Changelog

The /billing hard-cap panel let you configure a per-meter spend ceiling that nothing read. Setting a limit there changed no behaviour: traffic was not blocked at it, and usage above your plan was not billed against it. It has been replaced.

Metered overage is opt-in and off by default. Turn it on, name a limit, and usage above your plan's included allowance keeps working and is billed at the rate card — up to the amount you set, and no further. Leave it off and nothing above your allowance is ever billed; that is unchanged from today.

• The number you set is the number enforced. It is the value the server compares your accrued metered cost against before each call.
• Your plan bounds it. Starter authorizes up to $5,000 per period, Growth up to $25,000; Enterprise is uncapped.
• Lowering it takes effect immediately — including below what you have already used, which stops further metered usage at once. You are still billed for what you actually used; the limit is a ceiling on new spend, not a refund.
• Any amount you had typed into the old hard-cap panel is carried over and pre-fills the new limit field. It is carried over switched off: the old setting meant "don't let me spend past this", the new one means "do bill me past my allowance", and we will not read the first as consent to the second.

Writes still require a master key — an agent key cannot raise the ceiling it runs under.

Correction (2026-08-05): the outbound-call sentence below is wrong in the same way as the Starter repackage entry — calls were never metered per-call, and the 1,000/mo figure is Growth's anti-abuse ceiling, not a withdrawn allowance. See that correction. The original entry follows unedited.

---

Two tiers repriced and one retired:

Starter — now $19/mo (was $29): 25,000 emails/mo (up from 10K), 25 GB storage, and email support. SMS, voice, phone, vault, and domains are unchanged.

Growth — now $199/mo (was $99): 250 agent identities (up from 100), 10 phone numbers (up from 3), 250,000 emails/mo (up from 100K). SMS included trimmed to 500 out + 500 in (from 5K), and the bundled outbound-call allotment is dropped — calls are metered per the rate card.

Scale is retired. It's no longer offered on the pricing page. If you're already on Scale, your plan and limits are unchanged; you keep everything you have.

Correction (2026-08-05): this entry said outbound calls became metered at $0.03 per call. They did not — per-call metering was never built, so no per-call charge has ever appeared on an invoice, and that rate has been removed from the rate card. The 250/mo figure was not withdrawn either: it remains what it always was, an anti-abuse ceiling that refuses the next dial rather than billing for it (Starter 250/mo, Growth 1,000/mo). What a call costs is its minutes. The original entry follows unedited.

---

Starter ($29/mo) moves to a lower included base with pay-as-you-go overage. What changed:

Included quotas adjusted:

• SMS: now 50 out + 50 in / mo (was 500 + 500)
• Voice: now 50 min Basic (was 100 Basic + 10 Premium)
• Custom domains: now 10 (was 3)

Removed:

• The 250 bundled outbound calls / mo. Outbound calls are now metered per the rate card ($0.03/call).

You can buy more SMS, voice, and other usage at the published rate-card prices — there's no hard wall on Starter. Email (10K/mo), phone number (1 included), and vault (500 credentials) are unchanged.

The Free plan is now built around email, vault, and MCP instead of a thin slice of every channel.

Added to Free:

• 3,000 emails / mo (up from 100)
• 5 GB attachment storage
• Credential vault: 3 vaults, 10 stored credentials
• Still no credit card required

Removed from Free:

• Phone numbers, SMS, and voice — these now start on Starter ($29/mo)

If you're on Free with a provisioned phone number, the number stays attached and inbound keeps delivering, but outbound SMS and calls now return 402 with an upgrade link. Nothing is deleted.

Attachment blobs now persist to Google Cloud Storage instead of instance-local disk, and downloads stream through the API at /v1/.../attachments/{id}/stream. The streaming endpoint enforces agent scoping and refuses any attachment whose malware-scan verdict is BLOCKED. This fixes the getAttachmentUrl 500 some orgs hit — attachment URLs were relative paths on ephemeral storage that didn't survive a deploy. Bodies now survive restarts, deploys, and scale-out.

Two fixes from a customer-report sweep:

• GET / (bare root, no path) hit an unhandled error path that could crash the API process — the source of intermittent 503s. Now returns a clean response.
• /openapi.json 500'd due to a contract-level security parameter mismatch; the generated spec is back and accurate.

Also landed in the SDK repos: the published Go, Node, and Python SDKs were sending bare paths (missing the /v1 prefix) and getting Route not found — all three now target https://api.useanima.sh/v1 correctly. Go v0.2.0 is live; Node and Python releases are rolling out.

Closed the class of failures where an inbox received mail but the platform couldn't fetch it (auth 401 against the mail store despite a healthy-looking account). Root cause: the mail server intermittently left a new account's auth index unwritten at creation.

Three layers shipped:

• Create-time verification — account creation now probes a real login before returning; on failure it recreates (up to 3×) or throws loudly. Bad accounts can no longer enter the fleet.
• Detection — a scheduled auth-health job logs in as every mailbox every 30 minutes and reports any that fail.
• Auto-repair — failing mailboxes are re-keyed in place automatically (rename fallback if needed). Breaks self-heal within 30 minutes without an operator.

Every attachment — inbound and outbound — now runs through malware scanning. Download endpoints check the verdict before serving: BLOCKED attachments are never handed to an agent or a human, PENDING ones wait. Scan status is visible on the message. This closes the "agent forwards a poisoned attachment" path.

Webhook endpoints can now require auth and shape delivery rate:

• Endpoint auth — attach a basic-auth pair, bearer token, or custom header to every delivery, so your receiver can reject anything that isn't Anima.
• Delivery throttle — per-endpoint rate limit; bursts queue instead of hammering your receiver.

Shipped across the API, the MCP webhook_set tool, the CLI, the console create/edit dialog, and the docs (with SDK examples for both features).

Inbox addresses with dots in the local part (inspections.acme@...) are now stored the way Gmail does it: the dot-stripped form is the canonical account, the dotted address the customer asked for is kept as a delivery alias. Both receive mail; auth is always against the canonical form. Dotted inboxes previously could hit an auth edge case that made their mail unfetchable.

• Every webhook now carries a timestamp-bound HMAC signature (v1 scheme); verify it to reject spoofed or replayed deliveries.
• The signing secret is revealed once at creation and never again on read paths; a rotate endpoint issues a new one.
• Webhooks gained an active toggle — pause delivery without deleting the endpoint.
• Auto-forward on inboxes now works for every inbox type — inbound mail forwards to the configured address regardless of how the inbox was created.

After two same-day email outages, the channel got a monitoring spine:

• Round-trip canary — a dedicated org sends and receives a real email every 15 minutes in production; failures alert before customers notice.
• Loud inbound drops — every path that discards an inbound email now emits a reason-tagged event; silent drops are gone.
• Drift scan — a read-only job that cross-checks every inbox against the mail store and flags mismatches.
• Startup guardrail — the worker refuses to boot into a configuration that would silently skip identity verification.
• Platform-default-domain identities (*@agents.useanima.sh) are verified automatically, fixing a state where fresh agents couldn't send.

Inboxes created directly from the console (not through an agent) silently dropped inbound mail — the receiving pipeline only resolved mail through agent email identities. Standalone inboxes are now backed by the same identity plumbing as agent inboxes, so inbound mail lands. A drift-aware reconcile job diagnoses and repoints any existing inbox whose mail-store account went missing or stale.

Retrying a failed request can no longer double-send:

• Email and SMS sends are idempotent server-side — a retry of the same logical send is deduplicated even if the first attempt's response was lost.
• The Idempotency-Key header is now honored across instances (Redis-backed), so replays hit the cached response no matter which node serves them.

A full-codebase security audit produced a batch of fixes, all shipped together:

• Closed cross-agent and cross-org access paths on vault TOTP reads and scoped-token minting.
• SSRF guard on every outbound fetch the platform makes on your behalf (webhook delivery, OAuth token refresh, URL-sourced attachments) — one shared, hardened implementation.
• Webhook signature verification hardened: replay window enforced, fail-open path removed, constant-time comparison.
• Agent keys are strictly self-scoped on voice and scoped-token read endpoints.
• Org roles are exact-matched (a crafted role name can no longer escalate).
• Vault operations fail closed if the encryption key is missing; inbound carrier webhooks fail closed if verification credentials are unset.
• Auth hot path got dedicated key-hash indexes — security *and* a latency win.

GET /v1/orgs/me previously returned the raw org settings object, which included fields an agent-scoped key has no business reading (internal verification material, owner contact details, billing identifiers). The response now passes through a default-deny allowlist — only explicitly public settings are serialized, so new sensitive fields can't leak by default. No evidence of exploitation; fixed the day it was found.

SMS to supported European destinations now arrives from the alphanumeric sender "Anima" instead of an anonymous long code. Routing is automatic per destination country; replies and OTP flows on numbered routes are unaffected.

Secure-note credentials now round-trip through the vault with their full payload. Store free-form secrets (recovery codes, config blobs, instructions) alongside logins and API keys.

Outbound delivery moved from AWS SES to Resend. Bounce and complaint webhooks are wired into the suppression pipeline, and per-mailbox receiving auth got a hardening pass in the same push. Deliverability reporting continues to flow into the same usage rollups.

The server-side voice conversation loop (attach it by passing agentConfig on call.create) is now a real agent runtime:

• Tool calling — streaming tool-use for Anthropic and Gemini models, dispatched mid-call without breaking the audio loop.
• Memory — per-agent recall / remember tools; the agent carries context across calls.
• Knowledge base — knowledge_base_search backed by an ingest endpoint; ground answers in your documents.
• HTTP — generic http_get / http_post tools (SSRF-guarded) for hitting external APIs mid-conversation.
• LLM tokens stream straight into speech chunking, provider + model are env-selectable, and dead-air paths speak a recovery line instead of going silent.

Outbound email now carries List-Unsubscribe / List-Unsubscribe-Post headers (RFC 8058 one-click), and every send checks the suppression list first — unsubscribed or bounced recipients are never mailed again, no matter what the agent asks for. Keeps agent traffic inside Gmail/Yahoo bulk-sender requirements by construction.

• Pass agentConfig on call.create and the platform runs the conversation loop server-side — STT → LLM → TTS on our infrastructure; your process just watches events.
• WebSocket voice accepts user-bound auth (OAuth and scoped tokens), reads agentId from call.create, and buffers pre-auth messages so a fast call.create isn't dropped.
• call.ended now includes a per-turn latency snapshot — STT, LLM, and TTS timings for every turn of the call.

Every new org now gets a real $0 Free subscription at signup (not an unbilled limbo state), which auto-cancels the moment an upgrade checkout completes — no double-billing window, no manual cleanup. Plan changes are now discoverable in the console sidebar.

One endpoint returns the org's month-to-date usage across email, SMS, voice minutes, and phone numbers — the same numbers billing meters against. Read-only, works with any key type.

email_send accepts attachments two ways: inline base64 or a URL the platform fetches server-side (SSRF-guarded — private ranges and metadata endpoints refused). Size and count limits enforced per message.

A dedicated latency push on the voice pipeline:

• Backchannel by default — the agent acknowledges ("mm-hm") while the LLM is still thinking; per-call opt-out.
• Per-call end-of-turn thresholds — tune how aggressively the agent decides you've finished speaking.
• New engine options: Speechmatics STT, Telnyx Ultra TTS, Deepgram keyterm boosting for domain vocabulary.
• Carrier-path optimizations shaved the round trip further.

Net: perceived response latency under 300ms on the basic tier.

Compose now, send later: email_draft_create / list / get / delete / send across the API and MCP. Drafts hold recipients, body, and attachments — the human-in-the-loop pattern where an agent stages mail and a person approves the send.

Agent identity documents moved from the custom did:anima: method to standard `did:web:`. Every agent's DID now resolves at https://agents.useanima.sh/{org}/{agent}/did.json with any off-the-shelf DID resolver — no bespoke method support required to verify an Anima agent.

The browser extension dropped pasted API keys for the full OAuth flow — consent opens in a real tab, tokens are agent-scoped, and the popup shows exactly which agent is connected. The websocket bridge authenticates with the same tokens (per-session HMAC key negotiated at auth:ok).

• Identity management API — create, list, and remove email identities per agent; pick the sending identity per message with fromIdentityId.
• Verification you can trust — the verified flag now reflects the provider's actual state (queried live, errors translated), a background worker promotes identities the moment DNS verification completes, and agent creation refuses domains that can't deliver rather than minting a broken agent.
• `/v1/orgs/me/workspace-health` — one call, no master key required, reports every identity's real deliverability state with remediation hints.

All routes now mount under a single server-side /v1 prefix — the base URL is https://api.useanima.sh/v1, and contract paths stay clean. One prefix, applied in one place, instead of per-route path strings.

Anima is now a full OAuth 2.1 provider, built for MCP clients and human consent:

• Consent UI — connect.useanima.sh renders exactly what an app is asking for, scope by scope; authorization rides the signed-in session, never a pasted key.
• `/v1/oauth/token` — authorization-code + refresh grants, with refresh-token rotation and reuse detection (a replayed refresh token revokes the whole chain).
• Dynamic Client Registration (RFC 7591) + .well-known discovery — MCP clients self-register and connect with zero manual setup.
• `/v1/oauth/userinfo`, app management endpoints, and WebAuthn step-up for high-risk approvals.

• Scoped tokens (stk_*) — mint a short-lived JWT carrying a narrowed scope set from a master or agent key. Hand a sub-process exactly the capability it needs, nothing more; scopes can only narrow.
• Webhook DLQ — deliveries that exhaust retries land in a dead-letter queue with glob-filtered replay (email.*), a full replay audit trail, and security events on poison payloads. An operator surface closes the loop.

The full vault smoke-test battery ran green from /admin/vault-verify:

• connectivity — 19ms (bw-serve reachable, vault unlocked)
• round-trip — 1,783ms (canary credential written, read back, fields intact)
• envelope:shape — 32ms (42-byte plaintext encrypted to 103-byte ciphertext; underlying provider sees only opaque cipher)
• cleanup — 45ms (2 test credentials removed)

PASS=4 WARN=0 FAIL=0. Phase 1b vault gate cleared. Any feature flag that depends on the vault is safe to flip.

Correction (2026-07-29): this entry claimed the hard cap blocked traffic at 100% of month-to-date spend. It did not. The panel wrote settings.hardCap, but no request path ever read it back, so the ceiling was never enforced and no traffic was ever blocked or billed by it. The panel has been replaced — see Metered overage, where the limit you set is the limit the server enforces. The original entry follows unedited.

---

The hard-cap *service* has been live since the §10 0j infrastructure step (default ON, blocks at 100% MTD spend). What was missing was the UI to configure it. The new /billing panel exposes:

• Global toggle — default ON. When OFF, all meters are uncapped (with a loud warning banner).
• Per-meter rows for email + sms + voice. Each meter has its own enabled toggle, mode (block | alert-only), and optional capCents override.
• Alert-only mode is the new escape hatch: for production agents where pausing voice mid-customer-call is worse than overspend, the operator can switch a single meter to alert-only. The 90% warning still fires, the 100% notification still fires, but traffic continues.

Server-side, updateHardCap is gated to master keys only — an ak_-keyed agent cannot lower its own ceiling, which would defeat the safety property. New unit tests cover the alert-only path, per-meter enabled precedence, and global-overrides-per-meter resolution. Closes the §10 0j PARTIAL.

Four long-form posts shipped to /blog covering the launch narrative:

• [Your AI Agent Doesn't Have An Identity. That's The Whole Problem.](/blog/your-agent-has-no-identity-2026) — category-defining manifesto. Why "API key in a .env file" is not identity, and what shipping a real per-agent identity requires structurally.
• [Inside Anima's Voice Guardrails: What Runs Server-Side, and What Doesn't](/blog/voice-guardrails-tcpa-rnd-server-side) — the enterprise/security angle. Walks through every gate that runs before POST /voice/calls reaches the dialer, with the actual middleware paths.
• [The Cross-Channel Moment: One Correlation ID, Email + Voice, In a Single Agent Run](/blog/cross-channel-correlation-id-launch) — demo + data model + why we pulled audit_events forward to Week 1 instead of Week 4.
• [Why We Bet on Bundled Identity Instead of Point Solutions](/blog/bundled-identity-not-point-solutions) — narrative-depth post on the structural argument for owning email + voice + vault + phone behind one identity primitive.

Each post links to working CLI commands. am init provisions a fresh agent in 60 seconds; am voice place is the wedge demo every post references.

/pricing rebuilt on the canonical 5-tier table — Free, Starter $29, Growth $99, Scale $249, Enterprise from $999. Includes a live usage calculator and the full §19.4 rate card (email, SMS, voice, phone numbers, vault, MCP, A2A). Voice runs at promo rates — Basic $0.07/min, Premium $0.15/min — through Q3 2026.

Two new comparison pages: - /compare/agentmail — frame: AgentMail does email well, but you'll need phone, voice, and vault within three months. - /compare/agentphone — frame: same numbers, but Anima ships server-side TCPA + RND gates that AgentPhone leaves to you.

(Corrected 2026-07-31: the RND half of that frame was never true. The lookup was written but has never been enabled in production, so the comparison page now claims only the consent gate and STOP/UNSUBSCRIBE honoring.)

Operators no longer need to wrangle a Clerk session token in curl. The new /admin/vault-verify page runs the vault smoke-test battery (connectivity → round-trip → encryption envelope → cleanup) with one click. Gated by ANIMA_PLATFORM_ADMIN_EMAILS.

Refactored the platform-admin guard into a shared module that bypasses resolveAuth() (which required an active org context) and surfaces the actual error message instead of a generic 401.

Every email send, SMS, voice call, vault read/write, and phone provisioning now emits one row to audit_events under the request's correlation ID. Inbound email gets a synthetic correlation ID so reply chains link back to the trigger.

Two consumer surfaces: - `GET /v1/audit/events?correlation_id=...` — query the full chain for a workflow. - `GET /v1/events/stream` — Server-Sent Events stream that backs am tail for live tailing. - /audit in the dashboard — paste a correlation ID, see the chain rendered with channel badges and timestamps.

Track 2 T2.3 ("data moat") is fully active — every cross-channel interaction logged under an Anima identity makes the next one more valuable.

Trust-score gate scores every signup against three signals before the agent gets phone/voice access: domain age (RDAP), IP ASN classification (IPinfo Lite — free tier supported), and Stripe SetupIntent CVC + ZIP checks.

Pending signups land in /admin/review with the per-signal verdict, score, and reviewer notes. Default OFF (FEATURE_TRUST_SCORE_GATE) — flip in env once IPinfo + Stripe creds are provisioned.

Outbound voice now runs through a consent gate before the dial: - TCPA: requires consent_source assertion on every call; missing/malformed → fail-closed.

(Corrected 2026-07-30: this entry originally also announced an RND gate. The lookup was written but never enabled in production, so no RND check has ever run on an outbound call. Scrubbing against the Reassigned Numbers Database remains the customer's responsibility.)

Per-tier daily call cap added to contain blast radius. ToS Section 11/23 updated with TCPA/DNC indemnification language. New /trust/tcpa-dnc page documents what Anima provides vs what stays the customer's responsibility.

New Scale tier at $249/mo for scaling startups before Enterprise — 500 identities, 10 phone numbers included, 1,500 min Basic + 300 min Premium voice, 4,000 outbound calls, 25K vault credentials, audit logs, SSO-lite.

Voice steady-state rates: Basic $0.08/min, Premium $0.18/min. Launch promo $0.07 / $0.15 through 2026-09-30.

Workflow-level correlation IDs now thread through HTTP, MCP stdio, and the response x-correlation-id header. One workflow → one ID across email + SMS + voice + vault, regardless of transport. Distinct from per-request x-request-id which stays unique per HTTP call.

Pure decision service that walks parent-child delegation grants (depth ≤ 10, cycle detection, scope narrowing). Sub-agent grants verify against a parent grant on every request; scopes can only narrow, never widen. Synchronous revocation propagation through the entire subtree — when a human revokes authority, every descendant agent loses access on the very next call.

Behind FEATURE_DELEGATION_ENABLED flag, default OFF. Full activation in the Day 31-45 push.

Two new CLI commands: - am doctor — single-command health check. Verifies config readability, API DNS, API health, auth validity, MCP registration. Each check is PASS/WARN/FAIL with timing. Triage answer in 3 seconds. - am tail — live event stream across all agent activity (email, SMS, voice, vault). Connects to /v1/events/stream with --filter <channel> and --agent <id> scoping. Auto-reconnects on disconnect.

13 engineering steps covering the launch gates: phone-flag gating, TCPA middleware, RND check, per-tier call cap, billing schema (Scale tier), Prisma migration, OAuth on-behalf-of, rate-limit middleware, trust-score signup gate, hard-cap toggle, correlation-ID propagation, delegation verifier, ToS legal updates.

Code-reality audit committed at repo root verifying every claim against actual source.

Consolidated 5 per-domain MCP repositories (mcp-agent, mcp-email, mcp-phone, mcp-vault, mcp-platform) into a single mcp-server deployment. One URL — https://mcp.useanima.sh/mcp — serves the full toolset across 5 domains via path routing.

Result: one process to deploy, one set of credentials to rotate, one tool registry to keep authoritative.

7 PRs landed across anima, mcp-server, and cli adding managed-OAuth flows for vault-stored credentials. Connect Links provide one-click OAuth handshakes for 20+ services (Google, GitHub, Slack, Notion, Linear, etc.). Tokens land in the vault, refresh automatically, and serve to agents on demand.

Positioning: server-side masking for sensitive fields (refresh tokens dropped entirely from agent-visible responses), per-credential audit log, scoped delegation tokens.

Full voice catalog with 24 natural voices across multiple languages. Filter by gender or language; am voice catalog from the CLI shows the full list. resolveVoiceConfig() resolves a voice ID like thalia into a fully-typed config the dialer accepts.

Anima now deploys to GCP Cloud Run via Pulumi-managed infrastructure. Three services — anima-api, anima-web, anima-console — plus the consolidated mcp-server. Cloud SQL with private-IP networking, Vaultwarden VM for credential storage, Redis for rate-limit counters.

Migration path: anima-migrate Cloud Run job applies Prisma migrations atomically before the API deploy.

Official Go SDK at github.com/anima-labs-ai/go. Type-safe client for the Anima API, mirrors the TypeScript and Python SDKs. go get github.com/anima-labs-ai/anima-go to install.