techlist.io
KREN

Techlist.io - Korean Tech Blog Curator

gitlab3 min readCurated summary

GitLab 18.11: Budget guardrails for GitLab Credits

GitLab 18.11 introduces spending controls for GitLab Credits used by the Duo Agent Platform. Organizations can set subscription-wide monthly caps, limit individual users, and monitor enforcement, making AI costs more predictable as adoption grows. The goal is to combine usage-based pricing with the budget certainty traditionally associated with seat-based licensing. ## Subscription-Level Spending Caps - Billing account managers can set a hard monthly ceiling in the Customers Portal. - When usage reaches the cap, Duo Agent Platform access pauses for all users until the next billing period. - Managers can raise or disable the cap mid-month to restore access. - Caps reset monthly and remain in effect until changed. - Because usage data is synchronized periodically, limited usage may occur after the cap is technically reached. ## Per-User Credit Limits - A flat per-user limit can be applied uniformly through the GitLab GraphQL API. - Custom overrides allow organizations to give higher allocations to selected users, such as staff engineers. - Limits apply to a user’s total consumption across all credit sources. - Reaching an individual limit pauses only that user’s Duo Agent Platform usage; their GitLab access remains intact. - Other users continue working until they reach their own limits or the subscription cap. ## Visibility and Notifications - Billing account managers receive email notifications when the subscription cap is reached. - Group owners on GitLab.com and instance administrators on Self-Managed installations can see users blocked by per-user caps. - Administrators can restore access by changing limits through the GraphQL API. - Per-user usage data supports monitoring, chargeback, and future budget planning. ## Benefits for Scaling AI Adoption - Hard caps make AI spending easier to forecast, approve, and include in quarterly budgets. - Per-user limits help distribute credits fairly across teams and cost centers. - Organizations can expand from small pilots to hundreds or thousands of developers without risking uncontrolled invoices. - Usage data helps platform teams understand consumption patterns and adjust allocations. ## Usage-Based Pricing with Guardrails GitLab contrasts its approach with seat-based AI tools, where organizations pay a fixed amount per user regardless of usage. GitLab Credits instead charge based on actual consumption while adding enforced spending limits, combining flexibility with predictable budgeting. ## Example Deployments - A 200-person engineering organization can set a subscription cap matching its approved monthly budget. - If usage approaches the limit, finance or billing managers can either increase the cap or wait for the next period. - A 2,000-person enterprise can apply standard limits to most developers while allocating higher caps to engineers handling complex work. ## Availability and Setup - The controls are available for GitLab.com and Self-Managed customers running GitLab 18.11. - Subscription-level caps are configured by billing account managers in the Customers Portal. - Flat and custom per-user caps are configured through the GitLab GraphQL API by namespace owners or instance administrators. Organizations adopting GitLab Duo Agent Platform should establish a subscription cap, define fair per-user allocations, and monitor usage regularly. These controls provide a safer foundation for expanding AI usage without sacrificing financial oversight.

Read original(opens in new tab)
Machine LearningGitlabSoftware DevelopmentSaas+4
gitlab1 min readCurated summary

GitLab 18.11 release notes | GitLab Docs

Agentic SAST Vulnerability Resolution is now generally available in GitLab 18.11 through the GitLab Duo Agent Platform. It autonomously analyzes critical and high-severity SAST findings, proposes code fixes, and creates ready-to-review merge requests. The feature is designed to accelerate remediation while giving reviewers confidence assessments and the option to apply fixes directly from vulnerability details. ## Availability and Integration - Available with GitLab Ultimate. - Supported on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. - Runs: - As part of a SAST scan - After SAST false-positive detection - Manually for individual SAST vulnerabilities ## Automated Vulnerability Analysis - Examines each finding and reasons through the surrounding code context. - Generates proposed fixes for critical and high-severity SAST vulnerabilities. - Automatically opens a merge request containing the remediation for review. ## Review and Remediation Workflow - Provides quality assessments to help reviewers evaluate the likely reliability of each proposed fix. - Lets users apply resolutions directly from vulnerability details pages. - Feedback is welcomed through GitLab issue 585626. ## Practical Recommendation Teams using GitLab Ultimate can enable the feature to streamline SAST remediation, while still reviewing agent-generated merge requests before merging changes.

Read original(opens in new tab)
GitlabCode QualityDevOpsSast+3
github2 min readCurated summary

Build a personal organization command center with GitHub Copilot CLI

Brittany Ellich built a personal organization command center to reduce the friction of switching between numerous apps. Using GitHub Copilot for planning and implementation, she created a working first version in one day. Her experience suggests that AI-assisted development makes it easier to turn everyday frustrations into practical, customized tools. ## The Problem: Digital Fragmentation - Brittany wanted to consolidate information scattered across roughly a dozen applications. - Her goal was a calm, visual workspace suited to her learning style and the way she organizes information. - The project became a personal command center for bringing disparate work and productivity tools together. ## Planning and Building with AI - Brittany uses a “plan-then-implement” workflow. - During planning, Copilot interviews her about requirements and behavior until they form a sufficiently detailed plan. - Copilot then implements the system based on that plan, reducing guesswork and making development smoother. - The first version was completed in a single day alongside her normal work. ## Her Development Workflow - She uses VS Code Agent Mode for synchronous work, generally running up to two non-competing agent workflows. - She uses Copilot Cloud Agent for asynchronous, well-scoped tasks such as bug fixes and technical-debt cleanup. - This division lets her focus personally on work requiring close oversight while agents handle lower-risk background tasks. ## Technology Stack - **Electron** for the cross-platform desktop application. - **React** for the interface, components, and state management. - **Vite** for development tooling and hot module replacement. - **Tailwind CSS** for styling. - **WorkIQ MCP and CLI** for accessing Microsoft 365 data, including calendar information. - The application also uses ElevenLabs for its voice assistant. Although Brittany had wanted to build an Electron app, she learned relatively little about Electron because Agent Mode handled most of the implementation. She later simplified the repository manually to make it suitable for public release, noting that agents tend to add code more readily than remove it. ## Getting Started The project is available as the open-source `command-center-lite` repository. Running it requires Node.js 18 or later, GitHub Copilot CLI for WorkIQ setup, a Microsoft 365 account for calendar synchronization, and an ElevenLabs account for voice features. The broader recommendation is to start building solutions for small, personal problems. AI tools can accelerate both learning and implementation, making experimentation with unfamiliar technologies far more accessible.

Read original(opens in new tab)
Model Context ProtocolReactGithub Copilot CliNode.Js+3
cloudflare2 min readCurated summary

Register domains wherever you build: Cloudflare Registrar API now in beta

Cloudflare has launched its Registrar API in beta, allowing domains to be searched, checked, and registered programmatically. The API is designed for AI agents, editors, deployment pipelines, and other automated workflows, closing the gap between developing an idea and securing its domain. Its three-step process uses cached search results, authoritative availability checks, and streamlined registration with account defaults. ## Built for Agents and Automation - Supports domain registration directly from code editors, terminals, backend services, and deployment pipelines. - Enables agents to: - Generate domain name ideas - Search candidate names - Confirm availability and pricing - Register a selected domain after user approval - Registration responses can complete immediately or provide a status endpoint for polling. - The API is available through Cloudflare’s existing API and MCP integration, so tools such as Cursor, Claude Code, and other MCP-compatible environments require no separate custom integration. ## Search, Check, and Register - **Search:** Finds candidate domains, optionally across extensions, and returns registrability, tier, currency, registration cost, and renewal cost. - **Check:** Queries the registry directly for current availability and pricing. - **Register:** Completes the purchase using a minimal request containing the domain name. Cloudflare recommends checking availability immediately before registration because search results are cached and popular names can become unavailable within seconds. ## Registration Defaults and Protection - The only required registration field is the domain name. - The account’s default registrant contact and payment method are used automatically when configured. - Contact details can instead be supplied in the request. - WHOIS privacy is enabled by default at no additional cost. - Registrations include details such as active status, expiration date, auto-renewal, privacy, and domain lock state. - Premium domains may be supported, but require explicit acknowledgement of their fees. ## Initial Availability - The beta initially supports a curated selection of popular top-level domains. - Cloudflare directs users to the Registrar API documentation for the current supported TLD list. The API makes domain acquisition a natural part of automated development workflows: search a name, verify its live price and availability, obtain approval, and register it in seconds without leaving the development environment.

Read original(opens in new tab)
AutomationCloudflare ApiApi DevelopmentDomain Registration+3
cloudflare3 min readCurated summary

Project Think: building the next generation of AI agents on Cloudflare

Project Think is Cloudflare’s next-generation Agents SDK for building persistent, scalable AI agents. It combines durable execution, sub-agents, persistent sessions, sandboxed code execution, and runtime-created extensions, while allowing developers to use individual primitives or an integrated Think base class. Its central argument is that agents should run as durable, one-to-one infrastructure rather than ephemeral processes on laptops or permanently running servers. ## Why Agents Need a New Foundation - Coding agents increasingly act as general-purpose assistants by reading context, writing and executing code, observing results, and iterating. - Existing agents are limited by: - Dependence on a laptop or costly VPS - Fixed costs while idle - Manual installation, updates, identity, and secret management - Unlike traditional applications, agents are typically one-to-one: each user, task, or conversation may require a distinct agent. - Supporting millions of concurrent agents with always-on containers would be economically impractical. ## Project Think’s Core Primitives Project Think introduces: - Durable execution through fibers, including checkpointing, crash recovery, and automatic keepalive - Isolated sub-agents with independent SQLite databases and typed RPC - Persistent, searchable sessions with message trees, branching, and compaction - Sandboxed code execution using Dynamic Workers, codemode, and runtime npm resolution - An execution ladder spanning workspaces, isolates, npm packages, browsers, and sandboxes - Self-authored extensions that let agents create tools dynamically ## Long-Running Agents with Durable Objects - Each agent is implemented as a Durable Object with: - A stable identity - Persistent SQLite-backed state - Message-based wake-up - Automatic hibernation when idle - Agents can resume after HTTP requests, WebSocket messages, alarms, or inbound email. - Hibernated agents consume no compute, allowing many more agents than an always-on VM or container model. - Durable Objects provide automatic routing, recovery, and per-agent state without separately managed load balancers, databases, or process supervisors. - For example, 10,000 agents active only 1% of the time require capacity for roughly 100 active agents rather than 10,000 continuously running instances. ## Durable Execution with Fibers - Long LLM calls and multi-step workflows can be interrupted by deployments, restarts, or resource limits. - `runFiber()` makes a function invocation durable by: - Registering it in SQLite before execution - Allowing progress to be checkpointed with `stash()` - Recovering interrupted work through `onFiberRecovered` - Agents can save intermediate findings, resume from the latest checkpoint, and broadcast progress to clients. - The SDK automatically keeps the agent alive while a fiber runs. - `keepAlive()` and `keepAliveWhile()` support active work lasting minutes or longer, such as CI pipelines, design reviews, and video generation. Project Think’s recommendation is to treat agents as persistent, addressable infrastructure: use the low-level primitives for customization, or adopt the Think base class for a faster, integrated starting point.

Read original(opens in new tab)
Database DesignDurable ObjectsSqliteAgents Sdk+4
cloudflare3 min readCurated summary

Browser Run: give your agents a browser

Cloudflare is renaming Browser Rendering to Browser Run and positioning it as a full browser platform for AI agents. It provides remotely hosted Chrome sessions that agents can control, observe, debug, record, and scale globally, while allowing humans to intervene when necessary. The update expands access through CDP and MCP, making existing automation tools and AI coding assistants compatible with Cloudflare’s browser infrastructure. ## Browser Run for AI Agents - Agents can navigate websites, read content, fill out forms, extract data, take screenshots, and verify results. - Browser sessions run on Cloudflare’s global network, reducing infrastructure and browser-maintenance requirements. - Sessions can scale dynamically and open near users for lower latency. - The platform now supports up to 120 concurrent browsers, up from 30. ## Observability and Human Intervention - **Live View** shows an agent’s browser session in real time, making it easier to confirm success or diagnose failures. - **Human in the Loop** allows agents to transfer control when they encounter login screens or unusual edge cases. - A human can resolve the issue and return control to the agent. - **Session Recordings** capture DOM changes, interactions, and navigation for debugging and postmortem analysis. ## Browser Control Options Browser Run supports several levels of automation: - Low-level control through the Chrome DevTools Protocol (CDP). - Higher-level automation with Puppeteer and Playwright. - Quick Actions for simpler tasks. - WebMCP for websites that expose agent-discoverable actions. ### Chrome DevTools Protocol - Browser Run now exposes CDP directly through a WebSocket endpoint. - Existing CDP-based frameworks, scripts, and agent tools can connect with minimal changes. - CDP provides capabilities beyond Puppeteer and Playwright, including JavaScript debugging. - Raw protocol messages can be sent directly to models, potentially reducing token usage. - Developers can connect from any language or environment without creating a Cloudflare Worker. - Self-hosted Chrome scripts can be migrated by changing the browser WebSocket URL and adding Cloudflare authentication headers. ### MCP Client Support - MCP clients such as Claude Desktop, Cursor, Codex, and OpenCode can use Browser Run as a remote browser. - Cloudflare supports the `chrome-devtools-mcp` package, which provides browser automation, debugging, and performance-analysis capabilities. - Configuration requires pointing the MCP server to Browser Run’s CDP endpoint and supplying an API token. ### WebMCP - WebMCP is intended to make websites more reliable for AI agents. - Websites can declare actions that agents can discover and call directly. - This addresses the limitations of a web originally designed primarily for human navigation. ## Overall Direction Cloudflare’s update combines hosted browser infrastructure, multiple automation interfaces, real-time visibility, replayable sessions, and human fallback. The goal is to make browser-based agents more dependable in production while avoiding the operational burden of managing Chrome infrastructure themselves. For teams building web-using agents, Browser Run offers a practical path from self-hosted or local browser automation to scalable, observable remote sessions, especially when existing CDP, Puppeteer, Playwright, or MCP tooling is already in use.

Read original(opens in new tab)
AI AgentsCloudflareHuman In The LoopPuppeteer+4
cloudflare3 min readCurated summary

Introducing Agent Lee - a new interface to the Cloudflare stack

Agent Lee is Cloudflare’s new in-dashboard AI assistant, designed to replace complex navigation with natural-language interaction across the Cloudflare platform. It can inspect account data, troubleshoot issues, and—when explicitly approved—make changes or deploy resources. Built on Cloudflare’s own infrastructure, it combines sandboxed code execution, permission controls, and generative UI to provide an interactive way to manage real accounts. ## A Natural-Language Interface to Cloudflare - Agent Lee understands account resources such as Workers, zones, DNS settings, and error rates. - Users can ask it to: - Identify the top error messages for a Worker. - Diagnose access problems involving a `www` prefix. - Enable Cloudflare Access for a domain. - Create an R2 bucket and connect it to a Worker. - It can retrieve account-specific context, use the appropriate tools, and present results through charts and other visualizations. - The beta reportedly serves about 18,000 daily users and performs nearly 250,000 tool calls per day across services including DNS, Workers, SSL/TLS, R2, Registrar, Cache, Cloudflare Tunnel, and API Shield. ## Codemode and Sandboxed Execution - Instead of exposing raw MCP tool definitions to the model, Agent Lee uses Codemode. - The model writes TypeScript that calls a generated API, which is intended to improve accuracy and support multi-step operations in a single script. - Generated code runs through a Cloudflare MCP server and a Durable Object acting as a credentialed proxy. - The Durable Object: - Classifies operations as reads or writes by inspecting the method and request body. - Proxies read operations directly. - Blocks write operations until the user explicitly approves them. - Keeps API keys out of generated code and injects credentials server-side. ## MCP Permissions and User Approval - Agent Lee connects to Cloudflare’s MCP server through: - A search tool for querying API endpoints. - An execute tool for running code that performs API requests. - Any operation that changes the account must pass through an elicitation step. - Approval is an enforced permission boundary rather than merely a confirmation-oriented interface feature. - Agent Lee cannot bypass the approval gate before executing writes. ## Built on Cloudflare’s Public Stack - Agent Lee uses the same building blocks available to Cloudflare customers: - Agents SDK - Workers AI - Durable Objects - Cloudflare’s MCP infrastructure - Cloudflare developed and tested the system in production against real accounts. - The company positions this approach as a way to identify platform limitations and validate patterns that other developers can reuse. ## Generative UI - Agent Lee supplements text responses with dynamically generated interface components. - Questions about traffic can produce interactive line charts rather than plain numerical summaries. - An adaptive grid lets users reserve space for new UI blocks by dragging across the interface and describing what they want. - Supported components include: - Tables - Interactive charts - Architecture maps - Other dynamic visual blocks - The result is intended to turn conversation history into an evolving operational dashboard. ## Quality and Safety - Elicitations are used whenever Agent Lee needs to perform a non-read action, requiring explicit approval in the interface. - Cloudflare also evaluates the system’s: - Conversation success rate - Information accuracy - Because the product remains in beta, users may encounter limitations or edge cases as its reliability and performance continue to improve. Agent Lee’s central promise is to make Cloudflare operations conversational without removing control. Its most important design choice is the combination of broad account awareness with a structural approval gate for changes, while its generative UI makes the resulting information and workflows more actionable.

Read original(opens in new tab)
Database DesignCloudflareUser InterfaceTypeScript+4
cloudflare3 min readCurated summary

Add voice to your agent

Cloudflare’s experimental `@cloudflare/voice` package adds real-time voice to existing Agents SDK applications without requiring a separate voice framework. Voice interactions use the same Durable Object, WebSocket connection, tools, and SQLite-backed history as text interactions. The package provides ready-made STT and TTS integrations while keeping provider interfaces open for alternative speech, telephony, and transport systems. ## Voice Support for Existing Agents - `withVoice(Agent)` enables full conversational voice agents. - `withVoiceInput(Agent)` supports speech-to-text-only features such as dictation and voice search. - React applications can use `useVoiceAgent` and `useVoiceInput`. - Framework-independent clients can use `VoiceClient`. - Built-in Workers AI providers include: - Deepgram Flux for continuous speech-to-text - Deepgram Nova 3 for speech-to-text - Deepgram Aura for text-to-speech - Developers can get started without external API keys. ## Minimal Server and Client Setup - A voice agent extends a class created with `withVoice(Agent)`. - The server configures a transcriber and TTS provider, then implements `onTurn()`. - `onTurn()` receives the user’s transcript and returns the agent’s response. - React clients can display: - Connection status - Interim and finalized transcripts - Conversation messages - Start, end, and mute controls - Non-React applications can connect through `@cloudflare/voice/client`. ## How the Voice Pipeline Works - The browser captures 16 kHz mono PCM microphone audio. - Audio streams over the agent’s existing WebSocket connection. - A continuous STT session remains active for the duration of the call. - The speech-to-text model detects completed utterances and produces stable transcripts. - Each transcript is passed to `onTurn()` for application or LLM logic. - The response is synthesized into audio and streamed back to the client. - Streamed responses can be sentence-chunked so audio begins playing before the full response is complete. - User and agent messages are persisted in the Durable Object’s SQLite database, surviving reconnections and deployments. ## Extensible Provider Architecture - The package is designed not to lock developers into one fixed voice stack. - Small provider interfaces allow speech, telephony, and transport providers to build integrations. - Developers can mix and match components based on their application’s requirements. - Voice therefore becomes another interaction mode for the same stateful agent rather than a separate application architecture. Cloudflare’s approach is best suited to developers who already use the Agents SDK and want to add conversational voice while preserving existing state, tools, persistence, and connection patterns. Since the package is experimental, teams should evaluate provider support and API stability before relying on it in production.

Read original(opens in new tab)
Database DesignReactSqliteSpeech To Text+3
cloudflare3 min readCurated summary

Rearchitecting the Workflows control plane for the agentic era

Workflows was originally designed for human-paced events, but autonomous agents now create and manage workflow instances at machine speed. To support this shift, the platform increased its limits substantially and redesigned its control plane for horizontal scalability. The new architecture replaces V1’s account-level bottleneck with distributed components while preserving durable execution, retries, and human-in-the-loop pauses. ## The Shift to Agent-Driven Workloads - Workflows initially handled events such as sign-ups and purchases, typically requiring only one instance per person. - Persistent agents can operate for hours or days and launch dozens of workflows from a single session. - Concurrent agents can create thousands of workflow instances within seconds. - Workflows also serve as durable execution harnesses for agent loops, maintaining progress across failures and supporting asynchronous work. ## Higher Workflows Capacity The platform now supports: - **50,000 concurrent instances**, up from 4,500. - **300 instance creations per second per account**, up from 100. - **2 million queued instances per workflow**, up from 1 million. These increases were driven by observed usage patterns and a redesign of the control plane. ## V1: A Single Account-Level Bottleneck - Each workflow consists of durable, independently retryable steps that can run tasks, wait for events, or sleep until a scheduled time. - SQLite-backed Durable Objects provide execution, coordination, and storage. - An **Engine Durable Object** is created for each workflow instance and handles execution, retries, and sleeping. - A single **Account Durable Object** manages account-wide workflow and instance metadata. - All create, update, and list operations passed through the Account object. - High-volume customers could generate thousands of requests per second as instances started and completed, overwhelming the singleton. - The original rate limits were therefore hard architectural limits rather than adjustable product settings. ## V2: Horizontal Scaling Principles The redesigned control plane is based on several architectural changes: - The instance’s **Engine is now the sole source of truth** for whether that instance exists. - The system verifies that an Engine exists before queuing an instance, avoiding queued instances with no running execution object. - Instance lifecycle and liveness operations are distributed across workflows and regions so they can scale horizontally. - The Account singleton stores only essential metadata and has a bounded maximum number of concurrent requests. - Limits are designed to be flexible and increaseable rather than constrained by one central bottleneck. ## SousChef and Gatekeeper - V2 introduces two central components: **SousChef** and **Gatekeeper**. - SousChef acts as a “second in command” to the Account, taking over work that previously concentrated all workflow and instance management in one Durable Object. - Together, these components are intended to distribute control-plane responsibilities and enable higher creation rates and concurrency. - The migration was performed with live traffic, allowing customers to move to the new architecture without interruption. The redesign aligns Workflows with agentic workloads by moving coordination away from a single account-level Durable Object. Developers running high-volume or highly concurrent agents should benefit from the new limits and a control plane that can continue scaling independently.

Read original(opens in new tab)
Database DesignDurable ObjectsSqliteScalability+3
line4 min readCurated summary

ODW #2: Developing Single/Multi-Agents with ADK and Integrating with Internal Systems

AI adoption can improve productivity, but relying on individual developers to create and refine local AI agents leads to knowledge silos, duplicated effort, and uneven results. LY Corporation’s Orchestration Development Workshop addresses this by teaching engineers to build shared single- and multi-agent systems with Google’s Agent Development Kit (ADK). The workshop combines theory with hands-on integration of agents and internal tools such as Jira and Confluence through MCP. ## Organizational Need for AI - Potential applications include pull request reviews, customer support, and internal document search. - Information is difficult to find because company knowledge is distributed across systems such as Jira and Confluence. - LY Corporation aims to double work productivity within three years through AI and continuous innovation. - As tools such as Cline and Claude Code spread, usage remains concentrated among individuals. - This creates: - Productivity gaps between employees - AI knowledge silos - Repeated prompt-development work across teams - Limited awareness of multi-agent approaches - Abandonment of AI when single agents cannot handle complex tasks ## Why a Hands-On Workshop The organizers concluded that organization-wide adoption required practical understanding of three areas: - The strengths and limitations of single-agent and multi-agent systems - A team-based model for building and sharing centralized agents - Integration between AI agents and internal systems through the Model Context Protocol (MCP) Rather than teaching only concepts, the workshop required participants to build working agents with ADK. ## Single-Agent and Multi-Agent Systems - **Single agents** - Use one LLM and are relatively inexpensive and simple to develop. - Work well for straightforward tasks. - Struggle with complex problems requiring multiple specialties. - **Multi-agent systems** - Divide work among multiple specialized LLM-based agents. - Can handle more complex workflows and optimize tasks more effectively. - Require more development effort and token usage. - Must be designed carefully to avoid usage limits and excessive costs. ## Introducing Google ADK - ADK is open-source software for defining agent behavior and building multi-agent systems. - It supports Python, Java, and Go. - Python functions can be exposed as tools that agents invoke. - Teams can build and host shared agents, reducing the need for every employee to independently optimize prompts. ## Building a Single Agent Participants practiced: - Running an ADK web UI and interacting with an agent in a browser - Modifying instructions to change agent behavior - Connecting a prepared Python function as an executable tool The exercises demonstrated that prompts can flexibly control responses and that ordinary Python code can be integrated into an agent with relatively little effort. ## Connecting Agents to Internal Systems with MCP - MCP is an open standard for connecting LLMs to external systems. - It enables agents to actively search sources such as previous inquiries, documentation, Jira, and Confluence. - Participants learned that merely exposing tools is insufficient; the agent also needs clear instructions to use them effectively. - Giving one agent too many tools can enlarge its context, slow responses, and reduce accuracy. - Splitting responsibilities across multiple agents can help isolate context and mitigate these problems. ## Building a Sequential Project Tracker The main exercise created a project-tracking system that analyzes Jira projects and produces translated progress reports. - Four agents execute sequentially: 1. Analyze in-progress tasks 2. Analyze todo or unstarted tasks 3. Generate a consolidated Markdown report 4. Translate the report into the configured language - The first two agents use Jira through MCP. - The report generator synthesizes the preceding analyses. - The translator preserves the report’s formatting and structure. - ADK’s `SequentialAgent` coordinates the workflow and passes results between specialized agents. ## Practical Recommendation Organizations seeking broader AI adoption should move beyond individual experimentation. Shared agents built with ADK, connected to internal systems through MCP, can consolidate expertise, reduce duplicated prompt work, and make multi-agent workflows accessible to entire teams.

Read original(opens in new tab)
AIKubernetesModel Context ProtocolPython+4
gitlab3 min readCurated summary

A guide to the breaking changes in GitLab 19.0

GitLab 19.0 is expected to introduce 15 breaking changes, primarily by removing deprecated components and outdated platform support. The most significant effects involve Helm chart networking and bundled services, OAuth authentication, PostgreSQL, Redis, and supported operating systems. Administrators should audit their deployments and complete migrations before upgrading. ## Release and Deployment Windows - **GitLab.com:** Primary breaking-change window is May 4–6, 2026, with a fallback window on May 11–13. - **GitLab Self-Managed:** GitLab 19.0 becomes available May 21, 2026. - **GitLab Dedicated:** Upgrades occur during assigned maintenance windows, with GitLab 19.0 scheduled for the week of June 22, 2026. - Additional changes may roll out outside these windows in exceptional circumstances. ## High-Impact Changes ### NGINX Ingress Replaced by Gateway API - The GitLab Helm chart will use **Gateway API with Envoy Gateway** as its default networking configuration. - Bundled NGINX Ingress reached end-of-life in March 2026. - Existing deployments can explicitly continue using bundled NGINX Ingress until its planned removal in GitLab 20.0. - The change does not affect: - NGINX used by the Linux package. - Deployments using externally managed Ingress or Gateway API controllers. - Administrators should plan migration to Envoy Gateway or another externally managed controller. ### Bundled PostgreSQL, Redis, and MinIO Removed - The GitLab Helm chart and GitLab Operator will no longer bundle Bitnami PostgreSQL, Bitnami Redis, or the forked MinIO chart. - These components were intended for proof-of-concept and test environments, not production. - Deployments using them must migrate to external services before upgrading. - PostgreSQL and Redis bundled with the Linux package are unaffected. ### OAuth ROPC Grant Removed - The Resource Owner Password Credentials OAuth flow will be removed across GitLab.com, Self-Managed, and Dedicated. - ROPC is being eliminated because of security limitations and its removal from OAuth 2.1. - Applications using ROPC must migrate to a supported flow, such as Authorization Code. - After upgrading, ROPC will not work even when client credentials are provided. ### PostgreSQL 17 Becomes Required - PostgreSQL 16 will no longer be supported; PostgreSQL 17 becomes the minimum version. - Single PostgreSQL instances installed through the Linux package may be upgraded automatically during GitLab 18.11. - Cluster deployments and installations that opt out of automatic upgrades require a manual migration. - Administrators should verify sufficient disk space and complete the upgrade before GitLab 19.0. ## Medium-Impact Changes ### Ubuntu 20.04 Packages Discontinued - GitLab will stop publishing Linux packages for Ubuntu 20.04. - GitLab 18.11 is the final release supporting that distribution. - Affected installations must upgrade to Ubuntu 22.04 or another supported operating system first. ### Redis 6 Support Removed - External Redis 6 deployments must migrate to Redis 7.2 or Valkey 7.2. - The Linux package’s bundled Redis is unaffected because it has used Redis 7 since GitLab 16.2. - Migration options vary by provider: - AWS ElastiCache and GCP Memorystore: Redis 7.2 or Valkey 7.2. - Azure: self-host Redis or Valkey on VMs or AKS until managed support is available. - Self-hosted installations: upgrade directly to Redis 7.2 or Valkey 7.2. ### Auto DevOps Builder Image Updated - The CNB builder image used by Auto DevOps changes from `heroku/builder:22` to `heroku/builder:24`. - Pipelines relying on the older image may need testing or configuration updates. GitLab administrators should review the deprecations and upgrade documentation, identify whether their deployment uses any affected components, and complete required migrations before GitLab 19.0.

Read original(opens in new tab)
Database DesignGitlabPostgreSQLDevOps+4
figma2 min readCurated summary

The TL;DR on MCP: Why Context Matters and How to Put It to Work | Figma Blog

MCP (Model Context Protocol) connects AI tools to the design decisions and data stored in tools like Figma. Figma argues that giving coding agents structured access to components, tokens, and layout rules produces code that better matches the intended design and design system. It also creates a two-way workflow in which developers and designers can move between code and canvas without losing context. ## MCP Connects Design and Development - Product work is increasingly iterative rather than a linear design-to-development handoff. - MCP lets AI coding tools access Figma files as structured design sources, not merely as screenshots. - Figma’s MCP server helps bring design context into code, while code-to-canvas tools can bring working interfaces back into Figma. - This keeps the broader product team involved as designs and implementations evolve. ## Why Context Matters for AI-Generated Code - Without context, an AI tool may: - Choose a color that resembles the brand color but is not linked to the correct design token. - Recreate a card instead of reusing an established component. - Flatten a complex, nested form into a single basic element. - These seemingly minor deviations accumulate across screens and components. - MCP exposes the underlying components, tokens, and layout decisions that explain how a design was built. ## Designers: Files Directly Influence Production Code - Design systems now influence not only human implementation but also AI-generated code, from prototypes through production. - Well-structured, consistent Figma files can guide AI toward more reliable and on-brand results. - Poor organization or small inconsistencies can spread widely because AI reproduces them at scale. - MCP also lets designers review code-built interfaces in Figma, add missing states, refine details, and prepare work for production without starting over. ## Developers: Less Translation, More Building - AI coding tools can accelerate implementation, but their output is less accurate when design intent is unavailable. - MCP reduces the translation required between a visual design and working code by supplying the system and component context behind the design. - Developers can spend more time building instead of reconstructing design decisions from screenshots or incomplete handoffs. Figma’s practical recommendation is to treat design files and design systems as active inputs to AI workflows. The better the structure and context captured in those files, the more consistently AI can generate code that reflects the intended product.

Read original(opens in new tab)
FigmaAIDesign SystemsAI Agents+3
aws3 min readCurated summary

AWS Interconnect is now generally available, with a new option to simplify last-mile connectivity | Amazon Web Services

AWS Interconnect is a managed service for private, high-speed connectivity between AWS and other clouds or on-premises networks. Its multicloud capability, now generally available, initially connects AWS with Google Cloud while Microsoft Azure support is planned for later in 2026. The service aims to replace complex VPN, colocation, and third-party networking setups with a turnkey, resilient configuration managed through AWS. ## AWS Interconnect Capabilities - **Interconnect – multicloud** connects an AWS VPC privately to VPCs on other cloud providers. - **Interconnect – last mile** simplifies connectivity from branch offices, data centers, and remote sites through existing network providers. - Both capabilities provide: - Dedicated bandwidth - Private connectivity - Managed provisioning - Reduced infrastructure and configuration overhead - Connections can be configured through the AWS Console by selecting the location or provider, AWS Region, and bandwidth. ## Multicloud Connectivity - The service provides a managed **Layer 3 connection** between AWS and another cloud provider. - Traffic uses the AWS global backbone and the partner’s private network rather than the public internet. - This improves: - Latency predictability - Throughput consistency - Isolation from internet congestion - Google Cloud is supported at launch; Microsoft Azure is expected later in 2026. ## Security, Resilience, and Monitoring - Physical links between AWS and partner routers use **IEEE 802.1AE MACsec encryption** by default. - Each cloud provider handles encryption on its own backbone, so customers must verify that the resulting deployment satisfies compliance requirements. - Connections use multiple logical links across at least two physical facilities to protect against device or facility failures. - Amazon CloudWatch integration includes: - A Network Synthetic Monitor for round-trip latency and packet loss - Bandwidth utilization metrics for capacity planning ## Open Partner Specification - AWS has published the underlying Interconnect specification on GitHub under the **Apache 2.0 license**. - Other cloud providers can become partners by implementing the specification and meeting AWS requirements for: - Resiliency - Support - Service-level agreements - Operational readiness ## Provisioning an AWS–Google Cloud Connection - The demonstration connects a single AWS VPC to a Google Cloud VPC using a Direct Connect Gateway. - In the AWS Direct Connect console, the user: - Selects Google Cloud as the provider - Chooses AWS Region `eu-central-1` - Chooses Google Cloud Region `europe-west3` - Specifies bandwidth - Selects a Direct Connect Gateway - Enters the Google Cloud project ID - AWS then generates an activation key for use on the Google Cloud side. ## Configuring Google Cloud - Because a Google Cloud web console option was unavailable at the time, the example uses the `gcloud` CLI. - The user creates a transport resource with: - The AWS activation key - The Google Cloud region - The target VPC network - Advertised AWS routes - After the transport reaches the appropriate state, the user creates a VPC peering connection between the Google Cloud VPC and the generated transport network. - Custom routes are imported and exported through the peering configuration. ## Completing the AWS Configuration - Once the Google Cloud transport and peering are configured: - The AWS Interconnect status can be checked in the Interconnect console. - The Direct Connect Gateway shows the new attachment. - The final AWS-side step is associating the gateway with the appropriate Virtual Private Gateway. - The Virtual Private Gateway must be in the same AWS Region as the Interconnect. - AWS routing still requires a final route entry so workloads can reach the remote Google Cloud network. AWS Interconnect is best suited to organizations operating hybrid or multicloud environments that want private, resilient connectivity without managing physical links or complex third-party networking. The managed provisioning process can reduce setup time to minutes, but teams should still validate routing, encryption responsibilities, regional constraints, and compliance requirements.

Read original(opens in new tab)
Google CloudCloud MonitoringNetwork ConfigurationAws Interconnect+4
github3 min readCurated summary

Hack the AI agent: Build agentic AI security skills with the GitHub Secure Code Game

Agentic AI tools can automate powerful tasks, but their autonomy creates new security risks, including prompt injection, tool misuse, memory poisoning, and compromised multi-agent workflows. GitHub’s Season 4 Secure Code Game teaches developers to recognize these threats by attacking and hardening ProdBot, a deliberately vulnerable terminal-based AI assistant. Its five levels progressively add capabilities—and corresponding attack surfaces—mirroring how real-world AI systems evolve. ## The Secure Code Game’s Evolution - The free, open-source, in-editor course teaches security by having players exploit and fix intentionally vulnerable code. - Earlier seasons covered: - General secure coding across JavaScript, Python, Go, and GitHub Actions. - LLM security, including malicious prompts and defensive techniques. - More than 10,000 developers from industry, academia, and open source have participated. - Season 4 shifts focus from AI that generates content to AI that independently browses, uses tools, calls APIs, and acts for users. ## Why Agentic AI Security Is Urgent - Agentic systems are moving rapidly from research projects into production environments. - The OWASP Top 10 for Agentic Applications identifies threats such as: - Goal hijacking - Tool misuse - Identity abuse - Memory poisoning - A Dark Reading poll found that 48% of cybersecurity professionals expect agentic AI to be the leading attack vector by the end of 2026. - Cisco reported that although 83% of organizations planned to deploy agentic AI, only 29% felt prepared to secure it. - The article argues that learning to think like an attacker is essential for closing this readiness gap. ## ProdBot: A Deliberately Vulnerable AI Assistant - ProdBot is a terminal-based productivity and coding assistant inspired by tools such as OpenClaw and GitHub Copilot CLI. - It can: - Convert natural-language requests into bash commands. - Browse a simulated web. - Connect to MCP servers. - Run organization-approved skills. - Store persistent memory. - Coordinate multiple agents. - Players’ objective is to use natural language to make ProdBot reveal the contents of `password.txt`. - No prior AI or coding experience is required; all interaction takes place through the CLI. ## Five Progressive Attack Surfaces - **Level 1: Shell execution** - ProdBot runs generated bash commands in a sandbox. - The challenge is to determine whether the sandbox can be escaped. - **Level 2: Web browsing** - ProdBot reads simulated news, finance, sports, and shopping sites. - Untrusted web content introduces risks such as instruction hijacking and prompt injection. - **Level 3: MCP integrations** - ProdBot gains access to external tool providers for stock quotes, browsing, and cloud backup. - Additional tools increase both functionality and opportunities for abuse. - **Level 4: Skills and memory** - Organization-approved plugins and persistent memory create layered trust relationships. - The level tests whether trusted skills and stored information are actually safe. - **Level 5: Multi-agent orchestration** - ProdBot combines six specialized agents, three MCP servers, three skills, and a simulated open-source project. - Claims that agents are sandboxed and data is pre-verified become assumptions to test rather than guarantees. ## Real-World Relevance - The game’s vulnerabilities reflect active security concerns in deployed autonomous AI systems rather than purely theoretical exercises. - The article cites CVE-2026-25253, known as “ClawBleed,” an OpenClaw vulnerability rated CVSS 8.8. - The flaw allowed attackers to steal authentication tokens through a malicious link and gain full control of an OpenClaw instance. - Season 4’s broader goal is to develop instincts for identifying similar weaknesses during architecture reviews, tool-integration audits, and production deployments. Developers working with AI agents should treat every new capability—shell access, browsing, plugins, memory, or collaboration—as a potential attack surface. Practicing these failure modes in a controlled environment like the Secure Code Game can help teams design safer agentic systems before deploying them.

Read original(opens in new tab)
AI AgentsModel Context ProtocolAi SecurityPrompt Injection+2
github2 min readCurated summary

How exposed is your code? Find out in minutes—for free

GitHub’s Code Security Risk Assessment offers organizations a free, one-click way to uncover vulnerabilities that manual reviews and limited scanning tools may miss. Using CodeQL, it scans up to 20 active repositories and provides a prioritized view of risks by severity, language, repository, and vulnerability type. The assessment also connects findings to GitHub Code Security and Copilot Autofix, helping teams move from discovery to remediation. ## What the Assessment Reveals - Scans up to 20 of an organization’s most active repositories. - Reports vulnerabilities by severity: - Critical - High - Medium - Low - Breaks findings down by programming language. - Identifies the specific security rules and vulnerability classes detected. - Highlights the repositories with the greatest number of vulnerabilities. - Shows which findings are eligible for Copilot Autofix. - Uses CodeQL, GitHub’s static analysis engine. The assessment is free for organization administrators and security managers using GitHub Enterprise Cloud or GitHub Team. Scanning does not consume the organization’s GitHub Actions minutes quota. ## Combining Code and Secret Exposure The Code Security Risk Assessment complements GitHub’s existing Secret Risk Assessment. - Both assessments can be launched from one entry point. - A tabbed interface separates secret exposure findings from code vulnerabilities. - The combined view helps organizations understand their overall security posture. - Secret Protection focuses on preventing credential leaks. - Code Security identifies and helps remediate vulnerabilities in source code. GitHub cites 2025 usage figures for Secret Protection, including nearly 2 billion scanned pushes and 19 million blocked secret exposures. ## From Detection to Remediation Finding vulnerabilities is only the first step; reducing risk requires fixing them. - GitHub reports that Copilot Autofix resolved 460,258 security alerts in 2025. - Half of vulnerability alerts were fixed directly in pull requests. - Mean remediation time was 0.66 hours with Copilot Autofix, compared with 1.29 hours for manual fixes. - Assessment results show how many discovered vulnerabilities could potentially be fixed automatically. - Organizations can enable GitHub Code Security directly from the results page. The assessment is intended for organizations with no current scanning, teams evaluating existing tools, or security leaders seeking broader visibility across repositories. Running it provides a quick, no-cost baseline for prioritizing security work.

Read original(opens in new tab)
GitHub ActionsStatic AnalysisSecret ScanningCodeql+3