Devin AI Changelog: Latest Features, Releases, and Product Updates

Release Cadence and Distribution Channels

Cognition delivers product updates on a bi-weekly release cadence across web, desktop, and CLI channels. In addition to regular bi-weekly feature cycles, Cognition ships point releases and targeted hotfixes as needed to address protocol stability, terminal rendering bottlenecks, and sandbox permissions.

The release pipeline divides updates into distinct channels:

• Devin Cloud Webapp: Cloud updates apply continuously to active sessions in the browser. These updates include visual interface improvements, sidebar navigation changes, automated code scans, and organization settings.
• Devin Desktop: The native desktop application receives scheduled desktop builds incorporating updated language server configurations, local terminal integrations, and editor window splits.
• Devin CLI: The terminal client operates on two channels: a stable track (such as the v3000.6.x series) and an insiders preview channel. The stable track prioritizes backward-compatible shell execution, Model Context Protocol (MCP) transport stability, and subagent orchestration.

Where Engineering Teams Access Official Release Notes

Tracking official documentation ensures that developers and DevOps engineers do not rely on third-party aggregators or outdated summaries. Cognition publishes release information across four primary destinations:

1. Devin 2026 Release Notes: The official Devin 2026 Release Notes document platform-level updates, covering the web interface, enterprise security controls, automation triggers, and major infrastructure milestones.
2. Devin CLI Stable Changelog: The Devin CLI Stable Changelog catalogs exact version changes for the command-line client, detailing command flags, slash commands, shell execution changes, and MCP client updates.
3. The Devin Web Console: In-app notification sheets and release banners at app.devin.ai highlight newly released features directly within active workspaces.
4. Cognition Engineering Blog: The official Devin Blog provides long-form technical architectural essays, benchmark analyses, and detailed walk-throughs of major milestone releases.

Orchestrating Self-Hosted Workers with Devin Outposts

Introduced in the July 22, 2026 platform release, Devin Outposts allows organizations to execute Devin workloads directly within their own self-hosted environments. Historically, running Devin required executing all shell commands, compilations, and tests inside Cognition's multi-tenant cloud Devboxes. While cloud Devboxes offer rapid provisioning, regulated industries and security-conscious enterprises frequently require source code and build pipelines to remain behind corporate firewalls.

Devin Outposts establishes a hybrid execution architecture:

• Centralized Cloud Brain: Devin's reasoning engine, planning heuristics, and high-level task decomposition remain in Cognition's managed cloud.
• Private Worker Nodes: Code checkout, terminal commands, compilation, and unit test execution occur on local infrastructure inside your corporate network.
• Outpost CLI Bootstrapping: Engineers can initialize and manage local workers using the devin worker start command, connecting private nodes to the central coordinator without opening inbound network ports.

This architecture enables Devin to interact with internal database replicas, private package registries, and staging environments without requiring enterprise teams to route sensitive repositories through external execution environments.

Continuous Vulnerability and Dead Code Scanning in Automations

Automated code scanning represents another major platform capability introduced across the August and September 2026 releases. Instead of waiting for developer prompts, Devin can now run continuous repository audits as scheduled background automations or on every new commit.

Key scanning capabilities documented in the 2026 changelog include:

• The /scan Composer Command: Developers can trigger repository audits on demand from the web composer by entering /scan followed by the target scope.
• Cleanup Scans for Dead Code: Introduced in September 2026, cleanup scans detect unused functions, stale imports, orphan test fixtures, and deprecated API calls across the codebase.
• Scan Validation Severities: Security profiles allow administrators to specify which finding severities require validation before alerting developers, reducing false positives.
• Batch Remediation via v3 API: Enterprise teams can programmatically trigger scans across multiple repositories and dispatch batch remediation requests to resolve identified flaws automatically.

Sidebar Grouping and Multi-Select Metadata Filters

Managing dozens of concurrent agent sessions requires structured navigation. In late August and early September 2026, Cognition rolled out major improvements to session organization in the web console.

The session sidebar now supports multi-select metadata tag filters with real-time per-tag session counts, alongside machine-type filters. Sessions can also be grouped dynamically by pull request status or by target repository. In addition, the session workspace introduced VS Code-style split editor groups, allowing developers to inspect file diffs and review terminal execution side by side without toggling between tabs.

Terminal Command Architecture and Session Governance

Recent stable releases of the Devin CLI have refined how developers interact with local execution loops. The v3000.5.20 release in late August 2026 introduced substantial operational commands:

• Session Management (devin rm): Developers can delete old or abandoned sessions directly from the terminal. Deletion requires user confirmation by default and includes safety checks that refuse deletion if another active Devin process holds the session open.
• Session Diagnostics (devin doctor): A diagnostic tool that verifies local environment health, file path permissions, and subagent frontmatter definitions.
• Context Summarization (/recap): Generates an on-demand summary of recent turn decisions, terminal actions, and code modifications within the active session.
• Session Renaming (/rename): Assigns descriptive titles to ongoing tasks, making session histories easier to search and resume via devin -r or devin ls.
• Parallel Querying (/btw): Opens a non-blocking side-chat panel that answers developer questions using session context while the primary agent continues working.

Process control has also been hardened. On Unix systems, cancelling or timing out a terminal command now sends a SIGTERM signal to the process group first, followed by a five-second grace period before dispatching SIGKILL. This prevents half-written database migrations and corrupted local state when developers interrupt long-running scripts.

Smart Permission Modes and Subagent Isolation

Permission models in early coding agents often forced a frustrating choice: either prompt the developer for every single command, or grant unrestricted shell execution.

The CLI changelog introduced the smart permission mode (v3000.3.22), which balances safety and developer velocity. Under smart mode, routine read actions, lint checks, and unit tests auto-approve, while high-risk actions always prompt for human confirmation. High-risk actions include package installations, destructive file operations (rm), system privilege escalation (sudo), git mutations, and access to sensitive files such as environment credentials or private keys.

Subagent management has also matured. When a primary Devin agent spawns subagents to inspect secondary modules, the terminal tray displays the active model for each child process. In v3000.5.20, killing an individual subagent by pressing x in the Subagents tab halts only that specific worker, preserving the parent session turn and state.

Model Context Protocol Configuration and Transport Updates

Cognition has steadily enhanced Devin's support for the Model Context Protocol (MCP). In release v3000.3.22, MCP server declarations were separated from the main user preferences file and moved into dedicated configuration paths:

• ~/.config/devin/mcp_config.json (or %APPDATA%\devin\mcp_config.json on Windows) for global user servers.
• .devin/mcp_config.json for repository-scoped servers.
• .devin/mcp_config.local.json for uncommitted, machine-specific overrides.

Subsequent updates refined network protocol stability. Release v3000.6.11 added connection timeouts to prevent stalled MCP servers from blocking the turn loop. Release v3000.6.12 resolved a transport regression connecting to MCP servers via Streamable HTTP, ensuring that remote HTTP endpoints function reliably alongside legacy stdio transports. MCP prompts also map directly to interactive slash commands using the format /mcp__<server>__<prompt>, allowing developers to invoke custom agent skills with positional arguments.

Enterprise MCP Server Distribution and Private Tunnels

Managing dozens of distinct developer machines creates configuration drift. Enterprise administrators can now configure approved MCP servers once at the enterprise root level within the web console. These servers automatically propagate to child organizations, while allowing individual teams to define local overrides where necessary.

For dedicated enterprise deployments, Devin supports private network MCP servers. In this architecture, OAuth authentication handshakes and tool-call payloads travel entirely through private network tunnels rather than crossing the public internet. Enterprise administrators can also upload custom private Certificate Authority (CA) bundles, allowing Devin workers to communicate securely with internal corporate services using private TLS certificates.

Short-Lived OIDC Authentication and Role-Based Permissions

Security policies often prohibit providing static, long-lived API tokens to autonomous agents. In mid-2026, Cognition introduced OpenID Connect (OIDC) identity tokens for Devin. Devin sessions can now generate short-lived cryptographic tokens to authenticate directly with major cloud providers (such as AWS, Google Cloud, and Azure). This allows Devin to deploy staging infrastructure or run remote integration tests without storing permanent credentials inside repo secrets.

Administrative permissions have also become more granular. The August 28, 2026 update split automation permissions so that organization administrators can manage personal automations independently from system user automations. This ensures that routine developer automation jobs do not interfere with production-critical security scan triggers.

Release Matrix Across Devin AI Environments

Understanding where changes land helps teams focus their monitoring efforts. The table below outlines how Devin release channels operate across different engineering environments:

Connecting Devin to Fast.io via Model Context Protocol

Fast.io exposes a consolidated MCP toolset accessible over Streamable HTTP at https://mcp.fast.io/mcp (or https://mcp.fast.io/mcp/key with Bearer authentication) as well as legacy SSE at https://mcp.fast.io/sse. Developers can configure Devin to connect directly to Fast.io by adding the server to their .devin/mcp_config.json:

{
  "mcpServers": {
    "fastio": {
      "url": "https://mcp.fast.io/mcp/key",
      "headers": {
        "Authorization": "Bearer YOUR_FASTIO_API_KEY"
      }
    }
  }
}

Once connected, Devin can read repository specifications, reference architectural diagrams, and write build artifacts directly into organization-owned workspaces. Files uploaded to Fast.io are never lost when a terminal turn ends or a cloud sandbox reboots.

Persistent Version History and Intelligence Mode

Fast.io provides per-file version history for every asset stored in a workspace. When Devin iteratively refactors a code module or updates an architectural draft, Fast.io automatically preserves previous versions. If an agent execution loop introduces a breaking regression, human developers can review the changes and restore earlier versions with complete audit transparency.

When Intelligence Mode is enabled on a workspace, Fast.io automatically indexes uploaded documents, code files, and specifications for hybrid search (combining full-text keyword matching and semantic search). Human engineers and autonomous agents can query the workspace context using natural language chat, receiving answers grounded in verified project documentation with source citations.

In addition, Fast.io features Metadata Views, turning workspace files into a live, queryable database. Teams can extract structured data such as ticket numbers, author metadata, and dependency licenses across hundreds of files without writing manual extraction scripts.

For client and external handoffs, Fast.io provides purpose-built branded shares (Send, Receive, and Exchange) that can be durable or expiring, featuring granular per-recipient access controls. Fast.io also supports ownership transfer, allowing an autonomous agent to initialize an organization and build workspaces before transferring administrative ownership to a human team lead.

Every organization starts with a 14-day free trial, which requires a credit card. | Plans are Starter at $29/mo, Business at $99/mo, and Growth at $299/mo on Fast.io pricing.