Changelog

A second MCP OAuth compatibility patch: your choices on the consent screen now decide the grant for clients that request no scopes.

MCP OAuth

• Fixed write access for MCP clients. Clients like Claude Code send no scope parameter on the authorize request, and the server silently reduced every consent decision — including Root / Admin — to the read-only baseline. The selection you make on the consent screen is now exactly the grant.
• Clients that request explicit scopes are unchanged: the grant is still capped at what the client requested.

A compatibility fix for connecting MCP clients: the OAuth authorization server no longer requires the RFC 8707 resource indicator.

MCP OAuth

• The resource parameter is now optional on the authorize request. When a client omits it, the server binds the request to the canonical MCP resource URI from its own metadata, so clients that predate resource indicators in the MCP auth spec (for example JetBrains Air's MCP settings) can complete the consent flow.
• A provided resource must still equal the canonical MCP URI, so audience binding is unchanged: a code minted for this server cannot be replayed against another one.

The public site, properly. A working marketing site with deep product pages, a hosted blog and changelog, and full SEO.

Marketing site

• A fully functional footer and top nav, with every link resolving.
• Deep, technical product pages for Projects, Meetings, Notes, and Activity.
• Rebuilt About and Contact pages, plus Privacy and Terms.

Blog and changelog

• A Elliptic-hosted blog with posts and an RSS feed.
• This changelog, hosted on the site.

SEO and social previews

• Sitemap, robots, and canonical URLs across the site.
• Generated Open Graph and Twitter cards, with a per-page image.

The first public release of Elliptic. The full agent-native work platform, open source under Apache-2.0 and self-hostable with one docker compose.

Work tracking

• Projects with leads, members, states, and templates.
• Linear-style tasks with stable identifiers like DEMO-42, List, Board, and Table views, sub-tasks, labels, priorities, and the PQL query language.
• Cycles, initiatives, milestones, and releases for planning at every altitude.
• Intake and triage to turn inbound requests into tracked work.

Meetings and knowledge

• Speaker-attributed meeting transcripts, AI summaries, and ask-the-meeting.
• Notes and a company wiki with live multi-cursor co-editing.
• Folio meeting import.

AI and agents

• A built-in MCP server (OAuth 2.1, about 144 tools) that exposes the whole workspace to agents.
• An in-product assistant, plus agents with budgets and a sandboxed runner.
• Bring your own OpenAI or Anthropic key, encrypted at rest, with every run written to an audit log.

Collaboration

• Live sync over SSE, threaded comments, reactions, activity feeds, notifications, and full-text search.
• Public embeds and shareable links.

Enterprise and platform

• True multi-tenancy with org-scoped data isolation.
• SSO over SAML and OIDC, SCIM, LDAP, IdP group sync, and domain verification.
• RBAC with audit logs, approvals, and compliance surfaces.
• Webhooks, an outbox event backbone, S3-compatible storage, and analytics dashboards.