Feature ideas

Some data models include blueprints such as CI/CD jobs or deployments. These blueprints usually get filled with high number of entities, but the entities in these blueprints become stale and lose relevancy very quickly. With this feature, users will be able to configure custom retention for specific blueprints, giving them the option to automatically delete old entities once the number of entities for the blueprint passes X entities, or if an entity was updated more than 1 week/month/year ago

Request to move the Port Slack app to Slack’s newer agent messaging layout, where app conversations show up in the regular Messages tab. The app currently uses the older assistant layout, which has separate Chat and History tabs. Every DM the app starts goes to History, including approver requests for WFs. As a result, approvers miss approval requests by default, and Slack plans to phase out the older layout anyway.

Customers want to build server-side apps that call Port MCP ( https://mcp.port.io/v1 ) on behalf of individual users, with each call running under that user's own Port identity and permissions. Today the only way to do this is the authorization_code flow, which means every user has to link their Port account separately. These customers already sign in to their apps and to Port with an external IdP (e.g. Microsoft Entra ID SSO), so they want a single sign-in to cover both their app and Port. Request: Add the urn:ietf:params:oauth:grant-type:token-exchange grant (RFC 8693) to https://mcp.port.io/v1/token (and the US equivalent, mcp.us.port.io ). The client would send an access token issued by a trusted external IdP (e.g. Entra ID) as the subject_token and get back a Port access token for the matching Port user. Admins would need a way to configure which issuers they trust, the expected audience or scope, and which client registrations are allowed to exchange tokens. Current behavior: The token endpoint metadata (/.well-known/oauth-authorization-server) lists only authorization_code, refresh_token and client_credentials. client_credentials doesn't fit this use case, because it is a machine identity with no per-user permissions. Related: There is an existing roadmap idea for token exchange on the Port API: https://roadmap.getport.io/admin/board/ideas/p/token-exchange-mechanism-for-api-authentication This request is specifically about the MCP server. Customer: Abu Dhabi Investment Authority (ADIA), org_jRQbsFhFMow9ywPM, EU Zendesk: https://getport.zendesk.com/agent/tickets/12235

Description: Custom Plugins currently run under a CSP of script-src 'self' 'unsafe-inline', which blocks WebAssembly.compile() and WebAssembly.instantiate(). This prevents plugins written in languages that compile to WebAssembly, such as Go, Rust or C#, from running in Port, even when the whole plugin is a single self-contained HTML file within the 10 MB limit. Requested: Add 'wasm-unsafe-eval' to the script-src of the Custom Plugins CSP, so WebAssembly modules embedded in the plugin file can compile and run. Optionally, make this an opt-in setting per organization or per plugin, so admins can choose to allow it. Use case: Teams that already have tooling or UI logic in Go or other WASM-compiled languages want to reuse it in Port plugins instead of rewriting it in JavaScript or TypeScript. Notes: 'wasm-unsafe-eval' only allows WebAssembly compilation. It does not enable JavaScript eval(), so the rest of the CSP (connect-src limited to Port domains, Trusted Types, object-src and frame-src 'none') would stay the same.

Currently, the message sender only supports slack. Some organizations use Microsoft teams, which means they cannot create notifications for their teams.

As a Port admin, I need to enforce a code freeze across the organization so that no one, including other Port admins, can edit integrations, blueprints, workflows, or dashboards while the freeze is active. Today I can only ask people not to make changes, and nothing in Port prevents them. I’d like a single toggle or scheduled freeze window that makes these configuration objects read-only for everyone, with an audit trail of who attempted changes during the freeze. Workflow runs should remain allowed by default, with an option to block them as well. This would let us enforce our organization’s code freeze policy directly in Port.

Currently, when an approver approves or rejects a request, there is no notification sent to the other approvers. It would be beneficial to implement an email notification so that other approvers are informed and do not act on requests that have already been acknowledged.

Currently, in the connector page, we are showing in each connector all the blueprints that were mapped in the lifetime of the connector. We wish to change it so that the connector tab/card will only show the blueprints that are being mapped in the connector at the time.

Teams need to see security vulnerability data alongside the services and infrastructure they own in Port. We’d like a Qualys integration that syncs hosts, assets, and vulnerability findings into the catalog and links them to the relevant services and owners. This would let teams check their risk posture from the same place they manage their software, and build scorecards around open critical vulnerabilities or patch SLAs. Ideally the integration would also support scheduled syncs and keep findings up to date as Qualys scans run.

Currently, Port's audit log does not capture the source IP address of individual API calls. The request is to expose the source IP address for each API request in the audit log