Changelog
What shipped, release by release.
Tinspec updates itself — the app offers each new version on launch. These notes cover what each one changed. The build you can download right now is marked.
- v0.1.0-preview.11 current download
Agents that know which org they are in, ask for less, and keep their own record
- macOS and Linux. The Windows build waits for next month's CI minutes; if you are on Windows, this update is not offered yet and your current version keeps working.
- Choose the organization a token is for. A user in two orgs can now be tested in both: Clerk makes it the active organization, Keycloak requests the organization scope, Auth0 and Firebase get their own parameter, and your own login request or script sees {{org}}. Providers with no such concept say so instead of quietly using the default.
- Every agent send says who it went out as, and which org the token itself carries — so a 403 as the wrong org no longer reads like a tenancy bug. The Agent view shows the same, in amber when the two differ.
- Agents ask for less: a jq `select` returns only the fields they need, `bodyMode: summary` returns the shape of a body, `expect` answers pass/fail instead of the body, and long arrays and strings are clipped with every cut reported. Response headers now come back only when asked for.
- `waitUntil` polls a job until it is done — one approval for the whole poll, and only the last response comes back.
- Agent sessions: an agent opens a session (title and goal) before sending anything, and can list exactly its own requests in it afterwards. "Allow all" on the approval card lasts for that session, the Agent view groups by it, and the agent's closing summary shows up there.
- The Agent view's detail pane no longer hides its tabs and buttons against its own background, and session summaries show the path a request really went to instead of an encoded template.
- v0.1.0-preview.10
Auth that never rots, schemas that stay live, and a runner for CI
- macOS only. The Linux and Windows builds are opt-in per release rather than automatic, and were not run for this one — if you are on either, this update is not offered and your current version keeps working.
- Sign in to anything: generic OAuth 2.0 / OIDC with all four grants, PKCE and discovery — point it at an issuer and the endpoints fill themselves in — plus AWS SigV4, where picking a sender means assuming a role. Bearer, Basic and API keys can now be typed straight onto a request.
- Tokens refresh when the server says so, not when a timer guesses. A real 401 drops the cached credential and retries that one step, and records how long the token actually lived — so a provider that advertises an hour and delivers a minute stops being a mystery.
- gRPC needs no .proto: point at a server with reflection on. GraphQL needs no schema file: it introspects. Both are polled sources like an OpenAPI document, so Spec Changes tells you when an RPC gained a required field or a nullable turned non-null, and says which of your chains and overlays it breaks.
- Per-request, per-collection and per-provider send settings: timeouts, proxies including SOCKS5, mTLS, custom CA bundles, HTTP/2, gRPC deadlines and compression. Every effective value shows where it came from. A Timeline tab breaks a response into DNS, connect, TTFB and transfer.
- Assertions grew up — duration, size and cookie sources, eleven more operators, and `schema`, which checks a response against the endpoint's own declared shape. One dropdown, nothing to paste, and it follows the spec as it moves.
- Pre-request and post-response hooks with a documented `ts.*` library — hmac, sha256, base64url, jwt sign and decode. No npm, deliberately: a collection is something you pull from a teammate.
- Find in a response, filter it with the same path language chains use, diff a run against the last passing one or the spec's own example, and save a response as a named example. Chain extractions and assertions can reach into XML with XPath, which also makes SOAP and RSS ordinary.
- Talk MCP both ways: call a tool on someone else's server as an ordinary saved request, or publish your own API as tools your agent can call — each carrying a resolved provider and sender, so the agent never sees the JWT.
- Serve a mock straight from the bound spec, refreshed on every poll, and validate what your frontend sends back against the same contract.
- Settings are tabbed and searchable instead of one long scroll; API provider and folder settings too. The tab rail is legible again — it had been drawing at 9.75px.
- Twenty-one fixes found by reading the code rather than waiting for reports. Among them: a provider rule that said "no auth" was still sending the folder credential, an assert inside a split branch was checking the other branch's response, and a cloud pull silently dropped a provider's network settings.
- v0.1.0-preview.9
Paste curl with your env vars, jump to any variable, tidier navigator
- Windows: first preview build — a per-user .exe installer with the same self-updater. Not code-signed yet, so SmartScreen asks once (More info → Run anyway).
- Paste a curl that uses shell variables — $BASE_URL, ${TOKEN}, $env:KEY, %API_KEY% — and they become {{variables}}; a toast offers to add the missing names to your active environment (or a new Local one) with the value left for you to fill in.
- ⌘-click any {{variable}} in the URL, params or headers to go straight to it: path variables open the Path Vars tab, environment variables open Environments on that row (an empty row if it isn’t defined yet).
- Build prerequisites now works on independent requests too — matched to the API provider endpoint by method + path — and sits at the right of the editor tab strip, so the URL bar has the full width. ⇧-scroll pans a long URL.
- Choose which section tabs the folder panel shows (Settings → General, or right-click the tab bar); the status-bar icons keep every section one click away.
- Right-click the project folder, a collection file or a launcher project to reveal it in Finder or copy its path. Endpoint menus gain Copy response object when the last response is JSON.
- GET requests can carry a body. Fix: editing environment variables, headers or params crashed the editor in some cases.
- v0.1.0-preview.8
Simpler chains, smarter autofill, visible agents
- Build prerequisites — pick any endpoint and Tinspec plans the setup calls it needs from the spec (create the template group, then the template, then the scenario…), creates the chain with example or previously accepted bodies, and sets it as the endpoint’s pre-run. Agents get the same via plan_prerequisites and save_chain.
- Chains have a Steps view: an ordered list of editable cards with Run to here, reorder, click-to-insert {{variables}}, suggested id extractions, and validation while you type — missing requests, unproduced variables and bad extraction paths are flagged before you run.
- Fail on unresolved {{variables}} (on by default): a step or request still holding an unknown placeholder stops with an error naming it, instead of sending it literally.
- Fill from real sends — the Body autofill menu offers bodies the server already accepted for this endpoint (from your sends and your agent’s), newest and test-passing first, with secrets masked. AI autofill and agents see them too.
- History shows who sent each request — you, an agent (by name) or a chain — with a filter, plus a Chain runs group. A new Agent activity panel logs every tool call, approval decision and timing.
- Settings lists all 17 MCP tools and the resources agents can read. Extraction errors now include the HTTP status and a body excerpt.
- v0.1.0-preview.7
Agent access works with Claude Code
- Fixes for the current MCP protocol (2026-07-28): Claude Code 2.1 can now list tools, read the skill resource, and send approved requests. preview.6 connected but rejected the tool list.
- The approval card and History now name the agent (“claude-code wants to send GET /orders”) even for agents that use the new sessionless flow; Settings lists connected agents by last activity.
- v0.1.0-preview.6
Agent access — bring your own AI agent
- Tinspec is now an MCP server. Turn on Settings → AI → Agent access, copy one setup line, and your own agent — Claude Code, Claude Desktop, Cursor, … — can list endpoints, read specs, send requests, run chains and check history in the project you have open.
- Every send, chain run, or file write from an agent asks you first with an in-app approval card (⌘⇧↵ allow, ⌘⇧⎋ deny); read-only tools never prompt. Loopback only, bearer-token protected; auth tokens and environment values never leave the app.
- Agent runs show up in History tagged “mcp”, and request-level tests run on agent sends too.
- A bundled agent skill (SKILL.md) teaches agents the Tinspec workflow — served to connected agents as tinspec://skill, and installable for Claude Code from Settings with one click.
- v0.1.0-preview.5
Tests, Postman import, gRPC over TLS
- Request-level tests — a new Tests tab on every request: assert on status, headers, body paths, or variables. Results show as a pass/fail strip on the response and are kept in History. Same checks as a chain’s assert node.
- Import a Postman collection (v2.1) next to curl and HAR — folders, variables, bodies, and bearer/basic/API-key auth carry over; scripts and unsupported auth are listed as skipped.
- Paste a curl command on the empty pane (⌘V) and it opens as a new request, ready to send.
- gRPC over TLS — grpcs:// targets connect now; the “accept self-signed certificates” setting applies to gRPC too.
- Spec Changes → Copy OpenAPI: tick the changed endpoints and copy a minimal, valid OpenAPI document (YAML or JSON) for just those operations — removed endpoints are reconstructed from their last-seen shape.
- Header: an environment switcher next to the project name, and a centered “Search endpoints… ⌘K” field.
- Chains refuse WebSocket and streaming-gRPC requests up front instead of failing mid-run.
- v0.1.0-preview.4
A new brand mark
- Tinspec has a new icon: the Pipeline — two pipe elbows handing a request off to each other, on a flat teal tile. It replaces the old letter mark everywhere: the app icon (light and dark, on every platform), the launcher and Welcome screen, and the in-app mark.
- The launcher and Welcome screen drop the glow and gradient behind the mark for a flatter, calmer look.
- v0.1.0-preview.3
Tabs that remember, spec changes explained
- Every tab keeps its own state — the selected Params / Headers / Body / Auth tab, the response tab and JSON folds, Docs and Overview filters, the Chains dock and canvas position, and more all survive switching to Settings and back. Closing a tab and reopening it (or ⌘⇧T) resumes exactly where you were, last response included.
- Spec Changes now explains what changed — a modified endpoint lists each changed field, parameter, response, or body field against what you last saw, and removed endpoints keep their last-known method and path. Marking changes seen is explicit: a per-row check, per provider, or all at once; opening an endpoint to look no longer acknowledges it.
- The Response dock hides itself on pages that can never have a response (Settings, History, Environments, …) and comes back on your next request tab — without overriding a dock you closed yourself.
- Long auth sender names no longer overflow the “Send as” picker.
- v0.1.0-preview.2
LangGraph Debugger and a foldable response body
- LangGraph Debugger — agent runs are a first-class protocol. Author the input, pick stream or buffered mode, define custom fields, and read the run as a structured trace: Timeline, Messages, Tool Calls, State, and Raw, with per-run history.
- Foldable response body — the Body tab fills the dock, every JSON object and array gets a fold caret with an “… n items” summary, plus Collapse all / Expand all.
- Tunnels and spec auto-discovery are documented; the app probes well-known OpenAPI paths so a bare base URL still lands in the live-provider flow.
- v0.1.0-preview.1
Autofill, Send last, and a quieter cloud
- Autofill request bodies — a new Autofill button fills the body with realistic sample values straight from the endpoint’s schema (no AI needed); with AI Assist enabled, a dropdown adds an “Autofill with AI” option too. gRPC message editors get the same one-click refill from the proto skeleton.
- Send last from Docs — next to “Send with realistic example values,” Docs can now replay the exact request from an endpoint’s most recent run.
- Declutter the cloud surfaces — Settings → “Show cloud features” hides the account button, cloud sync, and the new Tunnels sidebar section for anyone who doesn’t want the paid tier; the app stays fully usable offline either way.
- Fixed blurry dialogs on Linux — WebKitGTK’s backdrop-blur combined with fractional Wayland display scaling made every dialog render blurry; dialogs now skip the blur on Linux.
Earlier preview and beta builds predate these notes. Something missing or broken? Tell us.