Release notes — September 2026

Summary

Build 2.0.96.231. This release changes how you work with Shift-Left Studio. A new Project Assistant answers questions about your project from its own data, and it can do the work too: you accept a change and it goes through the same checks as the button it replaces. Two new protocols arrive, JSON-RPC 2.0 / MCP and WebSocket-RPC, plus support for streaming (Server-Sent Events) responses. A failed run now shows you its causes instead of a long list of red rows, and a green run now tells you what it did not check. End-to-end workflows can be built from your requirements and specifications. A broad performance pass makes projects, reports, and large test packs noticeably faster.

Improvements

Project Assistant

• Ask about your project in plain language: the assistant looks up your requirements, endpoint specifications, tests, run history, and run analyses before it answers, then cites what it found. Citations open the item in the project tree.
• It can act, with your approval: the assistant can offer to run a test or pack, generate tests, fix a test, or create a project, feature, endpoint, test, requirement, dataset, or workflow. Nothing changes until you accept. Every accepted change goes through the same route, permissions, licence checks, and audit log as the button in the product. It never deletes anything, handles credentials, or changes what production points at.
• Attach a specification or document in the conversation, and the assistant can read it or import it.
• Works across projects: name another project you have access to and the assistant reads from it. It says so plainly when a project is outside your access.
• Learns from your corrections, per project: rate an answer or tell it what was wrong, and review or retire what it has learned. A correction can never grant the assistant permissions it does not already have.

New protocols and streaming

• JSON-RPC 2.0 and MCP testing: import an OpenRPC document or discover a Model Context Protocol server's tools as testable endpoints, with dedicated assertions for results and errors. Available in Trial and Enterprise editions.
• WebSocket-RPC testing: a connect wizard probes your gateway and lists the methods it declares. Read-only methods are selected for you, and methods that change data stay unticked. Workflows keep one authenticated connection open across ordered steps with Connect, Call, and Close blocks. Gateway credentials are saved once as named access keys. Results read in plain language, with a conversation view of each call. Optionally, a pack can take a gateway backup before its first test and restore it after its last. Available in Trial and Enterprise editions.
• Streaming responses (Server-Sent Events): text/event-stream responses are parsed into a list of events you can assert on, with an optional true-streaming mode for first-event latency.

Understanding test runs

• Failed runs explained as causes: failures are grouped into a handful of causes, each with a verdict: test defect, data issue, environment problem, or suspected product bug. Fix every test that shares a cause in one step. A suspected product bug is never "fixed" by changing the test, and a negative test is never weakened into one that can no longer fail.
• Reads what the server actually said: a firewall or gateway page, a sign-in page, rate limiting, and a missing record are told apart from a real permission refusal, instead of all reading as "access denied".
• Ask for a second look at a cause and add your own hints. The AI takes them into account.
• Green runs, examined: passing tests are checked for what they leave open. Would the test notice a regression? Was the requirement it claims to cover actually verified? Does the response still match its documentation? Suggested improvements only ever add checks.
• A grounded Fix button: Fix now reads the specification, the requirement, the test's intent, and the analysis of the run, and every suggested change cites its evidence. Runs record richer diagnostics to support it.

Workflows

• Workflows build themselves from use cases: an approved use-case requirement with ordered steps becomes a workflow as soon as each step has a test. When one cannot be built, the product names the missing step and says whether it needs a test or an endpoint. It can then generate the missing tests and build the workflow in one step.
• Build a workflow from your specification and tests, or from a sentence, with data automatically passed from one step to the next.
• Cross-project workflows, with a separate environment for each project a pack runs against.
• Workflow doctor: diagnoses the workflow on your canvas, including unsaved edits, and offers fixes that only add what is missing.
• Workflows count as requirement coverage, and a workflow run can verify a requirement.

Generation, import, and requirements

• Generate tests for every endpoint in one go, for a whole feature or project.
• Select every test in a large project when building a pack, without paging through it.
• Postman import creates one test per request, carries over its assertions, and lists any requests it left out, with a one-click re-import.
• Link a requirement to its endpoint and fill coverage gaps in place. Header requirements (such as Content-Type or SOAPAction) can now be tested, and the gaps panel explains why a requirement has no tests.
• More AI providers: OpenRouter, Cerebras, and Hugging Face are now fully usable.

Integrations, dashboards, and administration

• MCP server for AI agents: connect Claude, Cursor, or another MCP client to Shift-Left Studio.
• CI/CD integrations are now public: the GitHub Action, Azure DevOps extension, Jenkins plugin, CircleCI orb, Bitbucket pipe, and GitLab component now live in the Shift-Left API Integrations repository.
• Persona dashboards: TV mode, embedding, scheduled reports, and alerts now work as intended. You can resize and rearrange widgets, narrow multi-project dashboards to a focus project, and view the environment matrix.
• Activity feed switch: administrators can turn the activity feed on or off from Settings → System & Monitoring → Audit Logs. It is off by default, and events are still recorded while it is off.
• Running a pack opens its summary, search is kept when the page reloads, and an execution summary shows its counters first with causes below.

Performance

• Faster everywhere it matters: opening a project, loading reports, working in large test tables, and typing in the sidebar all do far less work.
• Large packs run leaner: connections are reused between tests, a big pack no longer times out the browser it was started from, and run logs are no longer stored twice.
• Lower memory use on long-running servers and in the desktop Agent, and database indexes are now built on every installation.

Fixes

• Execution: a GET request never sends a body, request timeouts are reported consistently, a pack cancelled while queued no longer runs anyway, and an auth profile that cannot be resolved now says why.
• Desktop Agent: auth profiles using bearer or basic credentials now authenticate correctly when tests run on the Agent.
• Scheduling: a pack scheduled for the current minute runs immediately, recurring packs stay on their scheduled time, scheduled WebSocket-RPC packs sign in the same way manual runs do, and times in the past are rejected.
• Mocks: adding a second mock on the same path and method no longer makes every request return 404.
• Reporting and dashboards: pack duration is reported as wall-clock time, "14 days" and "Last 24 hours" no longer show 30 days, scheduled reports honour their time zone, "Send now" no longer reports success when no email profile is configured, and dashboard share links point at the right address.
• Test generation: an endpoint that returns 204 is no longer given body assertions it cannot pass, additionalProperties: false is no longer assumed to mean a 400 response, SOAP negatives XML cannot express are no longer generated, and a cut-off AI reply is detected reliably.
• Roles: a permission you switch off now stays off.
• Workflows: a workflow that a pack still runs can no longer be deleted, and a pack now reports any workflows it is missing.
• Licensing: a request blocked by a network filter no longer reads as a rejected licence key, and activation no longer retries in a burst.
• Security: endpoint listings now require authentication, decrypted secrets are no longer kept in memory caches, the installed Engine no longer trusts proxy headers by default, and application source is no longer included in the installer.
• Installer and Engine: a network failure during installation is reported as what it is, instead of "releases not available". The Engine explains why it did not start instead of looping on service error 1067, Engine updates no longer crash-loop on a template secret, and JSONPath works in the installed Engine.

Breaking changes

• Free licences now run for six months. A fresh installation no longer licenses itself automatically. Register for a Free or Trial licence and activate it on first run. Existing Free licences issued without an expiry now expire six months after they were first issued.

Known issues

• The desktop Agent must be updated to this release to pick up the authentication and execution fixes above.
• WebSocket-RPC tests run on the cloud or server Engine, not on the desktop Agent's local runner.
• Tests generated earlier for 204 endpoints keep their previous assertions until they are regenerated.

Related links

• Browse all release notes
• Download the latest build
• Help Center
• Product documentation
• Plans and editions