Changelog

Ultra came out of stealth with $10 million in seed funding. The ultra.security website was redesigned alongside the announcement.

Traffic and Audit Log are now one Activity page. Tool calls and audit events share a single searchable list, every column filters and sorts from its header, and any view exports to CSV or JSON. Selecting a record opens it as a full page.

Exclusions skip a guardrail for a specific connector without turning it off everywhere, for example running PII Protection on every connector except one. Each exclusion names a connector, optionally a tool, and the guardrails to skip. It applies to the organization, a workspace, or a device, and requires a reason. Create one from Guardrails > Exclusions, or from a guardrail alert, a guardrail, or a connector.

Admins can collect diagnostics from a device in the Hub. Select the device in Devices and choose Gather diagnostics. Ultra collects the device's checks and configuration with nothing for the user to run. Reports are kept in the device's history and can be run again or downloaded as JSON. Requires Ultra v0.11.0 or later on the device.

The identity details page has been redesigned and improved. Each identity's page shows the connectors, tools, agents, and devices it uses, with tabs for its requests, guardrail blocks, and anomalies.

Guardrail events now record the value that matched, such as the flag, path, or pattern that caused a block. Alerts open to a full-page detail view. Devices can be searched by name, hostname, or owner. Hub navigation is grouped into Observe, Protect, and Inventory. Settings has a Downloads tab with Mac and Windows installers and an MDM deployment guide.

Ultra alerts can now be sent to Slack. Connect your Slack workspace from the Hub, invite the Ultra app to the channels you want, and choose which severities each channel receives. Each alert posts as a card colored by severity that shows what happened, who was involved, and which tool and connector it touched, with a button that opens the alert in Ultra. Repeats of the same alert are grouped into one card, and a delivery history shows what was sent and when.

A single Integrations page in the Hub settings brings together everything Ultra connects to. Add Slack or Amazon S3 in a few clicks, follow guided setup for alert streaming to Panther, and find setup guides for Jamf, enterprise SSO, and Google Workspace in the same place. Each connection keeps its own delivery history, so you can confirm alerts are reaching their destination.

Streaming alerts to an Amazon S3 bucket you own is now self-serve for every organization. Connect a bucket from the Integrations page in a few guided steps, with access granted through a cross account role you control, and check the delivery history to view alerts. Any SIEM or data lake that reads from S3 can pick them up from there.

Every agent now opens to a full page showing the devices and identities using it, including devices that have it installed but have not sent any traffic yet. The versions view breaks usage down by release, and selecting a version jumps straight to the devices and identities running it.

Alert handling and triage are streamlined. New organizations start with anomaly detection on and every built-in guardrail in monitor mode. Teams and Members have an improved UI/UX. SCIM deactivation now ends a user's sessions and tokens immediately, and the install script itself is now signed so you can verify it.

Ultra now tells you when something needs your attention instead of waiting for you to go looking. A dedicated alerts experience collects what fired, why it fired, and the request behind it, tracks what you have already read, and links guardrail alerts straight through to the audit event that caused them. Choose which rules alert you from a configuration page, filter the feed by type, context, and time, and export any view to CSV or JSON. Guardrail enforcement, governance policy, and anomaly findings can all raise alerts. You can send a test alert from any rule to ensure you receive the alert.

Ultra alerts can now stream continuously into your own SIEM or data lake. Alerts are delivered as immutable, append only objects into an S3 bucket you own and control, through a cross account role rather than long lived keys, with checkpointing so nothing is dropped or delivered twice. Each record carries the investigation context an analyst needs, so an alert arrives in your existing detection pipeline ready to work rather than as a bare notification.

Panther is the first supported destination for alert streaming. Ultra publishes and maintains a Panther schema for its alert format, along with a setup guide covering bucket policy, least-privilege IAM, encryption, and event notifications. Ultra alerts parse and normalize in Panther on the first ingest, with no custom parser for your team to write or keep up to date.

The things you connect through Ultra are now connectors, the machines Ultra runs on are devices, and the AI apps your team uses are agents. You will see the new names across the dashboard, CLI, and docs. Old links redirect and existing commands keep working, so nothing about your setup changes.

Three new tools let your assistant manage Ultra from inside the conversation. ultra_configure sets a connector's settings, a client ID, an environment variable, or another value, then reloads that connector in place without a restart and clears stored authorization when credentials change. ultra_tools and ultra_call cover AI apps that do not refresh their tool list mid conversation: list what is live through Ultra right now, then run one by name, so a connector is usable the moment it is ready rather than after a restart. Settings values are never echoed back, and anything called this way carries the same guardrails, audit trail, and tracing as any other tool call.

ultra uninstall removes Ultra cleanly from a device. It stops Ultra's processes, removes only the entries Ultra added to your AI app configurations, and deletes stored credentials, leaving anything you configured yourself untouched. Backups are always preserved, and restoring the connectors you had before Ultra is a single flag. A companion script does the same for every user on a Mac, so removing Ultra across a fleet through your MDM is one step.

Anomaly findings are easier to act on. Affected users show real names rather than internal identifiers, affected traces link through to the traffic or audit record behind them and collapse past the first five so a long list stays readable, and scores are visible even below the alerting threshold so you can see what Ultra considered and set aside. Anomaly findings now raise alerts alongside guardrail and governance events.

A pass of smaller fixes across the Hub. Managing people is more direct: edit roles and team fields in place, remove a direct member from a team, assign an existing team to a workspace after the fact, and see pending invitations alongside the access they will grant, while SCIM and SSO now apply your configured default role and keep rosters and names in sync with your directory. The connector catalog holds on to a connector's last known tools after the device reporting it goes offline, so your inventory no longer shrinks when laptops close, and Ultra recomputes tool fingerprints itself rather than trusting what was reported. Elsewhere, IDs copy on hover wherever they appear, toasts show how long they have left and pause when you hover them, lists hold a stable order while they refresh, saved filters drop options that no longer exist, and raw identifiers no longer appear where a person's name belongs.

Drift enforcement now lives with your governance policy instead of on each machine. Set the mode once for your whole organization or per workspace, see the value in effect and where it came from, and devices pick it up on their next sync. Ultra can also configure newly discovered AI apps for you as they appear, and drift checks now understand commented VS Code configuration files rather than treating them as broken. A fleet stays configured the way you intended without anyone touching a laptop.

Following last month's Windows installer, every Windows release is now signed as Ultra Security, Inc. That clears the SmartScreen unknown publisher warning and the unidentified publisher prompt during install. The signature covers the update package as well as the installer, so automatic updates stay verified too, and a release only publishes once signing has succeeded.

A new guide documents how to securely provision, access, operate, and decommission administrative accounts in Ultra, the security relevant settings those accounts control, and the secure defaults Ultra applies from the start. It ships with a machine readable baseline and a comparison script, so you can check a live tenant against it and catch configuration drift. Written to support Ultra's FedRAMP 20x Class B certification, and useful to anyone hardening a deployment.

The Hub now follows your operating system's appearance by default, and you can pin it to light, dark, or system from the theme switcher in your account menu. Light mode is a new variant verified against WCAG AA contrast, dark mode is unchanged, and your choice persists across sessions without a flash of the wrong theme on load.

A new interactive Ultra app runs inside MCP clients that support them, so you can see every connected server, discover and add new ones, reconnect an expired login, and remove, disable, or enable a server without leaving the conversation or opening a terminal. It adopts the host client's styling so it looks native wherever it runs, and every action it takes is recorded in your audit log.

Gateways now report the full tool catalog of every server they proxy, and the Hub persists it, so you get a complete inventory of what each server actually exposes rather than only what has been called. A new catalog view lists every server across your organization with its tools, and those tools now populate governance drill-downs, server detail pages, and rule builders. Catalog data exports to CSV or JSON like the rest of the Hub's tables.

Gateways can be given a readable name from the Hub, so a fleet reads as the machines and people you recognize instead of generated identifiers. Renames are recorded in the admin log, and gateway detail views now show the resolved owner alongside the option to change it.

Your profile picture is now pulled from your Google account on sign-in, or you can upload a custom image instead. Avatars appear across the Hub wherever activity is attributed to a person, which makes traffic, audit, and identity views easier to scan.

When an upstream server's authorization expires, you can re-authenticate it in place instead of restarting the proxy. Run ultra reconnect for a single server or with no arguments to sweep every degraded upstream at once, or trigger it from your assistant. Adding a server now opens the browser sign-in flow automatically, so authorization happens up front rather than failing on first use.

A deploy key can now carry a server profile, so a machine that links with it is provisioned with the right set of MCP servers automatically. Attach servers to a key from the Hub, enroll a device during install, and new gateways come online already configured, which removes the per-machine setup step from fleet rollouts.

Grok Build joins the list of supported MCP clients, with the same one-step config detection and migration as Claude Code, Claude Desktop, Cursor, Codex, Antigravity, and Zed, so its MCP servers route through Ultra automatically.

The personal data protection guardrail can now detect and act on Protected Health Information (PHI), joining the existing personal data types. Select PHI when configuring the guardrail to block or redact health data moving through your MCP traffic.

Running ultra start now shows a cleaner, more informative terminal view: your proxied servers listed alphabetically, per-upstream connection details, and clearer status for anything that needs attention, so you can tell at a glance what connected and what did not.

The admin log now captures more of what happens in the Hub. Data exports, security setting changes, gateway renames, guardrail edits that were previously missed, and server actions taken from inside your MCP client all record an entry, so the trail of administrative activity is more complete.

The Anomalies page replaces its risk-score line chart with a findings swarm that plots every individual finding over time, so you can see the shape and spread of activity instead of a single averaged score. Click a type in the legend or a severity lane to filter, and the swarm and its stat cards follow the shared time-range filter across the page.

Ultra now ships a native Windows GUI installer, available from the download page, alongside a broad set of Windows fixes covering client detection for packaged apps, install location and PATH handling, auto-update, file locks, OAuth browser launches, and installer responsiveness. Windows installs are now a first-class path rather than a manual one.

Settings moved from a vertical sidebar to horizontal tabs, with a polish pass across the whole area. Teams gained a details drawer and can be assigned during an invite, Workspace and Team cards preview their relationships, and deploy key creation moved into a responsive modal.

New cross-server Tools inventory in the Hub, a peer to Servers, Clients, and Gateways. See every tool observed across your fleet with call volume, success rate, blocked count, anomalies, connected clients, average latency, and last-active time, then block or unblock any tool directly from the table or its detail drawer.

A global command palette, opened with Cmd/Ctrl+K or the header search trigger, for jumping to any page or action in the Hub without clicking through the menus. Type a few characters to filter pages and shortcuts and go straight there.

Google Antigravity and Zed join the list of supported MCP clients, each with one-step config detection and migration so their MCP servers route through Ultra just like Claude Code, Claude Desktop, Cursor, and Codex.

New built-in availability guardrail that monitors upstream MCP server transport failures and latency, trips when a configured error-rate threshold is reached, and blocks a degraded upstream until a cooldown recovery succeeds. Breaker state persists across gateway restarts so a failing server stays contained.

Table export is now generally available across the Hub's data tables. Export the current view of Traffic, Audit, Identities, Servers, and more to CSV or JSON, with column-driven output and formula-injection hardening built in.

The Hub's data tables gained multi-row selection with a unified toolbar, so you can select multiple rows at once and act on them together, such as exporting them to CSV or JSON, etc.

Copy-link buttons across Traffic, Audit, Clients, Gateways, and anomaly findings generate a deep link that reopens the exact trace, event, or finding for anyone on your team. Paste a link and the Hub restores the same drawer and detail view you were looking at.

A rebuilt Hub home page with a cleaner layout and a time-range filter that scopes the whole view, so you can see all activity across a specific period, whether that's the last hour, last 24 hours, or last week. Updated widgets surface a bevy of high-level activity from across the entire app, including top clients and tools, servers ranked by activity, and your most active identities, alongside a redesigned Fleet Health card that shows gateway status at a glance. Where the home page previously showed little more than recent events, it now gives you an immediate read on activity and trends across your MCP fleet.

Governance rules can now target multiple gateways at once with a multi-select scope, and adding a server or running a manual migration is gated through governance policy. Destructive deletions require typing "delete" to confirm, and the guardrail configuration UI received a broad polish pass.

The Server Detail page now shows a User column in two places, on both the Overview and Requests tabs, so you can attribute each MCP tool call to the user who made it directly from the table, instead of clicking into individual trace details.

New Identities page in the Hub that pulls every actor across your MCP fleet, both human users and AI agents, into a single identity view. Layered attribution ties each identity back to its gateways, sessions, and tool calls, and an assurance badge reflects how strongly the identity is verified. A shared identity link now threads through the Audit, Trace, Traffic, and Server Detail pages, so you can pivot from any event straight to the responsible identity.

Ultra Ledger, our Trust Score service for MCP servers, is now live and reachable directly from the Hub. Agents can check a server's Trust Score before connecting, and security teams can browse Ledger data without leaving Ultra.

A dedicated anomaly detection experience in the Hub. Review the findings surfaced by background scans of your MCP traffic, browse per-run scan history, tune how often scans run from every 15 minutes to once a day, follow clear first-run guidance, and trigger an on-demand scan whenever you need one.

Establish a baseline MCP configuration for your fleet and enforce compliance to it. Ultra continuously checks each gateway against its approved spec, flags any drift, and can automatically bring gateways back into compliance.

New built-in guardrail that contains the blast radius of cross-tool and cross-server attacks. It tracks content flow within a session and blocks a tool call when its arguments contain data produced by a different server's earlier response, shutting down prompt-injection chains that try to move secrets between servers, such as a poisoned Linear issue steering a filesystem read into a Slack message. Operators can also define forbidden tool-to-tool sequences.

New built-in guardrail that blocks access to credential files such as .env, SSH keys, and cloud credential stores, auto-redacts secrets in transit, and detects credential-harvesting patterns across tool call parameters and responses.

Jump straight to any page in the Hub's data tables by typing a page number instead of clicking through one page at a time. Since Ultra collects thousands of logs and events, this makes navigating large Audit, Traffic, Identities, and other views far faster.

New MCP client inventory page in the Hub. Aggregates every detected client across the fleet with last-seen activity, gateway attribution, and per-client metrics so security teams can see exactly which clients are talking to which servers.

Dedicated Governance page in the Hub for managing MCP allow/block policies across servers, clients, and agents. Block or approve any server or agent fleet-wide from one place, view the live list of active blocks, and one-click unblock. Block actions are also available directly on Server rows for admins.

Compose richer governance rules with multiple conditions and OR-separated server groups. The expanded validator preserves condition caps while letting you express policies that previously required several rules.

Ultra now runs cleanly inside Ona cloud development environments, treated as a first-class MCP client, so any background agents running in your environment can be monitored, observed, and secured just like any other client.

Hermes joins the list of supported MCP clients, with one-step config migration so Hermes routes through Ultra just like Claude Code, Claude Desktop, Cursor, Codex, etc.

Test guardrail configurations against historical traces before enforcing. Pick a scope, choose a time range, and see exactly which traces would have been caught, including a stateful evaluator shim that simulates rate-limit behavior over real traffic so policies can be tuned without risk to production.

New built-in guardrail that scans MCP request and response payloads for personally identifiable information. Detects emails, phone numbers, SSNs, and other sensitive identifiers, with configurable block, warn, or audit actions.

Token-bucket rate limiting and circuit breaking guardrail to stop runaway agent loops, flood attacks, and endpoint scraping. Org and workspace-scoped limits are statically partitioned across active gateways and recomputed automatically as gateways join, leave, or go offline.

Gateways now report Ultra version and workspace name, and the Servers list shows transport type and binary location on host. Idle gateways are distinguished from offline ones, and the Gateways page now shows the full team's gateways instead of only the current user's.

Trace details now include collapsible per-trace guardrail evaluation results. Inspect exactly which rules fired, which conditions matched, and what action was taken for any individual request. No more cross-referencing logs to understand why a call was blocked or warned.

Configurable security guardrails for MCP tool calls. Define policies to block, warn, or audit specific actions based on tool name, parameters, or calling context. Enforce least-privilege access at the protocol level.

Enterprise single sign-on with SAML 2.0 integration. Connect your identity provider for centralized authentication and automated user provisioning across your Ultra organization.

Sign in to Ultra Hub with your Google account. One-click authentication for teams already using Google Workspace.

Automated user lifecycle management with SCIM 2.0. Sync users and groups from your identity provider to Ultra Hub, with support for Okta and other SCIM-compatible providers.

Native Okta integration for SAML SSO and SCIM provisioning. Manage Ultra access directly from your Okta admin console with automatic user sync and deprovisioning.

Device trust and endpoint compliance via Jamf Pro. Verify managed device status and enforce security posture requirements before granting access to MCP infrastructure.

Real-time Slack notifications for security events, anomaly detections, and policy violations. Configure per-channel routing with customizable alert thresholds.

Launched docs.ultra.security with comprehensive guides for installation, configuration, client setup, Hub management, observability, and security concepts.

New application-level security events system with a dedicated Admin Log page in the Hub. Tracks login attempts, member role changes, invite lifecycle events, and organization management actions with structured, auditable security trails.

Five-tier role hierarchy of Owner, Admin, Member, Viewer, and Beacon, with per-route permission enforcement across the Hub. Ensures proper least-privilege access for all users.

Complete security platform purpose-built for Model Context Protocol ecosystems with intelligent threat detection and response.

Complete visibility into your MCP ecosystem with real-time monitoring, automated discovery of all agents, servers, and tools. Includes detailed trace views for every MCP interaction with full request-response inspection.

Comprehensive logging for all MCP interactions with tamper-proof audit trails, real-time analytics, and compliance reporting. Full request and response payloads, latency breakdowns, and policy evaluation results.

Behavioral analysis of agent-tool interactions that establishes baselines and flags deviations in real time. Detects unusual tool call patterns, unexpected parameter values, and suspicious sequences.

Advanced client and agent identity verification with cryptographic attestation, tamper-proof mechanisms, and zero-trust authentication.