Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-09-21 · source-backed
PR #5133 adds an optional max_list_pages to stdio, SSE and Streamable HTTP MCP servers. Without it, automatic tool and prompt listing keeps fetching successful pages indefinitely when a server returns fresh continuation cursors, and that happens during tool discovery before the model runs at all. Exceeding the limit raises an actionable UserError without returning partial results or exposing cursor data. None keeps the unlimited default, so this is opt-in hardening you have to actually set.
Each link below shares sources, entities, or timing with this story.
Engrim (SQLite memory readable by four harnesses), Kit by Speakeasy (one binary speaking ACP v1/v2, A2A, MCP and Agent Skills), Yurei (MCP browser control for OpenCode, Cursor, Windsurf and Codex CLI) and Crew (agents messaging each other through ~/.crew hooks) all appeared be...
GitWarren reviews the dirty worktree before anything is committed and ships 17 MCP tools so the agent answers questions inside its own review. Ponytail applies a stop rule before generation. Twinrun runs old and new versions of changed callables on identical inputs and diffs t...
SDK 0.0.82, September 2, makes checkpoint restore refuse to run when HEAD has moved past the commit the checkpoint was taken on. The restore's git reset --hard had been knocking later commits off the branch, leaving them reachable only through the reflog, and the branch move i...
PR #3300, merged August 26, adds a charter under docs/community/working-groups. Transport is where nearly every MCP CVE this week actually lives: unauthenticated Streamable HTTP listeners, origin validation by prefix match, unbounded SSE buffering, DNS rebinding. A chartered g...
That's the classic bypass for any tool that fetches a URL the agent chose: pass the initial check, then redirect somewhere internal. The release also stops using a URL hostname as the MCP HTTP/SSE server_name and closes the agent scope on every failed attempt. (GitHub) If you...
Three separately-maintained projects now occupy the same layer. CodeBurn reads on-disk session files to price 41+ tools locally and flags waste like re-read files and unused MCP servers. caveman (98.9k stars) interposes a local proxy doing content-type-aware compression, JSON...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.