What We Shipped This Summer

Ad platforms you can connect yourself

Meta Ads, Google Ads, and Google Local Services Ads now connect through a sign-in flow instead of a support ticket. You authorize Dashfeed with the Google or Meta account that owns the ad accounts, pick the client account from a list, choose the streams, and the first sync backfills a year of history.

Two details took most of the engineering time and are worth knowing about. Meta doesn’t issue refresh tokens, so its roughly sixty-day tokens are re-exchanged in the background, and when one dies anyway the source card says “Reconnect required” with a button that reauthorizes in place. And Google restates conversion numbers for weeks after the fact, so the Google Ads connector re-reads a lookback window on every sync, thirty days by default, and upserts the corrected rows. We wrote up the setup and the two data quirks in a separate how-to.

The canvas is now the post

Feed posts that carry data used to be a block of text with a chart attached. Now the whole body of an AI-authored post is a canvas, the same interactive surface that powers dashboards. A metric update shows the hero number, the narrative, the supporting chart, and the detail chips inside one sandboxed frame, and the feed lays it out at feed width on web and mobile.

The practical effect is that a post about a revenue dip is something you can inspect rather than just read. Hover the chart, open the underlying table, and click through to investigate. Classic text posts still exist and still work. AI posts with data in them just default to the canvas.

Feed control, required reading, and profiles by role

The feed has always ranked itself around what each member engages with. The gap was that a new member started from the same generic feed as everyone else, and admins had no way to say “dispatchers should see these topics first” or “everyone has to read this one.”

• Feed profiles. Admins set default topics, preferences, and scorecard metrics for a workspace, a group, or a person. A member’s own choices always win over the profile.
• Required reading. A post can be marked as required with a deadline. It pins to the top of the feed for the people it applies to, tracks acknowledgements, and sends reminders until they’ve read it.
• Coverage and view-as. Admins can see the feed as a given member sees it, check who a post reached, and reset a member’s personalization with a visible notice rather than silently.

It stays one feed. There is no second ranking engine and no separate “announcements” surface. A required post is an ordinary post that has been placed.

One sign-in, and access tokens with scopes

Sign-in moved to a single identity service at auth.dashfeed.ai. One account now covers the web app, the mobile app, and the MCP server, and password reset and email verification go through it too. Most people will only notice that the login page looks slightly different.

The part that matters for developers is personal access tokens. Under Settings and then Access Tokens you can mint a token with exactly the scopes it needs, such as read-only access to dashboards and datasets, or write access to monitoring. The tokens are prefixed dfp_, and the MCP server now requires one. If you set up @dashfeed/mcp earlier in the year with a legacy API token, it will refuse to start and point you at the settings page.

Three MCP releases

The MCP server is how Claude, Cursor, Codex, and similar tools work inside a workspace, and it had three minor releases this summer.

• 0.4.0 added Drive tools, so an AI client can list, read, create, and version documents and artifacts, with byte caps on content reads so a large file never floods the model’s context.
• 0.5.0 added connection schema scoping, so a warehouse connection only auto-imports the schemas you name, and bulk dataset cleanup with a dry run and an explicit confirmation count. It also made widget-to-dataset bindings visible and rebindable in one call.
• 0.6.0 added dashboard filter tools. A filter key can parameterize SQL-backed widgets with {{key}} tokens, with one central serializer that quotes, escapes, and types every value.

Every mutation still requires an explicit confirm flag, and destructive tools require typed confirmation text. The Dashy chat assistant inside the app gets the same tools at the same time, because the two surfaces share one manifest.

Alerts by text message

Members can now receive monitor alerts, report events, approval requests, and workspace activity as text messages. Enrollment is double opt-in. A member enters a US mobile number, or an admin invites them, and nothing is sent until they reply YES. STOP works the way you’d expect, and the full program terms are on the SMS terms page.

Industry briefs for the trades

Dashfeed now ships trade-specific metric sets and a morning brief for HVAC, plumbing, roofing, and pest control contractors, built over the dispatch, accounting, and ad systems those businesses already run. Each has its own page under Industries, and we walked through an HVAC brief line by line last month.

Smaller things

• Data connections now have a proper lifecycle. A source that fails repeatedly pauses itself with a reason, a dead credential shows as “Reconnect required” rather than a generic failure, and a fixed source resumes where it left off.
• Ingestion flows keep per-step logs, so a failed sync shows which step failed and what it said.
• HTML artifacts uploaded to Drive now run their scripts in an isolated sandbox origin, so a shared report can’t reach the rest of the app.
• The edge timeout for long warehouse queries was raised to three minutes, so a slow query returns a result instead of a gateway error.

What’s next

The fall work is mostly under the surface. We’re consolidating how metrics are cataloged so a metric defined once shows up identically in the brief, in chat, and on a dashboard, and we’re finishing the move of the whole ingestion pipeline onto the data hub service. Neither should be visible to you except as things getting faster and more consistent. If they’re visible in any other way, tell us.