Pitchbar — Self-hosted SaaS Sales AI Widget for Any Website v2.1.0

What’s New in v2.1.0​

External tool servers, a themeable marketing site, real control over which AI model you run, and three dashboards that show you what the product is actually doing. Existing buyers get this update for free.

New: MCP tool servers​

Agents can now call tools hosted on external Model Context Protocol servers — your order system, your CRM, your internal API, anything that speaks MCP. Register a server once per workspace, discover its tools, and grant them per agent.

• Server registry — endpoint plus credentials, with the JSON-RPC handshake and server info handled for you. Credentials are encrypted at rest and never rendered back into the UI.
• Per-agent tool grants — discovered tools are listed with their schemas, and each agent gets an explicit allow-list, so a server shared across a workspace never exposes every tool to every agent.
• Safety rails — a remote tool is untrusted input: arguments are sanitised before dispatch, output is truncated before it reaches the prompt, and every server sits behind a circuit breaker that trips on repeated failures instead of stalling the visitor’s turn.
• Activity log — every call recorded with arguments, result size, duration and outcome, viewable per agent, pruned on a schedule.

New: pluggable marketing themes — Aurora and Prism​

• The public marketing site is now theme-driven, and two complete themes ship in the box — each with its own home, pricing, how-it-works, integrations, changelog, privacy and terms pages plus a matching sign-in shell. Switch from the admin without touching code.
• Try Now — the hero can fetch a visitor-supplied URL and run a live demo conversation against that page, so a prospect watches the assistant answer questions about their own site before signing up.

New: model picker with a real latency probe, and provider failover​

• Roughly 95 models across Cloudflare Workers AI, OpenAI and OpenRouter, with the Cloudflare catalogue fetched live from the provider so it can never go stale.
• Probe before you commit — measure a model’s real round-trip latency from your own server instead of guessing.
• Embedding-dimension warnings — a switch that would invalidate your vector index is flagged up front, not discovered after a rebuild.
• Automatic failover — when the primary provider errors or times out, the request falls through to the next provider instead of failing the visitor’s turn. Cloudflare deployments additionally self-heal model-to-model when a model is retired upstream.

New: three operator dashboards​

• Widget Monitor — records widget-side events including the failures that never reach the server, like a stream that closes without completing. A broken embed on a customer site becomes visible in your admin instead of only in a visitor’s browser.
• Hot-path latency — breaks every visitor turn into its stages (embed, vector search, rerank, tool loop, first token, total) and shows prompt size per turn, so a slow deployment is traced to the stage responsible. A perf:hotpath command runs the same measurement from the CLI.
• Turn debugger — a per-turn trace of which path answered, what was retrieved and with what scores, and where the time went.

New: Translation Manager and trial plans​

• Translation Manager — override any user-facing string in any of the 133 shipped locales from the admin, layered over the shipped translation file at runtime. Marketing copy and SEO metadata included, so you can retitle and re-describe the public site per language without editing files or redeploying.
• Time-limited trial plans without a card — grant a plan for a fixed window; when it closes the workspace hits an upgrade wall instead of silently continuing, and the customer keeps their data.

Improvements​

• Sharper retrieval. A follow-up that drops its subject (“and the year?”) keeps that subject for search instead of embedding as a generic query. Optional LLM query rewriting condenses a conversational message into a standalone search query, guarded so a rewrite can never come out worse than the deterministic version it replaces. Sources marked global — contact details, company facts — answer from any page.
• Faster turns. Knowledge-only questions skip the tool-check round-trip entirely, and the reranker is skipped adaptively when the vector search already returned a confident ordering.
• Crawling reach. Two new extraction tiers: Cloudflare’s page-to-markdown renderer, and a vision OCR fallback for pages whose content is locked inside images.
• Indexing that repairs itself. Every indexing job retries on transient failure and a scheduled sweep re-runs sources that failed anyway, so a provider blip no longer leaves a source permanently unindexed. Reindex now works correctly for pasted text, uploaded files and auto-indexed pages, and pasted-text sources can be edited in place.
• Workflow builder. Validation, a test-run mode that simulates a flow without touching a live conversation, and a canvas-first creation flow.
• Right-to-left support. The widget mirrors layout and input direction for Arabic, Hebrew, Persian and Urdu.
• Billing. Stripe automatic tax, pay-by-invoice subscriptions with bank transfer, operator-selectable default currency, yearly pricing, the Stripe-hosted invoice PDF in billing history, and an in-app Stripe health panel that verifies the webhook and tax configuration and can repair them.

Fixes​

• Runs correctly with or without FrankenPHP. The cron queue tick resolves the PHP binary rather than assuming the serving one, and streaming responses lift the execution-time limit PHP-FPM would otherwise apply mid-stream — so a plain Nginx + PHP-FPM host behaves exactly like an Octane deployment.
• Octane worker memory. FrankenPHP’s static binary ships no php.ini, so its compiled-in 128MB limit applied to every worker. A php.ini now ships with the application and is read at worker start.
• No more empty 500s. A PHP deprecation raised while rendering an error could replace the response with an empty 500 and destroy the original exception, making the real failure invisible in the logs. Fixed, with a dedicated log channel so a misconfigured logging environment can’t break logging itself.
• Adding a Google Sheet no longer breaks your Google Docs. The sheet sync kept its own copy of the OAuth token logic and wrote the expiry in a different format than the shared token store reads, so a first Sheet source could break every Doc source in the same workspace. One owner for Google tokens now, and a row already written in the wrong format repairs itself.
• Chat no longer breaks after an hour. The widget session token expires after 60 minutes; a tab left open past that received an error on every message, and the retry button replayed the same expired token. The widget now re-authenticates silently and replays the message — the conversation is resumed, nothing is lost.
• A slow reranker no longer times out the turn. Its HTTP timeout was long enough to push a turn past the widget’s own connection timeout; it now fails fast to the vector ordering, configurable by env var.
• Certificate-mismatched www hosts index again. A site whose TLS certificate covers only the apex domain failed every crawler tier for its www URLs and was treated as permanently broken. The crawler now retries the apex host once, for exactly that signature.
• Other fixes. Duplicate-content detection scoped to the source rather than the whole agent; a Google Docs link pasted into the URL form becomes a Google Doc source instead of a failed crawl; dead OAuth tokens flag the connection and tell the owner to reconnect; provider timeouts are no longer reported as firewall or DNS faults; the message id handed to the widget during streaming is the id that persists; analytics and turn-persistence jobs are consumed rather than accumulating; only one verification email at signup; soft-deleted workspaces no longer appear in the platform list; links in chat messages are clickable; and the marketing site gained a mobile navigation menu.