Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-06-17 · source-backed
The June 12 release connects Cursor, Claude Code, Windsurf, VS Code, Amazon Q, and Kiro to pipeline, build, log, test, and workflow data over MCP. Agents can reason over CI state, like diagnosing a failing build straight from logs, without copy-paste. MCP is becoming the default integration surface for DevOps vendors. The flip side, see the security section, is that every new MCP server is also new attack surface. Authenticate it.
Each link below shares sources, entities, or timing with this story.
The Amazon Q bug is one instance of a 2026 pattern: MCP configuration carried in repositories is now an RCE supply-chain vector, not just untrusted tool output. Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based auto-launch attacks (Windsurf...
Six clients. One manifest. Zero vendor lock. Vercel published Agent Plugins 1.0.0 on August 6, an openly licensed spec that bundles Agent Skills and MCP servers behind a single portable manifest. The shape is deliberately boring: a plugin.json requiring only schemaVersion and...
First major enterprise observability platform to ship a production-grade MCP server. Feeds live logs, metrics, and traces directly into Claude Code, Cursor, Codex, GitHub Copilot, and VS Code. AI coding agents can now investigate production issues using real-time telemetry. MC...
A symlink-following flaw (CWE-61) lets a malicious repo trick coding agents into writing files outside their sandbox, escalating to code execution. It hits six agents: Amazon Q, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. The vicious part is it hides the re...
MIT-licensed desktop app and CLI that auto-detects installed AI clients and manages MCP server configuration for all of them — Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, ChatGPT Desktop, Gemini CLI. Built-in MCP marketplace, team snapshot export, automatic backups...
A multi-stage npm supply chain worm dubbed SANDWORM_MODE deploys rogue MCP servers into configurations of Claude Code, Claude Desktop, Cursor, VS Code Continue, and Windsurf. At least 19 typosquatted packages harvest npm/GitHub tokens, SSH keys, and cloud credentials, then pro...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.