Axtary, an open-source content authorization tool for AI agents, launched v0.5.0 on npm under Apache-2.0. The tool enforces policy on exact payloads—such as diffs, messages, or tool calls—before execu…
Skill registries extend beyond filesystem-based discovery to support publish, install, search, semantic search, dependency resolution, and trust signals, according to a lesson in the Agent Skills Mast…
A backend engineer built and published a Model Context Protocol (MCP) server for Spain's AEMET weather API, exposing three read-only tools. The API uses a two-step pattern where the first call returns…
Five major large language models (LLMs) — Claude, Codex, Gemini, and two others — consistently hallucinate the same 127 nonexistent Python and npm package names, according to researcher Aleksandr Chur…
Anthropic launched Claude Code in early 2025, a terminal-based agentic coding tool that uses the Claude 3.5 Sonnet model to read files, execute shell commands, and write code directly to a local files…
Palo Alto Networks acquired Koi, an AI-native developer security product, to address blind spots in EDR/XDR systems that cannot detect threats from VS Code extensions, local MCP servers, and rogue AI …
Researcher Aleksandr Churilov found that five top AI coding tools—Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2—hallucinate the same 127 nonexistent package name…
A free, open-source tool called Draw Your Font lets users turn a photo of their handwritten alphabet into an installable TTF, WOFF, or WOFF2 font entirely on their local machine, with no uploads or cr…
Developer danilo-znamerovszkij has open-sourced a pipeline that converts handwriting photos into TTF fonts using npm, with a Claude Code skill wrapper that automates vision labeling and local build. T…
A developer found that ten git worktrees consumed 9.9 GB of disk on an EXT4 filesystem, mostly from duplicate node_modules and vendor directories. Using jdupes to hardlink byte-identical files reduced…
Kimi K3, an AI system, exploited a Redis server using a 0-day vulnerability it discovered, completing the attack in 27 minutes with 32 agents, marking the first known instance of an LLM autonomously w…
GitHub new repositories surged 79.2% month-over-month to 9.0 million, while AI crawlers now account for 5.8% of all HTTP requests, according to Cloudflare Radar. The data, compiled from 15 sources inc…
The npm package @copilot-mcp/apex is a postinstall dropper that installs a macOS infostealer on any machine that runs npm install or npx @copilot-mcp/apex, according to a security analysis. The packag…
Szr, a Go-native CLI proxy developed by devr-tools, reduces noisy terminal output before it reaches an LLM context, preserving exit codes and saving tokens on logs, diffs, and test output. It wraps co…
Developer Raj Nandan released json-to-md, an open-source tool that converts JSON documents into deterministic, human-readable GitHub Flavored Markdown, with byte-identical output across TypeScript and…
Pkgxray, a pre-install security tool for npm packages, MCP servers, and AI agents, uses static analysis to inspect packages before installation, reporting SAFE, REVIEW, or BLOCK verdicts without execu…
Claude Code hides context window usage and API rate-limit data until users hit limits, but a developer created the open-source npm package cc-context-telemetry to expose these numbers. The tool wraps …
A sophisticated multi-stage npm supply chain worm called SANDWORM_MODE was discovered in early 2026, targeting AI-augmented development environments like GitHub Copilot and Cursor. The worm exploits i…
A new independent study by researcher Aleksandr Churilov found that five frontier large language models—Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2—collectivel…
Developer Matheus Gomes released Decoreba, a 6.2 MB command palette for the terminal written in pure Go with zero dependencies, featuring fuzzy search, typo tolerance, recency ranking, and an MCP serv…