LoginSign Up
← Back to all sparks
T

Twenty

CRM
Velocity5.0

Modern open source CRM with a fresh interface designed as an alternative to Salesforce and HubSpot.

twenty.com ↗

Twenty 2.58 rebuilds CRM permissions down to the row and adds MCP workflow steps.

open-source-crmpermissionsworkflowsssoapp-platform
◆Current state
Twenty 2.58.0 on November 13 rebuilt how access works: role permissions now compile into row-level rules, legacy per-user permissions are gone and the old workflow object is dropped, all flagged as breaking. The same release adds a workflow step that calls MCP tools, self-service two-factor backup codes and stricter SAML checks. Patches 2.58.1 and 2.58.2 then stopped existing accounts from joining a workspace through SSO without an invitation first.
◆Where it's heading
Twenty is hardening the base under its AI and app platform: tighter access rules, SSO and SAML checks, and apps that run under their own grants. Workflows keep gaining ways to call outside tools, now including MCP servers.
◆Prediction
Expect follow-up patches as self-hosters hit the 2.58 permission changes, and a fix that lets invited users join SSO-only workspaces.

◆Recent moves

  1. 17h ago

    Twenty 2.58.1: SSO no longer adds existing accounts to workspaces

    An existing Twenty account can no longer join a workspace through SSO; it must accept the invitation once by another sign-in method. It tightens access right after 2.58's permission rebuild, at the cost of SSO-only workspaces for now.

    View source ↗
  2. 17h ago

    Twenty 2.58.2 repeats the SSO membership change

    Tagged the same minute as 2.58.1 with identical notes. No separate change is described.

    View source ↗
  3. 19h ago

    Twenty SDK 2.58.0 tag mirrors the 2.58 release

    The SDK tag carries the same list as the main 2.58.0 release, including the breaking permission changes. Nothing extra for app builders beyond what 2.58.0 describes.

    View source ↗
  4. 19h ago

    Twenty 2.58: row-level permissions, MCP workflow step, 2FA codes

    Role permissions now compile into row-level rules and legacy permission paths are removed, as breaking changes. Workflows gain an MCP tool step and users get two-factor backup codes, continuing the work on AI steps with their own scopes from 2.56.

    View source ↗
  5. 1d ago

    Twenty 2.58.0 packages published to npm

    An npm publish record for the 2.58.0 packages. No user-facing change of its own.

    View source ↗
  6. 4d ago

    Twenty SDK 2.57.1 type-checks AI component previews

    AI component previews now run TypeScript checks against installed dependencies, returning errors and locations so the AI can correct its code before the preview runs. Inbox messages also gain fields marking the built-in assistant and the sending app.

    View source ↗