> ## Documentation Index
> Fetch the complete documentation index at: https://recipe.uselettuce.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Week of June 1, 2026

> Self-hosted Lettuce ships, plus branch-aware indexing and a new security page.

## New

**🥗 Self-hosted Lettuce.** Run Lettuce inside your own infrastructure with a one-command bootstrap, license-key activation, and signed container images. See the [install guide](/self-hosted/install) and the new [self-hosted marketing page](https://uselettuce.dev/self-hosted) for the full pitch.

**Bring-your-own everything.** Self-hosted deployments support [GitHub Enterprise Server, GitLab self-hosted, and Bitbucket Data Center](/integrations/overview), Supabase or OIDC auth, and secrets in env vars, HashiCorp Vault, AWS Secrets Manager, or Google Secret Manager.

**OpenTelemetry support.** Self-hosted instances can export traces, metrics, and logs to any OTLP-compatible backend. See [observability](/self-hosted/observability).

**Branch-aware indexing.** Lettuce now indexes and searches per branch end-to-end, so results match the branch your agent is working on. No setup needed — every repo gets it automatically.

**On-the-fly local repo indexing.** A new MCP `index` tool lets your agent pull a local repo into Lettuce on demand, with an `unindex` counterpart and a `wait_until_ready` flag for scripted workflows. See [MCP tools](/mcp-tools).

**One-prompt setup.** New users can copy a single prompt into their coding agent and it wires up Lettuce end-to-end — install, auth, and first repo. See [Quickstart](/quickstart).

**Smarter low-confidence responses.** When Lettuce isn't confident in a retrieval, the MCP response now tells the agent exactly what to try next instead of returning a low-signal result. Guidance is documented in [Agent instructions](/agent-instructions).

**Security page.** A new [/security](https://uselettuce.dev/security) page lays out our architecture, data handling, and isolation model for security reviews.

## Updated

**Bolder homepage copy.** The landing page got a sharper rewrite — clearer headline, tighter value props, and a stronger CTA.

**Truth-audited public pages.** We swept the marketing site for empty links and claims we couldn't back up, and either filled them in or removed them.

**Developer/admin language.** Public copy now talks about *developers* and *admins* instead of *operators*, matching how teams actually describe these roles.

**Clickable repo rows.** Click anywhere on a row in your repo list to open its detail page — no more hunting for the right link.

**Snappier UI.** Subtle micro-animations on buttons, tabs, and list rows make the dashboard feel quicker.

## Fixed

* **Tokens saved now reports correctly.** The dashboard counter was stuck at 0 for some accounts; it now shows the real number.
* **MCP HTTP transport auth.** OAuth discovery probes are now surfaced properly, so agents using the HTTP transport authenticate cleanly on the first try.
* **DNS-rebinding protection.** The MCP server now enforces an `allowed_hosts` list, blocking a class of local-network attacks against self-hosted instances.
* **Bitbucket Data Center OAuth.** Refresh-token rotation is now defensive against partial failures, so long-lived DC installs stay connected.
* **Add Repo dialog.** The dialog now shows a real loading skeleton while repos are being fetched instead of an empty state.
* **"Coming soon" tabs** no longer overlap adjacent UI on narrow viewports.