Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-08-28 · source-backed
gemini-cli's August 27 nightly prevents SSRF in MCP OAuth metadata discovery and authentication (PR #29081), google/adk-python v1.39.1 added a Host header check on its CLI server plus artifact reference scoping, and pydantic-ai v2.35.3 scopes safe_download cookies to their original hostnames (GitHub). Discovery endpoints an agent fetches on your behalf are a repeatable SSRF class, and all three are in code paths a self-hosted agent runs by default.
Each link below shares sources, entities, or timing with this story.
PR #29081, merged August 26 and in nightly v0.59.0-nightly.20260827, enforces RFC 9728 §7.7 and RFC 8414 constraints across MCP OAuth metadata discovery, dynamic client registration, and token exchange. It requires HTTPS for remote endpoints with HTTP allowed only for loopback...
A spec is a press release until someone who didn't write it implements it. GitHub made Agent Plugins 1.0 generally available on August 12 across VS Code, Copilot CLI, the Copilot SDK, and the Copilot app on all plans. The spec, published August 6, was co-authored by AWS, Anysp...
v1.31.0 on August 22, v1.31.1 on August 23, v1.32.0 on August 24, reaching 4,502 stars (GitHub). Written in Rust, it provides long-term memory for coding agent CLIs and is explicitly built to hand work off between different agent vendors rather than lock into one. Releases shi...
Released August 26, it adds MCP 2026 core protocol support and an MCP Apps host that renders inline server-supplied applications inside daemon-backed WebShell sessions (GitHub). MCP Apps is the official extension standardizing server-rendered UIs (dashboards, forms, visualizat...
The CNCF Sandbox project shipped fixes on August 26 for command injection in the Kubernetes toolset plus slab, kubevela, inspektor_gadget and aks follow-ups, SSRF in fetch_webpage and connectivity_check, and hardening of kubectl-run to execute without a host shell (GitHub). Th...
A Chinese lab shipped a runtime that manages two American coding agents as subagents, and it went from repo creation to 145,439 stars in four days. deepseek-ai/deepseek-harness published dsh-v0.1.0-rc.7 at 12:01 UTC today, its first tagged release since the repo appeared on Au...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.