Release Notes

Release Notes

Every Core dna product, release by release, newest first. Each product ships on its own schedule.

Platform 2026.3

What’s new in Core dna Platform 2026.3

Connect your website to AI Agents

The Core dna MCP server connects a site to AI agents such as Claude, ChatGPT, Cursor, Gemini and Copilot, which carry out content and commerce tasks described in plain English.

Key highlights

  • The Core dna MCP server: connect Claude, ChatGPT, Cursor, Gemini or Copilot to a site with your own Core dna sign-in.
  • OAuth for AI connectors: dynamic client registration, PKCE and a discovery endpoint.
  • Downloads from templates: ask the browser to save a response as a file.

Connect your site to AI agents

This release introduces the Core dna MCP server, which connects a site to AI agents such as Claude, ChatGPT, Cursor, Gemini and Copilot. Your team describes a task in plain English, such as updating pages, changing product prices in bulk, or managing blogs, FAQs and forms, and the agent carries it out. Each site is its own MCP server at /cdna-mcp, and an agent signs in with the person's existing Core dna login and acts with that person's permissions, so there are no new accounts to manage.

OAuth for AI connectors

So that connectors can sign in on their own, OAuth now supports dynamic client registration, PKCE for apps without a client secret, and a discovery endpoint that advertises the site's OAuth endpoints. Registration is switched on per site, under Users › OAuth Authentication › Configuration:

The Dynamic Client Registration group of the OAuth settings: Enable switched on, allowed scopes mcp offline profile, inactive clients removed after 7 days
Users › OAuth Authentication › Configuration › DCR

Downloads from templates

A template can now ask the browser to save a response as a file instead of opening it, with an optional file name. This suits PDFs and other documents that people expect to download rather than view in a tab.

Template code 
{* Save this response as a file instead of opening it *}
{$_response->forceDownload('invoice-2026.pdf')}
{# Save this response as a file instead of opening it #}
{{ _response.forceDownload('invoice-2026.pdf') }}

Other improvements and bug fixes

  • Expanded OAuth support so third-party AI agent connectors can sign in against your site. The server now supports dynamic client registration, PKCE for public-client flows, and a standard discovery endpoint that advertises its capabilities.
  • Templates can now prompt the browser to save a file to disk instead of opening it inline, with an optional suggested filename. Particularly useful for PDFs and other documents that users expect to download rather than view in a tab.
  • Fixed an issue where submitting a form that included a payment element failed to capture the payment details. Payment information now flows correctly into the submission record and can be viewed in the admin or returned via the API.
  • PDF responses now respect cache-control settings, so updated PDFs are served immediately instead of being held back by stale browser or CDN caches.
  • Resolved a compatibility issue that caused PDF generation to fail under PHP 8.0. PDFs now render reliably on the current PHP version.
Go deeper
GuideMCP, for editors and agents GuideOAuth and connected applications How-toConnect an editor to a site's MCP server ReferenceAuthentication

Was this page helpful?

Your answer goes to the docs team.