Platform Changelog

Follow product changes across intelligence coverage, Chat, API access, and platform operations.

Current release: October 27, 2026Copy Anchor Link

Y2 Intel MCP 0.4.0 at mcp.y2.devCopy Anchor Link

The hosted connection for Claude, ChatGPT, and other assistants now runs at https://mcp.y2.dev/mcp. The local server is version 0.4.0 on npm.

• Reconnect hosted assistants. Connections to the earlier workers.dev address no longer work. Remove Y2 Intel from your assistant, then add it again with https://mcp.y2.dev/mcp.
• Node.js 24.22.1 or later. @y2-intel/mcp 0.4.0 requires Node.js 24.22.1 or later, or 26.12.1 or later. Earlier Node.js releases have known security vulnerabilities.
• Every published API operation. The local server has typed tools for all 78 published operations, including disclosures, DNS snapshots, and the change feed since start time. Write tools stay off unless you set Y2_MCP_ENABLE_WRITE_TOOLS=true.
• Smaller install. The npm package installs only the MCP SDK, yaml, and zod.

Connect through MCP → · Local MCP server →

October 26, 2026Copy Anchor Link

Military aircraft tracking returnsCopy Anchor Link

Live military aircraft are back on the Situation Room map and in the API, now sourced from the adsb.lol community ADS-B network (ODbL 1.0) instead of Wingbits.

• One request, every theater. Every 15 minutes Y2 reads every aircraft the ADS-B database flags as military, classifies the type (tanker, AWACS, fighter, bomber, and more), and assigns the smallest enclosing theater. Positions refresh in place and expire after 30 minutes.
• Posture for nine conflict theaters. /osint/military-posture assesses iran, blacksea, taiwan, israelgaza, emed, redsea, scs, korea, and baltic with a strike-capability read and counts by type.
• Click down on the map. The aircraft popup shows registration, type code, squawk, altitude, speed, and heading, and opens the aircraft on adsb.lol.
• Positions stay ephemeral. Only bombers, AWACS, reconnaissance aircraft, and emergency squawks become durable observations in the graph. Routine positions are not retained.
• API provenance. /osint/aircraft rows now carry registration, typeCode, squawk, SI units for altitude and speed, and a source linking to the aircraft on adsb.lol. Posture rows carry a computed source.

Wingbits is retired. GPS interference collection, which depended on it, is paused: the /osint/gps-jamming operation returns an empty collection with sourceStatus: unavailable, and the map layer is off by default until the feed is re-sourced.

Aircraft tracks → · API reference →

URLhaus restored and cyber threats with provenanceCopy Anchor Link

abuse.ch retired its anonymous URLhaus downloads on October 21. Y2 now reads the authenticated URLhaus API, so malware URL indicators flow again.

• Provenance on every cyber threat. /osint/cyber-threats rows carry source, observedAt, temporality, confidence, and provenanceTier, matching the rest of the observation contract. Provider rows still never expose the malicious URL, only the provider report page.
• Start the change feed at an instant. /api/v2/changes accepts since (RFC 3339 or Unix milliseconds) for a first read; resume with the watermark afterwards.
• Partial knowledge results are labeled. Global knowledge retrieval returns meta.availability with complete or partial and the corpora that answered.

Cyber threats → · Change feed →

October 16, 2026Copy Anchor Link

Cyber DNS ExplorerCopy Anchor Link

Look up a domain from Cyber → DNS Explorer to see its subdomains, mail servers, and name servers. The page also shows the addresses that each host resolves to and the networks that announce them. Y2 collects each answer from DNSDumpster and keeps it with the time that it arrived.

• A footprint map. The map shows the domain, one hub for each record type, each host, and each address. Addresses appear in groups under their network (ASN) with their netblock. Move the pointer over a host to see where it resolves. Tables list each record with reverse DNS and the HTTP and TLS banners seen on the address.
• Dated history. Each snapshot keeps its capture time. Open an earlier snapshot to compare it. A badge shows whether the records changed since the previous snapshot.
• One answer for 14 days. A domain that anyone looked up in the last 14 days opens from the saved snapshot. It does not use a lookup. Pro includes 5 new lookups a month. Elite includes 1,000.
• Mapped into the graph. The domain, hosts, addresses, and netblocks join the ontology. Network operators attach to companies that Y2 already tracks, such as Cloudflare. A company whose official website is the domain is linked as its operator. Each connection records when it was first and last seen. Open the domain in Explorer and add it to a Project.
• API, MCP, and Agent Y2. POST /api/v2/cyber/dns/lookups and GET /api/v2/cyber/dns/snapshots use the intel:cyber scope. The local MCP server calls them through y2_call_api. Agent Y2 can look up a domain or read its history in chat.

DNS Explorer requires a Pro or Elite workspace. Free-tier records include up to 50 A records for each domain. A larger domain is marked as truncated.

Look up a domain's DNS footprint → · DNS footprints in the graph → · API reference →

SEC filings, insider trades, and federal awardsCopy Anchor Link

Financial Intelligence now covers what public companies and the U.S. government disclose about themselves. Y2 reads SEC EDGAR twice a day and USAspending.gov once a day. Every company, insider, agency, and award recipient joins the same entity graph as the rest of your intelligence.

• Four new pages. Filings lists Form 8-K material events by their most material item. Insiders lists Forms 3, 4, and 5 from officers, directors, and 10% owners. Stakes lists Schedule 13D activist stakes. Awards lists federal contract actions of $5M or more and grant actions of $10M or more.
• Screening. Filter by category, severity, time window, and minimum amount, sort by size, and search by company, ticker, insider, agency, or recipient. Filters stay in the page URL, so you can share a screen.
• Primary records. Each row opens the full record: 8-K items, every insider transaction line, 13D reporting persons, or award details. Each row also links to the SEC filing or USAspending award page.
• One entity per company and person. Y2 matches issuers and insiders by SEC CIK and award recipients by Unique Entity ID. A new name is checked against existing entities before Y2 creates one. A contractor that also files with the SEC is one entity.
• A graph that builds over time. Officers and directors connect to their company. Contract and grant recipients connect to the awarding office. Each connection records when it was first and last evidenced. Explorer and entity profiles show each filing and award as an event tied to every party it names.
• Companies. Each company in Markets lists the disclosures that name it. The SEC filing import fills in the CIK that EDGAR recorded.
• API, MCP, and Agent Y2. GET /api/v2/disclosures returns the same records with ontology entity IDs. Integrate on each page shows the request for the rows you loaded, as curl, TypeScript, Python, or an MCP call. Agent Y2 can screen disclosures in chat.

Disclosures require a Pro or Elite workspace. API keys and MCP connections need the new intel:disclosures scope. Existing keys do not gain it automatically.

Screen disclosures with the Intel API → · API reference →

More resilient intelligence updatesCopy Anchor Link

• Large intelligence feed updates are saved in smaller groups so new observations can continue updating without exceeding processing limits.
• Events with an unfamiliar source category remain available under Other instead of stopping the rest of the update. Location, evidence, and confidence checks still apply.
• If a later group cannot be saved, observations from earlier groups remain available and the affected source can try again during its next refresh.

More resilient report completionCopy Anchor Link

• If one writing path cannot accept the report format, Y2 tries supported alternatives. The report can finish from the same collected evidence.
• This applies to reports generated after the update. Reports that already ended in failure remain unchanged and may still need to be retried.

More reliable report and signup deliveryCopy Anchor Link

• A report no longer repeats its full generation cycle when a saved delivery channel has no reachable contact details. Other recipients can continue receiving the report.
• Signup reminder emails can be prepared and queued without interrupting the scheduled reminder.
• An unreachable recipient still needs updated delivery details before they can receive a report. Earlier failed reports and reminders are not sent again automatically.

More dependable connected intelligence and Project EvidenceCopy Anchor Link

• Placeholder identifiers no longer interrupt connected-intelligence updates for unrelated products or assets.
• Project Evidence can show lineage details for linked reports and other supported records.
• Existing identity conflicts still require review and are not combined automatically.

October 15, 2026: One entity for each real-world thingCopy Anchor Link

Name variants such as U.S. Department of Defense and US Department of Defense, or AU and Australia, now resolve to a single entity. Graphs, profiles, and connected intelligence no longer split the same organization, agency, or country across duplicate nodes.

Fewer duplicate entitiesCopy Anchor Link

• Explorer graphs and entity profiles show one node after duplicates are combined. This includes duplicate country nodes that appeared in some graphs.
• New mentions from reports and enrichment attach to an existing entity when Y2 is confident they describe the same thing. People, organizations, threat actors, and other higher-risk kinds also need an independent second check before they attach.
• Uncertain matches stay separate and are held for review instead of being combined. Entities with conflicting identifiers, such as different registry or ISO codes, are never combined.
• CVEs and indicators continue to match only on their exact identifier.

Reviewed, reversible cleanup of existing duplicatesCopy Anchor Link

• Existing duplicates are combined in reviewed batches. The earlier entity stays as a redirect to the surviving one, so saved links and references keep working.
• Relations, incidents, and observations move to the surviving entity, and every combination can be reversed.

Read how Y2 resolves entity identity → · Read the October 2026 release notes →

Previous releasesCopy Anchor Link

Earlier release notes are grouped into monthly archives. Each link opens the full release entry.

September 2026Copy Anchor Link

• September 17: Private chats, conversation controls, and reliability
• September 14: Project intelligence PDF exports
• September 12: More complete monitoring and higher Elite limits
• Report and intelligence reliability
• September 1: Elite workspace usage and API key activity

View the complete September 2026 archive →

August 2026Copy Anchor Link

• August 25: Native WebMCP support
• August 22: MCP expands agent access
• August 7: Reliable API results, safer access, and updated plan limits
• August 5: Connected Explorer, Documents, and Project Evidence

View the complete August 2026 archive →

July 2026Copy Anchor Link

• July 30: Privacy, product platform, and installed-app foundation
• July 24: Projects, Automations, and workspace governance
• July 21: Global coverage, Chat updates, and Pro API keys
• July 17: Y2 Affiliate Program
• July 10: Privacy-first Chat and connected intelligence
• July 8: Agent Y2 API, OpenAI-compatible Chat, and MCP

View the complete July 2026 archive →

June 2026Copy Anchor Link

• June 30: News Terminal, Lite trial signup, and platform reliability
• June 18: Chat reliability, OSINT Monitor, and landing performance
• Y2 Elite B2B, Organization Workspaces and Intel API v2

View the complete June 2026 archive →

March 2026Copy Anchor Link

• Y2SOURCE Event Provenance Engine
• Profile Sharing Defaults
• Situation Room Map Enhancements

View the complete March 2026 archive →