Clear receipts, safer connections

A calmer confirmation

Capture receipts now use Miracle's compact dark-glass language, with a clear destination, a readable task title, and distinct success, warning, and error tones. Long titles stay tidy on screen while remaining fully available to assistive technology.

Connections that verify cleanly

Claude Code and MCP Inspector can now complete their approved local OAuth callbacks, while browser-based connections receive stricter origin and host protection. All 37 tools expose client-compatible public schemas without weakening the server's validation.

One credential, one job

Inbox URL secrets can now only capture into Inbox. REST and MCP use the separate API token in Settings under AI tools, or a scoped OAuth connection. Replace any older connection that reused an Inbox URL token.

Evidence that cannot bluff

Connector review evidence now binds to the exact MCP release, Git commit, Railway deployment, production health result, and 37-tool descriptor. A client run must be fresh, complete, tied to the dedicated reviewer, and cleanly reversed before it can be called Pass.