aws·Jun 17, 2026·3 min readCurated summary

Proactively reduce tech debt autonomously with AWS Transform – continuous modernization (preview) | Amazon Web Services

AWS is previewing AWS Transform – continuous modernization, a capability designed to continuously detect, prioritize, and remediate technical debt across thousands of repositories. It replaces fragmented, manual tooling with configurable analysis, automated pull requests, and current compliance visibility. The goal is to help engineering and platform teams keep codebases modern as dependencies, frameworks, runtimes, and security requirements evolve. ## Continuous Technical Debt Analysis - Scans connected repositories against configurable organizational baselines. - Produces findings within hours, including: - End-of-life dependencies - Deprecated frameworks - Security and code-quality issues - Organization-specific technical debt patterns - Teams can define custom policies for approved libraries, internal standards, deprecated components, or preferred coding patterns. - Findings provide a current view of which repositories are behind baseline, by how much, and which files or components are affected. - This reduces reliance on manual status reports and periodic compliance checks. ## Autonomous Remediation - AWS Transform can automatically generate pull requests for affected repositories. - Built-in transformations support common tasks such as: - Java version upgrades - SDK migrations - Library updates - Custom transformations can be created for organization-specific modernization needs. - Teams retain control by reviewing and merging the generated pull requests or applying their own fixes. - Continuous analysis verifies when repositories return to compliance without requiring manual confirmation. ## Integrated Security Remediation - Integration with AWS Security Agent brings source-code security vulnerabilities into the same workflow. - Security findings appear alongside other technical debt in a prioritized list. - Remediation is delivered through pull requests rather than separate, disconnected security processes. ## Dashboard and Remediation Campaigns - The AWS Transform web application provides portfolio-level visibility across repositories. - Users can view finding severity, affected files, categories, repositories, and available remediation options. - Remediation campaigns track: - Pull requests created - Pull requests merged - Repositories restored to compliance - AWS Transform supports repositories connected from GitHub and local environments. ## Continuous Mode and Campaign Mode - **Continuous mode** handles recurring maintenance: - Dependency upgrades - Security patches - Runtime updates - Coding-standard enforcement - **Campaign mode** is intended for larger, project-based changes, such as migrating frameworks or upgrading a major runtime across hundreds of applications. - AWS Transform custom remains the flexible option for substantial modernization projects, while continuous modernization focuses on high-volume, ongoing maintenance. AWS Transform – continuous modernization is available in preview through the AWS Transform web application, AWS Transform Kiro Power, MCP, and skills for coding-agent integration. It is most useful for organizations that need automated, organization-wide visibility and pull-request-based remediation for continuously accumulating technical debt.

Read original(opens in new tab)

Model Context ProtocolJavaAws LambdaPull Requests+4

aws·Jun 17, 2026·3 min readCurated summary

AWS Security Agent adds threat modeling, Kiro power and Claude Code plugin, and more | Amazon Web Services

AWS Security Agent, now part of AWS Continuum, is expanding into a unified security platform spanning design, development, and deployment. New capabilities include threat modeling, deeper pull-request and repository reviews, compliance validation, and integrations with Kiro, Claude Code, and other AI IDEs through MCP. AWS’s central promise is to find vulnerabilities, verify exploitability, and provide actionable fixes without interrupting developers’ workflows. ## Enhanced Code Reviews - Supports GitHub, GitLab, and Bitbucket, including SaaS and self-hosted installations. - Integrates with Confluence so reviews can use existing technical and security documentation as context. - Performs reasoning-based analysis of pull requests and entire repositories, identifying vulnerabilities beyond pattern matching. - Checks code against organizational security requirements and common security risks. - Validates findings in simulated environments to demonstrate proof of exploitability. - Provides remediation guidance and fix commits directly in the repository workflow. - Supports pull-request scanning, remediation, security requirement packs, and simulated validation. ## Compliance and Design Reviews - Managed compliance packs include: - AWS WAF - NIST CSF - PCI DSS - AWS best practices - Organizations can import their own security requirements from internal documents or Confluence. - Findings are mapped to the organization’s compliance posture, helping teams maintain audit readiness throughout development. ## Threat Modeling - Generates threat models from design documents or source-code repositories. - Builds an application context model covering: - Architecture - Data flows - Trust boundaries - Application components - Identifies likely threat actors, attack vectors, and weaknesses. - Uses the STRIDE framework to classify threats. - Prioritizes risks and recommends mitigations. - Threat models can be generated from the Security Agent console or through supported development tools. ## Kiro, Claude Code, and MCP Integrations - A Kiro power is available, with a Claude Code plugin coming soon. - An open MCP integration enables use from Kiro, Claude Code, or other AI-powered IDEs. - Developers can trigger scans, threat models, and remediation directly from their IDE or CLI. - Kiro commands include: - `Set up AWS Security Agent` - `Run a full security scan on this repo` - `help me remediate my findings` - `Build a threat model for this application` - Findings can be downloaded into the local workspace, prioritized, and used to start bug-fix specification sessions. - Generated threat models are saved at `.security-agent/threat_model.md`. - A Kiro agent hook can automatically evaluate whether a code-review scan should run after an agent turn. ## Lifecycle Coverage and Availability - Design-time security: design reviews and threat modeling, both in preview. - Development-time security: repository and pull-request code reviews, in preview. - Deployment-time security: on-demand penetration testing, generally available. - The features are available in supported AWS commercial Regions, with regional availability and pricing listed in AWS documentation. AWS Security Agent is positioned as a continuous security layer across the software lifecycle. Teams interested in automated, context-aware security analysis can try it through the Security Agent console, while developers can use the IDE and MCP integrations to keep scanning and remediation within their existing workflows.

Read original(opens in new tab)

Model Context ProtocolCode ReviewClaude CodeThreat Modeling+3

cloudflare·Jun 17, 2026·3 min readCurated summary

Introducing the Cloudflare One stack- agent-powered deployment

Cloudflare’s One stack is a pair of agent skills designed to help organizations evaluate, migrate to, deploy, and operate Cloudflare One Zero Trust environments. It combines expert-curated guidance, migration logic, decision trees, and API tooling so agents can understand existing networks, recommend architectures, and safely implement changes. The goal is to reduce migrations that traditionally take months to a more guided and automated process. ## The Challenge of Zero Trust Migration - Teams must first understand their existing environment, including: - Applications and connectivity requirements - Authentication and authorization policies - Traffic flows - Assumptions embedded in current security and routing rules - Agents can automate many security workflows, but lack organization-specific knowledge about network topology and vendor configurations. - Cloudflare’s stack supplies the structured context and prescriptive guidance needed for agents to work more effectively with security infrastructure. ## What the Cloudflare One Stack Provides - The stack consists of two lightweight skill files: - `cloudflare-one` for general Cloudflare One planning, deployment, management, and troubleshooting - `cloudflare-one-migration` for translating and migrating from legacy SASE vendors - It incorporates knowledge gathered from Cloudflare employees with extensive customer deployment experience. - When combined with Cloudflare’s code mode MCP server, agents receive a typed interface to the Cloudflare API. - Agents can inspect live accounts and make changes through Cloudflare-recommended workflows rather than arbitrary API calls. ## Covered Cloudflare One Capabilities - VPN replacement and remote access through Cloudflare Access - User, device, network, and data security through Cloudflare Gateway - Connectivity using Cloudflare Tunnel, Mesh, and WAN - Migration from vendors such as Zscaler and Palo Alto Networks - Network diagram interpretation and generation - Translation of concepts between competing SASE platforms - Troubleshooting and operations using Digital Experience Monitoring and automated rule recommendations ## Guided Deployment and Migration - For VPN replacement, the agent can: - Inventory existing VPN applications - Determine the required connectivity model - Map applications to Access, Tunnel, or Mesh - Recommend a deployment sequence that reduces cutover disruption - Produce a configuration summary for human review - For Zscaler Private Access migrations, the agent can: - Convert application definitions into Cloudflare Access applications - Translate user groups and policies - Create equivalent resources through the Cloudflare API - Summarize completed work and identify items needing manual review - The migration logic is based on Cloudflare’s Descaler and Deskope programs, which have migrated enterprise customers from Zscaler and Netskope in hours rather than months. ## Operations and Troubleshooting - The stack can recommend security rules based on live account traffic. - It can automatically migrate Zscaler Private Access applications into self-hosted Cloudflare Access applications. - Agents can investigate anomalies in secure web gateway HTTP logs and create rules to address user issues. - The Digital Experience Monitoring toolkit can report on user stability and help improve latency in important scenarios. Cloudflare positions the One stack as a way to make Zero Trust deployment more accessible and repeatable. Organizations can use the skills with their existing agents, add internal context, and combine them with API tooling—but should still review generated plans and configurations before applying changes.

Read original(opens in new tab)

Model Context ProtocolZero TrustSaseCloudflare Access+4

line·Jun 17, 2026·4 min readCurated summary

ID-JAG The Hard Way: Learning AI Agent Security Through Failure, Hands-On

ID-JAG provides a structured way for AI agents to access protected APIs on behalf of users without granting them permanent, broad permissions. The hands-on environment demonstrates how authentication, enterprise authorization policies, delegation, and token exchange work together across Keycloak, Athenz, MCP, and resource servers. Its central conclusion is that AI-agent security requires explicit delegation boundaries and centralized policy enforcement, not just user authentication at the entry point. ## Why AI Agents Need a Different Authorization Model - AI agents continuously call internal APIs, SaaS tools, databases, and other services. - Requesting user consent for every automated action would create an unusable experience. - Granting agents permanent, broad access increases: - Blast radius during failures or compromise - Difficulty assigning responsibility - Exposure to prompt injection and shadow AI risks - The key question becomes whether an agent is authorized to access a specific resource, for a specific user, with a specific scope at a specific time. ## ID-JAG and Its Practical Role - ID-JAG is an emerging OAuth profile discussed by the IETF OAuth Working Group. - It combines: - OAuth 2.0 Token Exchange (RFC 8693) - JWT Profile for OAuth 2.0 Authorization Grants (RFC 7523) - It models delegated, cross-domain API access using explicit authorization grants. - The hands-on explores questions that architecture diagrams often leave unanswered: - What token payloads are issued? - Why should an ID token not be exchanged directly for an access token? - Where are enterprise policies evaluated? - How does an agent prove it is acting for a user? - How is trust established between the identity provider and authorization server? ## Separating Authentication from Enterprise Authorization - Keycloak acts as the upstream identity provider: - Authenticates the user - Issues the original identity assertion - Athenz, through `KeycloakTokenExchangePlugin`, acts as: - The authorization server - The ID-JAG issuer - The policy decision point (PDP) - The central resource authorization authority - Athenz validates the Keycloak assertion’s: - Issuer - Signature - Audience - Subject - Client binding - Enterprise policy requirements - Resource authorization servers trust only the Athenz-issued ID-JAG, rather than accepting Keycloak tokens directly. - Centralizing delegation policies in Athenz reduces duplicated or conflicting rules across identity providers, SaaS vendors, and applications. ## End-to-End Request Flow - The user logs in through Keycloak. - The user gives the AI agent a task through a prompt. - The agent requests an ID-JAG from Athenz. - Athenz evaluates enterprise policies and determines whether the delegation is allowed. - The agent requests an access token from Athenz. - The agent calls the protected MCP server with the issued token. - The MCP server exchanges the token with the authorization server. - The MCP server uses the exchanged token to call the final resource server. - The agent therefore operates within a policy-defined boundary instead of holding a long-lived master credential. ## Learning Through Deliberate Failures The tutorial emphasizes failure paths to show where each security control applies. - Calling a protected API without a token produces `401 Unauthorized`. - Defining an enterprise role without adding membership causes token exchange to fail. - Omitting the agent’s required delegation permission breaks the delegation chain. - These failures reveal whether the problem lies in authentication, grant validation, agent delegation, enterprise policy, or resource-token validation. ## Why ID Tokens Should Not Be Used Directly - An ID token proves that a user authenticated successfully to a client. - An authorization grant is an artifact submitted to request access to a particular resource and scope. - Directly exchanging an ID token can implicitly treat login evidence as permission to access resources. - Using an explicit ID-JAG grant creates clearer boundaries between: - Authentication failure - Grant validation failure - Delegation denial - Enterprise policy rejection - Resource authorization failure - ID-JAG is not technically required for the small local demo, but it makes authorization boundaries and audit paths much clearer. ## Hands-On Environment - The tutorial is available in `athenz-community/id-jag-the-hard-way`. - It guides users through a deliberate “fail, diagnose, and fix” workflow. - Users can later remove an agent’s delegation permission in the Athenz UI and observe exactly where execution is blocked. - This experimentation demonstrates the value of centralized policy control more effectively than a successful request alone. AI-agent ecosystems need more than front-door authentication. A practical deployment should use short-lived, explicitly scoped delegation, centralized enterprise policy evaluation, and observable token-exchange boundaries such as those demonstrated by ID-JAG.

Read original(opens in new tab)

Model Context ProtocolAI AgentsJwtAuthorization+4

kakao·Jun 15, 2026·3 min readCurated summary

Is a Non-Developer Who Does Vibe Coding a Developer? (3)

AI coding agents have helped a non-developer move from creating small local HTML tools to building shared dashboards, integrations, automations, and repeatable workflows. The major change was not writing more code, but learning to define data, permissions, inputs, outputs, exceptions, and validation criteria. The author concludes that AI is making more kinds of work executable and structured, expanding questions about “development” beyond professional developers. ## From Local HTML to Shared Tools - Early tools were standalone HTML files used locally in a browser. - Sharing them introduced deployment, URLs, version updates, and maintenance concerns. - Once users needed persistent data and changing states, the problem expanded from UI design to: - Data storage - Access and edit permissions - Change history and rollback - Backups and operational responsibility - Google Sheets became a practical lightweight database because it already provided: - Collaboration and familiar interfaces - Permission management - Revision history - The author progressed from manually pasting Apps Script code to using `clasp` and Apps Script APIs for deployment and execution. - The key shift was learning to evaluate where data should live and which tools already work safely within an organization. ## Security as a Daily Habit - Connecting work tools through webhooks introduced the need to protect tokens and webhook URLs. - The author began using `.env` files and `.gitignore` to prevent secrets from entering source code or Git repositories. - Requests to AI agents increasingly included security requirements: - Read secrets from environment variables - Avoid printing sensitive values in logs - Use placeholders instead of real credentials - Small automations connected to external systems naturally required thinking about secret management, execution environments, and access control. ## Turning Manual Tasks into Workflows - Tasks such as copying files, organizing folders, converting documents, editing videos, and extracting audio or summaries were delegated to AI agents. - Delegating these tasks required explicit definitions of: - Input files - Output names and formats - Whether existing files may be overwritten - Failure conditions - Verification requirements - Informal, intuitive actions became structured work specifications. - The author found that understanding completion criteria and input/output formats was often more important than memorizing individual commands. ## Skills and Feedback Loops - Weekly meeting-note preparation revealed recurring editing patterns and implicit business rules. - These rules were encoded into Codex and Claude skills covering: - Note structure - Action-item extraction - PMO-related signals - Situations where the AI should ask questions instead of making assumptions - Skills functioned as stored decision criteria, not merely collections of prompts. - Comparing AI-generated drafts with the author’s final revisions enabled continuous refinement. - Deleting local data for security reasons accidentally removed useful conversation context, temporarily reducing skill quality and demonstrating the importance of preserving relevant operational knowledge. ## Using Outputs as New Inputs - Google Analytics reporting became more frequent and detailed through MCP-based API access and reusable reporting skills. - MCP provided the data connection, while skills preserved the recurring monthly report structure. - The valuable work remained interpreting changes between periods and deciding whether a change was meaningful. - Combining AI-generated metrics with the author’s contextual knowledge helped surface signals requiring further investigation in near real time. The author recommends focusing less on how much code AI can generate and more on how work can be clearly structured for AI execution. As agents become more capable, everyone—not only developers—will increasingly define inputs, outputs, permissions, security controls, repetition, and validation as part of everyday work.

Read original(opens in new tab)

Model Context ProtocolAI AgentsClaude CodeWebhooks+3

aws·Jun 15, 2026·4 min readCurated summary

AWS Weekly Roundup: AWS FinOps Agent in preview, Gemma 4 on Bedrock, Kiro Pro Max, and more (June 15, 2026) | Amazon Web Services

AWS’s June 15, 2026 roundup highlights rapid adoption of AI-native development, a preview of the AWS FinOps Agent, and major infrastructure and model releases. AWS reports significant productivity gains from agent-assisted engineering, while new services target cost optimization, observability, security, and developer workflows. The overall direction is toward more autonomous, context-aware tools integrated throughout the AWS ecosystem. ## AI-Native Development at AWS - Amazon engineering teams are restructuring development around AI agents. - A six-engineer team rebuilt the Amazon Bedrock inference engine in 76 days, compared with an original estimate of 30 developers over 12–18 months. - Structured Amazon Stores pilots achieved a median 4.5× improvement in normalized deployment velocity, with some teams exceeding 10×. - Recommended practices for “frontier teams” include: - Building steering files, coding standards, and structured repositories to provide agent context. - Expecting an initial productivity slowdown while workflows change. - Maintaining a backlog of well-scoped tasks that agents can execute in parallel. - Writing structured specifications before generating code. - Moving testing earlier so agents can detect and correct issues. - AWS cautions that commit velocity is only one measure; future work will address release management, operations, security, and end-of-life upgrades. ## AWS FinOps Agent Preview - AWS FinOps Agent helps finance and engineering teams: - Answer AWS cost questions and generate reports. - Identify rightsizing, idle-resource, and Savings Plans opportunities. - Investigate cost anomalies automatically. - Schedule recurring FinOps workflows. - Recommendations come from AWS Cost Optimization Hub and AWS Compute Optimizer. - The agent can open Jira tickets and post anomaly-investigation findings to Slack. ## New EC2 M9g and M9gd Instances - M9g and M9gd instances use AWS Graviton5 processors and the sixth-generation Nitro System. - They provide: - Up to 25% better compute performance than Graviton4. - Up to 35% faster web applications and ML inference. - Up to 30% faster database performance. - Up to 15% more network bandwidth and 20% more EBS bandwidth than M8g. - Graviton5 adds PCIe Gen6, DDR5-8800 memory, and a 5× larger L3 cache. - The Nitro Isolation Engine uses formal verification to provide mathematically proven VM isolation. - M9gd adds up to 11.4 TB of local NVMe SSD storage and 30% higher IOPS than M8gd. - Instance Bandwidth Configuration can shift bandwidth between EBS and VPC networking by up to 25%. ## Bedrock Model Updates - Anthropic Claude Fable 5 launched on Bedrock with: - Extended asynchronous task execution. - Advanced vision for diagrams, charts, and PDFs. - Proactive self-verification. - Access required Data Retention API opt-in and 30-day retention for inputs and outputs. - Anthropic later asked AWS to revoke access to Claude Fable 5 and Claude Mythos 5 in response to a U.S. government export-control directive. - Google DeepMind’s Gemma 4 models are available in three versions: - Gemma 4 31B for reasoning and coding, with a 256K-token context window. - Gemma 4 26B-A4B, a mixture-of-experts model for cost- and latency-sensitive use. - Gemma 4 E2B for low-latency interactive applications. - All variants support function calling, structured output, reasoning, streaming, multimodal inputs, and more than 35 languages. ## OpenSearch MCP Apps for Agentic Observability - OpenSearch MCP Apps bring logs, traces, metrics, and alerts into compatible agentic environments such as Claude Desktop and VS Code. - Agents can investigate incidents across OpenSearch and Amazon Managed Service for Prometheus. - Each tool call produces both: - A text summary for the agent. - An interactive visualization displayed in the conversation. - Available tools cover log, metric, and trace analysis; service performance; topology; agent health; cluster health; dynamic visualizations; and instrumentation scoring. ## Additional AWS Updates - AWS CLI v1 is entering maintenance mode: - Dependencies such as `botocore` and `s3transfer` will be vendored into the CLI. - Future releases will focus on critical bugs and security fixes. - AWS recommends migrating to CLI v2. - AWS Workload Credentials Provider provides short-term credentials for applications running outside AWS, including on-premises and third-party environments, without requiring long-term access keys. - Kiro Pro Max adds higher usage limits, access to newer frontier models, and additional agentic development capabilities for professional teams. AWS’s latest releases suggest that teams should prepare for AI agents to handle not only code generation, but also cost management, observability, testing, and operational workflows. Migrating to AWS CLI v2, evaluating Bedrock’s newest models, and establishing strong repository context and specifications are practical next steps.

Read original(opens in new tab)

Model Context ProtocolAI AgentsAmazon BedrockAmazon Ec2+4

dropbox·Jun 12, 2026·3 min readCurated summary

How Dropbox uses MCP and Dash to close the design-to-code security gap

Dropbox found a significant gap between security design reviews and implementation. Only 12% of implementing pull requests linked back to their original threat models, and the median delay between review and code submission was about five weeks. To close this gap, Dropbox built a system using Dash, Model Context Protocol (MCP), and foundational models to automatically retrieve relevant security requirements and compare them with code during review. ## The Design-to-Code Gap - Threat models document risks, attack scenarios, and agreed-upon mitigations during security review. - These documents often remain in wikis or documentation systems, while implementation happens later through pull requests. - At Dropbox: - Only 12% of implementing PRs linked to their original design review. - Among 79 verified pairs, 54% of PRs were opened more than a month after the review. - The median delay was approximately five weeks, with some delays exceeding 11 months. - Only 29% of PRs were opened within two weeks of the security review. - About 15% of design reviews were filed retroactively, suggesting that some security-sensitive work was not identified early enough. ## Why Existing Tools Fall Short - Static analysis can detect whether certain security patterns or controls exist. - It generally cannot determine whether those controls satisfy the specific requirements agreed upon during design review. - Manual linking between PRs and threat models depends on engineers remembering additional workflow steps. - Reminder bots may improve compliance temporarily, but adherence tends to decline. - The core problem is not a lack of security documentation; it is the difficulty of making that existing context available during implementation. ## Dash and MCP as a Context Bridge - Dash already indexes Dropbox content and connected applications, including threat models and engineering documentation. - Dropbox used Dash’s MCP server to let an AI security agent search and read this content. - MCP provides a common interface for bringing multiple context sources into one agent session. - When a PR is opened, the agent retrieves relevant threat models and supporting documents. - A foundational model then compares the documented requirements with the proposed code. - For example, it can identify whether code implementing an endpoint enforces authentication required by the corresponding threat model. - Unlike traditional static analysis, this approach evaluates code against documented security intent, not just known code patterns. ## Integrating Security into Code Review - Dropbox surfaced the system directly within the existing code-review workflow rather than creating a separate security process. - This allows developers and reviewers to receive relevant security context where implementation decisions are already evaluated. - The same mechanism can potentially identify missing reviews when code appears security-sensitive but has no corresponding threat model. Dropbox’s approach shows how retrieval and AI reasoning can reconnect design decisions with implementation. Organizations can apply the same pattern beyond security—for example, to compliance requirements, privacy reviews, accessibility standards, or other design-to-code checks.

Read original(opens in new tab)

Model Context ProtocolLarge Language ModelsCode ReviewStatic Analysis+2

slack·Jun 11, 2026·3 min readCurated summary

Agentic Testing: Where Agents Fit in the E2E Testing Stack

Agentic E2E testing validates whether users can achieve goals rather than enforcing one fixed sequence of UI actions. Slack’s experiment with more than 200 runs found that agents can reliably explore workflows, especially through Playwright MCP, but they are slower and more expensive than deterministic tests. The conclusion is that agents should complement—not replace—traditional E2E tests. ## Goal-Based Testing vs. Fixed Journeys - Traditional tests follow predefined steps: click, type, navigate, and assert. - Agent-driven tests receive a goal and adapt their actions to reach it. - Agents may use different paths to achieve the same result, such as: - Selecting a search suggestion or pressing Enter - Reusing existing navigation state or reopening a view - Adding or skipping intermediate actions - This flexibility improves exploration but introduces tradeoffs in reliability, runtime, and cost. ## Experiment Design Slack evaluated three execution models across more than 200 runs: - **Agent + Playwright MCP** - Uses predefined browser actions and persistent DOM snapshots and logs. - **Agent + Playwright CLI** - Runs Playwright commands through the shell and reassesses the UI after each step. - **Generated Playwright tests** - Produces deterministic test code from natural language, then iteratively refines it. The experiments used Claude Sonnet 4.5 for MCP and CLI workflows and Claude Opus 4.6 for generated tests. All tests ran in non-production Slack workspaces using test data. Two workflows were tested 20 times per configuration: - **Thread Reply:** A simple 15–20-step flow involving channel creation, messaging, thread replies, and verification. - **Search Discovery:** A 25–30-step flow involving search, result navigation, channels, threads, and state verification. Inputs were provided either as detailed natural-language instructions or structured YAML describing actions and expected outcomes. ## Results: Reliability, Cost, and Runtime | Approach | Thread Reply failures | Search Discovery failures | Average runtime | |---|---:|---:|---:| | Agent with Playwright MCP | 0% | Approximately 12% | 5–8 minutes | | Agent with Playwright CLI | Approximately 12% | Approximately 20% | 9–11 minutes | | Generated Playwright tests | Approximately 8% | Approximately 48% | About 3 minutes | - Playwright MCP was the most reliable agentic approach, particularly for simple workflows. - Playwright CLI failed more often due to authentication, navigation timing, and session instability. - Generated tests were fast and reasonably successful on simple flows but degraded sharply as workflows became more complex. - Generated tests often completed 70–80% of a complex workflow before failing on a final interaction or assertion. ## Why Complexity Exposes Differences - MCP maintains a live, stable view of the application through persistent context. - CLI-based agents reconstruct state from updated snapshots, allowing small timing or interpretation inconsistencies to accumulate. - Generated tests can suffer from: - Variable UI state - Imprecise element targeting - Mismatches between generated code and existing page-object abstractions - The results suggest agent-native execution models handle increasingly complex exploratory flows better than generated deterministic tests, despite taking longer. Agentic testing is best used as an exploratory layer for validating user goals and discovering unexpected paths. Deterministic Playwright tests remain preferable for fast, repeatable regression checks, while Playwright MCP appears to be the strongest option when flexible, goal-oriented E2E coverage is needed.

Read original(opens in new tab)

Model Context ProtocolLarge Language ModelsAI AgentsClaude+3

gitlab·Jun 10, 2026·4 min readCurated summary

Introducing GitLab Orbit

GitLab Orbit is a public-beta, queryable graph that connects code with merge requests, pipelines, deployments, vulnerabilities, incidents, and ownership. GitLab argues that this unified context makes AI agents faster, more accurate, and capable of answering cross-system questions that traditional file search or RAG cannot. In testing, Orbit improved code-review accuracy while reducing agent runtime, token use, and hallucinations. ## The Problem with Code-Only Agents - Agents often struggle to understand the systems surrounding code: - Related files and dependencies - Tests and pipelines - Deployments and environments - Vulnerabilities and ownership - Work items and merge requests - In large or multi-repository codebases, agents can waste tokens exploring irrelevant paths, miss dependencies, or run out of context. - This can produce code that appears correct but is later reverted or requires substantial human correction. ## Results from Compare the Market - Compare the Market tested four context-retrieval approaches across 79 real merge requests. - An Orbit-grounded AI reviewer: - Placed accurate inline comments about 70% of the time. - Outperformed RAG, which achieved roughly 58%. - Produced slightly better summaries of key changes: 68% versus 66%. - RAG performed worse than the other tested approaches, including using no additional context. ## Faster and More Efficient Coding Agents - Claude Code and other agents can connect to Orbit through the Model Context Protocol (MCP). - Instead of crawling a repository to infer relationships, an agent can query the graph directly for: - Where code is located - What depends on it - Which tests and pipelines cover it - GitLab reports up to: - 11× faster execution - 4.5× lower token usage - 45× fewer hallucinations ## Cross-System Engineering Workflows Orbit enables agents on the GitLab Duo Agent Platform to investigate relationships beyond source code. - **Pipeline failure triage** - Agents can identify merge requests associated with a failing job. - They can find other projects and in-flight changes likely to encounter the same failure. - This can help teams resolve shared incidents centrally rather than repeating investigations. - **Vulnerability blast-radius analysis** - Queries can trace vulnerable components through services, pipelines, environments, and owning teams. - Security teams can produce assigned remediation plans shortly after a CVE is discovered. - **Engineering metrics** - Teams can query relationships between cycle time, pipeline failure rates, and deployment frequency without waiting for custom dashboards or SQL analysis. - **Migration planning** - Orbit identifies dependent services, jobs, environments, and owners. - This reduces the risk of discovering hidden dependencies late in a migration. ## Architecture and Access - Orbit ingests lifecycle data through change-data capture into ClickHouse. - It parses code in 12 languages, including Ruby, Java, Python, TypeScript, Rust, Go, C#, C++, and PHP. - GitLab reports indexing more than: - 40,000 projects - 500 million nodes - 2 billion edges - The graph can be queried through: - A Cypher-like query language - MCP - REST - The GitLab CLI - An event-driven engine keeps the graph current as changes occur. - Indexing runs separately from GitLab, so query traffic does not burden the GitLab instance. - Authorization follows existing GitLab permissions, limiting agents to data their users can access. - Queries pass through validation, planning, optimization, and security stages before reaching the database. ## Engineer-Facing Data Explorer - The Data Explorer provides direct access to the same graph without an AI agent. - Engineers can use it to: - Investigate incidents - Trace dependencies across services - Diagnose recurring CI failures - GitLab positions it as a way to answer open-ended system questions in seconds rather than reconstructing the answer manually across multiple tools. GitLab Orbit is best suited to organizations where code, CI/CD, security, and ownership data are spread across large repositories or many projects. Its main recommendation is to use one permission-aware graph as shared context for both AI agents and engineers, rather than relying on repository search or disconnected tool calls.

Read original(opens in new tab)

Model Context ProtocolAI AgentsCI/CDGraph Database+3

kakao·Jun 8, 2026·3 min readCurated summary

Key Players in the Agentic AI Ecosystem: MCP Player 10 Wraps Up, and What’s Next!

Kakao’s first MCP Player 10 competition showcased how developers are using Model Context Protocol (MCP) to build practical agentic AI services. More than 150 teams participated, and ten finalists were selected for solutions addressing childcare, startup support, culture, gaming, legal research, and safety. Kakao plans to expand this ecosystem through the upcoming Agentic Player 10 competition and deeper integration with Kakao Tools. ## The MCP Player 10 Competition - The competition ran from December 19, 2025, to January 18, 2026, on Kakao’s PlayMCP open platform. - It emphasized: - Creativity - Everyday usefulness - Technical stability - The goal was to encourage developers to create MCP servers that solve real-world problems with AI. - Ten teams were selected after internal evaluation and received a share of 21 million won in support funding, along with opportunities to collaborate with Kakao. ## Award-Winning MCP Services ### 어린이ZIP: AI Assistant for Childcare Teachers - Automates administrative work for daycare and kindergarten teachers. - Analyzes uploaded activity photos to generate drafts of parent notices and childcare journals. - Remembers child-specific details such as allergies and pickup arrangements. - Produces personalized responses in a warm, professional tone. ### SeedUp: Startup Support-Program Research - Collects and analyzes fragmented government startup-support announcements. - Summarizes eligibility requirements and relevant opportunities. - Helps founders develop application strategies. - Supports natural-language requests such as finding weekly deadlines or analyzing an uploaded announcement. ### Other Selected Services - **공유 비밀의 방:** An anonymous platform for sharing and empathizing with personal stories and AI conversations. - **바우만 16 안티에이징솔루션:** Recommends skincare routines using the Baumann 16 skin-type classification, cosmetic ingredient data, and skin pH analysis. - **아라드도우미:** A Dungeon & Fighter assistant using RAG and Vision AI to analyze patch notes, item trends, and optimized character builds. - **키즈허브:** Aggregates public data such as emergency-room availability, childcare waiting lists, and child-development information. - **택배추적기:** Combines package tracking with AI-based detection of smishing URLs in delivery-related messages. - **ArtBridge:** Recommends performances and exhibitions from approximately 200,000 records across nine cultural categories, using location, budget, and preferences. - **KidSafe:** Detects harmful language and emotional-crisis signals in children’s chatbot conversations, escalating serious cases to guardians or professional resources. - **LexiLink_ko:** Searches and organizes statutes, court precedents, and administrative interpretations through natural-language queries. All ten MCP servers are now officially available through the PlayMCP platform. ## PlayMCP’s Future Direction - PlayMCP will remain a developer-focused environment for building and distributing MCP servers. - Kakao Tools, available through ChatGPT for Kakao, will focus on helping general users experience MCP-based services. - Kakao plans to connect the two platforms more closely. - Kakao is considering managed infrastructure, including: - Kakao Cloud-based server support - Automated deployment - Greater operational responsibility for MCP service stability - PlayMCP may also support richer in-app interfaces through JSON-based widgets, similar to those already available in ChatGPT for Kakao. ## The Next Competition: Agentic Player 10 Kakao announced a second competition, Agentic Player 10, designed to connect developer-created agents with Kakao Tools and expose them to a broader audience. The program is positioned as an opportunity for startups and aspiring founders to test their services with real users and potentially bring their agents into KakaoTalk. Developers interested in building practical AI agents are encouraged to use PlayMCP and participate in Agentic Player 10 as the next step in Kakao’s expanding agentic AI ecosystem.

Read original(opens in new tab)

Model Context ProtocolAI AgentsRAGJson+3

spotify·Jun 3, 2026·3 min readCurated summary

Encoding Your Domain Expert: The Context Layer Behind Spotify's Data Assistant | Spotify Engineering

Spotify’s data assistant, Vedder, relies less on model size than on carefully curated domain context. With more than 70,000 datasets, schemas alone cannot capture business definitions, data quality issues, or preferred query patterns. Spotify’s solution is a cluster-based context layer owned by domain experts, making AI-generated SQL more reliable, transparent, and maintainable. ## Why Schemas Alone Are Not Enough - Spotify has petabytes of data across more than 70,000 datasets, making it impossible to provide an LLM with the entire warehouse. - Even large context windows cannot represent all available schemas effectively. - Schema types and column names omit critical meaning, such as: - Which values represent test or legacy data - What “active user” means in a particular domain - Which tables or columns are authoritative - Without this context, an AI assistant may confidently choose the wrong dataset. ## Spotify’s Data Agent - Users ask questions in natural language, and the agent: - Selects the relevant context - Generates SQL - Executes it against the warehouse - Returns the answer, query, and sources - It uses a ReAct loop to reason, call tools, inspect results, and revise its approach. - Users can see how an answer was produced rather than receiving an opaque result. - The assistant is available through: - Slack - An MCP server for IDEs and AI tools - A dedicated web interface - Since August 2025, it has supported more than 2,100 users, 13,000 conversations, and 60,000 messages across 177 domain clusters. ## The Cluster Model Spotify organizes data domains into “clusters,” each owned by a named team of experts. A cluster contains: - **Datasets** - Relevant warehouse tables with schemas and profiling - Column cardinality, common values, and partition information - Details that help the model construct accurate filters and queries - **Pairs** - Expert-approved natural-language questions paired with SQL - Examples of both query patterns and domain semantics - **Docs** - Business terminology and definitions - Known data pitfalls - Guidance about which columns to use or avoid Clusters can represent organizations, initiatives, or specialized areas of interest. Domain experts decide what belongs in each cluster and which examples best represent correct practice. ## Why Human Curation Matters - Spotify considered automatically generating training pairs from historical query logs. - That approach produced unreliable results because query history contains: - Exploratory analysis - Debugging queries - One-off investigations - Incorrect table choices - Technically valid but misleading patterns - Cluster curators accepted only 12.5% of the proposed question-SQL pairs. - Experts therefore determine what is canonical and trustworthy, while the model uses that curated knowledge to answer more users. - The goal is not to replace data specialists, but to scale their judgment and expertise. ## Keeping Context Current - Data models and business logic change continuously. - Cluster health scores monitor signals such as: - Underlying data quality - Whether curated SQL still works after schema changes - Coverage of users’ real questions - Reproducibility of generated SQL - Renamed columns or deprecated tables can immediately reduce the validity of existing examples. - Cluster owners use health dashboards and recommended actions to prioritize maintenance. ## Learning from Every Conversation - Vedder records conversations, queries, answers, generated SQL, and user feedback. - Cluster owners use this information to identify missing documentation, weak examples, and emerging needs. - Each approved example or clarified definition improves future answers. - The system treats context as an ongoing product that requires ownership and maintenance, not a one-time upload of metadata. Spotify’s approach suggests that trustworthy enterprise AI depends on a maintained context layer: curated datasets, expert-approved examples, clear documentation, and continuous feedback. The model supplies reasoning and automation, but domain experts remain responsible for defining what the data means.

Read original(opens in new tab)

Model Context ProtocolAILarge Language ModelsSlack+4

line·May 29, 2026·4 min readCurated summary

ODW #8: A Hands-On Internal Workshop on Accelerating Incident Response and FAQ Generation with Slack MCP

LY Corporation’s Orchestration Development Workshop demonstrated how Slack MCP can turn scattered Slack conversations into structured operational knowledge. Using AI, employees can summarize incidents, generate reports, create FAQs, and publish results to Confluence with minimal setup. The workshop’s central conclusion was that hands-on practice, reusable skills, and human review are essential for turning new AI capabilities into practical workplace tools. ## The Information and Adoption Challenge - Slack contains valuable real-time information from incident response, customer inquiries, and project discussions. - Much of this information remains unstructured because employees lack time to document it. - Documentation quality varies by author, causing useful knowledge to become difficult to find. - Although Slack MCP became available internally in March 2026, adoption barriers remained: - Limited time to explore new tools - Concerns about complex configuration - Slow internal distribution of technical knowledge ## Introducing Slack MCP Through Hands-On Practice - Slack MCP is an internally developed MCP server connected to company authentication. - Employees can access internal Slack data without issuing personal tokens or configuring OAuth. - The workshop began with a simple exercise: - Launch a coding tool such as Claude Code - Ask the AI to post “Hello” in a designated Slack channel - Confirm that the message was actually posted - This immediate success helped participants understand MCP’s practical capabilities. ## Combining Slack MCP with Other MCP Servers Slack MCP supports several core operations: - Reading messages and threads - Posting messages and performing actions - Looking up channels and members - Searching Slack content Combined with other MCP servers, it can support broader workflows: - Slack plus Confluence MCP: Generate and publish project reports or FAQs - Slack plus Jira MCP: Create work tickets from discussions - Slack conversations can be transformed into structured documents rather than remaining isolated in chat history. ## Automatically Creating FAQs from Slack Inquiries The first major exercise converted repeated support discussions into reusable knowledge. - Slack inquiry threads were collected and converted into FAQ-formatted Markdown. - Existing Confluence content was checked to identify duplicates. - New FAQs were published as child pages under an existing Confluence knowledge base. - The output was formatted as a table containing: - Symptoms - Causes - Solutions The workflow was packaged into reusable skills such as: - `slack-to-faq`: Searches recent inquiry threads and generates new FAQ files - `faq-to-confluence`: Converts and publishes the FAQs to Confluence This demonstrated how MCP can automate the entire path from conversation search to knowledge-base publication. ## Supporting Incident Response The second exercise focused on reducing the time needed to understand and document incidents. ### Rapid Situation Summaries Participants could ask the AI to summarize an outage in natural language. MCP searched relevant Slack threads and organized the information into: - Current resolution status - Customer impact - Actions being taken by team members - A chronological timeline This helps managers or newly joining responders understand the situation quickly without reading every thread. ### Automated Incident Reports After resolution, the AI generated reports in a specified format, including: - Incident and detection times - Duration - Root cause - Affected users and features - Whether data was lost - Remediation steps The `slack-incident-status` and `slack-incident-report` skills separated real-time status checking from post-incident documentation. ## Practical Guidelines and Safeguards - Clean and constrain source data before processing it: - Compare results with existing Confluence FAQs - Filter messages using reactions or other markers - Limit searches to relevant channels and threads - Do not publish AI-generated documents without review. - Check for personal information and confirm that the output accurately reflects the source conversations. - Include links or references to the original Slack threads. - Specify the desired output structure, such as a three-column table for symptoms, causes, and solutions. - Convert successful prompts into reusable skills so teams can avoid rewriting complex instructions and maintain consistent output quality. ## Lessons from the Workshop - **Timing matters:** Holding the workshop soon after Slack MCP became available captured user interest and accelerated experimentation. - **Practice is more effective than explanation:** Starting with a simple Slack post and progressing to FAQs and incident reports made the benefits immediately tangible. - **Real work makes training relevant:** Inquiry handling and incident response were chosen because they are common, time-consuming tasks. - **Reusable skills improve adoption:** Prompt patterns were tested manually, refined, saved as skills, and shared with participants for continued workplace use. The recommended approach is to introduce new AI tools through timely, task-focused workshops, then refine successful workflows into shared skills. MCP can greatly reduce the effort of operational documentation, but human validation remains necessary before generated knowledge is published.

Read original(opens in new tab)

Model Context ProtocolGenerative AISlackClaude Code+4

figma·May 28, 2026·3 min readCurated summary

4 New Ways to Go From Idea to Product With AI Tools | Figma Blog

AI tools are reshaping product development by enabling teams to prototype, test, and refine ideas earlier and across both code and design. The article argues that working prototypes can expose problems that static mockups miss, while preserving design context throughout the path to production. It illustrates this shift through examples from FloQast, Merkle, Affirm, and Accor. ## AI-enabled product workflows - Product teams are: - Prototyping earlier instead of relying solely on traditional requirements documents. - Testing ideas in code before finalizing designs. - Exploring more possibilities at greater scale. - Carrying design-system context into implementation. - Figma presents these practices as ways to balance faster iteration with deliberate product decisions. ## Testing constraints in code AI coding tools make it easier for non-developers and product teams to build functional prototypes involving: - Multi-step workflows. - Conditional behavior based on user permissions or data. - Actions that trigger subsequent actions. - Realistic backend logic and data relationships. A prototype can then be moved into Figma with Codex to Figma for collaborative exploration and refinement. If implementation work continues in code, teams can move the design back through MCP while retaining the relevant design context. ## FloQast’s complex workflow prototype ### The challenge - FloQast needed to redesign an accounting workflow for investigating discrepancies. - Users previously had to move between multiple pages to: - Find an issue. - Investigate it. - Resolve it. - The team wanted one page where users could see tasks, identify blocked work, and take action. - Because the workflow depended on interconnected steps, real data, and business logic, a static mockup could not fully validate the concept. ### The unlock - UX manager Benjamin Ellis built a working prototype with an AI coding tool. - The prototype included: - A simulated backend. - Realistic data based on an actual customer’s workflows. - Clickable scenarios where completing one task affected the next. - Testing the workflow revealed interactions that appeared sound in a design mockup but failed when subjected to realistic conditions. ### The impact - The team and designer committed to a direction only after testing it against real scenarios. - They identified interaction problems earlier. - The approach reduced later surprises and increased confidence in the final design. ### When this approach is useful - When behavior depends on permissions, data, or sequential actions. - When a small fix is faster to make directly in code. - When designers and developers need a working example to scope a complex experience together. ## Exploring with AI on the canvas The next section introduces using AI directly in the Figma canvas to explore product possibilities. The provided excerpt ends before describing the specific workflow or company example. Teams should use code-backed prototypes when logic and real data are central to the experience, then bring those prototypes into collaborative design tools to refine decisions with greater confidence.

Read original(opens in new tab)

Model Context ProtocolFigmaDesign SystemsPrototyping+4

gitlab·May 28, 2026·3 min readCurated summary

Agentic coding is only as good as its context

Coding agents are only as effective as the context they can access. Repository-only agents may produce compiling fixes, but they often miss issue requirements, CI rules, security policies, and review standards. Integrating agents with GitLab’s issues, merge requests, pipelines, and security controls produces better-aligned code, fewer review cycles, and safer releases while preserving human approval. ## From Repository Context to Full Lifecycle Context - GitLab tutorials demonstrate progressively richer workflows using Claude Code and Codex. - **Repository only:** The agent reads local files, interprets the prompt, and runs the build, but lacks acceptance criteria, organizational requirements, and review expectations. - **Repository plus issue:** Through GitLab’s MCP server, the agent can read issue descriptions, labels, milestones, and implementation notes. - It can correctly link changes to issues, such as adding `Closes #32`. - Tools such as `get_issue` and `create_merge_request` connect implementation work to planned work. - **Working inside the merge request:** GitLab’s Code Review Flow provides feedback, which the agent can address by adding tests, improving documentation, and fixing validation gaps. - New commits automatically trigger CI/CD. - Human reviewers can inspect the result in the same merge request. - The tutorials report fewer review rounds and shorter merge times. ## Why Platform Visibility Matters - Platform teams determine: - Which agents and tools are permitted - How agent output is verified - Where human approval is required - Important context lives in the DevSecOps platform: - Issues define requirements. - CI/CD configuration defines quality standards. - Review instructions establish coding conventions. - Security scanners enforce vulnerability policies. - Merge requests bring automation and human review together. - IDE- or terminal-based agents generally see only the files provided to them, while the platform sees the full lifecycle, including deployment targets and approval rules. - Consequently, the platform—not the agent alone—largely determines what can ship safely. ## Security Implications of Faster Code Generation - Agents produce code and remediation patches faster, increasing both the number of vulnerabilities and the number of security fix merge requests. - The bottleneck shifts from finding vulnerabilities to deciding which AI-generated fixes should be reviewed and approved first. - Effective prioritization requires broader context, including: - Application data flows - Deployment environments - Project-wide code - Organization-wide security policies - GitLab’s security layer can filter false positives, confirm vulnerabilities, and use surrounding repository context to propose fixes. - Agentic SAST vulnerability resolution creates a merge request with the proposed remediation. - CI/CD validates the change, while a human reviewer retains final approval. - Strong quality gates and security controls applied within merge requests reduce the chance that vulnerabilities reach production. ## Repository Instructions with `AGENTS.md` - The tutorials use `AGENTS.md` to provide project-specific instructions. - These files can describe: - Repository structure - Commands to run - Code-quality expectations - Files or areas that must not be changed - Language and framework conventions - CI image-pinning requirements - Concurrency patterns - Custom instructions help agents operate consistently with project standards, even before they receive broader platform context. Organizations should connect coding agents to the systems that define requirements, quality, security, and approval. Repository access may enable a working patch, but lifecycle context is what makes that patch trustworthy and ready to merge.

Read original(opens in new tab)

Model Context ProtocolCI/CDGitlabDevSecOps+3

figma·May 26, 2026·2 min readCurated summary

Issue no.16: Trust the process | Figma Blog

Issue 16 of Figma’s newsletter, “Trust the Process,” explores how AI and agentic tools are changing product design. Its central argument is that faster creation makes judgment, context, and craft more important—not less. Teams need to choose the right problems, preserve design intent, and build workflows that connect design and code. ## Choosing What’s Worth Shipping - AI enables product teams to build and iterate rapidly. - The main risk is moving quickly in the wrong direction or settling for “good enough” output. - Strong product judgment and a clear sense of what creates meaningful differentiation remain essential. ## Using MCP to Preserve Context - Model Context Protocol (MCP) allows coding agents to access context from Figma files and design systems. - Figma’s MCP server helps developers translate design decisions into code more accurately. - Better documentation and structured design systems can make this workflow more effective. ## Building Visual Workflows with AI - Figma Weave supports AI-assisted work across video, photography, illustration, and 3D effects. - The newsletter highlights more than 20 workflow templates and methods for creating asset libraries from reference images. - Effective prompting depends on understanding the logic behind a visual language, including how to build, edit, and direct imagery consistently. ## The Design-to-Code Loop - Modern teams increasingly move back and forth between canvas and code. - This “roundtripping” gives designers and developers faster feedback and deeper product context. - Keeping real product states connected to the canvas can reduce drift between what is designed and what ultimately ships. - The convergence of design and development creates more opportunities to improve both speed and craft. ## Practical Experiments - A workflow lab demonstrates how Figma MCP can help teams refine a video export flow by bringing real product states into the design canvas. - Figma also offers efficiency tips for users who rely heavily on Figma Make, including ways to manage credits and streamline workflows. The newsletter recommends treating AI as an accelerator rather than a substitute for direction. The best results come from combining faster tools with deliberate judgment, strong context, and continuous collaboration between design and code.

Read original(opens in new tab)

Model Context ProtocolFigmaAIDesign To Code+2