Changelog

Features

• Added the singleExpanded attribute to the accordion-group Markdoc tag to keep only one accordion open at a time.

• Improved search to index every field, heading, and message.

• Added linkIcon, cta, iconColor, badge, badgeColor, and badgeIcon attributes to the card Markdoc tag to enhance customization options.

• Added recovery hints displayed when Docs MCP lookup failed.

• Added accordion and accordion-group Markdoc tags to organize content into collapsible sections.

• Added a Connect to the MCP server page at /mcp with tabbed setup instructions for Claude, ChatGPT/Codex, and raw JSON configuration.

• Improved MCP server code mode to reduce AI agent script failures and provide clearer error messages.

• Improved the credentials page to show all accepted API credentials.

• Added validation to the MCP credentials form.

• Added an opt-in /mcp-public endpoint to serve public content without authentication on RBAC-restricted projects.

• Added Docs MCP server audience validation for bearer tokens.

• Added an onClose prop to the custom ReplayGate component.

• Added idea as a supported type for the admonition Markdoc tag.

• Improved sidebar accessibility: separators are no longer announced as links by screen readers and no longer receive keyboard focus.

• Updated default border radius for components.

• Added translations for the Connect to MCP server and page action dropdown toggle labels.

• Improved the version picker to sort versions from newest to oldest using numeric-aware sorting, that is: 2.10 before 2.9.

• Added cross-links between the /mcp and /mcp-public setup pages and noted that the public page serves anonymous-accessible content only.

• Added an ability to create new environments in Replay using a ReplayGate.

• Added a shortcut in Replay that converts selected text in a request URL into a path parameter when pressing {.

Fixes

• Fixed an empty Download panel that appeared on the OpenAPI and AsyncAPI overview page when downloadUrls was set to an empty list.

• Fixed an issue where API docs pages opened scrolled down, hiding the breadcrumbs and any custom navigation placed above the API description.

• Fixed an issue in API docs where a schema that inherited its discriminator from an allOf parent displayed only the discriminator property, without its variants or other properties.

• Fixed an issue where several Redocly extensions were incorrectly rendered as custom vendor extensions when showExtensions was enabled.

• Fixed the gap between the label and the dropdown arrow in the Connect to MCP button.

• Fixed an issue where the Copied! tooltip on copy buttons disappeared too early when the button was clicked repeatedly.

• Fixed an issue where raw HTML in operation descriptions leaked into search results and was rendered as literal text.

• Fixed security vulnerabilities CVE-2026-84375, CVE-2026-84363, CVE-2026-84364 and CVE-2026-39408 by upgrading js-yaml to version 4.3.2 and hono to version 4.13.7.

• Fixed an issue where environment variable placeholders ({{ process.env.VAR }}) in redocly.yaml resolved to their build-time values instead of the server's runtime environment.

• Fixed the styling of dividers on Markdown pages.

• Fixed an issue in API docs where the request code sample lost its form fields and displayed an empty body.

• Fixed an issue in OpenAPI docs where schemas were positioned before operations in the sidebar.

• Updated openapi-sampler to version 1.7.5.

• Fixed an issue where a variant whose schema was unavailable, such as a schema restricted by RBAC, displayed as an empty option.

• Fixed OAuth2 client credentials exchange in the MCP gateway credentials form.

• Fixed an issue where SSO login in projects without an l10n configuration caused identity providers with strict ui_locales validation to reject the login request.

• Fixed an issue in OpenAPI docs where selecting an example in the response panel did not update the request code sample.

• Fixed an issue where Docs MCP API lookups rejected names that are unique parts of API titles.

• Fixed an issue where angle brackets: <, > weren't rendered inside inline code within Markdown link text, such as [`command <name>`](page).

• Fixed MCP code mode tool results and descriptions to match declared signatures.

• Fixed MCP server code mode crashes for runs that produce no output.

• Improved the MCP gateway to ask which credentials the user holds instead of picking the default.

• Fixed an issue where the MCP server sent outdated credentials.

• Updated the MCP API-credentials page to match Redocly styling.

• Fixed an issue where the MCP server served http:// links behind proxies.

• Fixed MCP connections for clients on the 2026-07-28 protocol revision.

• Fixed MCP OAuth discovery: the authorization server metadata issuer matches the portal origin (RFC 8414), 401 challenges include scope and authorization_uri.

• Removed the 405 status code text from the MCP endpoint pages (/mcp and /mcp-public).

• Fixed the documentationUrl in the MCP server card to include the path prefix.

• Fixed an issue where describe-tools tool in the MCP server didn't provide a human-readable name.

• Fixed an issue where project SSO login failed when the IdP sent many group claims.

• Fixed an issue where the Docs MCP get-endpoint-info tool returned operations for paths hidden with x-mcp.

• Fixed security vulnerabilities CVE-2026-83610 and CVE-2026-45820 by upgrading @xmldom/xmldom to version 0.9.12 and fflate to version 0.7.5.

• Fixed spacing and the selected language tab indicator in API docs overview panels.

• Fixed an issue in OpenAPI docs where object-valued path item extensions, such as x-okta-lifecycle, rendered as extra HTTP operations in the navigation.

• Fixed an issue where pages rendered blank for visitors with ad blockers.

• Fixed an issue where example descriptions weren't rendered in the request and response samples panels.

• Fixed mcp.docs.ignore to correctly exclude ignored content from Docs MCP search results.

• Fixed an issue where code samples omitted the discriminator value of the selected variant.

• Fixed an issue in Replay where Basic authentication credentials with non-ASCII characters produced a corrupted Authorization header or prevented the request from being sent.

• Fixed an issue in Replay and the Try it console where operations with many editable fields got slower on each reopening.

• Fixed an issue in the Try it console where closing an inactive tab moved the selection to a different tab instead of keeping the active tab.

• Fixed an issue in Replay where the request body editor didn't display property descriptions for content with Markdown formatting.

• Fixed an issue in Replay's mobile layout where the first character typed in a request input moved focus to the close button.

• Added missing tooltips to the Try it console parameter rows in OpenAPI docs.

• Fixed an issue in Replay where truncated tab names and request titles did not display their full versions on mouse hover or keyboard focus.

• Reworded the AI assistant's welcome message, disclaimer, and error messages for consistent naming.

• Improved the 404 page for API Docs.

• Fixed an issue where clicking an item in the table of contents caused the selection indicator to jump and highlight an incorrect item.

• Fixed an issue in API docs where deep links did not open the linked field.

• Fixed broken llms.txt links to use the configured seo.siteUrl instead of the Redocly-hosted domain.

• Fixed small visual issues with the Connect to MCP server button and aligned its styling with the page action button.

• Fixed an issue in API docs where the menu link for a section of a tag description contained a duplicated path segment.

• Fixed an issue where Markdown tables would render a collapsed gray header row when all heading cells were empty.

• Fixed an issue where a search query that contained duplicated characters returned an error.

• Updated @redocly/openapi-core to version 2.53.0.

• Fixed an issue where a mapping key that pointed to the same schema as defaultMapping disappeared from the variant list.

• Updated the language selection indicator's position in the API docs Languages panel to display inside the language selection box.

• Fixed an issue in OpenAPI docs where the server URL was missing from the request panel for APIs with a single server.

• Fixed an issue in API docs where the code samples panel displayed no Discriminator selector for schemas that inherited their discriminator from an allOf parent.

• Fixed an issue where preview did not update llms.txt and page Markdown related to LLMs.

• Fixed an issue in Try it where parameters without an example appeared empty and were excluded from requests.

• Fixed an issue in Replay where the input popover truncated selected values.

• Fixed an issue in Replay where a response without a body, such as 204 No Content, displayed an empty code editor on the Body tab.

• Fixed an issue in Try it where typing in the empty parameter row of a request opened in a new tab: discarded the character, moved focus out of the field, and added the parameter to the previously opened request.

• Fixed an issue in Replay where the Send button became wider while a request was in flight, which shifted the request URL row.

• Fixed an issue in Replay where a duplicate server variable appeared as an extra row in the Environments dialog's Inputs table.

• Fixed an issue in Replay where pressing the Return or Enter key in the request URL field could break the URL onto a new line or clear the response panel during a running request.

Features

• Added target branch change event to the pull request timeline.