT_ID         = "00000000-0000-0000-0000-000000000000"
      # MS_TEAMS_AZURE_SUBSCRIPTION_ID      = "00000000-0000-0000-0000-000000000000"
      # MS_TEAMS_AZURE_RESOURCE_GROUP       = "runlayer-ms-teams-bots"
      # MS_TEAMS_APP_URL                    = "https://<domain_name>"
      # ... other required variables
    }

    └──▷ BREAKING ON UPGRADE

    • !The MS_TEAMS_APP_URL (domain name) is effectively immutable once agents are provisioned: each agent's Azure Bot resource stores the messaging endpoint at creation time and is never rewritten, so changing the domain orphans existing bots until each is deleted and recreated.
85. docs update Sep 23, 2026 · issue 083

    Runlayer agents can now reject Slack DMs and restrict interaction to channel mentions only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Restrict an agent to channel-only interaction so it never processes DMs or assistant-pane conversations.
    📍In the agent's Slack settings, go to Inbound messaging and turn off Direct messages to the agent.
    • Adds Direct messages to the agent / Inbound messaging toggle in an agent's Slack settings to block inbound DMs — when disabled, the agent replies that it does not accept direct messages and redirects users to mention it in a channel instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

86. 1.28.731 (2026-09-23) Sep 23, 2026 · issue 083

    Runlayer 1.28.731 adds Claude Opus 5.5, GPT-6 Sol/Luna, channel-only Slack agents, and Shadow AI access controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Prevent employees from DMing a sensitive Slack agent directly — force all interactions into auditable channels.
    📍In the agent's settings, go to Slack notifications and disable Allow direct messages. Users who DM the agent will be prompted to mention it in a channel instead.
    Route Gemini model calls through an OpenAI-Compatible provider so agents can use Google models without Bearer-token auth failures.
    📍In the provider settings, add an OpenAI-Compatible provider with base URL set to generativelanguage.googleapis.com and supply your Google API key. Runlayer will send it in the format Google expects.
    • Restricts saved Shadow AI skill and plugin files to resource managers and security or analytics reviewers; organization-wide Shadow AI REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools now require organization-wide audit log access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for channel-only Slack agents: admins can turn off direct messages to an agent in its Slack settings, redirecting DMs to channel mentions instead.
    • Adds Claude Opus 5.5 as an agent model, available via the Anthropic API or AWS Bedrock, with adaptive thinking effort settings.
    • Adds GPT-6 Sol and GPT-6 Luna as agent model options for the OpenAI provider.
    • Supports Google Gemini through OpenAI-Compatible providers pointed at generativelanguage.googleapis.com, sending API keys in the format Google expects rather than as a Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
    • Restricts saved Shadow AI skill and plugin files to resource managers and security or analytics reviewers; organization-wide Shadow AI REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools now require organization-wide audit log access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for channel-only Slack agents: admins can turn off direct messages to an agent in its Slack settings, redirecting DMs to channel mentions instead.
    • Supports Google Gemini through OpenAI-Compatible providers pointed at generativelanguage.googleapis.com, sending API keys in the format Google expects rather than as a Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..

    2 more in Everything

87. docs update Sep 23, 2026 · issue 083

    Runlayer Terraform module gains private CA trust bundles and Microsoft Teams integration for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. self-hosted deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Trust an internal private CA so ECS workers can reach MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers or HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxies signed by that CA.
    hcl copy

    trusted_ca_pem = file("${path.module}/company-ca.pem")

    Enable Microsoft Teams integration by supplying all five required values; pass the client secret via environment variable to avoid storing it in state.
    terraform.tfvars copy

    # terraform.tfvars
    MS_TEAMS_APP_CLIENT_ID          = "00000000-0000-0000-0000-000000000000"
    MS_TEAMS_RUNLAYER_TENANT_ID     = "00000000-0000-0000-0000-000000000000"
    MS_TEAMS_AZURE_SUBSCRIPTION_ID  = "00000000-0000-0000-0000-000000000000"
    MS_TEAMS_AZURE_RESOURCE_GROUP   = "runlayer-ms-teams-bots"
    MS_TEAMS_APP_URL                = "https://runlayer.example.com"
    # export TF_VAR_ms_teams_app_client_secret=<secret> before running terraform apply

    • Adds trusted_ca_pem Terraform module variable to inject a PEM certificate bundle (single or concatenated) into ECS deployments, enabling backend, shared worker, and MCP execution worker tasks to trust private CA-signed MCP servers and HTTPS proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Microsoft Teams integration via five module variables — ms_teams_app_client_secret (Terraform variable, recommended via TF_VAR_*) plus MS_TEAMS_APP_CLIENT_ID, MS_TEAMS_RUNLAYER_TENANT_ID, MS_TEAMS_AZURE_SUBSCRIPTION_ID, MS_TEAMS_AZURE_RESOURCE_GROUP, and MS_TEAMS_APP_URL — which together provision a per-agent Entra app registration and Azure Bot Service resource; the integration is off unless all five values are set.
    • Adds rds_writer_cpu_utilization_threshold, rds_reader_cpu_utilization_threshold, and rds_writer_acu_utilization_threshold Terraform variables to control RDS autoscaling targets for ECS deployments.
    • Requires registering https://<domain_name>/api/v1/integrations/ms-teams/admin-consent-callback as a Redirect URI (Authentication → Web) on the multi-tenant Entra app registration for Teams admin consent to succeed.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The MS_TEAMS_APP_URL (domain name) is effectively immutable after agents are provisioned — changing it orphans each agent's Azure Bot resource, which must be deleted and recreated to restore Teams connectivity.
88. docs update Sep 23, 2026 · issue 083

    Runlayer Operator adds Microsoft Teams integration, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Catalog API, AI Watch binary distribution, and OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools. observability support on Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Inject the MCP Catalog API key into the platform namespace so onboarding can reach GET /api/v1/catalog/ and setup status loads correctly.
    copy

    $ kubectl create secret generic runlayer-catalog \
      --namespace runlayer-platform \
      --from-literal=MCP_CATALOG_API_KEY=<key-from-runlayer>

    Apply updated CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. before upgrading the operator to avoid schema drift between the controller and the cluster.
    copy

    $ kubectl apply -f crds/platform.runlayer.com_runlayerinstances.yaml \
                 -f crds/deploy.runlayer.com_mcpservers.yaml

    • Adds MCP_CATALOG_API_KEY secret (set on the platform namespace) to enable MCP Catalog onboarding; without it, GET /api/v1/catalog/ fails and setup shows Couldn't load setup status.
    • Adds AI Watch binary distribution support, requiring a Runlayer download token and a customer-owned object-storage cache with workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. permissions; missing inputs surface as 'No AI Watch installer is currently resolved' in the UI.
    • Adds OTLP observability support for Kubernetes deployments (requires Kubernetes ≥ 1.29 and reachable OTLP endpoints; hostname endpoints may need extra NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. CIDRs).
    • Publishes operator and runlayer-instance Helm chart via Customer Distribution OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry at oci://088332244652.dkr.ecr.us-east-1.amazonaws.com/runlayer-helm-charts/runlayer-instance, supporting cross-account ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. pulls for EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. and GAR/private mirror for GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. or air-gapped environments.
    • Adds CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. manifests crds/platform.runlayer.com_runlayerinstances.yaml and crds/deploy.runlayer.com_mcpservers.yaml shipped with the Helm chart for upgrade workflows.

    +3 more show less

    • Adds configurable HPA behavior block with documented defaults: 1800s scale-down stabilization for fleet components, 300s for others, max 10% removal per minute, and 60s scale-up with up to 50% or 2 pods per minute; setting behavior replaces the entire default block.
    • Publishes supporting guides covering Kubernetes prerequisites (EKS + GKE cluster requirements), external dependencies (Postgres, Redis, buckets, streams with sample Terraform), Runlayer-provided inputs, and a ServiceAccount → IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. / Workload Identity permission matrix.
    • Adds components.mcpCatalogApi Helm/CR field to optionally enable in-cluster MCP Catalog API; the documentation notes this should not be enabled for the standard customer path.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Changing MS_TEAMS_APP_URL after initial provisioning does not move already-provisioned bots: each agent's Azure Bot resource keeps the messaging endpoint captured at provisioning time and must be recreated.
89. docs update Sep 23, 2026 · issue 083

    Runlayer adds workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. support for EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. (IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials.) and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., eliminating long-lived cloud keys from deployments⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Wire IRSA roles to each Runlayer component on EKS so workloads assume cloud permissions without embedded credentials.
    yaml copy

    spec:
      serviceAccount:
        backend:
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/runlayer-acme-backend
        worker:
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/runlayer-acme-worker
        auditConsumer:
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/runlayer-acme-audit-consumer
        siemExport:
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/runlayer-acme-siem-export
        sessionMaterializer:
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/runlayer-acme-session-materializer

    Verify that the IRSA annotation is present on the ServiceAccount and that the pod actually assumes the expected role.
    copy

    $ kubectl -n runlayer-acme get sa acme-prod-backend -o yaml
    # expect eks.amazonaws.com/role-arn in annotations
    kubectl -n runlayer-acme exec deploy/acme-prod-backend -c backend -- aws sts get-caller-identity
    # Arn should be the IRSA role

    Deploy Runlayer into a custom namespace instead of the default runlayer-<customerId> when your cluster naming conventions require it.
    yaml copy

    spec:
      deploy:
        platformNamespace: runlayer-acme-prod

    • Adds spec.serviceAccount field in the RunlayerInstance CR to annotate per-component Kubernetes ServiceAccounts with IRSA role ARNs (eks.amazonaws.com/role-arn) on EKS or GSA emails (iam.gke.io/gcp-service-account) on GKE — no long-lived cloud keys embedded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds spec.deploy.platformNamespace to the RunlayerInstance CR to override the default runlayer-<customerId> namespace where workload-identity ServiceAccounts are created.
    • Provisions dedicated Kubernetes ServiceAccounts per component — {instance}-backend, {instance}-worker, {instance}-audit-consumer, {instance}-siem-export, {instance}-session-materializer, {instance}-toolguard — each independently annotatable with cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles.
    • Publishes a per-component permission matrix covering S3/GCS, Kinesis/Pub/Sub, DynamoDB checkpoints, Bedrock/Vertex LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. invocation, and bedrock-agentcore:InvokeAgentRuntime so operators can scope IAM grants to only enabled features.

    4 details in Everything

90. docs update Sep 23, 2026 · issue 083

    Runlayer documents external dependency wiring for PostgreSQL, Redis, audit streams, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. export, AI Watch packages, and session materializer on AWS and GCP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Wire audit streaming and SIEM export into a RunlayerInstance CR after provisioning the Kinesis stream, EFO consumers, DynamoDB checkpoint tables, and DLQ/destination buckets out-of-band.
    yaml copy

    spec:
      components:
        auditConsumer:
          enabled: true
          streamBackend: kinesis
          kinesis:
            streamArn: arn:aws:kinesis:us-east-1:123456789012:stream/myorg-audit-log
            consumerArn: arn:aws:kinesis:us-east-1:123456789012:stream/myorg-audit-log/consumer/myorg-audit-log-consumer
            checkpointTableName: myorg-audit-log-consumer-checkpoints
            deadLetterBucket: myaccount-myorg-audit-log-consumer-dlq
        siemExport:
          enabled: true
          streamBackend: kinesis
          kinesis:
            streamArn: arn:aws:kinesis:us-east-1:123456789012:stream/myorg-audit-log
            consumerArn: arn:aws:kinesis:us-east-1:123456789012:stream/myorg-audit-log/consumer/myorg-siem-export
            checkpointTableName: myorg-siem-export-checkpoints
            deadLetterBucket: myaccount-myorg-siem-export-dlq
          export:
            s3Bucket: myaccount-myorg-siem-export

    Enable Redis with TLS in the RunlayerInstance CR after provisioning an ElastiCache replication group with transit_encryption_mode: required.
    yaml copy

    spec:
      redis:
        tls: true

    • Maps PostgreSQL (Aurora/RDS or Cloud SQL) into RunlayerInstance via spec.database.* and Secrets runlayer-db / runlayer-redis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Maps Redis (ElastiCache or Memorystore) into RunlayerInstance via spec.redis.*, with spec.redis.tls: true when TLS/auth is enabled.
    • Enables optional AI Watch binary package caching via a private S3 bucket configured with BINARY_PACKAGES_S3_BUCKET on runlayer-app, requiring s3:ListBucket, s3:GetObject, and s3:PutObject on the {instance}-backend and -worker IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. roles.
    • Enables optional audit event streaming to Kinesis or GCP Pub/Sub, wired into components.auditConsumer with streamBackend: kinesis or streamBackend: pubsub, plus spec.gcp.projectId for GCP.
    • Enables optional SIEM export as an independent consumer on the same Kinesis or Pub/Sub stream, wired into components.siemExport with streamBackend: kinesis, kinesis.streamArn, kinesis.consumerArn, kinesis.checkpointTableName, kinesis.deadLetterBucket, and export.s3Bucket.

    +1 more show less

    • Enables optional session materializer component ({instance}-session-materializer) backed by a Kinesis hook-events stream, DynamoDB checkpoint table, S3 session-payloads bucket, and S3 DLQ on AWS; or an ordered Pub/Sub subscription and GCS buckets on GCP.

    6 details in Everything

91. docs update Sep 23, 2026 · issue 083

    Runlayer adds self-hosted Kubernetes deployment support on EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. alongside existing ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping./AWS path⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Kubernetes self-hosting support on EKS (AWS) and GKE (GCP), requiring Kubernetes 1.29+ and Helm 3.8+, as an alternative to the ECS deployment path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Runlayer Operator for EKS/GKE, enabling one or many isolated tenants via MCPServer on the same cluster.
    • Supports per-workload ServiceAccounts with IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. (EKS) or GKE Workload Identity for cloud API access.
    • Supports AWS Bedrock as an AI provider in the EKS self-hosted deployment path, requiring IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions and Anthropic Bedrock use-case form approval.
    • Adds multi-tenant platform topology where platform teams can run Runlayer for multiple internal orgs on a single EKS/GKE cluster.

    5 details in Everything

92. docs update Sep 23, 2026 · issue 083

    Runlayer adds Agent Accounts with per-agent policies and audit trails, plus Kubernetes self-hosting docs for EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., and Figma MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Agent Accounts — give each agent its own identity in Runlayer with independent policies, delegations, tokens, and audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Kubernetes self-hosting support: cluster prerequisites for EKS and GKE, external dependency guidance (Postgres, Redis, buckets, streams) with sample Terraform for EKS (AWS) and GKE (GCP).
    • Adds Workload Identity mapping for the Runlayer Operator: map operator ServiceAccounts to IRSAIRSAAn AWS mechanism that lets a Kubernetes pod assume an IAM role via a service account, so tools running in EKS can call AWS APIs without embedding long-lived credentials. (EKS) or Workload Identity (GKE) via a per-feature permission matrix.
    • Adds Figma integration: connect Figma's remote MCP server through Runlayer using a customer-registered OAuth app.

    4 details in Everything

93. docs update Sep 23, 2026 · issue 083

    Runlayer Operator now supports customer-managed Kubernetes clusters on EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

94. 1.28.687 (2026-09-22) Sep 22, 2026 · issue 083

    Runlayer 1.28.687 adds Figma MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector, client-provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. policy conditions, and queued agent messages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Lock a connector so self-registered MCP clients can never reach it, regardless of whether they go direct or through a plugin.
    📍In the Runlayer console, go to Policies › New policy condition, set the field to meta.client.kind, operator to equals, and value to dcr (or any of: cimd, pre_registered, manual, ema, agent). Add a second condition on meta.plugin.id if you also want to block plugin-routed paths. Set the policy action to Deny and apply it to the target connector.
    • Adds meta.client.kind (values: dcr, cimd, pre_registered, manual, ema, agent) and meta.plugin.id as policy condition keys so access policies can gate connectors by how an MCP client obtained its credentials and whether it reaches a connector directly or through a plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Figma remote MCP connector to the catalog — register a Figma OAuth app, have Figma approve its client ID, paste credentials into the connector, and users connect with their own Figma account.
    • Adds a recommended security settings dialog on the connector page so admins with the Manage security policies capability can review and apply per-tool scanner settings after deploying a connector, instead of during the deploy wizard.
    • Adds queued agent messages: send follow-ups while an agent is working and they run in order; messages can be edited, reordered, or removed, and resumed after stopping a response.
    • Adds shareable Policies view URLs so admins can bookmark and share filtered policy views, and connector notices now open Policies pre-filtered to the relevant connector.
    • Adds meta.client.kind (values: dcr, cimd, pre_registered, manual, ema, agent) and meta.plugin.id as policy condition keys so access policies can gate connectors by how an MCP client obtained its credentials and whether it reaches a connector directly or through a plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Figma remote MCP connector to the catalog — register a Figma OAuth app, have Figma approve its client ID, paste credentials into the connector, and users connect with their own Figma account.
    • Adds queued agent messages: send follow-ups while an agent is working and they run in order; messages can be edited, reordered, or removed, and resumed after stopping a response.
    • Adds shareable Policies view URLs so admins can bookmark and share filtered policy views, and connector notices now open Policies pre-filtered to the relevant connector.

    1 more in Everything

95. docs update Sep 19, 2026 · issue 079

    Runlayer Operator gains Microsoft Teams provisioning via six new MS_TEAMS_* environment variables⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Enable Microsoft Teams bot provisioning on a self-hosted Runlayer Operator deployment by supplying all required MS_TEAMS_* variables — omitting any of them leaves Teams provisioning off.
    .env copy

    MS_TEAMS_APP_CLIENT_ID=<entra-app-client-id>
    MS_TEAMS_APP_CLIENT_SECRET=<entra-app-client-secret>
    MS_TEAMS_RUNLAYER_TENANT_ID=<entra-tenant-id>
    MS_TEAMS_AZURE_SUBSCRIPTION_ID=<azure-subscription-id>
    MS_TEAMS_AZURE_RESOURCE_GROUP=<resource-group-name>
    MS_TEAMS_APP_URL=https://runlayer.example.com

    • Adds MS_TEAMS_APP_CLIENT_SECRET environment variable to supply the client secret for the Entra provisioning app backing the Microsoft Teams integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds MS_TEAMS_APP_CLIENT_ID environment variable to set the application (client) ID of the multi-tenant Entra app used to provision per-agent Teams bots.
    • Adds MS_TEAMS_RUNLAYER_TENANT_ID environment variable to identify the Entra tenant where per-agent Entra apps and Azure Bot resources are created.
    • Adds MS_TEAMS_AZURE_SUBSCRIPTION_ID environment variable to specify the Azure subscription holding the Bot Service resources.
    • Adds MS_TEAMS_AZURE_RESOURCE_GROUP environment variable to specify the resource group within that subscription.

    +1 more show less

    • Adds MS_TEAMS_APP_URL environment variable to set the public HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. base for the Bot Framework messaging endpoint and admin-consent callback; defaults to the operator's own host and must match the Redirect URI registered on the Entra app or admin consent fails with AADSTS500113.

    6 details in Everything

96. docs update Sep 19, 2026 · issue 079

    Runlayer Terraform module gains Microsoft Teams integration with per-agent Entra app and Azure Bot Service provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Microsoft Teams integration to the Terraform module, configured via five environment variables — MS_TEAMS_APP_CLIENT_ID, MS_TEAMS_RUNLAYER_TENANT_ID, MS_TEAMS_AZURE_SUBSCRIPTION_ID, MS_TEAMS_AZURE_RESOURCE_GROUP, and MS_TEAMS_APP_URL — with the client secret supplied through ms_teams_app_client_secret (recommended via TF_VAR_ms_teams_app_client_secret); the integration is off unless all five values are set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Provisioning the Teams integration creates a per-agent Entra app registration and Azure Bot Service resource, requiring a multi-tenant app registration with Graph application permissions Application.ReadWrite.All, AppCatalog.ReadWrite.All, and TeamsAppInstallation.ReadWriteForUser.All (admin-consented), a resource group granting Azure Bot Service Contributor to that app, and the Microsoft.BotService provider registered on the subscription.
    • Requires registering https://<domain_name>/api/v1/integrations/ms-teams/admin-consent-callback as a Redirect URI under Authentication → Web on the app registration, or admin consent fails with AADSTS500113.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The domain name configured at agent provisioning time is effectively immutable: each agent's Azure Bot resource stores the messaging endpoint captured at creation time and is never rewritten, so changing the domain orphans existing bots until each is deleted and recreated.
97. docs update Sep 19, 2026 · issue 079

    Runlayer adds Agent Accounts, giving each agent its own identity with policies, delegations, tokens, and audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

98. 1.28.574 - Richer session timelines and inline video artifacts (2026-09-18) Sep 18, 2026 · issue 079

    Runlayer 1.28.574 adds skipped-message timelines, inline video artifacts (25 MB), login-host badges, and OAuth token redaction in audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Agents Sessions list now shows Slack messages the agent chose to skip alongside runs, with search covering both skipped messages and runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Video artifacts play inline in the run view, and the artifact size limit is raised to 25 MB.
    • Clicking a trace header with a single tool call opens its details directly.
    • Managed devices show a badge when a user's login host differs from the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed host, and hooks target the managed host.
    • OAuth token keys are redacted in audit log details.
    • Agents Sessions list now shows Slack messages the agent chose to skip alongside runs, with search covering both skipped messages and runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Managed devices show a badge when a user's login host differs from the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-managed host, and hooks target the managed host.
    • OAuth token keys are redacted in audit log details.

    2 more in Everything

99. docs update Sep 18, 2026 · issue 078

    Runlayer adds full Microsoft Teams integration: per-agent bots, workspace notifications, and link preview cards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable ambient channel monitoring so a security-focused agent answers every deployment-failure discussion without needing an @mention.
    📍1. Open the agent detail page. 2. Under Microsoft Teams, toggle on Respond without being tagged in channels. 3. In the condition field that appears, enter: only respond to messages about deployment failures 4. Click Save. 5. Reinstall the Teams app (Microsoft Teams → Install, same dialog) so the team owner can grant the extra permission.
    Route security scan violation alerts to a dedicated SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. channel and suppress low-severity mask/alert-only noise.
    📍1. Go to Settings → Integrations → Microsoft Teams. 2. Click Create Teams Bot and complete the tenant connection if not already done. 3. @mention the bot at least once from your #soc-alerts channel so it can post there. 4. Set Security alerts channel to #soc-alerts. 5. Enable Only alert on blocked calls. 6. Click Test next to the Security alerts channel to confirm delivery.
    Install an agent bot across an entire team in bulk so every channel member can @mention it immediately.
    📍1. Open the agent detail page → Microsoft Teams → Install. 2. In the Install Teams app dialog, choose Team (all channels). 3. Click Install for all teams. 4. Click Install.
    • Adds Microsoft Teams integration, enabling each agent to have its own bot that responds to @mentions and direct messages in Teams channels; connect via Settings → Integrations → Connect Microsoft Teams for org-wide tenant authorization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds per-agent Teams bot install from the agent detail page under Microsoft Teams → Install, with options to target a specific user (direct message), a team (all channels), or bulk install for all users or all teams.
    • Adds Respond without being tagged in channels toggle under each agent's Microsoft Teams settings, letting the bot answer channel messages it is not @mentioned in, with an optional natural-language condition to scope which messages trigger a response.
    • Adds agent-initiated outbound posting to a Teams channel — an agent can post a new message into any channel whose ID is provided, independent of any incoming message that triggered it.
    • Adds a shared Runlayer Teams Bot for workspace-level notifications, configurable from Settings → Integrations → Microsoft Teams with a Notification channel, an optional Security alerts channel for security scan violations, and an Only alert on blocked calls toggle.

    +1 more show less

    • Adds Runlayer link previews in Teams: pasting an agent, skill, plugin, artifact, or session URL into a Teams chat triggers the agent's bot to resolve it into a rich card showing resource type, title, and creator (access-aware, matching Slack's behavior); enabled by reinstalling the Teams app to pick up the updated manifest.

    6 details in Everything

100. 1.28.545 - Slack thread following, on-demand schedules, and trigger management over MCP (2026-09-17) Sep 17, 2026 · issue 078

     Runlayer 1.28.545 adds Slack thread following, on-demand schedule runs, and trigger management via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

     └──▷ HOW TO FIND IT
     Immediately re-run a failed scheduled job without waiting for the next scheduled window.
     📍In the Runlayer console, go to Agents › your agent › Schedules, then click Run now on the target schedule or Retry next to a failed run.
     • Adds trigger management via Runlayer MCP tools — create, list, and delete agent triggers programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Enables agents to follow a Slack thread continuously after an initial mention, without requiring re-mention for each reply.
     • Adds on-demand schedule execution — run a schedule immediately or retry failed scheduled runs directly from the schedule list.
     • Delivers Office document attachments shared in a Slack thread to the agent sandbox, and surfaces undeliverable files explicitly instead of silently skipping them.
     • Sets Claude Sonnet 5 as the default model for new agents; the managed assistant now runs on Claude Opus 4.8.

     +1 more show less

     • Turns the agent channel intro message off by default, with a per-agent opt-in to re-enable it.
     • Adds trigger management via Runlayer MCP tools — create, list, and delete agent triggers programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Enables agents to follow a Slack thread continuously after an initial mention, without requiring re-mention for each reply.

     4 more in Everything

     └──▷ BREAKING ON UPGRADE

     • !The agent channel intro message is now off by default; existing agents that relied on it broadcasting on channel join will no longer do so unless re-enabled per agent.
101. docs update Sep 17, 2026 · issue 077

     Runlayer adds Enterprise Grok Bot monitoring and DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. sender-constrained tokens for agent accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

     • Adds Central Grok Bot setup for Enterprise Team deployments, enabling credential provisioning and per-member shadow AI monitoring coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds DPoP (RFC 9449) sender-constrained token binding for agent accounts, tying tokens to a client-held ES256ES256An ECDSA digital signature algorithm using a P-256 elliptic curve and SHA-256 hash, defined in RFC 7518. Cyber tools use it to sign and verify JWTs with smaller keys than RSA while keeping strong integrity guarantees. key so a leaked token cannot be replayed.

     2 details in Everything

102. 1.28.515 - DPoP-bound agent tokens and calendar LLM budgets (2026-09-17) Sep 17, 2026 · issue 077

     Runlayer 1.28.515 adds DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key.-bound agent tokens, calendar LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. budget windows, recursive delete detection, and zip skill import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

     └──▷ HOW TO FIND IT
     Enforce DPoP-bound tokens for a specific agent to prevent token replay attacks at the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. proxy.
     📍In the Runlayer admin UI, go to Agents › select the agent › Settings, and enable the require DPoP flag. Tokens issued to this agent will be bound to a DPoP key and rejected at the MCP proxy if presented without a valid DPoP proof.
     Cap monthly LLM spend per agent to enforce governance budgets that reset on a calendar cycle.
     📍In the Runlayer admin UI, go to Agents › select the agent › Usage Rules, add a budget window, and set the period to monthly with your desired token or spend cap.
     Package a multi-file skill and import it in one step rather than uploading files individually.
     📍In the Runlayer admin UI, go to Skills › Import Skill, select Zip import, and upload a zip file containing all skill files. Runlayer will create the multi-file skill from the archive.
     • Adds DPoP binding for agent-account tokens at issuance, enforced at the MCP proxy via a per-agent require DPoP flag and admin UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds calendar-based budget windows (e.g. monthly caps) to LLM gateway usage rules.
     • Adds per-tool enrollment diff for recommended security-setting enrollment, showing the effective per-tool diff with scan-direction safety checks before applying.
     • Adds recursive delete detection to ToolGuard skill scanning, catching combined short-flag recursive deletes such as rm -rf.
     • Adds zip skill import, allowing a multi-file skill to be created by importing a single zip file.

     +5 more show less

     • Adds set_cells capability to the edit_table tool for Google Docs, enabling multiple table cells to be set in one call.
     • Extends audit events to cover Managed Slack provisioning and to carry agent and run IDs on agent-run tool-call events.
     • Adds View as permission group capability for Super Admins to view the workspace as any permission group.
     • Agent runs triggered via MCP or REST now continue after an approval decision, and users can continue their own run from any surface.
     • Rejected access requests now include an explanation of why the request was rejected.
     • Adds DPoP binding for agent-account tokens at issuance, enforced at the MCP proxy via a per-agent require DPoP flag and admin UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds calendar-based budget windows (e.g. monthly caps) to LLM gateway usage rules.
     • Adds zip skill import, allowing a multi-file skill to be created by importing a single zip file.
     • Adds View as permission group capability for Super Admins to view the workspace as any permission group.

     6 more in Everything

103. 1.28.478 - Gmail label-added trigger and Vercel connector (2026-09-16) Sep 16, 2026 · issue 077

     Runlayer 1.28.478 adds a Gmail label-added poll trigger, a Vercel OAuth connector, and agent approval run continuations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

     • Adds a Gmail label-added poll trigger that fires an agent whenever a label is added to a Gmail message.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds Vercel as a connector available through the OAuth broker.
     • Agents now post to Slack as the agent bot by default unless explicitly configured to act as the connected user.
     • Adds a Gmail label-added poll trigger that fires an agent whenever a label is added to a Gmail message.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds Vercel as a connector available through the OAuth broker.

     1 more in Everything

     └──▷ BREAKING ON UPGRADE

     • !Grok cloud hooks now require explicit opt-in and will no longer activate automatically — existing setups relying on automatic Grok cloud hook enrollment will stop working until opted in.
     • !In monitor mode, hooks now fail open (allow) on credential rejection instead of blocking the editor — workflows that previously relied on monitor-mode hooks to block on rejection will no longer be blocked.
104. 1.28.515 Sep 16, 2026 · release notes

     Runlayer 1.28.515 adds DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key.-bound agent tokens, calendar LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. budget windows, zip skill import, and richer audit events for agent runs.

     • Agent-account tokens can be bound to DPoP keys at issuance with a per-agent require DPoP flag.
     • LLM gateway usage rules now support calendar-based budget windows, such as monthly caps.
     • Multi-file skills can be imported via a single zip file.
     • Admin UI lets Super Admins view the workspace as any permission group.

     4 details in Everything

105. 1.28.478 Sep 15, 2026 · release notes

     Runlayer v1.28.478 adds Gmail label trigger, Vercel integration, monitor-mode hook fail-open, and Playground Stop.

     • Adds Gmail label-added poll trigger to fire agents when a label is added to a message
     • Adds Vercel connector via the OAuth broker
     • Configures monitor-mode hooks to fail open on credential rejection instead of blocking the editor
     • Requires explicit opt-in for Grok cloud hooks

     4 details in Everything

106. 1.28.428 - Webhook signing, scan budgets, and Windows browser auto-deploy (2026-09-14) Sep 14, 2026 · issue 076

     Runlayer 1.28.428 adds webhook HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. signing, scan budgets with fail-open/closed control, Terraform-managed agents, and Windows browser auto-deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

     • Adds runlayer_agent resource and data source to the Terraform provider so agents can be fully managed as infrastructure-as-code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds HMAC signing for agent webhooks — create, rotate, and disable signing secrets from the webhook dialog, with a scheme picker and curl examples.
     • Adds scan budgets to ToolGuard: configure latency and payload budgets with fail-open/fail-closed behavior, allow/truncate/block payload actions, and budget-exceeded events written to audit logs.
     • Adds new get_table, delete_between_text, and delete_table tools to the Google Workspace connector.
     • Adds usage APIs by IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups and departments.

     +10 more show less

     • Adds X API MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. to the connector catalog.
     • Unifies event triggers into Connector Events with audience fan-out, an event volume signal, and chat-list visibility for event-triggered runs.
     • Enables Chrome, Edge, and Firefox auto-deploy on managed Windows devices via the AI Watch browser extension, with native identity hosts per browser.
     • Enables AI Watch extension auto-deploy to Microsoft Edge on managed macOS devices.
     • Removes the per-agent artifact limit.
     • Adds server-side PDF text extraction to the Google Drive connector.
     • Adds spend breakdowns per person, team, and department — with clients drilling down to models — and browseable usage by current teams and departments.
     • Adds a work ledger for units-of-work pricing showing how each unit's cost was attributed, with branch checkouts steering attribution and Runlayer artifacts and skills counted as outputs with in-app preview.
     • Relays upstream progress notifications through the proxy so long-running tools report progress to clients.
     • Adds dynamic plugin routing per client, with Codex configured for plugin routing and org installs learning client-routed tools.
     • Adds runlayer_agent resource and data source to the Terraform provider so agents can be fully managed as infrastructure-as-code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
     • Adds HMAC signing for agent webhooks — create, rotate, and disable signing secrets from the webhook dialog, with a scheme picker and curl examples.
     • Adds scan budgets to ToolGuard: configure latency and payload budgets with fail-open/fail-closed behavior, allow/truncate/block payload actions, and budget-exceeded events written to audit logs.
     • Adds new get_table, delete_between_text, and delete_table tools to the Google Workspace connector.
     • Adds usage APIs by IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups and departments.

     +7 more show less

     • Adds X API MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. to the connector catalog.
     • Enables Chrome, Edge, and Firefox auto-deploy on managed Windows devices via the AI Watch browser extension, with native identity hosts per browser.
     • Adds server-side PDF text extraction to the Google Drive connector.
     • Adds spend breakdowns per person, team, and department — with clients drilling down to models — and browseable usage by current teams and departments.
     • Adds a work ledger for units-of-work pricing showing how each unit's cost was attributed, with branch checkouts steering attribution and Runlayer artifacts and skills counted as outputs with in-app preview.
     • Relays upstream progress notifications through the proxy so long-running tools report progress to clients.
     • Adds dynamic plugin routing per client, with Codex configured for plugin routing and org installs learning client-routed tools.

     3 more in Everything

107. 1.28.428 Sep 14, 2026 · release notes

     Runlayer 1.28.428 adds webhook HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. signing, scan budgets, Terraform agent management, and Edge auto-deploy.

     • Agent webhooks now support HMAC signing with secret creation, rotation, disabling, and a scheme picker
     • Configurable scan budgets for latency and payload limits with fail-open/closed, allow/truncate/block actions, and audit log events
     • Policies reject tokens from mismatched OAuth clients to harden token handling
     • AI Watch browser extension auto-deploys to Chrome, Edge, and Firefox on managed Windows devices
     • Edge AI Watch extension auto-deploys to managed macOS via Browser Extension

     +15 more show less

     • Extension health checks detect missing Chromium installations and refresh managed browser policy caches
     • Skill removal tracking reconciles removed skills from host scans for accurate installation counts
     • Connector Events unifies event triggers with audience fan-out, volume signals, and chat-list visibility
     • Terraform provider adds runlayer_agent resource and data source for agent management
     • Triggers UI now includes a polished Add Trigger flow and dedicated Triggers page
     • Per-agent artifact limit is removed, allowing unlimited artifacts per agent
     • Eager sandbox reconnects and immediate aborts on upstream rate limiting improve run steadiness
     • Spend breakdowns allow analysis per person, team, and department with model drilling via new APIs
     • Units of work pricing uses session time slices with a work ledger for cost attribution
     • New usage APIs support querying by IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. groups and departments
     • Google Drive connector extracts text from PDFs server-side
     • Google Workspace connector adds get_table, delete_between_text, and delete_table tools
     • X API MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector is available in the Connectors catalog
     • Upstream progress notifications are relayed through the proxy for long-running tools
     • Dynamic plugins route per client, with Codex configured for client-routed tool installation

     20 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !No breaking changes found in this release.
108. 1.28.318 Sep 10, 2026 · release notes

     Runlayer 1.28.318 adds Amazon Nova defaults for agents, inline skill editing, and units of work analytics

     • Agents can now run non-Claude Bedrock models with Amazon Nova defaults, enabling gateway routing and catalog pricing reports
     • Read an agent’s sharing configuration (owner and user/group/role/team grants) through MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools via Runlayer MCP
     • Long-running clients can read run-token expiry and self-fence before it lapses
     • Inline skill editing allows markdown files to be edited directly in the skill view using a block markdown instructions editor
     • AI outputs are grouped into units of work with a rebuilt timeline where drafted Slack messages count as output

     5 details in Everything

109. 1.28.281 Sep 8, 2026 · release notes

     Runlayer 1.28.281 adds broad policy principals, agent polling triggers, Slack file attachments, and output analytics.

     • all-users and all-agents policy principals allow targeting every user or agent in a single authorization entry
     • get_deployment_logs MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool exposes container logs for deployments
     • Agent responses can now attach files to their Slack replies via the Slack file attachments feature
     • Output analytics tab adds business-function output inspection and output model participation metrics

     4 details in Everything

110. 1.28.208 Sep 3, 2026 · release notes

     Runlayer 1.28.208 adds human approval policies and one-click Slack agent installation

     • Adds Human approval policies (beta) to hold an agent’s tool call for person-to-approve or deny before execution
     • Enables One-click install for Slack agents via Managed Apps, removing OAuth screens during setup

     2 details in Everything

111. 1.28.206 Sep 2, 2026 · release notes

     Runlayer 1.28.206 adds Slack routing, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. rules, Claude Fable 5.1, and Nimble connector

     • Adds Slack security channel to route security notifications separate from general alerts
     • Adds Scanner recommendations on connectors to surface catalog defaults before changes
     • Adds Policy overrides from Shadow AI allowing allow/deny actions directly in the Activity tab
     • Adds LLM usage rules that cascade across the LLM gateway via admin UI
     • Adds Claude Fable 5.1 as a new model option for agents

     +1 more show less

     • Adds Nimble MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector to the catalog

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Session grants no longer resolve for a grantor whose account has been deactivated
112. 1.28.201 Aug 30, 2026 · release notes

     Runlayer v1.28.201 adds a reasoning effort picker to the agent tab and improves chat rendering.

     • Adds a reasoning effort picker in the agent tab UI to select an agent's reasoning effort from a compact menu
     • Pretty-prints JSON payloads sent as user messages in the agent chat instead of displaying them as dense lines

     2 details in Everything

113. 1.28.200 Aug 28, 2026 · release notes

     Runlayer 1.28.200 adds scoped incident remediation and changed-file indicators to skill versions.

     • Adds changed-file indicators to skill version history
     • Enables scoped incident remediation at local family/tool and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector/tool scope

     2 details in Everything

114. 1.28.191 Aug 27, 2026 · release notes

     Runlayer 1.28.191 adds Markdown rendering in approvals, inline results, and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. routing for Claude Code/Codex.

     • Approval requests in the web app now render full Markdown — callouts, semantic entities, and formatted content instead of raw text
     • The outcome of an approval shows inline in the request, so you can see what was decided without leaving the page
     • Runlayer can now write LLM routing config for Claude Code and Codex clients

     3 details in Everything

115. 1.28.192 Aug 27, 2026 · release notes

     Runlayer 1.28.192 adds Agent Monitor dashboard, personal inbox for request decisions, delegation lifetime caps, and DCR auditing.

     • Adds Monitor dashboard tab to agents to view agent status
     • Introduces personal inbox for items emitted when requests are decided
     • Adds ability to set per-agent-account cap on delegation and access-token lifetime
     • Enables auditing of failed dynamic client registrations and stamps successful ones with the org

     4 details in Everything

116. 1.28.188 Aug 26, 2026 · release notes

     Runlayer 1.28.188 adds per-scope memory, agent ownership, Slack channel allowlists, and TraeWork detection.

     • Notes and SQL memory are scoped per agent, team, or workspace instead of globally.
     • Runlayer Assistant runs on your org's configured AI providers instead of a default provider.
     • A Popular skills tab appears on the build home, ranked by real skill invocations.
     • The in-app MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server now serves docs and help tools from your tenant via Connectors.
     • Slack channel allowlist restricts which Slack channels an agent may post in.

     +3 more show less

     • Agents, plugins, connectors, and artifacts record an owner on creation with existing resources backfilled.
     • Memory actor binding binds agent memory to verified runtime actors and enforces run-level authority.
     • Detection coverage includes TraeWork detection and reliable detection of large JetBrains AI plugins.

     8 details in Everything

117. 1.28.183 Aug 21, 2026 · release notes

     Runlayer v1.28.183 adds AgentGuard sensitivity config, broadened AI Watch detection scope, and allowlist-only OAuth redirects.

     • AgentGuard sensitivity is now a configurable option for the AgentGuard behavior scan.
     • Broaden AI Watch detection to cover top-50 AI clients, global npm installs, IDE plugins, runtimes, containers, and disguised skills (e.g., Claude Code via VS Code extension).
     • Allowlist-only OAuth redirects enables restricting dynamic client registration redirect URIs to an allowlist in Connectors.
     • Sessions panel now opens in a drawer with a key moments rail.
     • Skill usage is visible in session timelines.

     +3 more show less

     • Pending requests are displayed on the Monitor page.
     • Agent analytics includes a top erroring agents card and links agent names on the Usage page to the agent detail screen.
     • Team artifact discovery allows adding and discovering team-shared artifacts from team and workspace pages.

     8 details in Everything

118. 1.28.181 Aug 18, 2026 · release notes

     Runlayer v1.28.181 adds agent monitor filters, Zed skill sync, fetch_artifact tool, list_ai_providers MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool, and stricter OAuth validation.

     • Filter agent runs by user and source with run_source and actor shown on each card
     • Sync skills to Zed via the CLI with new Zed native skill support
     • Install test devices on macOS or Windows in one command using hosted install scripts
     • Fetch artifact content in sandbox agent runs with the new fetch_artifact tool
     • List AI providers over MCP with the new list_ai_providers MCP tool

     +6 more show less

     • Filter manage skills list by device sync status
     • Support writable file metadata in Google Drive connector
     • Attribute token spans to the producing model in sessions
     • Audit LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway and AI provider configuration changes
     • Detect Claude Desktop and Cowork skills with AI Watch Shadow AI scanning
     • Validate redirect URI allowlists consistently at client registration for stricter OAuth

     11 details in Everything

119. 1.28.179 Aug 17, 2026 · release notes

     Runlayer 1.28.179 adds runlayer doctor CLI, managed Slack onboarding, verified skills and DeepSeek V4 Pro support

     • Adds runlayer doctor CLI command to check OAuth and connectivity before deployment.
     • Adds DeepSeek V4 Pro as a new model option for agent runs.
     • Enables admins to mark skills as verified to indicate trusted status.
     • Adds one-click Slack consent allowing approval of paused agent runs via Slack messages.
     • Adds guided managed Slack setup during onboarding for connecting managed Slack accounts.

     +4 more show less

     • Allows setting event trigger conditions for agent event triggers.
     • Expands detection scanning to include Pi, Kimi Code, Kilo Code, Junie, and Devin CLI tools.
     • Supports upstream MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers using public OAuth clients without a client secret.
     • Makes audit log action and resource types queryable over MCP.

     9 details in Everything

120. 1.28.177 Aug 12, 2026 · release notes

     Runlayer 1.28.177 adds live Slack progress cards, per-agent prompts, scheduled run audiences, artifact versioning, Windows/Linux skill sync, Grok hooks, header asset creation

     • Adds Live Slack progress card to replace per-tool-call checklists with one live-updating card for agent progress.
     • Enables Per-agent Slack suggested prompts to assign unique suggested prompts to each agent in Slack.
     • Introduces Scheduled run audiences with audience badges on schedules to control which recipients a scheduled agent run posts to.
     • Adds Artifact versioning to maintain version history for artifacts, mirroring agent and skill versioning.
     • Extends Automatic skill sync scheduling support to Windows and Linux platforms in addition to existing platforms.

     +3 more show less

     • Introduces Grok hooks to monitor local Grok CLI activity; note that Grok Bot cloud hooks are experimental.
     • Enables Add team assets from the header creation directly from the team header instead of per-tab dropdowns.
     • Streams Session events to your SIEM by allowing users to send session data to their own SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. bucket.

     8 details in Everything

121. 1.28.175 Aug 11, 2026 · release notes

     Runlayer 1.28.175 adds per-type scan actions for scanning rules and emergent org tags.

     • Adds per-type actions for scanning rules: choose a different action per PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. label and credential type instead of one action for the whole rule
     • Emergent org tags are automatically applied to connectors, plugins, skills, and agents to group and find related resources

     2 details in Everything

122. 1.28.176 Aug 11, 2026 · release notes

     Runlayer 1.28.176 adds Bedrock provider support, artifact tagging, and container/WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. detection to the agent platform.

     • Adds Amazon Bedrock as a configurable LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. gateway provider for agent runs
     • Introduces artifact tagging and filtering by team or workspace (readable via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.)
     • Increases the subagent limit from previous versions to 50 per agent definition
     • Enables Runlayer Slack app installation through Enterprise Grid managed installs
     • Adds Scan risk signals to skill reads over MCP for security context

     +1 more show less

     • Expands MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. detection capability to include Containers and WSL environments

     6 details in Everything

123. 1.28.174 Aug 10, 2026 · release notes

     New audit log coverage for org settings, Slack user-identity indicators, and desktop tray access controls

     • Audit logs now record changes to organization settings with ATLAS techniques on MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. log summaries
     • Admins can see recent sessions and approve access requests directly from the Desktop tray
     • The agent UI indicates when Slack MCP actions send as the connected user rather than the bot (Slack user-identity)
     • Scheduled agent runs now execute as the identity of the schedule creator
     • Shared connector deployment warns before deploying a connector that is already in use by others

     +3 more show less

     • Guided setup for Slack agents walks through prerequisites before installation
     • Agents can read usage-page token and spend data over MCP with clearer cost formatting
     • Team and All Workspace plugin tabs support infinite scroll and server-side search

     8 details in Everything

124. 1.28.172 Aug 8, 2026 · release notes

     Runlayer v1.28.172 adds Anthropic tool-result scanning via ToolGuard and imported skill auto-update

     • create_agent reports the result of the Slack install operation.
     • New Anthropic inference hooks adapter brings Anthropic-based clients under hook enforcement.
     • Agents can now read a session’s activity and business-outcome summary over MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..

     3 details in Everything

125. 1.28.173 Aug 8, 2026 · release notes

     Runlayer 1.28.173 adds skill scan failure visibility in the webapp and a per-agent Slack channel intro toggle.

     • Added skill security scan failure visibility in the webapp with summary details
     • Added CLI self-update capability that aligns the installed version to the build source
     • Added per-agent toggle for Slack channel intro messages

     3 details in Everything

126. 1.28.170 Aug 7, 2026 · release notes

     Runlayer v1.28.170 adds browser extension targeting, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. condition operator enumeration, and agent run privacy redaction.

     • Adds extension version targeting for the browser extension rollout, allowing administrators to choose which extension version rolls out to which devices
     • Adds PBAC condition operator enumeration over MCP so agents can build policies without guessing available operators
     • Adds agent run privacy redaction in Runlayer MCP tools so other users' agent-run content is not visible

     3 details in Everything

127. 1.28.169 Aug 6, 2026 · release notes

     Runlayer 1.28.169 adds Cursor coverage reporting, incident badge popovers, larger skill uploads, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-based agent management APIs.

     • cursor surface coverage reporting alongside existing AI surfaces
     • Compact incident rows with ATLAS technique badges that open explanatory popovers
     • Skill upload limit increased to 5 MB
     • delete_agent tool for agent removal via MCP
     • Paging support (has_more) on list_agents and list_skills endpoints

     5 details in Everything

128. 1.28.167 Aug 5, 2026 · release notes

     Runlayer v1.28.167 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., blocking, sessions, evaluators and richer agent control, plus Slack agent routing.

     • Adds session topics and spend capabilities via MCP: enumerate session topics, pull spend rollups, and filter sessions by topic
     • Adds eval scorers as a new MCP tool to discover available agent eval scorers

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The CLI enforces a higher minimum MCP security level.
129. 1.28.165 Aug 4, 2026 · release notes

     Runlayer 1.28.165 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools (Artifacts, Agent prompts), shared mailbox connectors, and recursive delete detection.

     • New MCP tool Artifacts allows reading artifacts and their contents over the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
     • New MCP tool Skill import from URL enables importing skills directly from a public repository URL
     • New MCP tool Incident sessions lists the sessions behind an incident
     • New MCP tool AI Watch status reads AI Watch client and status information
     • New MCP tool Agent starter prompts allows reading and updating an agent’s starter prompts

     +1 more show less

     • Outlook connections now support shared mailboxes

     6 details in Everything

130. 1.28.163 Aug 3, 2026 · release notes

     Runlayer v1.28.163 adds AI policy drafting, new CLI tools (schedule), and broader client support.

     • runlayer schedule command for per-user scheduled tasks with macOS LaunchAgent support
     • Ask AI drafting in the Policy builder rework
     • Windsurf, Qwen Code, and Gemini CLI session hooks and enforcement support

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Public/private team distinctions removed from the Teams catalog page
131. 1.28.160 Jul 30, 2026 · release notes

     Runlayer 1.28.160 adds Intune macOS deployment, codex auto-sync, Slack notification toggles, and agent reasoning settings

     • Deploy agents to macOS fleets via Intune from the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. wizard
     • Codex configuration syncs automatically instead of requiring manual trigger
     • Agents run with a max reasoning effort setting
     • Toggle Slack security notifications between incidents and alerts
     • Track ToolGuard scanner status in the dashboard alongside model changelog

     +3 more show less

     • Session scan results split into discrete cards
     • Severity scored from outcomes with a recalibrated reason map
     • Wider MCP-serverMCP-serverA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. source-code signatures for Shadow detection; weak client evidence classified as traces

     8 details in Everything

132. 1.28.158 Jul 29, 2026 · release notes

     Runlayer 1.28.158 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. eval tools, sync-only API keys, list operators in PBAC and expanded browser enforcement.

     • skill_sync org-key role for creating sync-only API keys
     • New Runlayer MCP tools to create and read agent eval runs
     • contains / not_contains policy operators now accept list values
     • Browser extension now enforces Lovable, Bolt, Poe, Meta, and Grok surfaces

     4 details in Everything

133. 1.28.157 Jul 28, 2026 · release notes

     Runlayer v1.28.157 adds Slack MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. connector, drift detection runtime shadows, and Intune .intunewin packaging.

     • Adds Slack MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (OAuth) connector for connecting Slack MCP through a managed OAuth profile in the broker
     • Detect now surfaces configured-vs-running state with runtime shadows to spot drift between declared and actually-running MCP setups
     • Intune deployment card offers .intunewin package plus a signed detection script for easier MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. rollout
     • Adds approval policy surfaces across the dashboard and Runlayer MCP
     • Dashboard now shows source origin for each scanner policy (scanner policy provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build.)

     +1 more show less

     • New controls to govern outbound messaging from Slack-based agents

     6 details in Everything

134. 1.28.156 Jul 27, 2026 · release notes

     Global policies unified view, skill auto-sync, Kimi K3 via Baseten

     • Global Policies page now displays every policy in a single view with a pinned pagination footer for easier navigation
     • Skills sync automatically as first-class entities with assigned-skills visibility in ai-watch

     2 details in Everything

135. 1.28.150 Jul 24, 2026 · release notes

     Runlayer 1.28.150 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. denylist protection, ToolGuard feedback API, live AI Watch settings sync, and enhanced agent visibility.

     • Adds allow-unless-denied source governance for MCP denylists in Protect mode via remote URL, npm/PyPI package, or client built-in checks
     • Introduces POST /api/v1/security/feedback endpoint for reporting ToolGuard false positives and false negatives using existing API keys and roles
     • Enables automatic dashboard-to-agent sync of AI Watch settings without requiring MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. policy rebuilds
     • Expands Agent MCP activity view to include tool calls and other MCP events beyond lifecycle and delegation rows
     • Improves Slack-based agent support to reliably read image and PDF attachments shared in threads

     5 details in Everything

136. 1.28.153 Jul 24, 2026 · release notes

     Runlayer 1.28.153 adds Claude Opus 5 support for agents and introduces agent/skill version history with restore capabilities.

     • Adds Claude Opus 5 as a selectable model for agents
     • Enables viewing and restoring previous versions of agents and skills
     • Records version context on update audit events for agents and skills
     • Adds server-side search across the /admin/requests inbox for admin requests

     4 details in Everything

137. 1.28.144 Jul 23, 2026 · release notes

     Runlayer 1.28.144 adds offline agent evals with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge, webhook run-as-agent, plugin v2 multisearch, and CLI manual OAuth.

     • Adds Offline agent evals to replay agent runs with overrides, scored by an LLM judge plus custom scorers
     • Adds Webhook run-as-agent-account to allow webhooks to run as an agent account for true machine-to-machine runs
     • Integrates Plugin v2 with multisearch
     • Adds Manual OAuth support in the local CLI

     4 details in Everything

138. 1.28.147 Jul 23, 2026 · release notes

     Runlayer 1.28.147 adds Audited remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and Google Forms connectors, Codex client recognition, session-linked audit logs, WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. scanning, MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. toggles via UI, and unified /adm

     • Adds Audited remote MCP servers to the connector catalog for vetted remote tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions..
     • Adds write tools for Google Forms in the connector ecosystem.
     • Recognizes the Codex MCP client as a supported runtime.
     • Associates audit log entries with their session for end-to-end tracing.
     • Extends home-directory artifact scanning to WSL home directories.

     +3 more show less

     • Adds MDM process and container detection toggles directly in the config UI.
     • Unifies the requests inbox at /admin/requests with infinite scroll.
     • Enables adding or removing skills, plugins, and agents from any All Workspace tab.

     8 details in Everything

139. 1.28.142 Jul 22, 2026 · release notes

     Runlayer 1.28.142 adds org logo upload and expands AI Watch scan coverage.

     • Adds organization logo upload to brand the Runlayer workspace
     • Expands AI Watch scan coverage to include more agent definitions and container artifacts

     2 details in Everything

140. 1.28.141 Jul 21, 2026 · release notes

     Runlayer 1.28.141 adds Sourcegraph MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector and active-hours agent schedules

     • Sourcegraph connector added to the catalog (official MCP server integration)
     • Active-hours window support for agent schedules to restrict execution times

     2 details in Everything

141. 1.28.138 Jul 20, 2026 · release notes

     AI Watch detects shadow/managed clients, correlates MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. runtime sightings, supports client_credentials OAuth and auto-provisions users.

     • AI Watch now detects installed AI clients during scans and classifies them as shadow or managed, with a new client catalog and installation tables in the Shadow AI overview
     • MCP processes and MCP configs found inside running containers are correlated as runtime sightings in the UI
     • Allowlist discovered AI clients and drill into per-client audit detail
     • Enforcement can now be disabled for individual users
     • Download the AI Watch installers selected by your policy

     +3 more show less

     • Users surfaced during AI Watch scans that don’t match an existing account are now automatically provisioned
     • Remote MCP servers now support the client_credentials upstream OAuth mode
     • Owner opt-in for standalone machine-to-machine MCP access grants

     8 details in Everything

142. 1.28.139 Jul 20, 2026 · release notes

     Runlayer v1.28.139 adds AI Watch auto-updating, customizable block messages and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-based incident/session viewing.

     • Adds AI Watch agent auto-update for Windows and Linux endpoints
     • Adds customizable security block message configuration for scanner violations
     • Enables viewing incidents and sessions through Runlayer MCP tools

     3 details in Everything

143. 1.28.137 Jul 17, 2026 · release notes

     Runlayer 1.28.137 adds Carta/Egnyte/Make/Replit connectors, AI Watch device filters, and unused agent cleanup

     • Adds Carta, Egnyte, Make, and Replit as new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connectors in the catalog
     • Adds an Unused tab on the Agents page with a last-used badge to identify zombie agents for cleanup
     • Unpacks Usage Activity into six dedicated widgets for at-a-glance insights in Analytics
     • Adds unified device filters across AI Watch views via AI Watch device filters
     • Redacts environment secrets from get_deployment MCP tool output

     +1 more show less

     • Applies lifetime-relative inline-refresh floor to OAuth for reliable short-lived token refresh

     6 details in Everything

144. 1.28.133 Jul 15, 2026 · release notes

     Runlayer 1.28.133 adds per-client scanner overrides, AI Watch container support, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. allowlists and sub-day audit filters.

     • Security scanner settings can now be overridden per-MCP client to apply stricter scanning without changing global configuration
     • Credential masking controls now allow choosing exactly which credential types the scanner masks via new ToolGuard settings
     • New containerized deployment options for AI Watch Detect using standalone images, DaemonSets or CronJob manifests on Kubernetes
     • Enforce policies now support MCP server allowlists and blocking built-in client tools with a dedicated allowlist editor
     • Audit logs now support sub-day (hour-level) time filters and include new events for agent enable/disable and scanner setting changes

     5 details in Everything

145. 1.28.128 Jul 11, 2026 · release notes

     Runlayer 1.28.128 adds a new admin Monitor dashboard, Kubernetes deploy support, and multi-select plugin creation.

     • Adds a new Monitor home for admins with workspace-wide insights; admins now land on Monitor after login.
     • Enables deploying Runlayer MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers on Kubernetes (enterprise) with pod logs and status visible in the deployment UI.
     • Allows multi-selecting connectors and skills to create or extend a plugin, and recommends the Runlayer Plugin in add-to-client flows.

     3 details in Everything

146. 1.28.125 Jul 9, 2026 · release notes

     AI Watch supports Linux agent memory with scoped persistence

     • Adds AI Watch detection mode for Linux via native packages
     • Adds scoped agent memory to persist and recall data across runs

     2 details in Everything

147. 1.28.71 Jul 9, 2026 · release notes

     Runlayer 1.28.71 adds a Microsoft Teams MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector for managing chats and channels

148. 1.28.119 Jul 8, 2026 · release notes

     Runlayer 1.28.119 adds guided agent creation, beta OAuth connector support, skill scan transparency, and Web AI Watch capture for 10 clients.

     • Adds a new dedicated agent creation page with a guided flow in the UI
     • Enables catalog connectors to register with vendor-required OAuth client names and be flagged as beta, unblocking integrations like Figma remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
     • Provides skill import transparency by showing exact source snippets behind security findings and allowing shadow skills to open in a viewer with inline risk annotations
     • Adds pagination for deployment logs in the Deploy interface
     • Introduces a search box in the Settings sidebar

     +1 more show less

     • Expands Web AI Watch browser extension capture to 10 specific AI chat web clients to reduce false positives

     6 details in Everything

149. 1.28.112 Jul 2, 2026 · release notes

     Runlayer 1.28.112 adds Claude Sonnet 5 agents, model governance, MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-configurable AI Watch, Ashby connector, and UI pagination.

     • Adds Claude Fable 5 and Sonnet 5 as available agent models when Anthropic or AWS Bedrock is configured
     • Adds Model governance to restrict which LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. models each role may use and configure a recommended model
     • Adds Ashby as a new catalog connector
     • Makes AI Watch project depth and timeout MDM-configurable
     • Adds infinite scroll and server-side pagination on the agents, skills, and connectors pages for faster large workspaces

     5 details in Everything

150. 1.28.70 Jul 2, 2026 · release notes

     Runlayer v1.28.70 syncs agent icons to Slack bot profiles in seconds.

     • Agent Slack app icon sync: Agent icons are now synced to Slack app bot profile images.

     1 detail in Everything

151. 1.28.109 Jun 29, 2026 · release notes

     Runlayer 1.28.109 adds GitHub Copilot CLI hooks, customizable no-access messages, and agent sorting.

     • Adds GitHub Copilot CLI to AI Watch session monitoring and enforcement scope
     • Adds a customizable no-access message for connector policy blocks
     • Adds account rename and disconnect actions in the connector account menu

     3 details in Everything

152. 1.28.102 Jun 25, 2026 · release notes

     Runlayer v1.28.102 adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. spend analytics by agent, shareable agent artifacts, and a Tinybird connector.

     • Adds Agent spend analytics that breaks down LLM spend by agent
     • Makes Agent artifacts shareable with other users
     • Adds Tinybird as a new catalog connector

     3 details in Everything

153. 1.28.99 Jun 23, 2026 · release notes

     Runlayer 1.28.99 adds self-improving agents with cost budgets, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. artifact APIs, and browser extension delivery via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies..

     • Adds opt-in self-improving agent capability that distills reusable Skills from successful runs
     • Adds agent_cost_budgets per-agent LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. cost budget configuration
     • Adds programmatic artifact management (create, update, list, delete) via Runlayer MCP
     • Enables native skill installation into Codex
     • Adds AI Watch browser extension delivery through MDM configuration in the CLI

     +2 more show less

     • Adds team settings dialog for renaming teams, setting icons, and controlling visibility
     • Replaces the Runlayer-built Snowflake server with an official Snowflake Cortex MCP connector

     7 details in Everything

154. 1.28.69 Jun 19, 2026 · release notes

     Runlayer AI Watch for Windows now uses device-local Scheduled Tasks instead of Intune Remediations.

     • AI Watch on Windows registers device-local Scheduled Tasks (SYSTEM hook + per-user S4U scan fan-out) to run scans in each user’s context without interactive logon
     • Intune P2 / Remediations dependency removed for AI Watch on Windows; use detect-install.ps1 as the custom detection rule instead

     2 details in Everything

155. 1.28.96 Jun 19, 2026 · release notes

     Runlayer 1.28.96 adds Azure AI Foundry provider, device monitoring dashboard, and incident filtering.

     • Adds Azure AI Foundry as a new LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider option for agents
     • Introduces the AI Watch Devices tab on the Shadow dashboard for per-feature check-in and health monitoring of device inventory
     • Adds VS Code hooks to enable session monitoring and enforcement within VS Code
     • Adds Goose hooks support for the Goose client
     • Enables team owners to share skills with their team via Teams: skill sharing

     +3 more show less

     • Adds filtering capability to the incidents list and renames Severity to Priority for better Slack formatting
     • Allows admins to change an agent’s owner from the Share modal via Agent ownership transfer
     • Includes unique user counts in Connector metrics activity data

     8 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Severity field is renamed to Priority
156. 1.28.89 Jun 16, 2026 · release notes

     Runlayer 1.28.89 adds runlayer catalog CLI commands and an Artifacts tab for agents

     • runlayer catalog subcommands enable browsing skills, plugins, and connectors directly from the terminal
     • Agent pages now include an Artifacts tab listing published files
     • Sidebar sections in the UI can now be collapsed and persist per browser session

     3 details in Everything

157. 1.28.82 Jun 15, 2026 · release notes

     Runlayer 1.28.82 adds AI Providers settings, AWS Bedrock support, interactive test connections, and OAuth redirect-URI consent

     • Adds Settings → AI Providers page to configure LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers per agent
     • Enables configuring AWS Bedrock as an agent LLM provider
     • Generates automatic titles for sessions
     • Adds interactive tool runner in the Test Connection drawer for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools

     4 details in Everything

158. 1.28.67 Jun 10, 2026 · release notes

     Runlayer adds row overwriting and cell padding to Google Docs table editing

     • edit_table.set_row_text now accepts a list of values to overwrite an entire row in one call
     • style_cell gains a padding option to set cell padding on all four sides (in points)

     2 details in Everything

159. 1.28.77 Jun 10, 2026 · release notes

     Runlayer 1.28.77 adds Artifacts gallery, single-org AI Watch deployment with capability flags, and auto-created access policies for new connectors.

     • Adds Artifacts gallery to browse all artifacts published by agents
     • Changes AI Watch MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. deployment to use one org API key with capability flags instead of per-feature credentials
     • Enables hosted stdio connectors to prompt each user for their own environment variables (e.g. personal API keys)
     • Adds icon picker when creating a custom connector
     • Auto-creates an access policy for every new connector at creation time

     5 details in Everything

160. 1.28.66 Jun 9, 2026 · release notes

     Runlayer v1.28.66 enables onedrive_read_file to extract text from Office files server-side.

161. 1.28.65 Jun 5, 2026 · release notes

     Runlayer 1.28.65 improves SharePoint and Outlook integration fidelity: exact site resolution for sharepoint_search_sites and lightweight calendar summaries for list views.

162. 1.28.73 Jun 5, 2026 · release notes

     Runlayer 1.28.73 adds skill editing in UI, unredacted audit log filters, and native Metabase and Deel MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connectors.

     • Enables direct editing and renaming of skills within the web interface
     • Adds an Unredact filterable event type to the Audit Logs view
     • Replaces the Runlayer-deployed server with a native Metabase MCP connector
     • Introduces a new hosted Deel MCP connector

     4 details in Everything

163. 1.28.64 Jun 1, 2026 · release notes

     Runlayer v1.28.64 adds outlook_create_reply_draft tool for saving editable Microsoft Outlook reply drafts in-thread.

     • Adds the outlook_create_reply_draft tool which saves a Reply or Reply-All as an editable draft nested inside the original conversation.

     1 detail in Everything

164. 1.28.24 May 29, 2026 · release notes

     Runlayer v1.28.24 adds Identity Forward to all HTTP connectors, web UI .md skill upload, and a new MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. config wizard.

     • Enable X-Runlayer-* headers or signed JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Identity Forward on any Streaming HTTP or SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. connector via its configuration
     • Upload a single .md file as SKILL.md in the web UI to create skills with auto-derived names
     • Install full event/session hook set by default for MDM deployments; toggle enforcement-only with MDM field set to false
     • Access Settings → MDM Configuration wizard to guide platform selection, detect/enforce mode, and artifact download

     4 details in Everything

165. 1.28.63 May 29, 2026 · release notes

     Runlayer 1.28.63 adds HITLHITLHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. notify-only mode, quarterly agent schedules, Slack channel blocklists, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. export noise reduction

     • Adds asynchronous HITL Notify-Only approval mode for agents
     • Allows agent schedules to use :00, :15, :30, and :45 cadences
     • Adds Slack channel blocklist support in admin settings
     • MCP export_audit_logs trims verbose internal details by default with an opt-in flag

     4 details in Everything

166. 1.28.23 May 21, 2026 · release notes

     Runlayer 1.28.23 adds webhook API-key auth, bulk audit log export via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and customer-owned SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. S3 bucket support.

     • Webhook dialog can now require API-key authentication for agent webhooks
     • Adds export_audit_logs tool to Runlayer MCP for exporting logs as JSON or CSV
     • Runlayer Hooks TypeScript SDK supports client_credentials token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. for agent account auth
     • SIEM export allows writing directly to a customer-owned S3 bucket
     • Shadow page includes new Skills section with discovery timeline and breakdowns

     +4 more show less

     • Agent run timelines now render subagent tool calls and events inline
     • Claude Opus 4.8 is available as an agent model when Anthropic is configured
     • Server-level Policies tab renamed to Permissions in the UI
     • New catalog connectors: AWS MCP, Supernova Relay MCP

     9 details in Everything

167. 1.28.22 May 18, 2026 · release notes

     Runlayer adds Microsoft Outlook Calendar MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector with 11 tools for event CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and availability lookups

168. 1.28.21 May 13, 2026 · release notes

     Runlayer 1.28.21 adds Mask violation action, self-serve SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. role mapping, and agent cloning.

     • Adds Mask violation action to Security Scanners to redact detected PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. or credentials while allowing the request to continue
     • Enables admin-only configuration of SCIM groups-to-roles mapping in Settings → Workspace → Manage Directory Sync for self-serve directory sync
     • Introduces agent cloning capability via the renamed Clone action, copying configuration, connectors, and tools to a new agent

     3 details in Everything

169. 1.28.20 May 11, 2026 · release notes

     Runlayer 1.28.20 adds PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. regex detection, Helm CA/bundle config, new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, and expanded client scanning.

     • Adds model and icon parameters to the create_agent MCP tool.
     • Adds is_disabled parameter support to the update_agent MCP tool.
     • Expands create_server and update_server MCP tools to support all REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. fields including OAuth, audit log sensitivity, and deployment association.
     • Adds PII pattern-based detection using regex validators for SSN, credit card, phone, email, passport, driver’s license, IBAN, IP address, date of birth, MRN, VIN, Bitcoin address, and Ethereum address.
     • Allows organization API keys to be scoped with the Deploy role.

     +7 more show less

     • Enables mounting a custom trusted CA bundle for outbound HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. in self-hosted Helm deployments.
     • Adds support for referencing an existing Kubernetes Secret for backend credentials in Helm chart configuration.
     • Adds ability to configure a read-replica endpoint for offloading read traffic in Helm deployments.
     • Expands AI Watch detection to discover MCP configs in Cline, Cline CLI, Gemini CLI, Antigravity, and GitHub Copilot CLI.
     • Adds codex mcp add <name> --url <proxy> command for native client setup.
     • Shows user attribution for shadow MCP servers in discovery reports.
     • Adds Ramp Data as a new catalog connector with read-only financial data support.

     12 details in Everything

170. 1.28.19 May 5, 2026 · release notes

     Runlayer 1.28.19 adds artifact publishing, agent memory toggle via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., and shareable session links

     • Adds publish_artifact tool to agents for sharing workspace files as URLs
     • Adds enable_memory parameter to create_agent and update_agent MCP tools
     • Enables shareable direct links for agent run sessions from the sessions list

     3 details in Everything

171. 1.28.18 May 1, 2026 · release notes

     Runlayer v1.28.18 adds skill risk badges, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client analytics, Slack DM mode via slack_terminal_run_dm_mode, and refreshed agent templates.

     • Adds the slack_terminal_run_dm_mode config key to control run-result Slack DMs (always, errors_only, disabled) via the update_agent MCP tool
     • Introduces a Skill risk assessment widget on the Skills tab with per-skill risk level badges (High, Medium, Low, Minimal, Unknown)
     • Adds a Plugin usage by client widget to the Plugins tab showing which MCP clients generate the most plugin activity
     • Replaces agent creation templates with new default patterns: 1:1 Prep, Release Notifier, Account Intelligence, Daily Briefing

     4 details in Everything

172. 1.28.17 Apr 29, 2026 · release notes

     Runlayer 1.28.17 adds GPT-5.5 support, OneDrive/SharePoint MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connectors, and expanded agent permissions.

     • Adds GPT-5.5 as an available agent model when OpenAI is configured as the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.
     • Adds OneDrive and SharePoint MCP connectors for Microsoft 365 integration.
     • Expands Runlayer MCP server management to allow creating, updating, and deleting connectors via admin-only commands.
     • Adds a Connectors section to the Shadow page UI showing shadow servers, users, migration targets, and MCP client usage.
     • Allows all workspace members (not just admins) to view agent accounts, create delegations, and create session grants.

     +4 more show less

     • Enables agent say tool on webhook and scheduled runs when the Slack MCP connector is attached.
     • Makes Agent memory an opt-in feature available via advanced settings.
     • Includes tool calls and results from prior turns in agent conversation context for better multi-step continuity.
     • Adds Skyvern to the connector catalog.

     9 details in Everything

173. 1.28.16 Apr 27, 2026 · release notes

     Runlayer 1.28.16 adds scoped PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection, new connectors (Kubernetes, Tines), shadow analytics, and Outlook MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. guide

     • Adds PII scan direction configuration to scope PII detection to tool inputs, outputs, or both, configurable globally in Settings → Security Scanners or per connector.
     • New Shadow vs Managed breakdown chart and Shadow Server Discoveries timeline available on the Shadow page for better visibility into unauthorized connectors.
     • Adds new connectors for Fellow, Tines, Kubernetes, and Superhuman Mail to the catalog.
     • Adds a dedicated Outlook setup guide for the Outlook MCP connector.
     • New workspace setting in Settings → Workspace allows admins to show full admin-facing client setup instructions to all users.

     5 details in Everything

174. 1.28.15 Apr 23, 2026 · release notes

     Runlayer 1.28.15 adds identity forwarding via headers/JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store., timezone-aware agent schedules, and new catalog connectors.

     • HTTP-based MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connectors (Streaming HTTP or SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates.) now receive the authenticated caller's identity via X-Runlayer-* headers or a signed JWT when enabled in connector configuration
     • Agent schedules support a Local wall clock mode that evaluates cron expressions in the selected timezone and automatically adjusts for DST transitions
     • New catalog connectors Pinpoint ATS, Clay, and pganalyze are now available

     3 details in Everything

175. 1.28.14 Apr 21, 2026 · release notes

     Runlayer 1.28.14 adds configurable risk policies, Intune Remediation support, and new catalog connectors.

     • Adds per-tier actions (Block, Warn, Allow) for high-risk and medium-risk skills in Settings → Security Scanners
     • Adds Remediation deployment method to the Intune deployment guide
     • Adds Smartsheet and DataGrail Vera to the connector catalog
     • Hides Draft status connectors from MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint and proxy visibility

     4 details in Everything

176. 1.28.13 Apr 19, 2026 · release notes

     Runlayer Assistant GA, Onelayer plugin default visibility, Slack run context in Activity view, new Amazon Redshift connector.

     • Adds runlayer_assistant generally available for all workspaces with agents enabled.
     • The onelayer plugin is now visible in the plugin list for all users without a feature flag gate.
     • Agent runs triggered from Slack now display conversation, channel, and trigger details in the Activity view, with a direct link to the originating Slack message.
     • Adds Amazon Redshift as a new catalog connector (read-only SQL — discover, explore, and query Redshift clusters and serverless workgroups).

     4 details in Everything

177. 1.28.12 Apr 17, 2026 · release notes

     Runlayer 1.28.12 adds Claude Opus 4.7 agent support, custom deployment icons, PPPC profiles for macOS Detect, and ZoomInfo connector.

     • Adds Claude Opus 4.7 as an available agent model when Anthropic is configured as the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider
     • Enables setting a custom icon during agent creation in the UI
     • Allows setting or updating custom icons for deployments via the deployment settings dialog
     • Adds a Resume action in the Activity view to continue past agent runs in the Playground with prior context
     • Updates Slack messages to display the LLM model used per response and removes inline tool outputs

     +3 more show less

     • Auto-grants developer access to the deploying user when deploying a connector via the CLI
     • Adds the ZoomInfo connector to the new catalog connector list
     • Promotes the Ashby connector from beta to generally available

     8 details in Everything

178. 1.28.11 Apr 15, 2026 · release notes

     Runlayer 1.28.11 adds agent tool call analytics, auto-sync plugins via Onelayer, connector alias resolution in CLI, and new Render/Hugeicons connectors

     • Adds top agents by tool calls ranking widget in the Agents tab alongside the existing top-by-runs metric.
     • Adds a built-in persistent SQLite database for agent memory; documented with no extra storage setup required.
     • Adds an Auto Sync toggle to the Onelayer org install dialog, pushing plugins via runlayer setup sync.
     • Expands runlayer setup sync to install both connectors AND plugins marked for auto-sync.
     • Allows runlayer run to accept a connector alias in addition to a UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. for target resolution.

     +2 more show less

     • Adds the new recipes page with copy-paste examples for M2M tokens, OBO flows, session grants, and external user mapping.
     • Adds Render and Hugeicons connectors to the catalog.

     7 details in Everything

179. 1.28.10 Apr 13, 2026 · release notes

     Runlayer 1.28.10 adds Terraform Provider beta, session grant-based OAuth auth, Slack messaging, and admin revocation.

     • Adds a Terraform Provider (Beta) for managing Runlayer policies and resources
     • Uses session grants for agent account authentication to OAuth-protected connectors
     • Automatically revokes all of a user's session grants when an admin deactivates the user
     • Introduces the Slack say tool so agents can post additional messages back to a conversation thread

     4 details in Everything

180. 1.28.9 Apr 11, 2026 · release notes

     Runlayer 1.28.9 adds Agents analytics tab, agent duplication, OpenAI org install, connector search, and schedule badges.

     • Adds Agents tab to the Analytics dashboard featuring an inventory card and runs-over-time chart
     • Enables workspace members to duplicate agents from the detail page or agent card menu, cloning configuration, connectors, and tools
     • Adds OpenAI support to the Add to Organization flow for the Onelayer plugin with MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. connector registration and skills upload in ChatGPT
     • Disables manual role and group editing in the UI when SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. directory sync is enabled, displaying an explanatory banner instead
     • Adds global command palette (Cmd/Ctrl+K) and query parameter on the servers API for connector search by name or description

     +1 more show less

     • Displays a badge on agent cards indicating the count of active schedules for that agent

     6 details in Everything

181. 1.28.8 Apr 9, 2026 · release notes

     Runlayer 1.28.8 adds Goose MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client support, S3 SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. export, agent UI filters, and CLI skills/plugins commands.

     • Goose is now a supported MCP client with hosted and local setup guides
     • Audit logs can now be continuously exported to an S3 bucket for SIEM ingestion via the SIEM export (S3) feature
     • CLI 0.23.0 adds new skills find and plugins find commands for browsing and installing skills or plugins from the terminal
     • The Agents page supports sorting by newest, oldest, alphabetical, and last-used, plus a status filter (active / disabled)
     • The Playground now automatically injects Runlayer tools (search, run, manage) so agents can reason about the workspace without manual connector setup

     +2 more show less

     • Connectors requiring authorization now show a guided access setup dialog directly during agent creation, with per-connector status indicators
     • The tool picker in policies now includes an annotation-based category dropdown next to Select All for faster bulk selection

     7 details in Everything

182. 1.28.7 Apr 6, 2026 · release notes

     Runlayer 1.28.7 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. subagent management, Ravenna connector, Slack link, and scheduled run retries

     • Add, update, and delete subagents on an agent directly through Runlayer MCP tools (confirm-required).
     • New catalog connector for Ravenna (AI knowledge management — search knowledge bases, manage channels, and automate support workflows).
     • Agent Slack settings now include a direct link to manage the agent’s Slack app on api.slack.com.
     • Scheduled agent runs now retry transient authentication errors automatically instead of failing immediately.

     4 details in Everything

183. 1.28.6 Apr 3, 2026 · release notes

     Runlayer 1.28.6 adds agent creation from plugins, AirOps/Pendo connectors, CLI deploy URL output, and Analytics v2 UI overhaul.

     • deploy command (CLI) now prints the deployment URL after a successful deploy
     • Agent inheritance: creating an agent from a plugin detail page automatically inherits that plugin’s connectors and skills
     • Connector catalog additions: AirOps (50 tools) and Pendo; Datadog now uses its full toolset by default
     • Analytics v2 Overview tab: new Tasks chart (human vs agent), Usage card, Most Used Clients, and redesigned Security Alerts widget

     4 details in Everything

184. 1.28.5 Apr 2, 2026 · release notes

     Runlayer 1.28.5 adds sensitive audit log redaction for connectors, scheduled run failure DMs, and a new Connectors analytics tab.

     • Adds the ability to mark connectors as sensitive, triggering automatic redaction of tool call arguments, results, and security scan details from audit log entries
     • Enables Agent owners to receive a Slack DM notification when a scheduled agent run fails
     • Introduces a dedicated Connectors tab in Analytics containing top-by-tool-call, connector health, and usage-by-client widgets

     3 details in Everything

185. 1.28.3 Apr 1, 2026 · release notes

     AI Watch adds Codex/OpenCode plugin scanning; Enforce supports Claude Code MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. interception; new Zoom connector and Agent Policies UI.

     • Adds detection of installed plugin artifacts in Codex and OpenCode for AI Watch via CLI 0.22.0
     • Enables shadow MCP tool call interception for Claude Code on macOS in Enforce
     • Adds a dedicated Policies section in the Agent detail page for managing per-agent access rules
     • Displays skill usage timelines and top skills rankings in the Analytics Skills tab
     • Introduces Zoom connector to the catalog with meeting search, recording access, and Docs creation tools

     5 details in Everything

186. 1.28.4 Apr 1, 2026 · release notes

     Runlayer 1.28.4 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. policy CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information., configurable ToolGuard sensitivity levels, and security warning classification.

     • Tool Guard now supports Strict, Balanced, and Moderate sensitivity levels configurable per connector
     • Adds Create, Update, Delete (CRUD) operations for policies via Runlayer MCP governance tools
     • Classifies hidden-character masking and sensitive-token masking findings as security warnings instead of violations

     3 details in Everything

187. 1.28.2 Mar 31, 2026 · release notes

     Runlayer 1.28.2 adds agent subagents, v2 analytics tabs, audit events, and API rename.

     • Adds AGENT_RUN, AGENT_RUN_SUCCESS, and AGENT_RUN_FAILURE audit log events for agent runs
     • Introduces shadow subagents that inherit parent connectors but follow separate instructions
     • Adds a Delete All option in Deployments to remove connected servers alongside the deployment
     • Includes Kandji in Shadow MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. device filtering

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The public Agents API routes have been renamed from /assistants to /agents.
188. 1.28.1 Mar 29, 2026 · release notes

     Runlayer 1.28.1 adds native Codex plugin install, agent templates, and Kandji/Vimeo connectors.

     • codex plugin support is now installed via CLI for first-class integration
     • Agent templates (workspace agent, research agent, weekly summary, morning brief) pre-fill name, prompt, connectors, and tools
     • Failed agent runs can be retried from the Activity view
     • Agent owner is displayed on the agent detail page
     • Grant access button appears on connector cards for authorization-required connectors

     +3 more show less

     • Kandji MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. support added for auto-provisioning
     • Vimeo connector available in the connector catalog
     • Workday deployments now support configurable OAuth scopes

     8 details in Everything

189. 1.28.0 Mar 25, 2026 · release notes

     Runlayer 1.28.0 adds granular admin roles, shadow skill detection, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. proxying and CLI keychain storage

     • Adds Security Admin, IT Admin, Helpdesk, Developer and Analytics Admin roles alongside Super Admin for separation of duties
     • Enables Shadow AI coverage now includes skills to discover, classify and surface analytics on shadow skills in supported clients
     • Supports workspace-level LLM provider settings with Anthropic, OpenAI, and OpenAI-compatible gateways
     • Routes OpenAI model traffic through the backend proxy layer via new proxying configuration
     • Adds per-agent SQLite-backed memory scoped to individual agents

     +18 more show less

     • Allows disabling agents without deletion, blocking Slack, webhook and scheduled execution until re-enabled
     • Introduces SkillWatch analytics with skill discovery metrics, risk breakdowns and outdated-skill visibility
     • Captures install analytics to track adoption of skills and plugins
     • Rebuilds deploy UX around guided dialogs, inline CLI commands and clearer setup states
     • Adds Build with Runlayer MCP entry point connecting deployment setup with the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Builder workflow
     • Supports renaming deployments directly from the UI
     • Expands plugin publishing workflow to support Claude-format plugin publishing via CLI and inline manifest support
     • Reads mcpServers from .claude-plugin/plugin.json with fallback to legacy .mcp.json
     • Adds native install guidance for clients including VS Code
     • Improves plugin push stability, root skill path handling and removal by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.
     • Supports multiple principals (users, groups, roles or agents) per permission rule
     • Enables capability-gated UI and API navigation so users only see what their role allows
     • Provides read-only troubleshooting and analytics access for Helpdesk and Analytics workflows
     • Updates global and connector-level policy flows with a better editing UX
     • Ensures audit parity for plugins and skills by logging installs, updates and upstream token refresh events
     • Stores CLI credentials in the OS keychain instead of plain local config
     • Folds verified-local into run to simplify local run flow
     • Adds Guru as a supported OAuth Broker vendor

     23 details in Everything

190. 1.27.0 Feb 23, 2026 · release notes

     Runlayer 1.27 adds Tool Intent Guard, org API keys, configurable PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. scanning, and a Security Scanning API endpoint.

     • Adds Tool Intent Guard runtime model that detects intent drift, output poisoning, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., and prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. by analyzing tool inputs and outputs together.
     • Provides /score/tool_guard_io API endpoint for programmatic security scanning of tools via CI workflows or custom integrations.
     • Introduces organization-level API keys scoped by role (Detect Scan, Security Scan) with auto-provisioning via enrollment keys.
     • Enables configurable PII scanning per connector, allowing users to enable/disable built-in types and add custom regex rules.
     • Adds Just-in-Time (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) Auth which prompts for credentials only on the first tool call, utilizing a three-tier cache.

     +2 more show less

     • Releases 25+ new catalog connectors including Lemlist, Webflow, Google Analytics, Neon, Pylon, DX, official Slack MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., Deepwiki, CircleCI, Ashby, Figma Desktop, Miro, Jamf, Cloudflare (16 servers), Datadog, Vanta, Granola, and LaunchDarkly.
     • Moves BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. and Slack connectors out of beta status.

     7 details in Everything

191. 1.25.0 Jan 19, 2026 · release notes

     Runlayer v1.25.0 introduces Deploy from Catalog, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Watch, Agent Accounts, and security scanner management tools.

     • Adds ability to deploy servers directly from the Catalog with Runlayer Deploy
     • Adds MCP Watch for shadow MCP discovery, tracking, and migration identification in Analytics
     • Adds capability to trigger re-analysis of discovered MCP servers from the UI via MCP Watch
     • Adds Microsoft Agent 365 integration with full OAuth broker support and catalog servers
     • Adds per-server metrics tab showing tool call health, usage, and performance charts

     +14 more show less

     • Introduces Agent Accounts (Beta) to register AI applications for programmatic authentication and MCP tool calls
     • Adds Runlayer self-MCP server capability to run Runlayer as an MCP server for automation
     • Adds security scanner management tools within Runlayer MCP for programmatic settings control
     • Adds dedicated MCP Catalog API service with API key authentication for downstream security scanners
     • Makes catalog tool lists available alongside catalog data to support static analysis and compatibility checks
     • Adds MCP Watch CLI workflow to collect device-side MCP configuration scans
     • Expands MCP Watch client support to include Goose and Zed
     • Adds request IDs to audit logs for faster investigations and support workflows
     • Adds typed actor/resource fields to audit log records for compatibility with long-lived deployments
     • Adds CLI login via device flow for authentication from constrained environments
     • Adds new CLI command cache clear for simpler troubleshooting
     • Updates ToolGuard with new threat detection capabilities
     • Improves deployment logs by redacting sensitive environment variables by default
     • Allows force-triggering new deployments and redeploys more explicitly in Runlayer Deploy

     19 details in Everything

192. 1.13.1 Dec 5, 2025 · release notes

     Runlayer 1.13.1 adds permission warnings, ToolGuard area details, CLI pull, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. catalog updates.

     • Users now see a warning before connecting an MCP client if they lack the necessary permissions
     • Security violations now show the specific area of concern that triggered the detection
     • Added Pulumi and Parallel Search to the MCP catalog
     • New pull command for downloading runlayer.yaml deployment configurations in the CLI
     • New optional MCP caching setting for tools/list requests to improve performance

     +1 more show less

     • Increased rate limit to 1000 requests/hour for OAuth client registrations

     6 details in Everything

193. 1.12.0 Dec 2, 2025 · release notes

     Runlayer 1.12.0 adds a visual audit log query builder, security alert emails for admins, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. catalog integrations.

     • Adds a visual Query Builder UI for filtering Audit Logs
     • Enables configurable Security Alert Email notifications for workspace administrators
     • Adds Grain, Fireflies, Iterable, Box, and Contentful to the MCP catalog

     3 details in Everything

194. 1.10.0 Nov 25, 2025 · release notes

     Runlayer v1.10 introduces Human-in-the-Loop security review via audit logs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. catalog extensions, and duplicate server detection.

     • Adds ability for admins to review, approve, or reject security violations from the audit logs
     • Adds Snowflake, ClickUp, and HubSpot to the MCP catalog
     • Adds duplicate server detection to warn when creating a server with a configuration that already exists

     3 details in Everything

195. 1.9.0 Nov 19, 2025 · release notes

     Runlayer 1.9.0 adds Runlayer Deploy for deploying MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers via managed infrastructure.

196. 1.8.0 Nov 13, 2025 · release notes

     Runlayer v1.8.0 adds CLI deploy command, token masking scanner, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server submission settings.

     • Adds deploy subcommand to Runlayer CLI for deploying Docker-based services
     • Introduces Token Masking Scanner that redacts sensitive tokens instead of blocking them

     2 details in Everything

197. 1.7.0 Nov 11, 2025 · release notes

     Runlayer 1.7.0 introduces policy-based access controls with advanced condition operators, OAuth refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. rotation, and redesigned UI pages.

     • Adds contains, matches, in operators for policy conditions to enforce fine-grained access control over MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client/server attributes
     • Enables automatic OAuth refresh token rotation for improved security posture

     2 details in Everything

198. 1.6.0 Nov 1, 2025 · release notes

     Runlayer 1.6.0 adds OAuth auth from MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients, server config drawer, and audit logs redesign.

     • Enables authenticating to upstream OAuth servers directly from MCP clients like ChatGPT, Claude, Cursor
     • New streamlined interface for viewing and editing MCP servers in the Server Configuration Drawer
     • Improved audit logs table layout and navigation

     3 details in Everything

199. 1.5.0 Oct 28, 2025 · release notes

     Runlayer 1.5.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Prompts support, popularity sorting, and server editing.

     • MCP Prompts Support with full integration for the MCP prompts specification
     • Enhanced Catalog features popularity-based sorting
     • Server Editing allows changing server name and description from the details page

     3 details in Everything

200. 1.4.0 Oct 24, 2025 · release notes

     Runlayer 1.4.0 adds ChatGPT and Gumloop MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client support with improved OAuth error handling and prompt detection.

     • Adds ChatGPT, Gumloop, and additional AI platforms as supported MCP clients

     1 detail in Everything

201. 1.3.0 Oct 16, 2025 · release notes

     Runlayer 1.3.0 adds local MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. v2, Management API for automation, and redesigned MCP details UI.

     • Use local MCP servers with the same security, authz, observability and auditing as remote MCPs
     • Automate server and user provisioning via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. with API key authentication
     • Rebuilt server details with tabbed navigation, client-specific setup instructions (Claude, Codex, others), and one-click deeplinks
     • Migrated catalog to standardized MCP registry schema
     • Enforced strict timeouts on all MCP operations

     +1 more show less

     • Captures stderr output, exit codes, and connection errors for faster troubleshooting of MCP server failures

     6 details in Everything

202. 1.1.3 Sep 30, 2025 · release notes

     Runlayer 1.1.3 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server integrations and non-admin analytics access.

     • Made analytics available for non-admin users, showing only their usage data

     1 detail in Everything

203. 1.0.0 Sep 23, 2025 · release notes

     Runlayer 1.0.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user/group sync and role mapping for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.

     • Adds support for syncing Users and Groups from SCIM providers.
     • Adds role mapping capability to map IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Groups to Runlayer roles.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The auth_client_id Terraform variable must be updated to the new client ID provided by Runlayer support.
204. 0.65.0 Sep 18, 2025 · release notes

     Runlayer 0.65.0 adds manual OAuth client configuration for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers without DCR

     • Adds Manual OAuth Configuration capability for MCP servers lacking Dynamic Client Registration (DCR)
     • Adds a guided UI flow for automatic detection of manual setup requirements
     • Updates MCP specification support to version 2025-06-18

     3 details in Everything

205. 0.63.0 Sep 17, 2025 · release notes

     Runlayer 0.63.0 introduces Prompt Guard V2 with improved accuracy and lower latency

     • Adds Prompt Guard V2 as the new default prompt attack detection system in security settings UI

     1 detail in Everything

206. 0.60.12 Sep 12, 2025 · release notes

     Runlayer 0.60.12 adds dual JSON/form editing for server configuration with .env import

207. 0.59.0 Sep 9, 2025 · release notes

     Runlayer 0.59.0 adds a load testing framework and per-server granular security controls with admin-only interface

     • Adds configurable test scenarios for load testing workloads including SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. response validation and compliance checks.
     • Enables per-server security settings to override specific global scanner defaults via an Admin-only interface.

     2 details in Everything