Changelog

Safer evidence

• Prompt-injection detection now normalises text first (Unicode, zero-width characters, look-alike letters) and recognises override instructions in seven languages, chat-template tokens, role and tool-call JSON, requests for system prompts or keys, and forged evidence ids. Ordinary pages that happen to say "ignore the previous step" or explain what a system prompt is are no longer flagged.
• Text a reader never sees (display:none, visibility:hidden, the hidden attribute, zero-size or same-colour text, off-screen text, unterminated comments) is left out of evidence, and a page that hides instructions this way is marked unusable. Cookie and consent overlays are left out too.
• More credential formats are redacted before storage (OpenAI, Anthropic, AWS, GitHub, Slack and Google keys, JWTs, private keys). Card numbers are redacted only when they pass issuer and checksum checks, so ISBNs, timestamps and years are kept.
• Search ranking discounts keyword-stuffed pages, leaves out pages that share no meaningful word with the query, collapses syndicated copies that differ by a line or two, and treats lang "no" as matching Bokmål and Nynorsk pages.

Installer-verifiable marketplace packages

• New package versions are signed with Ed25519 over the package id, version and content hash. Public keys are published at /.well-known/holosignal-marketplace-keys.json, so installers can verify a package without trusting HoloSignal's API at install time.
• The verify endpoint returns the algorithm, key id, the exact signed payload and the key set URL. The TypeScript and Python SDKs verify offline. Versions signed before this change keep verifying server-side and are marked as not installer-verifiable.

Command bar

• Press ⌘K (Ctrl+K on Windows and Linux) anywhere in the app to jump to any section, start a search, crawl, Context Pack or visibility run, create an API key, or open a recent run.

Faster answers

• Answer Studio starts researching straight away: it searches the web and your attached Context Pack in parallel before the agent plans its first step, and it fetches pages with the slower rendered fallback only when the fast pass finds fewer than two usable pages.

Account controls

• Sign in with a passkey (fingerprint, face or device PIN), including from the email field's autofill. Add, rename and remove passkeys under Settings; email links and codes keep working.
• Settings lists your active sessions with device, address and last activity, and signs out any one of them or all the others.
• Enterprise SSO now supports SAML 2.0 alongside OIDC: paste your identity provider's metadata, or enter its SSO URL and certificate. Assertions must be signed with SHA-256.
• API keys can be limited to IPv4 or IPv6 addresses and CIDR ranges (allowedIps); other addresses get KEY_IP_NOT_ALLOWED. Change the list with PATCH /api/v1/keys/{id}.
• Zero-data-retention mode: page content and run traces are purged an hour after a run completes, keeping the run record, units, hashes and signed receipts.
• Agency client monthly budgets are enforced: work that would exceed a client's budget is refused with CLIENT_BUDGET_EXCEEDED.

Answer Studio and a research agent

• POST /api/v1/answers: an agent plans, searches, fetches and queries your Context Packs, then answers in one of nine modes (concise, structured, memo, comparison, timeline, extraction, brief, audit, custom) with every material claim cited.
• GET /api/v1/answers/{id} returns numbered sources with fetch dates, a claim-to-citation map, citation coverage and contradictions, and exports to Markdown or HTML. "Insufficient evidence" is a valid answer.

Visibility Lab v2

• Visibility runs are now asynchronous and metered, with mention, rank, prominence, sentiment and citation per answer, discovery rates with 95% confidence intervals, share of voice, competitor comparison and source gaps.
• Ranked, evidence-backed opportunities; brand-neutral prompt generation; new endpoints for runs, opportunities and engines.

Retrieval, packs and monitors

• Context Pack queries use hybrid retrieval (semantic plus full-text). Pack refresh re-fetches every source and reports what changed; evaluation scores recall, citation precision, freshness and ranking, and fails on leaked personal data.
• Every monitor type now does what it says: site crawls, visibility shifts, pack source changes, spend spikes and run failures.
• Searches finish faster: pages are fetched in parallel, and script-built pages fall back to a rendered fetch.

Prepaid Context Unit packs

• Top up with packs of 15,000, 50,000 or 150,000 Context Units for $10, $25 or $50. Packs are used after your plan allowance and don't reset at renewal. HoloSignal never charges for usage beyond your plan and packs.

Platform

• 31 MCP tools, including answers, crawls, packs, visibility and replay. Every catalogued webhook event is now delivered, including budget thresholds, pack publication and regression, monitor triggers and privacy exports.
• Security headers on every page and HTTPS-only access.

HoloSignal on holosignal.xyz

• The product is now called HoloSignal. https://holosignal.xyz is the canonical domain for the app, API, docs and OpenAPI specification, and the hosted MCP server is https://mcp.holosignal.xyz/mcp.
• Requests to the previous domain and its www host are permanently redirected to holosignal.xyz with a method-preserving 308, so existing API clients keep working. Update base URLs when convenient.
• API key prefixes, header names, service identifiers and the TypeScript and Python SDK packages are unchanged.

Web search API

• POST /api/v1/search now runs a real web search: candidate URLs come from official search APIs, and HoloSignal fetches, ranks and cites its own copy of each page.
• Ranking combines BM25 relevance with Unicode word segmentation (including Thai, Japanese and Chinese), domain class, freshness and page quality.
• Answers cite results by position: generated when the model layer is available, otherwise extractive from the best passages. Set answer: false to skip them.
• New filters: lang, country, freshness or since, includeDomains and excludeDomains with domainMode boost or filter, domainClasses (gov, edu, official, reference) and safeSearch. content: text or markdown returns up to 20,000 characters per result.
• Results carry canonicalUrl, lang, publishedAt, fetchedAt, license, score and relevance. Near-duplicates are marked with dupOf by normalized URL or SimHash.
• ?wait= (seconds, 10s or 1500ms, up to 25 s) returns the finished search with 200, or the usual 202 if it isn't done in time. The TypeScript SDK adds searchSync().
• If page fetching is unavailable, search degrades to discovery-only results (fetch.status: "unavailable", fetched: false) instead of failing.
• New guide: /docs/search.

Sansa Auth service access

• Services in the Sansa ecosystem can call HoloSignal with a Sansa service key (sa_rt_…) through Sansa Auth, alongside HoloSignal API keys.
• Supported actions: oxysignal.search.run, oxysignal.fetch.run, oxysignal.context_packs.query (metered) and oxysignal.runs.read. Send x-sansa-tenant-id and, for metered actions, x-sansa-billing-profile-id.
• Calls through Sansa Auth are priced by the published Sansa Auth price; HoloSignal units are recorded as showback only.

Error reference and retention enforcement

• Every API error code now has a documentation page under /docs/errors with its HTTP status, retryability and remedy, linked from each error response.
• Retention policies are enforced hourly: raw snapshots and run traces past their plan or agency retention windows are purged, legal holds are respected, and each purge is audited. Context Pack evidence, run records, receipts and audit logs are kept.

v1.0.0

Closed-loop evidence platform

• Live-web search, fetch, crawl, interaction and governed Context Packs with signed receipts.
• Policy-gated analysis with deterministic validation, bounded expert review and replayable receipts.
• Visibility cohorts and approval-gated GitHub, CMS, signed-webhook, and allowlisted API actions with exact destination binding, post-publish recrawl, run comparison, and normalized GA4/Search Console outcomes.
• REST, OAuth 2.1 MCP, TypeScript and Python SDKs, CLI, signed webhooks, agency controls, and the governed package marketplace.
• Passwordless authentication; self-service privacy, export, deletion, billing, cookies, GDPR, and California controls.