OpenHands · DevinVinson · Sep 17, 2026 · Sep 16, 2026
diff --git a/docs.json b/docs.json
@@ -317,6 +317,7 @@
           {
             "group": "Release Notes",
             "pages": [
+              "openhands/usage/agent-canvas/release-notes/v1.19.0",
               "openhands/usage/agent-canvas/release-notes/v1.18.0",
               "openhands/usage/agent-canvas/release-notes/v1.17.0",
               "openhands/usage/agent-canvas/release-notes/v1.16.0",

diff --git a/enterprise/integrations/azure-devops.mdx b/enterprise/integrations/azure-devops.mdx
@@ -6,7 +6,7 @@

 This guide explains how to connect Azure DevOps Services to an OpenHands
 Enterprise installation. The integration lets users sign in with Microsoft
 Entra ID, open Azure Repos, create branches and pull requests, and use Azure
 Boards work items or pull request comments as context for OpenHands workflows.

 <Note>
@@ -17,22 +17,22 @@
 ## Prerequisites

 - An OpenHands Enterprise installation using Replicated or standalone Helm.
 - A Microsoft Entra administrator who can register an application and create a
  client secret.
 - An Azure DevOps Services organization, project, and repository.
 - Azure DevOps users with access to the projects and repositories they will use
  with OpenHands.
 - Network access from OpenHands to `login.microsoftonline.com` and
  `dev.azure.com`.
 - If you plan to trigger automations from Azure DevOps Service Hooks, network
  access from Azure DevOps back to the OpenHands app URL or automation webhook
  URL.

 ## Register a Microsoft Entra Application

 In the Azure portal, create a Microsoft Entra app registration for OpenHands.

 1. Go to **Microsoft Entra ID > App registrations**.
 2. Click **New registration**.
 3. Enter a name such as `OpenHands Azure DevOps`.
 4. Select the supported account type for your organization.
@@ -43,7 +43,7 @@
   ```

   Replace `<your-auth-hostname>` with your installation's Authentication
   hostname (`auth.<your-openhands-domain>` by default), for example
   `https://auth.openhands.example.com/realms/allhands/broker/azure_devops/endpoint`.

 6. Click **Register**.
@@ -156,18 +156,18 @@
 repository picker. OpenHands can:
 
 - List Azure DevOps projects and repositories available to the signed-in user.
-- Clone Azure Repos using the signed-in user's OAuth token.
+- Clone Azure Repos using the signed-in user's OAuth token. SSH remote URLs (`git@ssh.dev.azure.com:v3/...`) are also recognized.
 - Read branch and pull request context.
 - Create branches and pull requests.
 - Read and post Azure Repos pull request comments.
 - Read and post Azure Boards work item comments.

 OpenHands does not require users to paste a personal access token for Azure
 DevOps repository access when Microsoft Entra sign-in is configured.

 ## Trigger OpenHands from Azure DevOps

 Azure DevOps events can be connected to OpenHands automations through Azure
 DevOps Service Hooks and OpenHands custom webhooks. Use this pattern for
 workflows such as:

@@ -200,9 +200,9 @@
 | Symptom | Check |
 | --- | --- |
 | The Azure DevOps login option is not visible | Confirm **Azure DevOps Authentication** is enabled in the Admin Console or Helm values and the deployment has been applied. |
 | OAuth redirects fail | Confirm the Entra redirect URI exactly matches `https://<your-auth-hostname>/realms/allhands/broker/azure_devops/endpoint`. |
 | Microsoft sign-in shows an invalid client or secret error | Confirm the Azure DevOps Client ID and Client Secret match the Microsoft Entra app registration. If the secret expired, create a new one and redeploy. |
 | Microsoft sign-in succeeds but no repositories are listed | Confirm the user has access to the Azure DevOps organization, project, and repositories. Also confirm the default organization value is the organization name only. |
 | Consent fails or Azure DevOps API calls are denied | Confirm the Entra application has the required Azure DevOps delegated permission and that admin consent has been granted if your tenant requires it. |
 | Repository selection or Git operations fail | Confirm OpenHands can reach `dev.azure.com` and that the repository is referenced as `organization/project/repository`. |
 | Azure DevOps Service Hook deliveries do not trigger an automation | Confirm the custom webhook is registered, the Service Hook URL is correct, the event type matches the automation, and the automation is enabled. |
diff --git a/openhands/usage/agent-canvas/agent-profiles.mdx b/openhands/usage/agent-canvas/agent-profiles.mdx
@@ -46,10 +46,26 @@

 ### Let the Agent Switch LLM Profiles

 The OpenHands profile editor includes a **"Let the agent switch LLM profiles"** toggle. When enabled, the agent is given the `SwitchLLMTool`, which lets it switch between available LLM profiles during a conversation. When disabled, the tool is removed from the agent's toolset.
 
 This toggle is version-gated: it appears only when the connected backend reports agent-server `1.31.0` or later. On older backends (for example, agent-server `1.29.0`–`1.30.x`) the toggle is hidden.
 
+### Scope a Profile to Specific MCP Servers
+
+An agent profile can be scoped to a subset of configured MCP servers using **MCP server references** (`mcp_server_refs`). When a profile includes MCP server references, only the tools from the referenced MCP servers are available to the agent in conversations that use that profile.
+
+This is useful when you have multiple MCP servers configured but want a particular profile to access only a subset — for example, restricting a profile to a documentation search server while excluding servers with broader tool access.
+
+To scope a profile:
+
+1. Open `Settings > Agent` and edit the agent profile.
+2. In the MCP server scoping section, select the MCP servers this profile should access.
+3. Save the profile.
+
+When no MCP server references are set, the profile has access to all configured MCP servers. When references are set, only the selected servers' tools are registered with the agent.
+
+See also [Model Context Protocol](/overview/model-context-protocol) for an overview of MCP support across OpenHands platforms.
+
 ## ACP Profiles
 
 Use an ACP profile when you want Agent Canvas to drive an external coding agent through the Agent Client Protocol.

diff --git a/openhands/usage/agent-canvas/managing-automations.mdx b/openhands/usage/agent-canvas/managing-automations.mdx
@@ -1,17 +1,17 @@
 ---
 title: Managing automations
 description: Browse, export, import, enable, disable, and run automations from the Agent Canvas Automate view.
 ---

 The **Automate** view in Agent Canvas is the in-app control center for your automations. From here you can see all automations on the active backend, inspect their configuration and run history, and manage their lifecycle without leaving the app.

 <Note>
  Automations run on the active backend. Switch backends from [Connect and Manage Backends](/openhands/usage/agent-canvas/backends) to see automations on a different backend.
 </Note>

 ## Browse and inspect automations

 Open the **Automate** tab in the sidebar to see all automations on the active backend. Each row shows the automation name, trigger type, and enabled state. When the active backend is healthy but has no automations, the Automate pane remains available and includes an option to add one.

 Click an automation to open its detail view. The detail view shows:

@@ -34,10 +34,19 @@

 Use the Activity Log export controls to download run data as CSV or JSON. Both formats include a raw numeric `cost` field for every run, as well as the run's `phase`. An unavailable cost is exported as `null`.

 ## Enable and disable automations
 
 Toggle an automation on or off from the kebab menu (⋮) on the automation row, or from the detail view. Disabled automations do not fire on their scheduled trigger or in response to events, but their configuration is preserved.
 
+### Disablement reasons
+
+When an automation is disabled, the detail page shows a banner with a human-readable disablement reason, structured detail, and a timestamp. This helps you understand why an automation stopped running. Common reasons include:
+
+- **Manually disabled** — A user turned the automation off from the kebab menu or detail view.
+- **Permanent dispatch failure** — The automation backend reported a permanent failure that prevented the automation from running.
+
+The banner displays the reason, any additional structured detail provided by the backend, and the time the disablement occurred. To re-enable an automation, use the toggle in the kebab menu or detail view (cloud backends require manage permissions or that you are the automation's creator).
+
 ## Edit an automation
 
 You can edit an automation's name, prompt, model, timeout, and schedule directly in Agent Canvas. On cloud backends, editing requires manage permissions or being the automation's creator.
@@ -103,7 +112,7 @@

 5. Confirm to create the automation.

 Imported automations are created **disabled**. After importing, open the automation from the list, review its configuration, and enable it when ready.

 ## Related guides


diff --git a/openhands/usage/agent-canvas/release-notes/v1.19.0.mdx b/openhands/usage/agent-canvas/release-notes/v1.19.0.mdx
@@ -0,0 +1,29 @@
+---
+title: Agent Canvas 1.19.0
+description: Release notes for Agent Canvas version 1.19.0
+---
+
+# Agent Canvas 1.19.0
+
+Released September 16, 2026.
+
+[View the full release on GitHub](https://github.com/OpenHands/OpenHands/releases/tag/v1.19.0).
+
+## Highlights
+
+- **MCP server scoping for agent profiles** — Agent profiles can now be scoped to specific MCP servers using `mcp_server_refs`. When a profile is scoped, only the selected MCP servers' tools are available to the agent in that conversation. See [Agent Profiles](/openhands/usage/agent-canvas/agent-profiles).
+- **Automation disablement reasons** — The automation detail page now shows a human-readable disablement reason with structured detail and a timestamp. This makes it easy to understand why an automation was disabled, whether manually or due to a permanent dispatch failure. See [Managing automations](/openhands/usage/agent-canvas/managing-automations).
+- **GPT-6 Astra model support** — The Codex ACP model picker includes GPT-6 Astra. ACP agent model lists are sourced from the SDK registry, so no additional configuration is required. See [ACP Agents](/openhands/usage/agent-canvas/acp-agents).
+
+## Improvements and Fixes
+
+- Azure DevOps SSH remote URLs (`git@ssh.dev.azure.com:v3/...`) are now correctly parsed, so repositories cloned over SSH display the correct name and branch.
+- The static server now HTML-escapes injected runtime configuration and sets `Cache-Control: no-store`, fixing an XSS vulnerability.
+- The client ACP registry pin is now tied to the agent-server, ensuring ACP provider lists stay in sync.
+- The automation bundle-source validator now accepts `plugins/` package directories in catalog bundles.
+- SDK bumped to 1.48.0 and automation runtime bumped to 1.12.1.
+
+## Full Changelog
+
+- [GitHub release notes](https://github.com/OpenHands/OpenHands/releases/tag/v1.19.0)
+- [Compare v1.18.0 to v1.19.0](https://github.com/OpenHands/OpenHands/compare/v1.18.0...v1.19.0)
diff --git a/overview/model-context-protocol.mdx b/overview/model-context-protocol.mdx
@@ -57,4 +57,5 @@ When OpenHands starts, it:
 - **For detailed configuration**: See [MCP Settings](/openhands/usage/settings/mcp-settings)
 - **For CLI usage**: See [CLI MCP Servers](/openhands/usage/cli/mcp-servers)
 - **For SDK integration**: See [SDK MCP Guide](/sdk/guides/mcp)
+- **For scoping MCP servers to an agent profile in Agent Canvas**: See [Agent Profiles](/openhands/usage/agent-canvas/agent-profiles)
 - **For architecture details**: See [MCP Architecture](/sdk/arch/mcp)