What's new, for the people using it — not a commit log.
Ogen now runs in one region, the United States (Virginia), at us.ogenhq.com. The European pod and its own database are gone; they held no customer data. The database in Virginia keeps its read replica in Frankfurt for read-only fallback, as before.
If you still use eu.ogenhq.com or ogen-eu.noproduct.com, those addresses now redirect to us.ogenhq.com, path kept. Point your MCP entry at us.ogenhq.com when you can.
Eleven tools that each did one small thing are now four that take an action: settings ("mode", "contact", "evidence", "assist"), connections ("set", "list", "remove"), webhook ("set", "remove") and reverse ("reverse", "restore"). recall_live_fact now takes keys for up to 25 facts at once. Every action takes the same fields as the tool it replaced, and needs the same role and plan. Your client lists eighteen tools instead of twenty-six.
If your agent calls an old name, it gets one sentence back naming the new call, such as set_mode was folded into settings { action: "mode", … } on 2026-09-26. See Operating your tenant.
Record is now $180 a month or $1,800 a year, up to 5 scopes. An added scope is $30 a month or $300 a year. Both are one-time payments, never a subscription: a month adds 30 days to your plan and a year adds 365, counted from when your plan now ends. Nothing renews by itself. A scope you add is priced in the unit you’re in. Your tenant page shows whether you pay by the month or the year, with Add a month and Add a year.
Record is $1,800 a year for up to 5 scopes, then $300 a year for each scope after. A scope is one kind of action with a named person who decides it — the thing an auditor asks about. Record is still free until Ogen has held 10 actions. Your tenant page shows how many scopes you use and how many your plan covers, with Add a scope when you reach the limit. If you already pay for Pro, your year carries on as Record, and every scope you have keeps working. Team and Licensed are unchanged.
Binding a source or webhook to Ogen's own address is refused, and the refusal says what to point it at instead.
If the person an action is waiting on has left, or was never reachable, you no longer have to wait out the day for the hold to expire. Register the action again naming another approver and every hold still waiting on it goes to them instead: they get the link, and any link the previous approver was holding stops working. The fact the action waits on and how costly it is to undo can’t change while it waits. Owners do this; a key running unattended is told to ask one.
Storing a named connection is refused, the moment it's set, when the address it carries is Ogen's own — the same refusal a bound source or a webhook already gets, now held before the credential is ever saved rather than only on its first live read.
Registering an action kind other than read asks you to name its approver, so a hold can never end up addressed to nobody. Register the person first, then the kind with their name; leave the name out when you re-register and whoever is already named stays named. Kinds you registered before today keep working exactly as they did.
If the record changed after the action was held, Confirm won’t go through; the page asks you to look again. Reject always works.
When a hold's link has done all the reading it can, Confirm is shown greyed out with a line saying the record couldn't be read again — instead of quietly disappearing. Reject still works.
Two numbers in the report you get back from what_it_caught were named after our own plumbing rather than after what they tell you. They now say what they count: corrections that stopped applying, and actions that waited for a person and went through afterwards. The counts themselves are unchanged, and nothing you already have stopped being counted.
That check writes a handful of throwaway rows under a one-time marker, uses them to prove a routine tidy-up behaves the way the service depends on, and removes them again. It now holds that guarantee together end to end: a step it cannot complete never sends a request built from a guess it could not confirm; the throwaway rows are cleaned up however the check ends, including a machine that stalls or a run that’s interrupted partway; one missing credential is reported once, not twice, when two parts of the same check both needed it; and a note this check prints alongside its verdict never states a conclusion the data in front of it can’t actually support.
The check that proves every function in our database is reachable only by the service itself, never by an ordinary visitor, used to ask that question only after a step our own deploy tooling never actually repeats — so a newly added function could look closed in the check while shipping open in production. It now asks the same question at the point that matches how a change really reaches production, so a gap like that can no longer pass unnoticed.
The routine tidy-up behind the public conformance fixture picks out old rows to remove and then removes exactly those. A value updated in the moment between those two steps could previously still be swept away, even though it was fresh again by the time the removal actually ran. It now re-checks freshness at the moment of removal too, so a value you just updated always survives.
Alongside it: the nightly check that watches this housekeeping now builds and sends the identical requests the service itself sends, rather than a hand-written approximation of them, and now covers removing more than one row in a single pass — closing the gap between what the check was proving and what the service actually runs.
How heavily a confirmation link may be used is that one link's business. It could still, in effect, reach further than that: anyone who merely held the link could use it up, and deciding the very same hold through your own key was then refused too. For a hold not addressed to a named approver, deciding it with your own key now always works, however many times the link itself has already been opened — a hold addressed to a named approver still needs that person's own sign-in link either way, key or no key.
Our own nightly check caught this directly: a routine tidy-up behind the public conformance fixture was asking the database to clear only a small, bounded batch of old rows at a time, and on our production database that request wasn’t actually held to that bound — one run could have cleared far more than intended. It now looks up exactly which rows qualify first, and removes only those, so the bound holds regardless of what the database itself would allow. Found and fixed the same day.
A confirm page still opens after a link has been used heavily, and a person can still reject what’s waiting from it — and confirming always reflects the value as it stands now. A hold not addressed to a named approver can still be decided directly with your own key; a hold addressed to a named approver still needs that person’s own sign-in link; or the hold simply expires on its own. Separately: if a plan had already lapsed before a chargeback landed, winning that dispute could previously hand back less time than the plan already had — a win that made things worse. Winning a dispute now only ever holds a plan steady or extends it, never shortens it.
A link that’s shared, or hammered, can no longer spend the account’s whole day. Once a link has been opened that often the page still opens and says the value couldn’t be read just now; Reject still works, and Confirm is refused until the value can be read again. Winning a payment dispute used to put back the exact period taken by writing over the date on file, which could silently erase a payment made in between; it now adds that period back on top of whatever the account already has. And the address your agent calls now checks whether your plan covers a request before it counts against today’s allowance, never after — the same order the ordinary web addresses already use.
A call refused because the key making it is not permitted to make it — a read-only key asking to change a setting — used to cost the account one of its daily calls all the same. A key that leaked could therefore spend a whole day’s allowance on things it was never allowed to do. A refusal you cannot act on is now free; a call that runs is charged exactly as before.
Confirming always reflects the value as it stands now. What the confirm page reads was the one read in Ogen nobody was charged for; it now counts like any other read, against the account whose hold it is. When the day’s allowance is gone the page still opens and says plainly that it could not read the value just now. Reject still works; Confirm is refused until the value can be read again.
And you can now revoke your own key without asking an administrator first. Anyone else’s key still takes an administrator, and an account still cannot be left with no key and no owner — but if you think the credential in your hand has leaked, the fastest safe thing is for you to retire it yourself. In the same pass: issuing a key when an account is one below its limit of 25 is decided and written in one step, so two requests arriving together can no longer both be told there is room.
Three small follow-ons. A database whose name answers with several addresses often returns them shuffled; that is the same answer, so the connection is kept instead of being rebuilt each time the order changes — the same safety check still runs, and an answer that really changes still starts a fresh connection. The routine clearing of expired rows behind the public conformance fixture used to run without ever checking whether it had worked; now a clearing the database refuses reaches us as an alert, and still never fails the request it was tidying up after. And on the status page, the oldest day of the ninety-day strip is a full day rather than part of one, so every day on the strip means the same thing — and a day that could only be read in part is shown as “no data” rather than as a figure.
A refund or a dispute now takes the year back the same way a payment granted it. Until today Ogen listened for one thing from the payment provider — a completed purchase — so a purchase that was later refunded, or charged back, left the money out of our account and the paid year running to its full term. A refund or a chargeback now ends the paid period straight away and is written into the same record the payment was, however many times the notice arrives; a dispute we go on to win puts the year back. And a purchase we refuse — the wrong amount, the wrong product, a test payment — is now recorded as refused, so sending it again later, after a setting has changed, cannot quietly turn it into a year.
In the same pass: removing the last key that can administer an account was already refused, but two removal requests arriving at the same moment could each be told the other key would remain, and both go through — leaving an account nobody could administer and no door inside Ogen able to repair it. The two requests are now decided together, so exactly one of them succeeds and an owner always remains.
Three things, all about where a request actually ends up. A held-action notice never follows a redirect to another site: your webhook endpoint is the address it was sent to, an endpoint that answers “try somewhere else” is not followed, and the delivery is reported failed instead of quietly landing elsewhere. A database you named by hostname is now connected to at the exact address the safety check cleared, on the first connection and on every later one — and if that name starts answering differently, it is checked again rather than served by the connection it had before. And the status page keeps ninety days of history and no more: the strip is now counted a day at a time in the database rather than read back one check at a time, and older measurements are removed as each new one is recorded.
Ogen isn’t open for new accounts yet. Until it is, a new account needs an invitation to your address or the access password — that goes for signing in and for the free-key form alike, and nothing changes for an account you already have. In the same pass: if you belong to more than one tenant, you now keep a live sign-in for each. Signing into a second one used to quietly end the first. Your client can name the tenant a call is for; name none and the tenant you joined most recently answers.
The record of who decided a hold — the row itself, the confirm page's "Confirmed by …", and your export — now names the approver's registered name, the same one the activity log already used. Proof of which mailbox actually clicked never left; it just no longer needs the address written down anywhere to do its job. No approver's address rests anywhere in your record any more.
Losing the connection that enforces per-minute limits used to mean every limit lifted for as long as the outage lasted. Now a per-instance limit keeps applying instead. The three endpoints reachable with no sign-in at all — requesting a free key, the contact form, and a browser's own policy reports — treat a limiter that was never configured as something to refuse against rather than run without, and the health check now reports that state plainly.
Signing up for a free key, or sending us a note through the “Talk to us” form, used to leave the network address you came from sitting in our records in plain text. It was there for one reason: a daily limit per sender, so nobody can flood the form. That limit only ever has to tell two senders apart, so what we keep now is a one-way keyed fingerprint of the address instead — comparable to another fingerprint and nothing else. Records written before today have been rewritten the same way, and the same 30- and 180-day deletion windows still apply.
In the same pass: changing the credential Ogen uses to reach its own database used to invalidate the old one the moment the new one was made — so doing it meant a brief outage, and a change that costs an outage is a change that keeps getting postponed. A new credential is now put in place while the old one is still working, and the old one is retired only after a running deployment has been confirmed healthy on the new one. Nothing you do changes either way; that is the point.
We keep a one-way fingerprint of an email address rather than the address itself — it is what lets a signup be recognised as the same person twice, an invitation be matched when you sign in, and an erasure request find every record. Until today that fingerprint was computed a way anyone could repeat: someone who could read it and already had a list of addresses could work out which of those people we knew about. It is now computed with a secret only the service holds, so the same list tells them nothing. Nothing changes for you — your keys, your history and your tenant stay exactly where they are, records written earlier are updated the first time they are looked at, and erasure still reaches all of them.
Three things that belong together. The endpoint your agent talks to has had a per-minute limit for a while; the ordinary web addresses your own tooling and your account page call had none — including the one that makes Ogen go out and read a source you bound. They all carry the same limit now, counted per credential, so a fleet of workers gets its own budget instead of sharing whatever address they sit behind.
If you belong to more than one account, every one of those addresses now honours the header that names which account a call is for — the same header the tool endpoint has always read. Until today they answered as whichever account you joined most recently, so your account page could show one and read another a moment later. It stays a hint, never a grant: naming an account you hold no key in reaches nothing of theirs. Your account page sends it for whatever account it is showing, and takes ?tenant= in its own address so a link can open a particular one.
And an account can no longer be stranded. Revoking the last key that can administer it is refused, the way revoking your last key already was — issue another administrator key first. In the same spirit, an invitation that creates a brand-new account now always makes you its owner, whatever role the invitation named: that role is for joining an account that already exists, and an account nobody can administer is one nothing inside Ogen could repair.
When a hold is decided, the activity line now shows the approver's registered name — the same name you registered the action against — instead of their email address. And the record of whether their daily summary already went out today no longer keeps their address at all: it keeps a one-way fingerprint of it, which is all that record ever needed to tell one approver from another. Nothing you do changes. Summaries still go out once a day on that person's first touch, an address typed differently still means the same person, and rows written before today are migrated.
Ask us to erase your data and it is now handled in one pass across every place an address can be — anything you sent through the contact form, a key you asked for, an invitation, a signed-in identity, an address registered so a hold could reach you, and the notices sent to it — in both regions. Where a record has to survive for its own sake, such as an entry in the activity log showing that something happened, the address is removed from it rather than the record being dropped.
Before it tests anything, the nightly run now compares what each region’s database has actually had applied to it, against the other region and against this build. A region that is behind, or out of step with the other, raises the same alert a failing probe does.
Ogen answers at two kinds of address: the tool endpoint your agent connects to, and the ordinary web addresses your own scripts and your tenant page use. The free plan's daily allowance was only ever counted at the first of those, and a few of the second checked less than their tool equivalent did — one would hand a free plan the evidence export that Pro includes, another let a read-only key spend the account's one free trial. Every door now asks the same four questions in the same order: is this account closed, may this key do this, does this plan include it, and does it count against today's allowance. Adding a new door without them now fails the build's own checks.
The allowance itself moved too. It used to be counted per key, so issuing yourself a second key quietly issued you a second allowance; it is now counted per account per day, whichever key and whichever door the call came through. An account may hold up to 25 live keys at once — revoke one to make room — and issuing a key is rate-limited the way the signup form is. Signing in again reuses the key your identity already has instead of issuing another.
Recording that a payment happened and granting the year it paid for were two separate writes. If the second one failed, the first had already gone in — so the payment read as handled and the year was never given. They are now one step: both land, or neither does. A repeated notice from the payment provider still cannot extend a year twice, and a payment that was left half-applied before today completes itself the next time that notice arrives.
Two things around it, in the same pass. Paying — or starting a trial — now cancels a deletion you had scheduled, so a purchase can never be undone by a purge you changed your mind about; and starting a purchase while a deletion is pending is refused, naming the one call that cancels it, rather than taking money for a year that is about to be deleted. Separately, the Ogen Assist daily allowance now holds under simultaneous requests: it used to be counted and then written as two steps, so several requests arriving at the same moment could each be told there was room.
Ogen keeps the key a running process holds apart from the person who administers a tenant. A process can bind a source, teach a fix and commit an action all day; only an administrator changes where a hold goes, which actions need a person, or whether holding is on at all. Until today a key with only the first kind of permission could connect a personal sign-in and come out the other side with the second — so a key that leaked was worth more than it was ever meant to be. Connecting a sign-in to a tenant is now an administrator's act, and a key without that standing is told plainly to ask an administrator or to accept an invitation instead. Two settings that install something every later action then rides on — where notices are sent, and turning the drafting assistant on — moved to the same footing. In the same pass, a key restricted to part of your records can no longer reverse or reinstate a correction belonging to the rest of them. Nothing changes for a tenant with one owner key, which is most of them.
Loading the public status page used to make Ogen reach out to its payments and email providers, write a row, and run housekeeping — once per visitor, every visit — so anyone refreshing it was spending the service's own budget. The page now shows the last recorded measurement, and the checking runs on its own five-minute schedule; the page still says exactly when it was measured, so a stale reading is visible as one rather than hidden. Every remaining public endpoint that had no per-minute limit has one now — the status page, the sign-in form on our gated pages, and the test source the public conformance suite writes to — and the payments webhook refuses an oversized body before reading it.
Whenever Ogen reaches out to something for you — reading a source you bound, delivering the notice that an action is waiting, or opening a connection to a database you named by hostname — that request is now checked against the same rule, in the same place, every time. Where a name is involved we check where it actually leads, not just how it is spelled, and we connect only to the address we just checked. And if one of those places answers "go and ask somewhere else instead", we look at where it is sending us before going, and your credential does not travel to another site.
A check that has quietly stopped checking looks exactly like a check that keeps passing. Three of ours had, and all three are fixed. The nightly backup worked from a hand-kept list of what to copy, and that list had fallen behind what we actually store — including the encrypted credentials for the sources you have bound. It is now derived from the store itself, so anything we keep is in the backup or the build refuses to pass, and the restore rehearsal exercises the fuller set.
The check that stops a credential ever reaching our code repository was examining the wrong commits whenever a branch was pushed from anywhere other than the one currently open — a green tick for a range nobody was sending. It now examines precisely what is being sent. And the nightly test run could fail without saying so: if it crashed early, or its alert could not be delivered, the night looked clean. It now records every run, and the weekly summary reports when it last ran and how it went, so a job that has stopped running turns up within the week rather than whenever someone next thinks to look.
If the email carrying your free key failed to send, asking again used to just tell you "already issued" — with no way to actually get one. Asking again now sends a fresh key instead; the one that never arrived stops working the moment the new one goes out.
Three smaller things landed alongside it: a very long list of open holds is now capped, and says so when there's more than what's shown; the tenant page and the proof page now announce what just happened to a screen reader, not only to the eye; and, behind the scenes, the drill that proves a backup can actually be restored now runs itself once a month instead of only when someone remembers to.
Sending a fresh key when the first one never arrived, above, went one step too far: asking again for an address whose key had arrived also replaced it. That made the free-key form a way for anyone who knew your address to take away the key you were working with and mail you a new one, over and over. An address whose key arrived is now told, as before, that it already has one. Only a key that never arrived is sent again — at most three times a day for any one address, each of them counting against the daily limit of whoever asked.
On the money side: a completed purchase used to be granted a Pro year on the strength of naming an account, whatever it was for and whatever it cost — including nothing, and including a test account. A year is now granted only for a live purchase of the Pro year itself at its real price; anything else is refused, recorded on that account's activity log, and raised with us. A payment we cannot record is retried rather than quietly reported as handled. And if you ask for many facts at once with your day's free allowance nearly spent, you now get answers for as many as the allowance covers, and a plain "the allowance is used up" for the rest, instead of being charged for all of them and answered on none.
Any change to the rules the record itself enforces is now run against a real database, not a stand-in, before it can reach the pod that serves you — twice, not once, so passing on the first try is never taken as proof by itself. And when a payment dispute goes your way, the period you get back is exactly the one you had already paid for — not a fresh term, not a guess at one.
Three tools for managing a named, reusable credential were live and callable, but this site’s reference page hadn’t caught up to them yet. It now lists all of them, alongside every other tool.
New in the docs: point Ogen at a plain Google Sheet — a customer list, an order tracker — from Claude Desktop or Cursor with nothing but a free key and a sentence typed in chat. Ask for a fact and get one answer, every disagreeing row at once, or a plain "nothing there." Edit the sheet and ask again — the answer changes immediately.
Your tenant page now shows how long each decided hold actually waited for a person, plus a running median, 95th percentile and longest wait over the trailing 30 days. The weekly digest carries the same summary for the week just passed.
The pages with no per-request handler to weave a per-response protection into (about, privacy, security, status, terms) previously only reported what a policy would have blocked. They now actually block it, with no loosening anywhere it wasn't already needed.
The email address you register for a named approver is now stored encrypted, under the same key that already protects your source credentials and your own contact address. Nothing you do changes: registering an approver, the hold notice that reaches them, and the sign-in link all work exactly as before, and the address is still never returned to a caller or shown on a page.
The public memory-conformance suite now runs every night from outside the pod against both us.ogenhq.com and eu.ogenhq.com, each with its own dedicated key. A failure or an incomplete run sends one email naming what went wrong; a clean night sends nothing. First run: us.ogenhq.com 12 of 12 passed; eu.ogenhq.com is skipped until its own database credential is added.
New tool: recall_live_facts takes 1 to 25 keys and answers each one exactly as recall_live_fact would — independently, so one unresolved key never changes another's answer. Every key goes through exactly the same checks and the same live read as a single recall — once each, in one round trip instead of many.
Switching a tenant to observe mode now requires an explicit acknowledgement — before, it was one field, the same shape as switching it back. Doing it also tells the tenant's contact who flipped it and when, and every action result and the tenant page now show plainly which mode is in effect.
Registering an action or its approver, switching gate/observe mode, setting up or removing a connection or webhook (removing one now travels with adding one, for symmetry), and minting a key or inviting someone, all now need an owner key or a signed-in person. A day-to-day operator key keeps doing everything it did before for ACTING — binding a source, teaching a fix, deciding a hold, committing a gated action — it just can no longer reconfigure the tenant on its own. Every key minted before today is an owner key, so nothing changes for existing tenants unless you've already handed out a narrower one.
Add https://us.ogenhq.com/api/mcp to Claude Code, a claude.ai custom connector, Cursor or any MCP client with OAuth — no key to paste. You sign in with your email, approve once, and the client is connected as your tenant. A signed-in person shows up in your key list as a signed-in row and is revoked like any key. Keys keep working exactly as before for scripts and bridges.
Ogen now speaks 16 MCP tools:
recall_live_fact, commit_gated_actionregister_action, register_approverbind_sourceteach_fix, reverse_action, restore_fixwhat_it_caught, audit_logset_mode, set_contact, register_webhook, remove_webhook, set_evidence, export_evidencebind_source now reads six kinds of live source: a plain https endpoint, a PostgREST/Supabase table, an Airtable table, a Google Sheet, a HubSpot object, or a tool on another MCP server. That last one means any MCP server your team already runs can become an Ogen source.
Switch a key to observe mode and commit_gated_action never holds or fires anything — it only tells you what it would have caught. Flip back to gate mode when you're ready for it to act for real.
Turn it on and every recall leaves behind a fingerprint — never the value itself — that you can export and verify offline against your own secret.
Register a named approver and a held action emails them directly, alongside the confirmation link. Register a webhook and the same "held" moment posts to your own endpoint too, signed so you can verify it came from Ogen.
List, mint, and revoke additional keys for your tenant without leaving your MCP client — no dashboard required.
The full tool contract now has its own docs site. A status page shows current reachability plus 90 days of daily uptime. A new security page lays out what crosses the wire, what's stored, and how credentials are protected.
Point any MCP-speaking client at https://us.ogenhq.com/api/mcp and read live facts, gate actions on them, and see the proof — no SDK install, no local code.
Request a key with your email and it arrives in your inbox — never shown on the page, one per address. Every new key starts with a demo source already bound, so the first call has something real to show.
A live proof page shows what Ogen caught, no key required. A public conformance suite now lives in its own repo, so anyone can test any memory server against the same contract — not just this one.