> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.54.md).

# Version 1.54

In version 1.54, we’re delighted to bring you two big and heavily-requested new ways to interact with Material as part of your AI-powered security system:

* An [MCP server](https://docs.material.security/reference/material-mcp-server)
* A limited release of [API v1](https://docs.material.security/reference) created from scratch specifically for customer use

We’re also continuing to make it easier to investigate and action issues in the UI. This release adds a consolidated AI investigation card, bulk phishing actions via the **all actions (⌘K)** menu, and a new feedback option for ambiguous detections, alongside several fixes that sharpen analyst and admin workflows.

***

## :partying\_face: New

### MCP server

Material now has an MCP (Model Context Protocol) server! The Material MCP server connects AI clients like Claude Code and Cursor to Material. It lets you query your data in Material, in plain language without leaving your AI workspace.

Use it to investigate threats, pull account and message context, combine Material data with signals from the rest of your stack, and design your own workflows and uses entirely!

{% @arcade/embed url="<https://app.arcade.software/share/U1Qgsxxapin7utfADXBy>" flowId="U1Qgsxxapin7utfADXBy" %}

[Learn more about the Material MCP server here](https://docs.material.security/reference/material-mcp-server).

### API v1 (Limited Release)

[Material API v1](https://docs.material.security/reference) is now available in limited release. It gives you programmatic access to Material threat detection and email analysis data, so you can use it outside the product.

This isn't just a new version of our beta API. We rebuilt API v1 from the ground up around common developer workfl*o*ws.

The first release focuses on Email Threat use cases. We’ll keep expanding the API based on customer needs. If you want early access or have feedback, contact support. [Learn more about API v1](https://docs.material.security/reference).

{% hint style="success" %}
Interested in participating in the limited release? Contact support.
{% endhint %}

### New "Analysis Unclear" feedback option

Feedback on email threat issues and their related messages now includes the option: "The analysis of this message is unclear."

<figure><img src="/files/KLh2srczpsu8iog8lQzo" alt="Version 1.54 feedback dialog showing the new Analysis Unclear option for email threat messages." width="375"><figcaption><p>Feedback now includes an option for unclear message analysis.</p></figcaption></figure>

Previously, feedback was limited to false positive or missed detection. This was useful for clear-cut errors, but not in cases where Material's assessment is ambiguous or hard to interpret.

This new option gives you a precise way to flag edge cases, helping Material's detection team identify and tune assessments that need more clarity rather than just a correction. We've recently surfaced a lot of the reasoning for the verdict, so now you have a way to provide feedback on those explanations.

{% hint style="info" %}
To share feedback from an issue, click **all actions (⌘K)** then **Share Feedback**.
{% endhint %}

### Bulk email threat message actions via all actions menu

Use the **All actions** menu **(⌘K)** to take bulk actions on messages directly from an email threat issue, including viewing message details and removing messages from an issue.

<figure><img src="/files/V8KT1SgR7dsrdIuWTiNA" alt="Version 1.54 All actions menu on an email threat issue showing bulk message actions." width="375"><figcaption><p>Use the All actions menu to manage messages in bulk.</p></figcaption></figure>

When triaging a high-volume email threat campaign, this eliminates the need to click into each message individually.

***

## ✨ Enhancements

### AI investigation summary consolidated into a single card

Agent investigation results, including decision reasoning, assessment steps, and risk factors, now appear as a single unified card instead of separate cards spread across the view.

<figure><img src="/files/QpQ345RfeCCcdJg7HDRb" alt=""><figcaption><p>AI investigation details now appear in a single card.</p></figcaption></figure>

The investigation reads as a coherent narrative, making it easier to follow Material's reasoning and understand what evidence contributed to a threat assessment.

### "Mark Suspicious" action always visible for selected messages

The **Mark Suspicious** action (previously labeled "Create new Material issue") is now pinned to the top of message action menus and always visible, regardless of message state.

<figure><img src="/files/ODORiSLcvCDOqSAvINLs" alt="Version 1.54 message action menu with Mark Suspicious pinned at the top." width="375"><figcaption><p>Mark Suspicious stays visible at the top of the action menu.</p></figcaption></figure>

### Trusted Entity settings now document reporter response behavior

We improved Trusted Entity help text to clarify the relationship between issue creation and reporter response automations:

"Set this to 'Don't create phishing issues' if you don't want reporter responses."

<figure><img src="/files/N1WKpgNetkyqliB6cFX9" alt="Version 1.54 Trusted Entity settings help text explaining reporter response behavior."><figcaption><p>Trusted Entity settings now clarify how reporter responses work.</p></figcaption></figure>

Admins now have additional context when configuring Trusted Entities.

### Clearer language for email threat remediation settings

Default Account Settings for Email Threat Remediation now use clearer language: **Allow Material to remediate** replaces **Should Material remediate**, and the UI notes that these settings apply only when Email Threat Remediation is enabled.

<figure><img src="/files/0h8pCLFPaY2xWS7sezjJ" alt="Version 1.54 Default Account Settings showing clearer email threat remediation language." width="333"><figcaption><p>Default Account Settings</p></figcaption></figure>

***

## 🐛 Fixes

* **Suspicious messages now explain why no issue was created**: When a message is flagged as suspicious but doesn't generate an issue (because the sender is a Trusted Entity, an exemption rule matched, or another configured condition applied) the message detail view now shows the reason directly (e.g., "Trusted Entity", "Exemption Rule: Sender Address"). Investigators no longer have to guess whether a missing issue is a bug or expected behavior.
* **Resolving issues no longer counts against the issue status update rate limit**: Changing an issue's status to Resolved is now excluded from the issue update rate limiter. During large incident cleanups, bulk-resolving issues could previously trigger the rate limit at exactly the wrong moment. Resolved is now always available.
* **Admin "Mark as Malicious" now respects configured remediation settings**: When an admin marks a message as malicious from message search, Material now applies the tenant's configured `IssueTriage` remediation settings, including per-entity overrides, instead of a hardcoded default. Previously, admin-initiated cases ignored customer-configured overrides, which could produce unexpected remediation actions for exempt domains or entities.
* **Browser tab titles now show the current page first**: Tab titles now follow standard order, with the page name first (for example, "Issue Details | Material Security"). This makes it easier to identify the right tab when running Material alongside other tools.
* **Simulation breakdown pie charts restored**: A regression caused pie charts in the email threat simulation breakdown side panel to stop rendering. They're back.

***

## :books: New and Updated Documentation

* [API v1 preview guides](https://docs.material.security/reference)
* [Material MCP server guide](https://docs.material.security/reference/material-mcp-server)
* New [Deployment Guide](/getting-started/deployment-guides/your-first-30-days.md) tutorials

\ <br>

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/whats-new/previous-releases/version-1.54.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.