> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.55.md).

# Version 1.55

Version 1.55 introduces the OAuth Remediation Agent in beta, giving you real-time visibility into every connected app in your environment and the ability to revoke OAuth tokens automatically.

This release also adds a new detection for Microsoft verification code abuse, plus a wide range of enhancements to the API, integrations, and investigator workflows.

***

## :partying\_face: New

### OAuth Remediation Agent

Material's OAuth Remediation Agent gives you real-time visibility into every OAuth connection in your Google Workspace environment, and the ability to act on them automatically.

{% @arcade/embed url="<https://app.arcade.software/share/6mnKaEUsPNyiIZtRAEgg>" flowId="6mnKaEUsPNyiIZtRAEgg" %}

The agent:

* Automatically classifies OAuth connections based on severity, risk, and business impact, using a unique understanding of each application's runtime behavior and potential reach
* Instantly detects new OAuth connections and continuously audits existing ones, performing the deep investigation an analyst would otherwise need to do manually
* Can revoke OAuth tokens automatically and flag critical risks for review, so your team stays in control without managing every connection manually

View your authorized applications in **Explorer** > **Apps**, and configure classification settings in **Settings** > **OAuth Apps**. [Learn more about the OAuth Remediation Agent here.](/learn-more/risk-areas/malicious-oauth-apps.md)

<figure><img src="/files/qxcKEem4l3ygpIhUQx1v" alt=""><figcaption><p>connected apps, risk classifications, and remediation options in the Explorer</p></figcaption></figure>

{% hint style="info" %}
OAuth monitoring is available on all plans.

* Essentials plans receive notifications when new app connections are detected and can manually revoke tokens and set classifications.
* Advanced plans also get AI-powered investigations and automatic remediation.
  {% endhint %}

{% hint style="success" %}
Join our June 16th webinar with VP of Product and Design John Hrvatin for hands-on guidance on setting up and using OAuth management and remediation features. [Sign up here!](https://content.material.security/customer-webinar-oauth-jun26)
{% endhint %}

### New detection for Microsoft verification code abuse

This release adds an improvement to [recently-reported abuse of Microsoft infrastructure to send spam links](https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/). This update joins a batch of tuning improvements across impersonation, infrastructure abuse, account takeover, and bulk-mail detection families we've recently made.

***

## ✨ Enhancements

### API & MCP

**MCP server: Claude Desktop support**

You can now connect the the Material MCP via Claude desktop in addition to Claude Code and Cursor, with a paste-ready `claude_desktop_config.json` snippet. [Learn more](https://docs.material.security/reference/material-mcp-server).

<figure><img src="/files/grqGTHEJwl4GNRbVQTNq" alt="Claude Desktop configuration example for connecting to the Material MCP server."><figcaption><p>Use the provided Claude Desktop config to connect to the Material MCP server.</p></figcaption></figure>

<details>

<summary><strong>API actor indicator in issue timeline</strong></summary>

Issue timeline entries for actions performed via the API now show a `</>` code icon next to the actor, matching the audit log. You can now tell at a glance whether a remediation was applied manually or by automation.

</details>

<details>

<summary><strong>API v1 enhancements</strong></summary>

* **Set issue classification via API.** API v1 now [lets you set an issue classification.](https://docs.material.security/reference/api-v1/issues#patch-api-v1-issues-id) If you don't include an explicit remediation, the API automatically applies the [default remediation](/getting-started/fundamentals/respond/configure-default-responses.md) configured for that classification. Programmatic responders get UI-consistent behavior without computing it themselves.
* **Typed error codes in OpenAPI spec.** API v1's OpenAPI spec now documents typed error codes, so client integrations can handle errors reliably without pattern-matching against free-text strings.

API v1 is currently in limited release. [Learn more about API v1](https://docs.material.security/reference).

</details>

<details>

<summary><strong>Consistent API message summary shape</strong></summary>

The message summary returned in search results and issue-message edges now uses the same field structure as the full message object. You can parse both with the same schema, with no need to handle them separately.

</details>

<details>

<summary><strong>Navigation rename: "API and MCP"</strong></summary>

The **API** section under **Integrations** is now labeled **API and MCP** in the left navigation, so you can find both entry points in one place:

<figure><img src="/files/pBfUUKO3xg4jMWj3ctRf" alt="Left navigation showing the Integrations section renamed to API and MCP." width="235"><figcaption><p>The left navigation now labels this section as API and MCP.</p></figcaption></figure>

</details>

### Integrations

**Copy Test Event for integrations**

Events associated with integrations that contain a JSON payload now have a **Copy Test Event** button. Clicking it opens a modal with the full JSON payload and a copy-to-clipboard control, so you can build a receiver without sending test events and logging the payload manually.

To copy the test event:

1. From a saved integration, open an event row.
2. Click **Copy Test Event** to open a modal with the full JSON payload and a copy-to-clipboard control.

You need to save your integration first for this option to appear. See [Integration Fundamentals](/integrations/integration-fundamentals.md) for more details.

<figure><img src="/files/6Ze7KE07SpZ4VEGYlWYL" alt="Integration event details view with the Copy Test Event action available." width="332"><figcaption><p>From an integration, open an event row to copy test event.</p></figcaption></figure>

**Clone an event subscription**

A new **Clone** action on each event in an integration duplicates an existing subscription's configuration into a new draft. This is useful when building several similar subscriptions without having to create from scratch each time.

<figure><img src="/files/6Z1k9Z8Qb3Gg8W4sCenD" alt="Integration event subscription row showing the Clone action." width="375"><figcaption><p>Use Clone to duplicate an existing event.</p></figcaption></figure>

### Issues & Investigation

#### **"Assign to me" on issues**

Issue detail pages now include an **Assign to me** action under **All Actions**, so analysts can take ownership without searching for themselves in the assignee picker.

<figure><img src="/files/Db4ptr86X6xGkbB0IDjq" alt="Issue details page showing the Assign to me action in the All Actions menu." width="375"><figcaption><p>Assign to me is available from the All Actions menu on an issue.</p></figcaption></figure>

#### **Filter issues by response**

The Issues view now includes a **Response** filter, so you can find issues by the remediation that was applied, such as Spam, Block Links, Revoke token for all users, and more.

<figure><img src="/files/tG3dFWsPHZBJ7iTRUbDB" alt="Issues filter panel showing the Response filter options." width="232"><figcaption><p>Filter issues by the remediation response that was applied.</p></figcaption></figure>

#### **"View on issues list" everywhere**

All related-issues tables now include a link to the full Issues view (previously this link only appeared on tables with five or more rows).

<figure><img src="/files/aqNNRIMAehWkigdbaT74" alt="Related issues table showing the View on issues list link."><figcaption><p>Related-issues tables now link directly to the full Issues view.</p></figcaption></figure>

#### **EML filenames include the subject**

Downloaded `.eml` files are now named `{messageId} - {subject}.eml`, making it easier to identify messages at a glance when reviewing downloads in batches.

### Detection & Administration

#### **Delete calendar events in custom detection responses**

The [**Delete associated calendar events**](https://docs.material.security/learn-more/risk-areas/email-threats/auto-respond#update-response-defaults) remediation is now available as an automatic response option for Custom Detections.

1. To view your existing custom detections, from **Detections** filter to **Created By Admins**.
2. Open a custom detection.
3. Under Response, add **Delete associated calendar events**

<figure><img src="/files/N5WcdzocoXm9hbF91zg5" alt="Custom detection response settings showing the Delete associated calendar events option." width="336"><figcaption><p>Custom Detection Detail View</p></figcaption></figure>

#### **"Powered-by" branding toggle**

A new admin setting under **End-User Support** lets you show or hide the **Powered by Material** branding on your user-facing emails and pages.

1. From the top toolbar, click **Settings** (the cog icon).
2. Click End-User Support.
3. Toggle Material branding on or off.

   <figure><img src="/files/zUBLSzqOC54RfhnyjDaK" alt="End-User Support settings showing the Powered by Material branding toggle." width="563"><figcaption><p>Admins can show or hide Powered by Material branding in End-User Support settings.</p></figcaption></figure>

***

### 🐛 Fixes

* **Multi-recipient email subscriptions now deliver**: A bug was causing email event subscriptions with more than one recipient to fail silently. They now deliver as intended, and the UI guides you to separate multiple addresses with commas.
* **Model version display**: The model version in the Analysis card is now driven by the model family rather than hardcoded versions. When more than one model ran on an issue, the card now correctly displays the latest. Previously, nothing was shown.
* **Audit log filter for API tokens**: When you click **View Audit Events** on an API token, the audit log now shows the token as a visible, clearable filter chip, consistent with other audit log filters.
* **Character counter and instant comments**: Issue comment dialogs now show a live character counter with a warning when the 512-character limit is exceeded. New comments also appear in the timeline immediately rather than after a short delay.
* **Sensitive-term mail filters now honor exemptions**: The sensitive-terms detection was incorrectly triggering on excluded keywords in Gmail and Outlook mail filter detections. For example, a filter set to exclude a subject keyword would still generate an alert. This is now fixed, reducing false positives on messages users have deliberately filtered out.
* **Link extraction improvements**: Fixed edge cases in URL parsing in messages, improving detection quality.
* **Email threat issue summaries now include all signals**: Issue summaries were sometimes finalized before all analysis completed, permanently omitting signals like "Domain + BEC/Fraud Risk" or "Missing Domain Info." Summaries now regenerate when additional signals arrive, so analysts get the full picture.
* **Issue counters update after issue merge**: After merging issues, the surviving issue's message and account counts now reflect post-merge totals immediately, rather than waiting for an unrelated event to trigger the update.
* **Email Bomb detection visible per tenant**: On multi-tenant instances, Email Bomb detection was missing from the Detections list when filtering to a single tenant. Multi-tenant admins can now see and tune it per tenant as expected.
* **Trusted Entity Recommendations accessible to domain-scoped users**: Domain-scoped users were hitting a 403 on the Trusted Entity Recommendations page. This is now fixed.
* **Scroll jump fixed in Message Details**: Switching tabs between Recipients and Headers inside Message Details no longer causes the page to appear to jump to the top.

***

### :books: New and Updated Documentation

* [Material MCP server: Claude Desktop setup](https://docs.material.security/reference/material-mcp-server#two-connect-your-ai-tool)
* [API v1 : errors and troubleshooting updates](https://docs.material.security/reference)

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/whats-new/previous-releases/version-1.55.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.