Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-09-05 · source-backed
PR #3447 adds AuthSettings.validate_token_resource: when set, the bearer gate only accepts a token the TokenVerifier reports as issued for resource_server_url, and a token naming another resource gets the same 401 as an unrecognized one. The resource-server gate had checked scopes and expiry but never compared the token's resource indicator with the server's own identifier. Leaving it unset emits an MCPDeprecationWarning and behaves as off. 3.0 makes it the default (GitHub).
Each link below shares sources, entities, or timing with this story.
Warp released its client codebase under AGPL-3.0, surged to 56,000 GitHub stars and #2 on GitHub Trending. But the real story isn't the open-sourcing. It's the repositioning. Warp isn't calling itself a terminal anymore. It's an "agentic development environment." The product n...
Anthropic released Claude Fable 5.1 on September 1. Claude Code v2.1.257 made it the default Fable model at 17:53 UTC that day, with a 1M-token context window, $10 per million input tokens, $50 per million output, and $0.25 per million on cache reads (claude-code CHANGELOG). B...
RFC 9207 issuer identification enforcement in the MCP OAuth flow, isolation of the temporary directory for the macOS Seatbelt sandbox, path resolution and boundary validation hardening in the extension loader, and sanitization of a hardcoded Google CrUX API key out of chrome-d...
Cline 0.0.23 fixed one wedged MCP server blocking the rest from shutting down and leaking their processes. Copilot CLI 1.0.83-5 fixed MCP tools becoming uncallable after a server restart, and 1.0.83-4 fixed agent-configured servers disappearing after built-in sub-agent turns....
The abliteration tool gained 215 stars to reach 30,103, but the stronger signal is downstream: the HF trending endpoint returns DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusion-735-882-Heretic-Uncensored-NM-DAU and Momoking/Qwen3-VL-32B-Heretic-MiniMax-H3-NVFP4, both naming the too...
PR #2629 merged August 31, implementing the client half of RFC 9449 per draft SEP-1932 across 18 files and 1,753 added lines (GitHub). A DpopSession generates a non-extractable keypair and builds proofs with a fresh jti, a query/fragment-stripped htu, and an ath binding when p...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.