Changelog

Groups

We're happy to introduce a new concept: Groups. Groups allow you to track the organization, company, team, or workspace each of your identities is associated with. Dregs will then make use of group relationships to do better scoring and analysis.

The group type defaults to organization, or you can use your own word such as team, workspace, or clinic. Identities can belong to multiple groups. A particular user might be associated with multiple companies in your application, or a user might be part of both a team and a larger company.

To associate an identity with a group using the Dregs tracking script, first identify the user and then the group the current user belongs to:

dregs.identify('user_12345', { name: 'Jane Cooper', email: 'jane@example.com' });
dregs.group('organization', 'org_678', { name: 'Acme Inc', plan: 'enterprise' });

See Groups in the manual for more details.

Public OpenAPI specifications

You can explore the customer API, generate a client, or point an assistant at a real spec, without reverse-engineering the calls. A curated OpenAPI 3 document is publicly fetchable at GET /api/openapi.json (dregs.com/api/openapi.json).

It covers the customer API you call with a secret key (sk_): track events, identities, scores and analysis, devices, escalations, channels, datasets, and mappings. Sign-in, billing, team admin, and trainer routes stay out of the document.

Invalid signup payloads return 400

A bad body on POST /api/auth/registration used to come back as HTTP 500 Unexpected Error. It now returns HTTP 400. The message names each field and the constraint that failed: missing, not an email, too short, too long, or the wrong JSON type. Passwords stay out of the response. A missing or malformed body is a short 400. A complete payload still registers, and a duplicate username still returns HTTP 409.

Unrecognized secret keys get a clear API error

An unrecognized API secret key (sk_) on the REST API used to come back as an MCP error about requiring an MCP token. It now returns HTTP 401 with a clear unrecognized-secret-key message in the message field the server SDKs already read. The MCP endpoints, /mcp and /mcp/trainer, still answer with the MCP discovery challenge.

SMS pumping escalation

When Dregs corroborates SMS pumping, it already applies the Pumping Suspected badge. New customers now get a default escalation for that badge, so your application can hear about it and slow or stop further sends. Existing customers got the same rule if they did not already have it. It stays in the dashboard unless you add a notification channel.

Server SDKs for Python, Node, Java, Ruby, and PHP

You can install official server SDKs to track events, read scores, and verify webhooks from your backend with a secret key (sk_). Python is pip install dregs, Node is npm install @dregs/sdk, Java is com.dregs:dregs-sdk, Ruby is bundle add dregs, and PHP is composer require dregs/dregs-sdk. On npm, the unscoped dregs package is the browser tracker, not the server SDK. Browser tracking stays dregs.js with the public key. See the server SDKs chapter.

MCP OAuth consent shows the current account

After you switch dashboard accounts, restarting an MCP OAuth connect was showing the previous account on the consent screen. It now shows the account you are signed in as.

Agent-assisted onboarding

The onboarding steps for tracking and identify now offer tabs for Claude Code, Codex, Cursor, and Manual. Each agent tab includes your team's public key. The agent proposes changes for you to review and never sees the secret key. Manual keeps the existing snippet, and the steps still complete once events arrive.

MCP OAuth works again for local assistants

Connecting an assistant that redirects to localhost was failing during sign-in. Those connections work again.

Optional event ids use id

POST /api/events treats id as the optional event id you supply. trackedEventId still works as an alias. When a request sends both, id is the one that is kept.

Rate-limited ingestion returns 429

When a credential crosses the ingestion rate limit, POST /api/events now answers HTTP 429. An event from a disallowed origin, or one with a malformed device signature, still returns 200 with a null id.

Scores omit empty observations

GET /api/identities/{id}/scores no longer includes an empty observations list. The observations behind a score stay on GET /api/identities/{id}/analysis.

Webhook event types match the API

The webhooks manual now lists the event types the API sends: IDENTITY_SCORED, IDENTITY_BADGES_CHANGED, ESCALATION_OPENED, and ESCALATION_CLOSED.

Track accepts a null disregarded flag

Track requests that sent a null disregarded on the identity were failing. Those requests succeed now. Mark disregarded through the identity API as before.

Name-structure scoring works again

Name-structure scoring had stopped running. It scores again, so name-based authenticity signals are back.

AI Agents settings, revocable MCP tokens, and OAuth

Settings has an AI Agents tab for the MCP URL, connection snippets, connections, and tokens. MCP tokens are revocable, shown once, and limited to MCP endpoints. Assistants can also connect with OAuth 2.1 (PKCE) through an explicit consent screen that names the client and team.

More MCP tools for day-to-day work

Customer MCP tools now cover escalations (list, get, summary, acknowledge or close), escalation and badge rules (including preview), channels and delivery history, disregarding an identity, an account summary with plan limits and usage, and fetching chapters of the published manual. Writes that change rules stay admin-only.

MCP at /mcp

The MCP server now lives at dregs.com/mcp, alongside the REST API. Tools have titles, identity and device lookups include a dashboard link, and assistants confirm before they write.

Customer MCP tools only

The public MCP endpoint at dregs.com/mcp now lists only the tools a dashboard user should see. The trainer and analyzer tools Dregs staff use live on a separate trainer endpoint, so an assistant connected with your team token sees only the customer set.

Free email domains

Dregs now keeps a maintained list of free and public email providers (Gmail, Outlook, Proton, and the rest), separate from disposable addresses. Scoring can treat a free mailbox differently from a throwaway without mixing the two.

Identity reviews test proposed analyzers

When an identity review proposes a new or changed analyzer, Dregs runs the draft against a sample of your users and shows a before/after table on the review screen. You can see whether the change actually helps before you accept it.

More accurate disposable domain lists

Disposable email detection now combines the imported public list with our own additions and exclusions, so we can add domains and correct false positives without waiting for the next import. Registration blocking and authenticity checks use the combined list.

Plan limits stay in sync

Monthly operations limits and the grace period now follow the plan as billed, so a change on our side shows up in the dashboard instead of leaving a stale cap.

Registration bombing escalation

New customers get a default escalation when Dregs corroborates registration bombing and applies the Registration Bombing Suspected badge. Existing customers got the same rule. It stays in the dashboard unless you add a notification channel.

Authenticity Check, 0-100

The synchronous check endpoint is now POST /api/tools/authenticity-check and returns an Authenticity score on the same 0-100 scale as the dashboard and identity API. The older identity-check path still works as an alias.

Authenticated authenticity checks work again

Signed-in authenticity checks were failing with a server error. They work again, so you can use the check as a gate before sending confirmation emails.

Account takeover detection

Dregs now treats account takeover as a standard detection: activity from a new device combined with a password or profile change, and quiet when the device or network is already familiar. Corroborated cases get an Account Takeover Suspected badge and a default critical escalation. A new browser on a known network is unusual context, not an incident on its own.

Disposable email checker accepts domains

The disposable email checker now accepts a bare domain, not only a full address.

Disposable email checker

We shipped a free disposable email checker, backed by the same lists Dregs uses for Authenticity scoring. Paste an address to see whether it belongs to a known throwaway provider.

MCP server

Coding assistants can connect to Dregs over MCP to look up live identities, events, devices, and analyzers.

Disregarded accounts stay out of matching

When you disregard an operator account, Dregs also ignores the devices, IPs, and sessions that account used, so support logins and load tests no longer look like shared infrastructure on everyone else's identities.

Mappings in Settings

Team admins can connect event names and identity fields to Dregs's canonical types on the Mappings tab in Settings. The list is built from what you've already sent, with suggestions for unmapped rows.

Analyzers that understand your events

New behavior analyzers key off those canonical types (registration, login, password reset, and similar) instead of guessing at each customer's event names.

Event and identity mappings

Dregs can map your event names and identity fields to a shared set of canonical types, so analyzers recognize a signup or an email address even when every product names those differently.

Analyzer configs

Analyzer thresholds and similar settings have their own Configs tab in Training, with your account's values separate from the shared defaults. You can tune a detector without editing its script.

Pointer and keyboard collection

The tracking script now records clicks, mouse movement, scrolling, and similar interaction. Humanity scoring can tell a real pointer from a script that never moved the mouse.

Your own copy of global resources

You can copy a global analyzer, dataset, or mapping into your account and change the copy without altering the shared default.

Clearer onboarding and billing

The in-dashboard onboarding steps are easier to follow, and the billing screen shows when a subscription is set to cancel at the end of the period.

Demo mode

The dashboard can mask names, emails, and other personal details so a walkthrough doesn't expose real user data.

Test an analyzer before you save it

You can run a draft analyzer against a real identity and see the observations before you activate the change.

Dashboard consistency

Empty states and form controls are more consistent across lists and settings.

Slack notifications

You can connect a Slack workspace and send escalations there, including through Slack's app install flow.

Alerts are now escalations

We renamed Alerts to Escalations. The dashboard list and rules are the same idea; notifications still go through channels. Escalations remain visible in the dashboard even when no channel is attached.

Tighter account protections

Passwords must be at least 12 characters. After several failed logins, the account locks for a few minutes, and longer if the failures continue. Confirmation codes stop accepting guesses after too many tries; requesting a new code starts over.

Promo codes at checkout

Stripe Checkout accepts promo codes, and a few billing labels and buttons are clearer.

A home dashboard that fits your volume

The home view adapts to how much data you have: a simple layout when you're starting out, and date ranges, items that need attention, and rule activity once you have volume. A persistent banner appears when you hit a plan limit.

Secret key API access

Most API endpoints accept your secret key, so server-side integrations don't have to mint a user session first.

Retention is a window, not a delete

Older events stay stored. Lists and scoring only use activity inside your plan's retention window, and scores are left alone when an identity has nothing in that window.

Score history

Each identity has a score history graph, so you can see how Humanity, Authenticity, Uniqueness, and Behavior moved over time and open the observations behind a point. Alert emails use the same templates as the rest of our mail, and the alerts table is easier to scan.

Account email

Confirmation, password reset, and the other account messages are HTML emails rather than bare text.

Self-service billing

You can pick a plan, check out with Stripe, and manage billing from the dashboard. The pricing page matches what's in the product. We dropped the beta banner.

Broader scoring coverage

Scoring covers more of the abuse patterns on our use-case pages. Analyzers can look up related identities, devices, and lists while they run, so a single signal is less likely to be the whole story.

Self-service signup

You can create an account, accept the terms, and start a trial without waiting on us. Profile, password, and account deletion live on the Account page. When a trial ends, scoring pauses through a grace period while events still land.

Trainer access

Dregs staff can work in your account as trainers: review identities, adjust analyzers, and improve scoring for you and for everyone, without using your password.

Dataset overlays

You can add or exclude entries on top of a global dataset (a domain, an IP, and similar) without replacing the whole list.

Search that understands scores

Lists of identities, events, and devices have a search bar that mixes free text with filters such as humanity:10-40, so you can find a band of suspicious accounts without exporting a spreadsheet.

Disregard a device or identity

Mark a device or identity as disregarded when it's yours: support staff, load tests, or an office shared browser. Dregs skips it in scoring and in other users' relationship matching.

Identity review and datasets

You can request an AI review of an identity; it may suggest analyzer changes. Datasets are versioned lists that analyzers can look up, so publishing a new list doesn't interrupt scoring mid-cycle.

Editable analyzers

Analyzers are JavaScript you can view and edit in the dashboard. Dregs can also send an identity for review and take suggested rules from that review.

Alert rule previews

Creating an alert rule now shows who would currently match, and each alert carries more of the detail you need to act on it.

Alert rules you can time and keep

An alert rule can start from an effective date so it doesn't fire on old identities the moment you save it. Email alerts that hadn't been sending now go out. Deleted rules are kept for history instead of disappearing from past alerts.

Notification channels

Notifications go through channels. The first channel type is webhooks, so your application can hear about alerts without polling the dashboard.

Badges and alerts

Identities can carry badges, applied by analyzers or by rules you write. Alerts fire when scores or badges match conditions you set, so the cases that need a look don't wait for someone to open the identity list.

Identity relationships

Dregs records when identities look related (same device, similar email, shared IP, and similar) and shows those links on the identity page and in the API. That's the difference between one odd account and a small crowd sharing infrastructure.

The dashboard is live

The Dregs dashboard is generally available. Add the tracking snippet and Dregs starts scoring the people on your site across Humanity, Authenticity, Uniqueness, and Behavior. Identities, devices, and events show up as they arrive.

The home view charts activity and score mix, so you can see the shape of your user base without opening every record. Onboarding walks through API credentials and the first snippet, so the empty state has a next step.