Skip to content
Dreadnode Dreadnode Dreadnode

August 13, 2026

Versioned item type registry for structured agent output

← All updates

Versioned item type registry for structured agent output

5 new 10 improved 6 fixed

A new versioned item type registry backs structured agent output this week, giving platform admins explicit control over the schemas that capabilities write against.

New

  • Structured agent output registry. A versioned item type registry now backs Agent Output — platform admins can define, publish, and manage structured output contracts (findings, assets, and custom types) via Operations → Objects, while capabilities bind to approved registry versions and all item writes are validated against the canonical schema.
  • ScopeGuard in remote and headless sessions (experimental). ScopeGuard policy is now usable in remote and headless sessions via the SDK, and the session UI renders tool-call policy decisions when ScopeGuard metadata is present — the policy stays opt-in, with no workspace setting or picker entry yet.
  • Caido MCP server in web-security. The web-security capability now includes the full Caido MCP server (66 tools, 6 resources) as a second MCP server alongside the existing Python wrapper, both targeting the same Caido instance.
  • Bulk session delete. You can now select multiple agent sessions and delete them in bulk; deleted sessions also disappear from the list immediately without requiring a page refresh.
  • Response queue poisoning skill. A new response-queue-poisoning skill is available in the web-security capability, covering CRLF-powered desync attacks including response queue poisoning and request tunnelling via HTTP header injection.

Improvements

  • Capabilities UI redesign. The capabilities UI has been significantly redesigned with improved navigation, richer detail views for agents, skills, and MCP servers, and a new file browser for capability contents.
  • Model slug visible by default. The model slug is now visible by default in session metadata, so you can identify the exact model used without extra clicks.
  • Reader-only orgs disabled in workspace picker. Reader-role orgs are now visibly marked and disabled in the New Workspace dialog, preventing the 403 error that occurred when a reader submitted the form.
  • Evaluation creation progress in the CLI. Running dn evaluation create now shows a spinner (or plain status line in non-interactive output) while the evaluation is being submitted, so you can tell it’s working.
  • Output details panel clarity. The output details panel now labels provenance as “Recorded by,” renames “Origin” to “Session,” restores the session link’s brand color, and aligns severity badge colors with the main outputs page.
  • Agent outputs project fallback. The agent outputs page now falls back to a sensible default project when no project is explicitly selected, reducing dead-end states.
  • Sandbox isolation reference. A new sandbox isolation reference page covers Firecracker compute isolation, application authentication, public sandbox routing, outbound internet access, credential scope, and shared responsibility.
  • TLS troubleshooting runbook. The self-hosted TLS troubleshooting guide is now a step-by-step runbook covering endpoint selection, certificate chain validation, hostname mismatches, and certificate/key pairing.
  • Hub scope tabs documented. Hub browse pages (Datasets, Models, Capabilities, Environments) now document the Mine / org / Public scope tabs and clarify how the CLI’s --include-public flag differs from the Public tab.
  • Secret naming conventions explained. Secrets docs now explain how secret names map to sandbox environment variables, with concrete examples for LiteLLM providers like OpenRouter.

Fixes

  • E2B runtime stability on long generations. E2B-backed runtimes no longer stop responding partway through a long generation turn, so long-running evaluations no longer fail with an infrastructure error.
  • Large capability sets on OpenAI models. Agents whose capabilities exceed OpenAI’s 128-tool limit no longer fail with a 400 error on every turn; capability sync now preserves executable bits on scripts.
  • False dn judge failure on large tool output. dn judge outcome no longer falsely fails a successful flag_and_judge evaluation when the judge emits a tool result larger than the offload threshold.
  • Screenshots in trace transcripts. Trace transcripts now display screenshots returned as bare remote URLs, rather than showing nothing.
  • Web-security preflight tool guard. The web-security agent now checks for required tools at startup and prompts you to confirm scope or wait before running, rather than silently proceeding with a partial scan when tools like dnsx or katana are unavailable.
  • Project filter alphabetized on Agent Sessions. The Project filter list on the Agent Sessions page is now sorted alphabetically by display name.