Release notes — 16 October to 3 November 2026

Summary

This release adds API Discovery, a paid add-on that finds the APIs your organisation already runs and keeps one inventory of them. Each API also gets a single page that gathers its tests, security results, mocks, load results, workflows and requirements, plus a dependency map that shows how your APIs depend on each other. Before you approve a specification change, you can now see what it touches.

Other additions are a Quality Agent that reviews a project and tells you what to fix first, mocks you can steer and check against their contract, API governance, ready-made pipeline files for four CI systems, and support for the new Claude models. A short section at the end lists what shipped between 4 and 10 November.

Improvements

API Discovery (paid add-on; Trial includes it)

One inventory of your APIs. Open Discovery from the header and add a source. Discovery reads it on a schedule or on demand. Each row shows where the API is reached, the service it belongs to, and where it was seen. If you do not see the Discovery tab, tick it in your account menu, where each person chooses their header tabs.
Sources you can connect: specification files and addresses, Azure API Management, Kong, AWS API Gateway, Kubernetes, AI gateways, MCP servers, HAR files and log folders. Repository sources are GitHub, GitLab, Azure Repos and Bitbucket Cloud.
Every row says how sure we are. It is Confirmed, Observed or Inferred, with the reasons written out, and Ready to test or Not ready to test.
APIs found in code. Discovery reads routes from Express, Fastify, NestJS, Spring, ASP.NET Core, FastAPI, Flask, Django and Go projects as text. It never runs your code. These APIs show as Inferred, with the file and line as evidence, until a specification confirms them.
Add an API by hand when nothing reports it. It joins the same inventory, is recorded in the audit log and sends nothing to the API.
Accept what you find into a project. Accepting hands the API to the normal importer, so you get the same endpoints as from an import. No tests are created.
Stay informed. Discovery flags sources that stopped reading well and changes nobody has reviewed yet, and compares what a specification says with what traffic shows.
Suggested service names, owners and duplicates, within your organisation's AI policy. They are always labelled as suggestions.
Control what is kept. Evidence is kept for 90 days by default (7 to 365 days). Forget… erases what a source read.
Customer-side agents read sources inside your network and send only what the inventory needs. They only call out.
Your assistant can offer to accept, run and review what Discovery finds. The Discovery lookups are in the MCP client in the repository and reach the published npm client with its next release.

Gating: the add-on is sold as Starter, Team and Scale packages for Professional and Enterprise. Every Trial includes it.

Scan for APIs on this computer (desktop app)

Scan for APIs on the Discovery Overview finds the APIs running on your own computer. It looks on this computer only, asks for your consent first, sets aside databases and system services, and groups the results by what to do next.
Capture its calls records an application's calls in a Studio window, so you can see what it really sends.
Watch every app on this computer captures calls from all applications for as long as you choose, and restores your settings when you stop. It is available on Windows and macOS. Reading HTTPS is opt-in.
Also scan my network is off until you switch it on, and an administrator can turn it off for everyone.

These features run in the desktop app only.

One page for each API

Every API has a page that gathers its functional tests and latest results, security findings, mocks, load results, workflows and requirements. It reads what the other areas already hold, so nothing is run or changed by looking. It is available on every plan.
The inventory has a Quality evidence column that opens the detail. Its actions take you to the right area, already pointed at that API.
A project API list with filters, search, grouping and bulk selection of up to 25 APIs, and Compare all your projects for a side-by-side view of project states.
Download report saves a PDF or CSV for one API.
Applications. Group APIs into an application that a person keeps.
Numbers always say what they are out of, and a part you may not read is shown as Left out, not as zero. There is no overall score.

Dependencies

See which APIs come before and after an API, and which use its values. Every link says where it came from: Set in a workflow, Seen happening, A person said so, Suggested by AI, confirmed by a person, or Guessed from the paths.
A drawn graph is on each API's Dependencies tab. In Discovery, Dependencies shows a whole project.
Guesses are hidden by default in the functional and combined views. Tick Show the N guesses from the paths to see them.

Reviewing changes to a specification

Before you approve a change, see what it touches: the tests, mocks, load tests, workflows and requirements attached to the APIs it replaces, and the applications that use them.
Compare two specifications or two versions, compare environments, and follow a Timeline of changes. These views are in Discovery, then Changes.
Run the tests this change affects lets a person choose a non-production environment and run just the affected tests. Nothing runs by itself after you approve.
Mocks of changed APIs are marked May be out of date until you have checked them. The mark never changes how a mock answers.

Mocks

Ask for a response by name with the X-Mock-Scenario header or ?mockScenario= in the address. An unknown name returns a clear message listing the real ones.
Generated mocks get a named response for each documented error.
Make a mock fail on purpose. A response can time out or cut the connection.
Check the mocks against the contract compares each stored response with the schema its API documents, and reports "fits", "differs" and where, or "not checked" and why.
Stateful mocks that remember records, boundary-value variants, a default scenario for each environment, Mock the dependencies, versions you can restore, and regeneration from the contract that keeps your edits.
All mock features are available on every plan. Citizen Developer is limited to 50 mocks.

Quality Agent

A scheduled review of a whole project that puts what it finds in order. Each item has a sentence you can act on. It covers failing APIs and their causes, flaky tests, tests with no recent result, untested APIs and mocks that may be out of date.
Choose how far it goes. Only tell me what to fix costs nothing. Also prepare fixes for me to review asks the repair service to prepare fixes within your AI budget. Fixes wait for you. Nothing is applied by itself.
A real product bug is reported, never "fixed" in the test. A project with nothing to look at is reported that way, never as clean.
Find it under Project settings, Failing tests. Choose Review this project now or a schedule. Professional gets reports. Trial and Enterprise can also prepare fixes.

Testing depth

Generated REST tests now check that a response matches the schema its API documents, without adding extra tests to your list.
MCP tests can check the order of tool calls and compare meaning as well as exact text. A semantic check is never the only assertion.
Security: Content-Security-Policy and X-Frame-Options checks, CORS null-origin and preflight checks, and drafted fix advice. These need the security add-on.
Performance: custom cron schedules, optional monitoring of the target while a test runs, and plain-language explanations of recommendations. Monitoring is off for an environment until an administrator enables it.
Better generated cases for WebSocket-RPC, GraphQL and JSON-RPC.

Governance, analytics and reports

API governance (Professional, Trial and Enterprise): lifecycle stage, approver, version policy, a rule engine for your API standards, documentation completeness, API policies and a risk register. Every rule is opt-in.
CSV and PDF exports of the audit log, security compliance and the requirements traceability matrix.
Scheduled reports can include security and load sections, limited to what the report's owner is allowed to see.
API usage and health over time. Usage comes from Discovery sources.

Integrations

Read APIs from Postman, GitHub, GitLab, SwaggerHub, OpenTelemetry, Datadog, Splunk and Elasticsearch as Discovery sources. These need the Discovery add-on.
Send a test pack to Postman as a collection, after a preview and your approval.
Raise GitHub and GitLab issues from findings and from failures judged to be a product bug, beside Jira and Azure DevOps. A person presses the button each time.
Ready-made pipeline files for GitHub Actions, GitLab CI, Azure Pipelines and Jenkins. Open a test pack and choose Run in your pipeline. Available on Professional, Trial and Enterprise.
The MCP server client is on npm as @totalshiftleft/mcp-server, published on 3 November.

AI providers

New Claude models are supported, including Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1.
Connections now send each provider the request its API accepts today: Claude, Perplexity, AI21, Cohere, Replicate and OpenAI-compatible models. Adding a newer Claude model no longer fails its connection check.
The separate Meta Llama API key box was removed. Llama runs on the Replicate key.

Desktop app and platform

Choose which tabs appear in the header, one by one, in the account menu. Overview is on by default. Discovery, Governance, Analytics, Mocks, Performance and Security are off until you tick them.
One consistent table style across the API views, Governance, Discovery, Security, Performance and Dashboards, and the new Shift-Left API logo.
If the Engine cannot be reached, Studio names the address it tried and offers another server. File, then Connect to a Different Server, is available at any time.

Since 3 November

These changes shipped between 4 and 10 November and are not in the product's own release notes yet.

The header tab that lists a project's APIs is now called Overview. It shows the project's APIs and its release verdict. Its address is unchanged. Below a window width of 1,700 pixels only the icon is shown.
One merged API list. The release verdict's API by API list now carries the filters, search, grouping, tick boxes and the Tests, Security, Mock and Load chips. Without a verdict, the same list is drawn as a table.
Dependency map lenses and full screen. Choose End-to-end workflows, Functional dependencies or Both, and open the map in Full screen.
A workflow has a home project. A workflow belongs to one project that you choose, and Change home moves it. Run settings lets you pick an environment for each project the workflow uses, and Run with… always opens them. Deleting a project lists the workflows it owns.
Requirements from trackers (Professional, Trial and Enterprise). Import tickets from Jira, Azure DevOps, GitHub, GitLab and Confluence under Requirements, Requirement Documents, Add without a file, Import from a tracker. Group the traceability matrix by Ticket. Citizen Developer can still upload a Jira or Azure DevOps export.
Release verdict report. Download report (PDF) gives a readable release verdict report beside the audit bundle.
Name the test that gives a real record. When a test failed because its record does not exist, the fix names the test in your project that can supply a real one. Creating a record asks first and never runs on production.
AI fixes can no longer make a failing test worse. A fix that keeps the failing check, drops a success test's 2xx check or invents a variable is refused.

Fixes

Test packs: On Test Completion now emails every finished run, passed or failed. A pack that selects tests by tag can be saved and reopened, and security checks no longer crowd the test pickers.
Run triage: a failure cause offers one pending fix per test, not one for every run.
Mocks: {{request.path.id}} was always empty. A response with a changing value, such as {{uuid}}, was cached and repeated. A mock created by the assistant now starts switched off.
JSON-RPC: field negative tests were rewritten to expect a 400, so none could pass.
Dashboards: the first save no longer moves you to the Developer persona and loses your layout.
Assistant: it is told which Security tab you have open.
Licensing: a feature that was only listed in a licence record no longer reads as on.
Schedules: packs with a custom cron expression were left with no next run.
Governance: an unclassified API reads Not set, accepting a risk opens in the row you clicked, and a busy machine no longer makes a good specification read "incomplete".
Quality Agent: saving one budget no longer wipes what you were typing in the other.
Requirements: the screen no longer sends you back after you have left it.
Import: the Import dialog no longer lists .proto files, which suggested gRPC support. gRPC is not supported.
Product tour: it stops when you leave Home, so it no longer swallows your next click.
Discovery: a specification's base path is now part of every operation's address, and a scanned API is listed under the address it runs on.

Known issues

API Discovery is a paid add-on. Trial includes it. After buying or renewing, a licence change is picked up within 4 hours, or at once with Refresh on the License page.
Scan for APIs, Capture its calls and Watch every app run in the desktop app only. In a browser the Discovery Overview says where to find them. They have not yet been run in the packaged desktop app on a wide range of machines.
Discovery reads gRPC and messaging systems as inventory only. They cannot be tested in Studio.
The Quality Agent never applies a fix itself. Applying fixes unattended, quarantining flaky tests and a weekly report are not available.
The Jira, GitHub, GitLab and Confluence tracker readers are new. Tell support if an import behaves unexpectedly on your tracker.
Mock contract checks often say "not checked" for responses they cannot judge, such as templates and non-JSON bodies. A "not checked" is never a pass.
The desktop Agent must be updated to this release to receive the fixes above.