Skip to main content

Changelog

User-facing changes to Hyrax — things you'd notice in the product.

October 12, 2026​

  • Switch from the top of the rail. The card at the top of the rail names where you are. Open it, then click an Area or a Space to see what's inside, and All spaces in … or All projects in … at the top of the next column to go there. Click a Project to go to it, or All areas to go to the whole workspace. Type to find any of them, or type an issue's ref, such as ISS-12, to go straight to that issue. You stay on the same page, when the place you go to has one. The path in the top bar names where you are. The top bar's Go to… menu is gone. See Organizing work.

October 9, 2026​

  • API note. The deprecated health-score fields (overall_score, benchmark_scores, latest_benchmark_*, last_benchmark_status, org_averages and weakest_domains) and virtual_patch_counts are removed from repository records, the workspace dashboard, and the MCP get_repo and workspace_overview tools. They have always been empty, null or zero since health scores and Virtual Patches were retired. The …/benchmarks/progression and …/benchmarks/trends repository routes are removed too, and now return 404. The MCP workspace_overview tool is now cursor-paginated like the other list tools: it takes limit and cursor and returns the repo rows as data, with next_cursor and has_more, in place of the old repos list. See the API reference.

October 8, 2026​

  • Projects and Issues for every workspace. Every workspace now uses the new layout, organized into Areas, Spaces and Projects, with Issues to track work. If your workspace has never had a Space, Hyrax creates a Space named Default and puts your repositories in it, along with an Area named Default to hold it if you have no Area yet. That happens on its own, shortly after this update reaches your workspace.
  • Team context for every workspace. Team context, where your team writes down the decisions, conventions, runbooks and warnings your agents should know, is now on every plan. It used to be a private beta that had to be turned on for each workspace. Entries can be read and written in the web app, through the REST API and through the MCP server, and what an agent writes stays a proposal until a person confirms it. See Team context, and Members & roles for who can do what.
  • API note. Team context routes and MCP tools no longer refuse a call with plan_restricted. An API key created before this update may not include the Team context permissions; create a new key to use them. See Endpoint reference: Team context.

October 6, 2026​

  • Discovery is no longer limited to your first repository. Before, only your first repository and public repositories added by URL started Discovery on their own. Now Discovery starts automatically when you add any repository on the web or through the REST API, unless something holds it back, such as your workspace's usage limits. Adding a repository through the MCP server or chat doesn't start it. If a repository hasn't been discovered, including one you added before this change, start Discovery from its Discovery tab. See Discovery & AI agent context.
  • Virtual Patches is retired. Audits no longer learn scanner patterns from earlier runs or apply them to later ones, and the Virtual Patches page, its sidebar item, and its Settings toggle are gone. Virtual Patches never edited your files, so nothing in your repositories changes, and findings your audits already produced stay as they are. Later audits use Hyrax's standard scanner patterns and severities, so a pattern Virtual Patches had turned off or re-rated for your workspace runs as standard again.
  • API note. On repository records, virtual_patch_counts is deprecated: it now always reads {"patterns": 0} and will be removed in a later release. The MCP tools for listing learning improvements and setting learning flags are removed, and workflow='learn' continues to return 422. See the API reference.

October 1, 2026​

  • Every review now posts a fresh comment. Hyrax used to edit its review summary in place when the findings hadn't changed, which sent no notification and left the summary far up a long thread — so a re-review after a force-push could change the merge recommendation without anyone seeing it. Each review now posts at the bottom of the thread and folds the previous summary into a pointer that keeps the commit it reviewed, its finding count, and its merge recommendation when one was shown. Ticking a checkbox still edits the summary in place, and closing and reopening a pull request doesn't re-review a commit Hyrax has already reviewed. See Pull request review.

September 15, 2026​

  • Publish is retired — your AI agents read repo context over MCP instead. The Publish workflow opened a pull request that wrote generated documentation (HYRAX.md, a .hyrax/ directory, ignore files, and a block in your CLAUDE.md) into your repository. It's gone, and nothing replaces it in your repo: the same context — architecture, conventions, how-to guides, open findings — is served live by the MCP server, so a connected agent always reads the latest Discovery run rather than a copy that went stale when it merged. If you did merge a Publish pull request, the files it created are yours to keep or delete; Hyrax won't touch them again. Anything earlier on this page that describes publishing context into your repo is superseded. See Discovery & AI agent context.
  • API note. publish is no longer a valid workflow value and returns 422. See the API reference.

August 25, 2026​

  • Creating a workspace asks who you are. The workspace-creation screen now asks for your name, your company name, and your company URL, and every field carries a visible label instead of placeholder text that vanished as soon as you typed. See Quickstart.

August 24, 2026​

  • A clearer answer when a run is refused for credit. A Free workspace that has used up its credit is now told what its next monthly credit will be, instead of being pointed at a reset that might not cover the run it just refused. See Plans & pricing.

August 16, 2026​

  • Your remaining credit is in the top bar, on every plan. Free workspaces hold real spending credit — a one-time signup credit plus a monthly one — but the top-bar figure only ever appeared for paid workspaces, and Free's Settings → Plan showed the plan picker with no balance on it. Both now show what you have left ("$29.04 credit left", or "No credit left" when it runs out). It's a remaining balance rather than the paid plan's "$12 of $30" ratio: your signup credit and your monthly credit are one pool, not a countdown to a renewal date. See Plans & pricing.
  • Connecting a GitHub organization drops you straight into your new workspace. Finishing the connect could land on a "Hyrax is not configured" screen for a workspace that had just been created successfully — a refresh fixed it, but nothing said so. It doesn't happen any more, and if a workspace ever can't be loaded the screen now re-checks by itself and offers a retry instead of a dead end. Accepting an invitation had the same rough edge and is fixed with it. Connecting also shows a proper progress indicator now — setting up a workspace takes a few seconds and the button used to look inert while it worked.

August 11, 2026​

  • Two plans: Free and Paid, and Paid is priced per seat. Hyrax used to have three plans — Free, Pro, and Team — at a flat price each. It now has two, Free and Paid, and Paid costs $30 per seat, per month, with every dollar of the subscription coming back as spending credit for that month. No feature is withheld by plan: every workflow, the workspace audit log, Virtual Patches, the Todo list and notifications feed, and programmatic access through the REST API and the MCP server run on both, and repositories are unlimited on both. Anything earlier on this page described as a Pro or Team feature is now on every plan. Members are unlimited on Free; on Paid each member occupies a purchased seat, which you can add to or reduce yourself from Settings → Plan. Pro and Team are no longer offered; workspaces already on one keep everything they had, on the terms they signed up under. See Plans & pricing and Seats.

August 8, 2026​

  • Every plan now gets both audit depths, and the Mini audit is gone. The audit used to come in three depths that followed your plan. It now comes in two — the Standard audit and the Full audit — and both run on every plan, including Free. The Mini audit, a capped quick pass that only existed as Free's substitute, has been retired: with the real audits available to everyone there was nothing it was better at. What bounds your usage is your workspace's credit, not your tier. See Workflows and Audit depth.
  • Connecting a repo starts PR review, not an audit. New repositories arrive with pull request review switched on, so Hyrax starts working on the pull requests you open without you configuring anything. Your first repository still runs Discovery automatically to learn the codebase; audits are now always something you choose to run. Repositories you add later don't run Discovery on their own — start it from the repo's Discovery tab when you're ready (an audit needs it first). Public repositories added by URL are the exception: they always run Discovery, because without the GitHub App there are no pull requests for Hyrax to review.
  • API note. mini_audit is no longer a valid workflow value and returns 422. Use standard_audit or audit. See the API reference.

August 6, 2026​

  • Sign up with any email address. Hyrax no longer turns away signups from personal email providers — gmail.com, outlook.com and the rest now work like any other address.

July 28, 2026​

  • Signing in is Google or an email code. The "Continue with GitHub" button is no longer on the sign-in page — new accounts sign in with Google or with a one-time code sent to your email. If you already sign in with GitHub, that keeps working. Connecting GitHub is unchanged and remains a separate step, about repository access only. (This supersedes the June 17 note below, which listed GitHub as a sign-in option.) See Members & roles.

July 23, 2026​

  • Findings Hyrax can't fix now wait for your review — nothing is silently dropped. When automatic fix attempts are exhausted, a finding no longer disappears as "abandoned"; it stays open and moves into a needs-review lane on the Findings tab with clear next steps — dismiss it, mark it addressed, or try one more attempt. Cancelled fixes and infrastructure hiccups (a build/CI blip on our side) no longer count against a finding's attempt limit, so a finding whose only failures were noise stays freely retryable. See Findings.

  • When Hyrax thinks a finding is a false positive, it tells you. If the fix agent repeatedly concludes there's nothing to change, the finding is flagged as a suspected false positive — with the agent's reasoning shown inline — and you decide: Confirm false positive (dismiss it), Keep open (you disagree; it stays a real issue), or Try one more attempt. Hyrax never auto-dismisses it for you.

  • Notifications in the top bar. Pro and Team workspaces get an in-app notifications feed: the bell in the top bar now shows what happened in your workspace — a finished audit, a merged fix pull request — with an unread badge and a quick preview of recent items; opening an item marks it read. The Todo list moved to its own button beside the bell, which shows your open count and takes you straight to the Todo page. (This supersedes the July 10 note below about what the bell shows.) See Todo & notifications.

July 10, 2026​

  • A Todo for your workspace. Pro and Team workspaces get a Todo page — a prioritized list of what needs attention across your repos, from onboarding gaps and stale audits to unaddressed critical findings and stale fix PRs — each item with a one-click action. A Todo button in the top bar shows your open count and takes you to the list from anywhere in the app. See Todo & notifications.
  • Every resolution in one place. Each repository's Completed tab is now the full resolution record: fix pull requests in one lane, and a new Resolved lane listing everything closed without a pull request — findings you marked addressed or dismissed — with filters and the time each item was resolved.
  • Virtual Patches, on by default. Team workspaces now get Virtual Patches automatically: Hyrax studies what each audit found — and what you dismissed — and mines learned scanner patterns, scoped to your workspace, that apply at audit time without modifying any of your files. Each repository's Virtual Patches page lists every learned pattern and how it has performed, so you can turn any of them off (or back on) at any time — or switch the whole feature off in Settings. See Plans & pricing.

July 9, 2026​

  • See who changed what. Team workspaces get a Workspace changes log under Settings — a timeline of changes made in your workspace (role changes, invites, API keys, settings edits, repository changes) and who made each one. See Plans & pricing.

July 8, 2026​

  • Inactive Free workspaces pause after 90 days. A Free workspace with no activity for 90 days is now paused instead of staying live indefinitely: it becomes read-only and nothing is deleted. We email you about a week before the pause and again when it happens, and you can restore the workspace yourself with one click. Paid plans are unaffected. See Plans & pricing.

July 1, 2026​

  • See why to trust a finding. Each finding's detail page now has a Trust section: how the finding was detected, the evidence behind it, a Citation verified ✓ badge when the finding's detection query matched code in the repository at the time the finding was created, and a copyable check you can run yourself to confirm it. The findings list also gains a Category filter, so you can narrow the list to just security, performance, or any other category.

June 17, 2026​

  • New sign-in. Hyrax now uses hosted, password-free single sign-on — continue with GitHub, Google, or a one-time code sent to your email. There's no Hyrax password to set or remember, and connecting GitHub is now only about repository access, separate from how you log in. See Members & roles.
  • Two-factor by default. Every account is protected by a two-factor security floor, satisfied automatically by your verified login email — nothing to set up. You can additionally add an authenticator app or a passkey for stronger protection. See Security.

June 5, 2026​

  • Three audit depths, one per plan. The audit now scales with your plan: Free runs the Mini audit (a quick pass, up to 5 findings), Pro runs the new Standard audit (a focused 24-tool sweep across security, correctness, maintainability, performance, and dependencies), and Team adds the Full audit (the complete ~39-tool catalog, adding architecture analysis). The Run Audit button runs your plan's everyday audit — the Mini audit on Free, the Standard audit on Pro and Team; Team also gets a separate Full audit button for the complete catalog. See Plans & pricing and Workflows.

June 1, 2026​

  • First release. Connect a GitHub repository and Hyrax profiles it, audits it for prioritized findings, ships fixes as pull requests, reviews your incoming pull requests, and publishes your repo's context for AI coding tools. See How Hyrax works to get started.