Research, experiments, and implementation notes filed under devtools.
Chrome DevTools MCP 1.12 Can Reload Agent Browser Policy Live
Chrome DevTools MCP 1.12 can reload URL restrictions and tool settings without a restart, while adding offline heap analysis and parallel page-scoped work.
GitHub AI Scan Expands Pull Request Security Coverage, but It Won't Block Merges
GitHub AI Scan now checks pull request changes in PHP, Bash, Terraform, Dockerfiles, and other gaps in CodeQL coverage, with advisory findings and separate AI-credit billing.
Copilot CLI Local Model Discovery Makes BYOK Less Awkward
GitHub Copilot CLI can now discover supported Ollama models from the model picker, but local model routing still needs clear privacy and capability checks.
Protected Quick Tunnels Make Agent Previews Less Risky
Cloudflare added free email protection to accountless Quick Tunnels, giving local agent previews a lightweight access gate without creating a Cloudflare app.
Repo-Local Skills Turn Agent Work Into Maintained Workflows
OpenAI's Agents SDK maintenance write-up shows how repo-local skills, AGENTS.md, and CI make recurring agent work repeatable.
Copilot Dynamic Workflows Make Agent Runs More Repeatable
GitHub Copilot dynamic workflows put multi-agent orchestration into reusable code, with limits, checkpoints, and resumable runs.
Transformers Can Now Run GGUF Models Without Leaving Python
Hugging Face is bringing llama.cpp-style GGUF quantized checkpoints into Transformers, starting with fast Apple Silicon inference for Qwen3.5 models.
Dynamic Workers Make Agent Sandboxes Cheaper To Throw Away
Cloudflare Dynamic Workers move agent code execution into short-lived isolates, which is a practical shape for sandboxing generated JavaScript with narrow capabilities.
Copilot Local Sandboxing Makes Agent Permissions Concrete
GitHub Copilot app local sandboxing turns agent permissions into per-project policy, which is the right default shape for developer machines.
OpenAI's Agents API Turns the Harness Into a Product
OpenAI's public beta Agents API exposes the managed Codex harness, including sessions, sandboxes, compaction, tool search, and subagents.
GitHub Coverage Rulesets Are Now Scriptable
GitHub added REST API support for code coverage ruleset thresholds, making coverage gates easier to manage across repositories without clicking through settings screens.
AI Agent Benchmarks Need a Consistency Number
IBM's ALTK-Evolve team showed why average pass rates can hide unstable agent behavior, and how Pass^k gives builders a better reliability check.
GitHub Advanced Security Configurations Can Now Be Enforced
GitHub enterprise administrators can now enforce Advanced Security configurations against both repository and organization owners, closing a practical policy gap for large teams.
GitHub Copilot Auto Gets Cost And Quality Tiers
GitHub Copilot auto model selection now has efficiency, balance, and intelligence tiers, giving teams a practical way to steer cost, latency, and quality without picking a model for...
GitHub Copilot Code Review Gets Closer to Real CI
GitHub Copilot code review now uses broader shell tools and an ensemble of agents in Lite reviews, which makes AI review more useful but also worth treating like...
OpenAI Habitat Shows Why Storage APIs Should Be Boring
OpenAI's Habitat storage platform is a useful reminder that predictable APIs, event-loop telemetry, and controlled escape hatches matter more than expressive queries on hot paths.
Cloudflare Workers Gets Closer To Real Node Module Semantics
Cloudflare rebuilt the Workers module registry around URL-based resolution, lazy compilation, shared code caches, import.meta support, and better Node.js compatibility.
VS Code Agent Merge Turns PR Cleanup Into An Agent Loop
VS Code 1.136 adds Agent Merge in preview, giving coding agents a narrower loop for review feedback, failing checks, stale branches, and merge conflicts.
Programmatic Tool Calling Makes Agent Pipelines Smaller
OpenAI's Programmatic Tool Calling lets a model write bounded JavaScript to coordinate tools, which can shrink agent loops when the workflow is predictable and the boundary is clear....
gpt-oss Turns Open Weights Into Agent Runtime Choices
OpenAI's gpt-oss models make open-weight reasoning practical for agent stacks, but teams still need to treat prompt format, memory, tooling, and safety as runtime contracts.
Hugging Face Funes Turns Agent Sessions Into Owned Memory
Hugging Face's funes is a practical local-first memory layer for coding agents: index raw session traces, keep provenance, and share through a dataset only when you choose.
OpenAI Agents SDK Makes Sandboxes A First-Class Boundary
OpenAI's Agents SDK update is a practical reminder that production agents need explicit workspaces, isolated compute, durable state, and credential boundaries.
Codex Turns Agent Runtime Into Platform Work
OpenAI's Codex platform post is a practical reminder that useful agents need runtime boundaries, product-owned context, streaming, and approval flows, not just a chat box.
Ollama Brings Local Models Into Claude Desktop
Ollama's Claude Desktop support gives builders a simple way to route desktop AI work to local or Ollama-hosted open models, with a practical smoke test before trusting the...
GitHub Rule Insights Make Repository Governance Easier To See
GitHub's rule insights dashboard is now generally available at repository and organization levels, giving teams a faster way to audit ruleset failures, bypasses, and enforcement trends.
VS Code Agent Host Makes Coding Sessions Less Tied To One Window
VS Code 1.134 moves agent sessions toward a dedicated Agent Host process, making long-running coding work easier to share, resume, and run near the workspace.
Coding Agent Allowlists Are Not A Security Boundary
A practical look at why trusted-command allowlists can fail for coding agents, and what teams should move into the sandbox boundary instead.
GitHub's License Data Update Makes SBOM Reviews Less Noisy
GitHub is prioritizing registry license metadata in the dependency graph, which should make SBOMs and dependency review checks easier to trust.
Docker Sandboxes Make ESP32 Agent Workflows Less Risky
A practical look at reproducible ESP32 firmware builds, remote serial flashing, and safer AI-assisted hardware loops with Docker Sandboxes.
What MCP Traffic Detection Can—and Cannot—Protect
Where Cloudflare's MCP traffic detection helps, where it cannot, and which controls still belong at the server.
A Workable Artifact Layout for LeRobot Training Runs
Using manifests, checksums, and Hugging Face Storage Buckets to keep mutable robotics runs under control.
What Agent Plugins 1.0 Gets Right About Portable Tooling
A closer look at the portable packaging layer for skills, commands, hooks, and MCP configuration.