techlist.io
KREN

Python

52 posts

aws3 min readCurated summary

The AWS MCP Server is now generally available | Amazon Web Services

The AWS MCP Server is now generally available as a managed way for AI agents to access AWS securely through IAM-authenticated tools. It combines live AWS documentation, access to more than 15,000 API operations, and sandboxed scripting so agents can produce more current, efficient, and production-ready results. The post concludes that this solves major limitations of model-only AWS assistance without granting agents unrestricted credentials. ## Why AI Agents Struggle with AWS - Models may lack knowledge of recently launched services such as Amazon S3 Vectors, Aurora DSQL, and Bedrock AgentCore. - Agents often default to the AWS CLI instead of AWS CDK or CloudFormation. - Generated IAM policies are frequently broader than necessary. - The resulting infrastructure may work in demos but fail production standards. ## Core AWS MCP Server Tools - `call_aws` can execute more than 15,000 AWS API operations using the user’s existing IAM credentials. - `search_documentation` and `read_documentation` retrieve current AWS documentation and best practices at query time. - The compact tool set reduces model context usage and is intended to support newly launched APIs within days. ## General Availability Improvements - IAM context keys allow fine-grained access control through standard IAM policies without requiring a separate server permission. - Documentation retrieval no longer requires authentication. - Reduced token consumption improves complex, multi-step workflows. - The `run_script` tool executes short Python scripts in a server-side sandbox. - The sandbox inherits IAM permissions. - It has no network access or access to the user’s local filesystem and shell. - It can combine multiple API calls, filter results, and calculate outputs in one round trip. ## Skills and AWS Best Practices - Skills replace Agent SOPs with curated guidance for common AWS tasks. - AWS service teams contribute and maintain the Skills. - They help agents avoid mistakes, use validated patterns, reduce hallucinations, and consume fewer tokens. - Keeping the tool list small makes agent behavior more predictable. ## Enterprise Security and Observability - IAM policies and Service Control Policies can separate human permissions from agent permissions. - For example, a user may perform write operations while the MCP server is restricted to read-only access. - CloudWatch metrics under the `AWS-MCP` namespace distinguish agent activity from direct human calls. - AWS CloudTrail records all API calls for auditing and compliance. ## Demonstration with Claude Code - Without the MCP Server, Claude Opus 4.6 suggested several valid ways to store embeddings on S3 but missed Amazon S3 Vectors because the service launched after its training cutoff. - With the MCP Server, Claude Code searched current AWS documentation and correctly identified S3 Vectors. - Claude Code can connect through the open-source `mcp-proxy-for-aws`, which bridges local IAM credentials and MCP’s OAuth 2.1 requirement. - The server works with Claude Code, Kiro, Cursor, Codex, and other MCP-compatible clients. ## Availability and Cost - The service is available in US East (N. Virginia) and Europe (Frankfurt). - It can make API calls across AWS Regions. - There is no additional charge for the MCP Server; users pay for AWS resources and applicable data transfer. The AWS MCP Server is a practical foundation for giving agents current AWS knowledge and controlled operational access. Teams should pair it with narrowly scoped IAM policies, read-only defaults where possible, and CloudWatch or CloudTrail monitoring.

Read original(opens in new tab)
PythonModel Context ProtocolAWSClaude Code+4
gitlab3 min readCurated summary

Automate detection testing with GitLab CI/CD and Duo

GitLab’s WATCH framework continuously tests whether security detections still work in real conditions, rather than only verifying that detection rules deploy successfully. It runs simulated attacks in staging, checks alert propagation through logging, SIEM, and SOAR systems, and reports failures automatically. The framework uses GitLab CI/CD to schedule randomized tests, correlate expected alerts, and publish detection-health results. ## The Detection-Validation Gap - Security detections can silently fail because of: - Log schema changes - SIEM updates - Ingestion or pipeline misconfigurations - Other changes between the log source and alerting systems - Reinjecting synthetic logs into a SIEM can test rule logic, but it does not validate real-world behavior or the log-ingestion path. - GitLab’s detections-as-code pipelines confirm that rules can be created and deployed, but not that they fire when the targeted activity occurs. - WATCH fills this gap by validating detections end to end. ## WATCH’s Testing Lifecycle - **Scheduling:** A weekly GitLab CI/CD pipeline discovers active tests and assigns them randomized execution times. - **Heads-up notification:** WATCH creates a dedicated “WATCH Heads Up” SOAR record containing the detections expected to fire. - **Execution:** Scripts perform simulated malicious actions in staging, such as resetting an administrator password or making suspicious API calls. - **Detection:** Activity logs flow through ingestion into the SIEM, where detection rules process them. - **Correlation:** SOAR matches alerts to registered WATCH tests using: - The time window between execution and alerting - Actor identity, such as an IP address or username - The detection rule ID - **Verification:** A follow-up job confirms that all expected detections fired, updates detection metadata, and publishes results to a GitLab Pages dashboard. - Failed tests generate notifications in the team’s Slack channel. - Correlation prevents test alerts from being escalated as genuine incidents while still validating the complete alerting pipeline. ## GitLab CI/CD Implementation WATCH is organized into three pipeline stages: - **`schedule_pipelines`:** - Runs weekly. - Finds active tests and groups them into scheduled pipelines. - Passes the selected tests through the `TESTS_TO_RUN` variable. - **`run_tests`:** - Executes the assigned attack simulations. - Saves execution results in `detection_status.json`. - Records SOAR identifiers needed for later alert correlation. - **`pages`:** - Queries the SOAR to verify alert generation and routing. - Updates `detection_status.json` with test results. - Deploys the latest status data and dashboard assets to GitLab Pages. The example configuration uses Python 3.12, pipeline inputs to enable weekly scheduling or dashboard updates, conditional `rules`, and GitLab Pages artifacts. Scheduled execution is randomized to avoid predictable test patterns and to expose timing-related problems. ## Practical Recommendation Organizations with critical security detections should add continuous behavioral testing alongside detections-as-code validation. A framework like WATCH can provide earlier warning of broken ingestion, rules, or routing while reducing the cost and generic limitations of commercial breach-and-attack simulation tools.

Read original(opens in new tab)
PythonDatabase DesignSecurity MonitoringSiem+4
gitlab2 min readCurated summary

Teaching software development the easy way using GitLab

GitLab for Education can turn the administrative work of teaching software development into a scalable, professional workflow. University of Washington lecturer Stephen G. Dame uses GitLab groups, controlled permissions, merge requests, and inline comments to distribute materials, protect solutions, and provide contextual feedback. The approach helps students build real-world version-control and code-review habits while reducing instructor overhead. ## Building a Course Structure with Groups - Dame organizes the university in a root group such as `UWTeaching`, with one subgroup per course, such as `css430`. - Course subgroups contain: - Private lecture materials and code repositories - Student subgroups - Grader subgroups - Permissions inherit through the hierarchy, allowing instructors to control access centrally. - Students receive Reporter access with an expiration date tied to the academic quarter. - They can clone and pull assignment repositories but cannot push to instructor-controlled repositories. - Students use SSH keys across local machines, cloud shells, and virtual machines, then copy code into private repositories for their own version history. ## Automating Enrollment for Large Classes - Manually creating student accounts and permissions becomes impractical for large cohorts. - GitLab’s REST API can automate: - Creating personal subgroups for students - Looking up GitLab users - Assigning Reporter permissions - Setting membership expiration dates - GitLab also provides an open source class-management project with additional automation tools. ## Feedback Through Merge Requests - Students submit assignments by opening merge requests in their repositories. - Instructors immediately see a complete diff of the student’s work. - Comments can be attached directly to individual lines of code. - Inline feedback lets instructors explain both what is wrong and why, while directing students toward the next step. - Because feedback appears beside the relevant code, it is more actionable than comments on a separate document. ## Starting with GitLab for Education - The initial setup requires planning, but the workflow becomes largely self-sustaining once established. - GitLab for Education provides qualifying institutions with GitLab Ultimate features, including expanded storage, compute minutes, and merge-request capabilities. - Instructors are advised to begin with one course group, one assignment template, and a basic pipeline before expanding. A simple GitLab structure can make course administration more efficient while giving students practical experience with the collaborative development tools used in industry.

Read original(opens in new tab)
PythonDatabase DesignGitlabOpen Source+3
spotify3 min readCurated summary

Building a Natural Language Interface to the Spotify Ads API with Claude Code Plugins | Spotify Engineering

The post describes an open-source Claude Code plugin that lets users manage Spotify advertising campaigns through natural-language requests. It translates high-level intent into validated, multi-step Spotify Ads API calls, handling targeting lookups, budget conversions, entity dependencies, and missing information. The authors favor a Markdown- and CLI-based design over MCP because it keeps the system transparent, lightweight, customizable, and grounded in Spotify’s OpenAPI specification. ## Natural-Language Campaign Creation - Users can request campaigns conversationally, such as creating an audio campaign targeting a specific age range and location with a daily budget. - The agent orchestrates the campaign lifecycle: - Creates the campaign. - Creates an ad set with targeting and budget. - Creates the ad and attaches creative assets. - It handles implementation details automatically: - Looks up geographic targeting IDs. - Converts dollar amounts into API micro-units. - Validates audience size. - Passes entity IDs between dependent API calls. - Prompts for missing required information. ## Claude Code Plugin Architecture - **Skills** provide slash commands, with each command defined in Markdown alongside its endpoints, request formats, and output behavior. - **Agents** interpret freeform requests and decompose them into the necessary API operations. - **Hooks** intercept tool calls to refresh OAuth tokens and inject HTTP headers. - **Settings** store local user configuration, including credentials, ad accounts, and environment preferences. - Because all components are human-readable Markdown, the plugin has no compilation, bundling, or package-management step. - API behavior can often be corrected by updating documentation or instructions rather than changing compiled code. ## CLI and OpenAPI Instead of MCP - The authors avoided MCP because the Spotify Ads API has more than 30 resource types and complex nested schemas. - Defining every endpoint as an MCP tool would create a large static registry and consume context even when most tools were irrelevant. - The plugin loads only the API documentation needed for a particular task. - API calls are issued as visible `curl` commands, allowing users to inspect, copy, modify, and reproduce them. - Spotify’s roughly 8,600-line OpenAPI v3 specification serves as the single source of truth. - Updating one bundled specification file is simpler than maintaining a separate translation into MCP schemas. ## Domain-Specific Agent Behavior - The request-builder agent is defined in `agents/spotify-ads-request-builder.md`. - It teaches the model Spotify-specific conversions, including: - Dollar values to micro-amounts. - Natural-language dates to ISO 8601. - Platform names to API enum values. - It performs multi-step orchestration for campaign, ad set, and ad creation. - It resolves locations such as “Connecticut” through geo-targeting search endpoints and builds the required `geo_targets` structure. - It performs pre-flight audience estimates to ensure targeting meets minimum size requirements. - It is designed to control execution carefully and validate requests before making changes that could affect advertising budgets. ## Practical Implication The plugin demonstrates that a large advertising API can be made approachable without hiding its mechanics. A Markdown-based Claude Code integration, backed by the official OpenAPI specification and transparent CLI requests, offers a practical balance between natural-language convenience, developer control, auditability, and maintainability.

Read original(opens in new tab)
PythonDatabase DesignNatural Language ProcessingClaude Code+4
aws3 min readCurated summary

Introducing Anthropic’s Claude Opus 4.7 model in Amazon Bedrock | Amazon Web Services

Claude Opus 4.7 is now available in Amazon Bedrock as Anthropic’s most capable Opus model for coding, professional knowledge work, long-running agents, and visual tasks. It runs on Bedrock’s new inference engine, which dynamically schedules capacity, improves availability, queues requests during demand spikes, and provides zero operator access to prompts and responses. AWS positions the model as a production-ready upgrade to Opus 4.6, though teams may need to adjust prompts and agent harnesses. ## Model Improvements - **Agentic coding:** Stronger long-horizon autonomy, systems engineering, and complex code reasoning. - 64.3% on SWE-bench Pro - 87.6% on SWE-bench Verified - 69.4% on Terminal-Bench 2.0 - **Knowledge work:** Better document creation, financial analysis, and multi-step research. - Handles underspecified requests by making and explaining reasonable assumptions. - Self-verifies responses to improve first-pass quality. - 64.4% on Finance Agent v1.1. - **Long-running tasks:** Maintains coherence across its full 1-million-token context window while handling ambiguity and verifying results. - **Vision:** High-resolution image support improves analysis of charts, dense documents, and detailed screen interfaces. - **Adaptive thinking:** Dynamically allocates reasoning-token budgets based on request complexity. ## Bedrock Infrastructure and Scaling - The new inference engine uses updated scheduling and scaling logic to allocate capacity dynamically. - It prioritizes steady-state workloads while rapidly scaling capacity for changing demand. - During high demand, requests are queued instead of rejected. - Up to 10,000 requests per minute per account and Region are available immediately, with additional capacity available by request. - Zero operator access prevents AWS and Anthropic operators from viewing customer prompts and responses. ## Ways to Invoke the Model - Test Claude Opus 4.7 in the Amazon Bedrock console through **Playground**. - Use the Anthropic Messages API through: - Anthropic SDK integrations with Bedrock - `bedrock-mantle` endpoints - Use Bedrock-native APIs: - **Converse API** for multi-turn conversations and Guardrails integration - **Invoke API** for direct invocation and lower-level control - Invoke it with the AWS CLI using model ID `anthropic.claude-opus-4-7`. - The Anthropic Bedrock SDK can authenticate with AWS Signature Version 4 and submit Messages API requests programmatically. ## Availability - Initially available in: - US East (N. Virginia) - Asia Pacific (Tokyo) - Europe (Ireland) - Europe (Stockholm) - AWS directs users to the Bedrock model and pricing pages for regional availability updates. Teams seeking stronger coding agents, complex research workflows, or high-volume production inference can try Claude Opus 4.7 in Bedrock, while validating prompt and harness changes before migrating existing Opus 4.6 workloads.

Read original(opens in new tab)
PythonAmazon BedrockAPIAgentic Coding+4
cloudflare3 min readCurated summary

Cloudflare’s AI Platform: an inference layer designed for agents

Cloudflare is positioning AI Gateway as a unified inference layer for agentic applications. It provides one API for models from multiple providers, centralized cost and reliability controls, and low-latency access through Cloudflare’s global network. The platform is also expanding toward customer-hosted models and multimodal inference, reducing dependence on any single AI vendor. ### A Unified Model Catalog and Endpoint - Developers can call Cloudflare-hosted and third-party models through the same `env.AI.run()` interface. - Switching models, such as from Workers AI to Anthropic or OpenAI, requires only a one-line change. - Cloudflare plans to add REST API support for applications that do not run on Workers. - The catalog includes more than 70 models from over 12 providers, spanning: - Text and reasoning models - Image, video, and speech models - Open-source models hosted on Workers AI - Proprietary models from major providers - Users pay through one credit system rather than managing separate provider accounts. ### Centralized Cost and Usage Management - AI Gateway gives companies a consolidated view of spending across providers. - Request metadata can categorize costs by: - Team - User - Customer - Workflow - Free versus paid usage - This is particularly useful for agents, which may make many model calls for a single user request. ### Bringing Custom Models to Workers AI - Cloudflare is working on allowing customers to deploy fine-tuned or specialized models through Workers AI. - The deployment workflow uses Replicate’s Cog technology to package models and manage: - Python dependencies - CUDA requirements - Model weights - Runtime configuration - Developers define the environment in `cog.yaml` and implement model setup and inference in `predict.py`. - After building the Cog container, Cloudflare can deploy and serve it through existing Workers AI APIs. - Planned improvements include customer-facing APIs, Wrangler commands, and GPU snapshotting to reduce cold-start times. ### Optimizing Agent Responsiveness - For live agents, time to first token can matter more than total inference time. - A small reduction in startup latency can make an agent feel significantly more responsive, even if the full answer still takes several seconds. - Cloudflare’s presence in 330 cities places gateways close to users and inference endpoints, reducing network delay before streaming begins. - Workers AI is adding agent-focused open-source models, including Kimi K2.5 and real-time voice models. Cloudflare’s direction is to make model selection, deployment, monitoring, and failover easier through a single infrastructure layer. For teams building agents, the platform offers a way to mix providers and custom models while controlling cost, latency, and operational complexity.

Read original(opens in new tab)
PythonCloudflareApi IntegrationAi Gateway+4
cloudflare3 min readCurated summary

Cloudflare Email Service: now in public beta. Ready for your agents

Cloudflare Email Service is entering public beta as infrastructure for applications and AI agents that use email as a primary interface. It combines inbound Email Routing with outbound Email Sending, allowing agents to receive messages, perform asynchronous work, and reply without relying on separate email providers. Cloudflare argues this enables agents to move beyond instant chatbot responses and operate independently across support, billing, verification, and multi-agent workflows. ## Email as an Agent Interface - Email is universally available and requires no custom chat application or channel-specific SDK. - Developers already depend on email for: - Account signups - Notifications - Invoices - Customer support - Verification workflows - Agents increasingly need email to communicate with users and other systems. ## Cloudflare Email Service - **Email Routing** lets applications and agents receive email. - **Email Sending** enables replies and outbound notifications. - The service integrates with Workers and the Agents SDK. - The public-beta toolkit includes: - An Email Sending binding - An Email MCP server - Wrangler CLI email commands - Skills for coding agents - An open-source agentic inbox reference application ## Email Sending in Public Beta - Workers can send transactional email through a native `env.EMAIL` binding. - The binding requires no API keys or secret management inside the Worker. - Applications can also send email through a REST API or TypeScript, Python, and Go SDKs. - Cloudflare automatically configures SPF, DKIM, and DMARC when a domain is added, improving authentication and inbox delivery. - Since the service runs on Cloudflare’s global network, it is designed for low-latency delivery worldwide. - Combined with long-standing Email Routing, developers can receive, process, and send email within one platform. ## Email-Native Agents with the Agents SDK - The Agents SDK already provides an `onEmail` hook for processing inbound messages. - Previously, agents were limited to synchronous replies or messages sent to Cloudflare account members. - Email Sending removes those limitations, allowing agents to: - Process requests for extended periods - Query multiple systems - Schedule follow-ups - Escalate unusual cases - Reply asynchronously after completing work - This turns an agent from a simple chatbot into a system capable of acting independently. ## Support-Agent Workflow - The example `SupportAgent`: - Receives email through `routeAgentEmail` - Parses the raw message with `PostalMime` - Stores ticket details such as sender, subject, body, and message ID in agent state - Starts longer-running work or sends a task to a Queue - Replies using the Email Sending binding - Preserves the conversation with `inReplyTo` and a `Re:` subject - Address-based routing maps addresses such as `support@domain` or `sales@domain` to corresponding agent instances. Cloudflare’s recommendation is to use Email Service when an agent must communicate reliably with people over email, especially for workflows that require persistence, background processing, and delayed or follow-up responses.

Read original(opens in new tab)
PythonTypeScriptGoRest Api+4
line4 min readCurated summary

ODW #2: Developing Single/Multi-Agents with ADK and Integrating with Internal Systems

AI adoption can improve productivity, but relying on individual developers to create and refine local AI agents leads to knowledge silos, duplicated effort, and uneven results. LY Corporation’s Orchestration Development Workshop addresses this by teaching engineers to build shared single- and multi-agent systems with Google’s Agent Development Kit (ADK). The workshop combines theory with hands-on integration of agents and internal tools such as Jira and Confluence through MCP. ## Organizational Need for AI - Potential applications include pull request reviews, customer support, and internal document search. - Information is difficult to find because company knowledge is distributed across systems such as Jira and Confluence. - LY Corporation aims to double work productivity within three years through AI and continuous innovation. - As tools such as Cline and Claude Code spread, usage remains concentrated among individuals. - This creates: - Productivity gaps between employees - AI knowledge silos - Repeated prompt-development work across teams - Limited awareness of multi-agent approaches - Abandonment of AI when single agents cannot handle complex tasks ## Why a Hands-On Workshop The organizers concluded that organization-wide adoption required practical understanding of three areas: - The strengths and limitations of single-agent and multi-agent systems - A team-based model for building and sharing centralized agents - Integration between AI agents and internal systems through the Model Context Protocol (MCP) Rather than teaching only concepts, the workshop required participants to build working agents with ADK. ## Single-Agent and Multi-Agent Systems - **Single agents** - Use one LLM and are relatively inexpensive and simple to develop. - Work well for straightforward tasks. - Struggle with complex problems requiring multiple specialties. - **Multi-agent systems** - Divide work among multiple specialized LLM-based agents. - Can handle more complex workflows and optimize tasks more effectively. - Require more development effort and token usage. - Must be designed carefully to avoid usage limits and excessive costs. ## Introducing Google ADK - ADK is open-source software for defining agent behavior and building multi-agent systems. - It supports Python, Java, and Go. - Python functions can be exposed as tools that agents invoke. - Teams can build and host shared agents, reducing the need for every employee to independently optimize prompts. ## Building a Single Agent Participants practiced: - Running an ADK web UI and interacting with an agent in a browser - Modifying instructions to change agent behavior - Connecting a prepared Python function as an executable tool The exercises demonstrated that prompts can flexibly control responses and that ordinary Python code can be integrated into an agent with relatively little effort. ## Connecting Agents to Internal Systems with MCP - MCP is an open standard for connecting LLMs to external systems. - It enables agents to actively search sources such as previous inquiries, documentation, Jira, and Confluence. - Participants learned that merely exposing tools is insufficient; the agent also needs clear instructions to use them effectively. - Giving one agent too many tools can enlarge its context, slow responses, and reduce accuracy. - Splitting responsibilities across multiple agents can help isolate context and mitigate these problems. ## Building a Sequential Project Tracker The main exercise created a project-tracking system that analyzes Jira projects and produces translated progress reports. - Four agents execute sequentially: 1. Analyze in-progress tasks 2. Analyze todo or unstarted tasks 3. Generate a consolidated Markdown report 4. Translate the report into the configured language - The first two agents use Jira through MCP. - The report generator synthesizes the preceding analyses. - The translator preserves the report’s formatting and structure. - ADK’s `SequentialAgent` coordinates the workflow and passes results between specialized agents. ## Practical Recommendation Organizations seeking broader AI adoption should move beyond individual experimentation. Shared agents built with ADK, connected to internal systems through MCP, can consolidate expertise, reduce duplicated prompt work, and make multi-agent workflows accessible to entire teams.

Read original(opens in new tab)
PythonAIKubernetesModel Context Protocol+4
line3 min readCurated summary

The Key to AI Utilization Lies in 'Organizational Learning' - The Start of the Orchestration Development Workshop

LY Corporation is moving from simply adopting AI tools to building with AI as a collaborative development partner. Its new Orchestration Development Workshop teaches engineers to coordinate multiple AI systems across coding, testing, reviews, incident analysis, and other workflows. The initiative aims not only to improve efficiency but to free engineers from repetitive work so they can focus on more creative, high-value challenges. ## From AI Adoption to AI Collaboration - AI-assisted development and operations are spreading rapidly across LY Corporation. - Engineers use generative AI for code generation and testing, while combining it with non-generative AI for analysis and operational optimization. - Despite broader adoption, employees differ significantly in how deeply they use AI in their daily work. - The workshop was created to help the organization evolve from “using AI” to “creating alongside AI.” ## Orchestration: Coordinating Multiple AI Systems - “Orchestration” refers to combining multiple AIs, along with human input, to produce a complete outcome. - Example workflows include: - Generating code automatically from a Jira ticket. - Having AI run tests, conduct reviews, and create a pull request. - Analyzing a Slack incident report, estimating the cause, and proposing a fix. - The workshop turns these emerging practices into hands-on learning rather than passive demonstrations. ## A Hands-On, Interactive Learning Model - Participants follow instructors in real time and perform the same tasks themselves. - Zoom conversations and Slack questions create two-way communication during the session. - Instructors and representative participants explore solutions to problems as they arise. - The goal is for attendees to gain skills they can reproduce in their own projects, not merely acquire theoretical knowledge. ## Organization-Wide Support Through Guilds and DevRel - The initiative is designed to avoid depending on individual enthusiasm. - Three complementary functions support continuous growth: - **DevRel:** Drives the program and promotes adoption. - **Guilds:** Contribute practical insights from engineering teams. - **TD:** Helps maintain quality and reproducibility. - This structure supports consistent content quality and enables AI knowledge to spread across the company. ## Beyond Efficiency: Unlocking Engineering Creativity - LY Corporation views AI as more than a way to complete tasks faster. - By delegating repetitive work to AI, engineers can spend more time on creative and strategically valuable activities. - The organization aims to move beyond a model where AI writes code and humans only review it. - Instead, engineers should collaborate with AI from the design stage through implementation. ## Future Direction - LY Corporation plans to share lessons from the workshops through external channels such as its technology blog. - Future topics will include both generative and non-generative AI. - The broader goal is to provide practical guidance for engineers building new workflows with AI. The workshop represents a structured way to turn AI experimentation into repeatable organizational practice, helping engineers coordinate multiple AI tools while preserving human creativity and judgment.

Read original(opens in new tab)
PythonAIDatabase DesignPostgreSQL+4
meta4 min readCurated summary

How Meta Used AI to Map Tribal Knowledge in Large-Scale Data Pipelines

AI coding assistants struggle when they lack a map of a large, proprietary codebase. To address this, the team built a pre-compute system using 50+ specialized agents that analyzed over 4,100 files across four repositories and three languages, producing 59 concise context files. The approach gave agents complete module coverage, captured previously undocumented tribal knowledge, reduced tool calls by about 40%, and made complex development tasks much faster. ## The Problem: Powerful Tools Without Codebase Context - The pipeline combines Python configuration, C++ services, and Hack automation across multiple repositories. - A seemingly simple change, such as adding a data field, can affect: - Configuration registries - Routing logic - DAG composition - Validation rules - C++ code generation - Automation scripts - AI agents often explored repeatedly, guessed at conventions, and produced code that compiled but was subtly incorrect. - Important examples of missing context included: - Different field names for the same operation in separate configuration modes - “Deprecated” enum values that must remain for serialization compatibility - Hidden intermediate field names used between pipeline stages ## The Pre-Compute Approach The team used a large-context model and orchestrated specialized agents in several phases: - Two agents explored and mapped the codebase. - Eleven analysts read every file and answered five questions: - What does the module configure? - How is it commonly modified? - What non-obvious patterns can cause failures? - What are its cross-module dependencies? - What tribal knowledge is hidden in comments? - Writers generated context files. - More than ten critic passes reviewed quality across three rounds. - Fixers, upgraders, gap-fillers, prompt testers, and final critics corrected and validated the results. - In total, more than 50 specialized tasks were coordinated in one session. This process uncovered over 50 non-obvious design patterns, including naming conventions and append-only identifier rules that were not documented elsewhere. ## Context Files: “A Compass, Not an Encyclopedia” Each of the 59 context files is intentionally short—about 25–35 lines or roughly 1,000 tokens—and contains: - Quick Commands for common operations - Key Files limited to the most relevant three to five files - Non-Obvious Patterns - See Also references to related modules Together, the files use less than 0.1% of a modern model’s context window. They are designed for targeted, opt-in use rather than being loaded into every task. ## Routing and Dependency Navigation - An orchestration layer routes natural-language requests to the appropriate tool. - Operational questions can trigger dashboard scans and matching against more than 85 historical incident patterns. - Development requests can launch configuration generation and multi-phase validation. - A cross-repository dependency index and data-flow maps show how changes propagate. - Dependency questions that previously required about 6,000 tokens of exploration can be answered through a graph lookup using roughly 200 tokens. ## Results and Quality Controls - Preliminary tests across six tasks showed approximately 40% fewer tool calls and tokens. - Work that previously required around two days of research and engineer consultation took about 30 minutes. - Critic reviews raised quality scores from 3.65 to 4.20 out of 5. - Every referenced file path was verified, with no hallucinated paths. - Coverage expanded from navigation guidance for roughly 5% of modules to all 4,100+ files across three repositories. ## Why This Differs from Generic Context Files Research has found that AI-generated context files can reduce agent performance on familiar open-source projects. The team argues that this result does not directly apply to proprietary systems whose conventions and tribal knowledge are absent from model training data. Their approach addresses common problems by making context: - Concise rather than encyclopedic - Opt-in rather than always loaded - Quality-gated through independent critics - Continuously refreshed to prevent stale information Without this context, agents typically spend 15–25 tool calls exploring and remain vulnerable to subtle domain-specific errors. ## Keeping the Knowledge Fresh Automated jobs refresh the system every few weeks by: - Validating file paths - Detecting coverage gaps - Re-running critic reviews - Finding and repairing stale references - Updating routing and dependency information The system treats AI not merely as a consumer of documentation, but as the engine that creates and maintains it. ## Applying the Method Elsewhere Teams can adapt the approach by: - Identifying where agents most often fail due to undocumented conventions or dependencies - Applying the five-question analysis framework to each module - Keeping context files short and action-oriented - Using independent quality critics before publishing generated guidance - Automating freshness checks and self-repair The practical recommendation is to build a small, targeted, continuously maintained knowledge layer for proprietary codebases. Concise navigation and dependency context can reduce exploration costs while preventing the subtle errors that arise when agents lack domain-specific understanding.

Read original(opens in new tab)
PythonDatabase DesignCppConfig As Code+4
gitlab3 min readCurated summary

Getting started with GitLab feature flags in Python

GitLab feature flags let teams deploy code without immediately exposing it to users, reducing the risk of production failures and eliminating redeployments for rollbacks. Using the Unleash Python SDK, a Flask application can retrieve flag definitions from GitLab, cache them locally, and evaluate them quickly without a network request on every check. The tutorial demonstrates a practical setup using configurable rollout strategies such as user targeting, percentage rollouts, and all-user releases. ## Requirements and Project Setup - A GitLab project with Feature Flags enabled under **Settings > General > Visibility, project features, permissions**. - A fork or clone of the demo repository: - `app.py` contains the Flask and Unleash integration. - `requirements.txt` lists dependencies. - `.env.example` documents required configuration. - `templates/index.html` and `static/styles.css` provide the demo interface. - The example repository is available at `gitlab.com/omid-blogs/gitlab-feature-flags-demo`. ## How the Unleash Integration Works - GitLab provides an Unleash-compatible API for each project, so no separate Unleash server is required. - The SDK downloads flag definitions when the application starts. - It refreshes the cached configuration periodically; the demo uses a 15-second interval. - Calls to `is_enabled()` evaluate flags locally, avoiding a network request for each check. - Local evaluation makes flag checks fast and more resilient to temporary connectivity problems. ## Creating Feature Flags The tutorial creates four active flags, initially using the **All users** strategy: - `dark_mode` enables a dark color scheme. - `holiday_banner` displays a festive banner. - `new_layout` changes the card grid to a single-column layout. - `fun_fonts` applies a playful handwritten font. A flag must be both **Active** and assigned at least one strategy. An active flag without a strategy is evaluated as disabled. ## Choosing Rollout Strategies GitLab supports several built-in strategies: - **Percent rollout:** Gradually enables a feature based on user ID, session ID, or random assignment. - **Percent of users:** Targets a percentage of authenticated users. - **User IDs:** Limits access to explicitly named users, useful for QA. - **User list:** Enables a feature for a predefined user group. - **All users:** Enables the feature for everyone. A typical release process is to begin with QA users, move to a 10% rollout, and eventually enable the feature for all users entirely through GitLab’s UI. ## Configuring Unleash Credentials From the project’s Feature Flags page, the **Configure** panel provides: - `UNLEASH_URL`, such as `https://gitlab.com/api/v4/feature_flags/unleash/<your-project-id>` - `UNLEASH_INSTANCE_ID`, a project-scoped read-only token - `UNLEASH_APP_NAME`, used to identify the application, for example `production` The Instance ID can read flag state but cannot modify flags. It should still be treated as a secret because it can expose project flag information. ## Running the Application Locally - Install dependencies with: ```bash pip install -r requirements.txt ``` - Copy `.env.example` to `.env` and replace the placeholders with the GitLab credentials. - Export the variables from the `.env` file or define them directly in the terminal. - The three environment variables driving the integration are: - `UNLEASH_URL` - `UNLEASH_INSTANCE_ID` - `UNLEASH_APP_NAME` - Never commit `.env`; the repository’s `.gitignore` excludes it because the Instance ID is sensitive. The recommended approach is to use the `UnleashClient` Python SDK to handle polling, caching, and local feature-flag evaluation, while GitLab remains the control center for changing rollout behavior.

Read original(opens in new tab)
PythonGitlabApi IntegrationFeature Flags+4
line3 min readCurated summary

Advancing Guardrail Models through Automated Vulnerability Collection and Generation Using Coding Agents

LLM guardrails must detect prompt injection and jailbreak attempts without blocking legitimate requests that merely contain security-related keywords. The post argues that benchmark scores alone do not reflect production performance, especially false positives caused by missing input diversity. It presents a Codex-based, automated testing pipeline that generates categorized test data, evaluates the guardrail model, and analyzes failures reproducibly. ## The Gap Between Benchmark and Production Performance - The initial guardrail model performed well on external benchmarks but produced unexpected false positives in production-like tests. - Legitimate requests containing terms such as “ignore,” “bypass,” “override,” “system prompt,” or “jailbreak” were sometimes classified as attacks. - Examples included: - Development questions about temporarily bypassing authentication in a local test environment. - Educational requests about jailbreak techniques and defensive guidelines. - The core issue was insufficient representation of real-world input diversity, not simply poor model quality. - This motivated an automated environment for repeatedly discovering and analyzing guardrail weaknesses. ## Using Codex as a Test Automation Tool - The team adapted coding agents from software development tasks to complex, repeatable security testing. - Codex was used through its CLI capabilities to: - Read and create project files. - Edit code. - Execute evaluation scripts. - The pipeline relies on three Codex concepts: - **AGENTS.md:** Defines global rules, project conventions, commands, and security constraints. - **Sub-agents:** Allow a main orchestrator to delegate independent category tests to parallel worker agents. - **Skills:** Package repeatable procedures, input/output specifications, prompts, and scripts into reusable modules. ## Category-Based Experiments - Instead of sending thousands of random samples, experiments are divided into vulnerability and false-positive categories. - Example categories include: - Normal development or IT requests containing security-related keywords. - Educational or preventive requests involving sensitive topics such as jailbreaks or drug abuse prevention. - Categorization improves: - Root-cause analysis. - Parallel execution through independent workers. - Context clarity. - Regression testing after model changes. ## Separate Generation and Evaluation Skills ### `synthetic-generator` - Creates test queries according to each category’s specification. - Enforces constraints such as: - Attack type. - Sentence length. - Safe or dangerous target labels. - Produces varied, realistic phrasing and stores the dataset as JSONL. ### `injection-classifier` - Sends generated inputs to the guardrail model API through Python scripts. - Compares predictions with ground-truth labels. - Calculates false-positive and false-negative statistics. - Stores the original text, labels, predictions, and metrics in a consolidated JSONL file. Separating these procedures into skills provides intermediate artifacts for debugging, fixed input/output contracts for reproducibility, and independent maintenance of generation and evaluation logic. ## Pipeline Architecture - A **main agent**: - Reads `AGENTS.md` and `TEST_CATEGORY.md`. - Determines categories, sample counts, and constraints. - Creates and assigns work to category-specific workers. - Collects completion reports and verifies the run. - Each **category worker**: - Generates `input.jsonl` using `synthetic-generator`. - Evaluates the guardrail model using `injection-classifier`. - Produces `result.jsonl` with predictions and metrics. - Analyzes false positives and false negatives. - Writes a Markdown analysis report. - Stores outputs under `outputs/<run_id>/`, organized by category. ## Results and Practical Recommendation The pipeline enables systematic, repeatable testing rather than isolated discovery of misclassifications. For production guardrails, teams should combine benchmark evaluation with categorized real-world simulations, modular generation and evaluation steps, parallel test agents, and preserved JSONL artifacts for debugging and regression analysis.

Read original(opens in new tab)
PythonAPIPrompt InjectionCodex+4
toss3 min readCurated summary

Embracing the Software 3.0 Era

Software 3.0 replaces hand-written rules with natural-language instructions to LLMs, but models alone cannot reliably perform real-world work. The missing piece is the harness: tools, context, and environments that connect an LLM to codebases, commands, databases, and users. Claude Code illustrates how familiar Software 1.0 architecture can guide agent design while adding a new capability—asking humans for judgment when uncertainty arises. ## From Software 1.0 to Software 3.0 - **Software 1.0:** Developers explicitly write logic using languages such as Python, Java, or C++. - **Software 2.0:** Data and training produce neural-network weights that function as the program. - **Software 3.0:** Prompts and natural-language instructions direct LLM behavior. - Karpathy’s central claim is that Software 3.0 is increasingly absorbing both traditional code and trained models. ## Harnesses Make LLMs Useful - A raw LLM cannot independently read a codebase, execute commands, modify files, or access databases. - A **harness** supplies the tools and environment needed to turn model capability into practical work. - Claude Code is presented as a harness for Claude: it transforms a language model into an agent capable of completing and shipping tasks. ## Mapping Agent Concepts to Layered Architecture The terminology of agent systems can be understood through familiar Software 1.0 design patterns: - **Slash commands → Controllers** - They serve as entry points for user requests, such as `/review` or `/refactor`. - **Sub-agents → Service layer** - They coordinate multiple skills to complete a workflow. - Each sub-agent has an independent context and acts as a self-contained unit of work. - **Skills → Domain components** - Each skill should have one focused responsibility, such as reviewing code, generating tests, or writing documentation. - **MCP → Infrastructure or adapters** - MCP provides abstraction boundaries for external systems such as APIs and databases. - **CLAUDE.md → Project constitution** - It records stable project information: technology choices, conventions, and build commands. - Frequently changing task details should be provided through the conversation or injected into an agent’s context instead. ## Agent Design Has Familiar Anti-Patterns Traditional code smells also apply to agent systems: - **Feature Envy:** A skill relies excessively on another skill’s data. - **Duplication:** Prompts are copied across multiple skills. - **Long Method:** A single sub-agent performs an overly long sequence of many skills. - Clear boundaries, single responsibility, and limited coupling remain valuable. ## The Difference: Agents Can Ask Humans Layered architecture generally requires every failure and edge case to be handled through predefined exceptions, policies, or branches. - Traditional code must decide what to do when an unusual case occurs. - An agent using human-in-the-loop interaction can pause and ask the user for clarification. - In this model, exceptions become questions, allowing the agent to continue after receiving a decision. Agents should ask when: - An action is difficult to reverse, such as deletion or deployment. - Several valid options exist without a clear best choice. - The decision has significant consequences. They should proceed automatically when: - The operation is safely repeatable. - Existing conventions provide a clear answer. - The action is easy to undo. ## What Carries Forward into Software 3.0 The new paradigm does not make established engineering practices irrelevant. - Move away from explicitly coding every possible rule and edge case. - Do not reduce LLMs to simple autocomplete tools. - Preserve layered design, single responsibility, abstraction, dependency management, and interface design. - Continue emphasizing testability, debugging, code review, and iterative improvement. The practical approach is to combine Software 3.0’s flexible reasoning with Software 1.0’s architecture and engineering discipline, while giving agents a clear way to involve humans when decisions require judgment.

Read original(opens in new tab)
PythonLarge Language ModelsKubernetesReact+4
gitlab3 min readCurated summary

GitLab Container Virtual Registry with Docker Hardened Images

GitLab Container Virtual Registry provides a single, authenticated endpoint for pulling images from multiple registries while caching manifests and layers locally. It reduces repeated network downloads, centralizes upstream credentials, and makes it easier to adopt Docker Hardened Images without changing every team’s CI/CD configuration. The article recommends using it as an operational layer between pipelines and registries such as Docker Hub, dhi.io, MCR, and Quay.io. ## The Container Image Management Problem Platform teams often depend on several registries: - Docker Hub for common base images - dhi.io for Docker Hardened Images - MCR for .NET and Azure tooling - Quay.io for Red Hat ecosystem images - Internal registries for proprietary images This creates: - Different authentication mechanisms and image paths - Registry-specific CI/CD configuration - Repeated credential-management work - Slow builds caused by downloading identical images in every job ## How Container Virtual Registry Works - Pipelines pull through a GitLab URL such as: `gitlab.com/virtual_registries/container/<id>/image` - GitLab checks configured upstreams in priority order. - If the image is cached, GitLab serves it directly. - If not, GitLab fetches it from the appropriate upstream, caches the manifest and layers, and returns it. - Cache validity is configurable, with 24 hours presented as the default. - Developers and pipeline authors do not need to know which upstream registry provides an image. ## Benefits for Docker Hardened Images Docker Hardened Images offer: - Minimal attack surfaces - Near-zero CVEs - Software bills of materials (SBOMs) - SLSA provenance The virtual registry reduces the friction of adopting them by providing: - **Centralized authentication:** Teams authenticate to GitLab while GitLab stores and uses the dhi.io credentials. - **Simpler CI/CD:** Pipelines use one GitLab endpoint rather than configuring dhi.io separately. - **Gradual adoption:** Teams can migrate incrementally while cached image paths reveal which variants are being used. - **Improved visibility:** The cache provides an inventory of active dependencies, such as whether teams pull `library/python:3.11` instead of a hardened alternative. - **An audit trail:** Cached images help with compliance and understanding fleet-wide dependencies. ## Setting Up the Registry The article demonstrates setup with a Python client. - Create a virtual registry under a GitLab top-level group: ```python registry = client.create_virtual_registry( group_id="785414", name="platform-images", description="Cached container images for platform teams" ) ``` - Add Docker Hub as an upstream, using a 24-hour cache period. - Add dhi.io with a Docker username and access token: ```python dhi_upstream = client.create_upstream( registry_id=registry["id"], url="https://dhi.io", name="Docker Hardened Images", username="your-docker-username", password="your-docker-access-token", cache_validity_hours=24 ) ``` - Add other sources such as: - `https://mcr.microsoft.com` for Microsoft images, with a 48-hour cache period - `https://quay.io` for Quay-hosted images, with a 24-hour cache period ## Practical Recommendation Use GitLab Container Virtual Registry as a centralized pull-through cache when multiple teams rely on several container registries. Configure Docker Hardened Images as an upstream, point pipelines to the GitLab virtual registry endpoint, and use the cache contents to monitor adoption, performance, and image dependencies.

Read original(opens in new tab)
PythonCI/CDGitlabDocker & Containers+4
github3 min readCurated summary

How AI is reshaping developer choice (and Octoverse data proves it)

AI is reshaping software development not only by increasing coding speed, but also by changing which languages and tools developers choose. Octoverse 2025 shows this shift clearly: TypeScript became GitHub’s most-used language in August 2025, overtaking Python and JavaScript. The article argues that AI reduces the friction of complex technologies, while teams must establish strong architectural and testing practices to prevent faster development from producing faster degradation. ## The Convenience Loop Changes Developer Behavior - Developers form associations between convenience and particular technologies, much like sensory cues can trigger strong memories. - Eighty percent of new GitHub developers use Copilot within their first week, establishing AI-assisted development as their baseline experience. - When AI handles boilerplate and difficult syntax, developers become more willing to use powerful but traditionally costly tools. - Recent adoption figures reflect this change: - TypeScript grew 66% year over year. - JavaScript grew 24%. - Shell scripting in AI-generated projects increased 206%. - The rise in shell usage suggests developers are choosing tools based on suitability rather than avoiding them because of friction. ## Why Strong Typing Helps AI-Generated Code - Strongly typed languages provide clearer constraints for AI models. - A TypeScript declaration such as `x: string` rules out invalid operations that would remain possible in JavaScript. - These constraints help AI produce more reliable and contextually appropriate code. - More than 1.1 million public repositories now use LLM SDKs, showing that AI integration has become mainstream. - Adoption is concentrating around languages and frameworks that work effectively with AI-assisted workflows. ## Moving Faster Without Damaging Architecture ### Guidance for Developers and Teams - Establish coding patterns before generating large amounts of code; AI follows clear existing structures better than it invents them. - Use type systems as guardrails, not as proof that business logic is correct. - Test AI-generated code rigorously, even when it appears correct or passes initial checks. ### Guidance for Engineering Leaders - AI-assisted development can increase throughput by roughly 20–30%, but architectural drift can accumulate just as quickly. - Standardize practices before scaling AI adoption through documentation, template repositories, and explicit architectural decisions. - Monitor the nature and quality of generated code, not only productivity or acceptance rates. - GitHub’s Copilot usage metrics dashboard tracks active users, agent adoption, lines added and deleted, language and model usage, and other organizational patterns. - Teams can use these metrics to identify defect-prone languages, models, or workflows and target training or stricter review processes. - Greater developer productivity increases the importance of senior engineering capacity for architectural review. AI makes more technologies accessible and is actively influencing the future popularity of languages and frameworks. Organizations should embrace the productivity gains while pairing them with standardized patterns, strong type systems, rigorous testing, and continuous architectural oversight.

Read original(opens in new tab)
PythonTypeScriptJavaScriptGithub Copilot+4