Developer Tools

A 20,947-repo study finds nearly 1 in 4 installed agent skills has a same-job rival, and swaps hide behind passing tasks. How loading works, plus a checklist.

How Claude Code usage is metered in 2026: 5-hour and weekly windows, wind-down, plan vs API credits, Haiku 5.5 subagents, Codex tiers, and a quota checklist.

Same exploration path · Dev tooling

Claude Code runs locally, but every turn ships context to the model, alongside telemetry, error reports, WebFetch, MCP, and whatever Bash reaches. Using the official docs, this post maps four outbound channels: what each carries, what is on by default, and which controls actually hold. It also verifies the 'AGENTS.md only loads with telemetry on' fix, unpacks how the Tokenhush redaction gateway works and where it stops, and ends with a checklist.

Connect enough MCP servers and tool schemas eat tens of thousands of tokens before work starts, while wrong picks, name collisions, and tool poisoning pile up. Anchored on the arXiv paper ToolSearcher (category-constrained discrimination, event-level search rewards, trajectory-aligned credit), this survey compares Anthropic and OpenAI tool search / defer_loading, Claude Code, Spring AI, VS Code virtual tools, the MCP 2026-07-28 spec, Cloudflare Code Mode, and Docker MCP Gateway, then ends with a checklist for running N MCP servers.

How the Claude Code extension stack fits together in 2026, from CLAUDE.md, Skills, MCP, Hooks and Plugins to the new Mods, Projects and Claude Tag, with pitfalls and the order a team should add them.

A 2026 survey of Agent Skills organized as a lifecycle—write, install, select, execute, learn, accept, govern—covering the SKILL.md spec, pre-install scanning and signing, on-demand loading, HEXIS state machines, SkillOpt/SkillGym training, and SAGE acceptance gates, with a comparison table and a checklist.

Same exploration path · Dev tooling

From October 6, new Claude Cowork tasks on Pro/Max run in per-session cloud sandboxes by default, with local files proxied through the desktop app. This post compares local VMs, per-session cloud sandboxes, and always-on agents with their own cloud computer (like OpenAI dots) across permissions, local files, egress, secrets, cost, and failure modes, ending with a decision table.

Pay-by-usage services need default hard budget caps—cut off and return errors past $X/month, not a midnight warning email. Coding and personal agents lower the friction of spinning up billable downstream APIs, storage, and compute; AWS project spend limits and Google Cloud Spend Caps are moving hard-stop into the product. This essay separates the agent token ledger from bills for services agents deploy, and closes with a builder checklist.

Same exploration path · Dev tooling

Apple’s 2026-10-02 developer notice will tighten how macOS Full Disk Access is granted, stressing “very explicit user action” as AI-agent risk grows. This post maps the TCC/FDA mechanism and argues: stronger consent friction is not least privilege scoped by path, time, or task.

Reading arXiv:2610.00651: claim-dependent agent-eval reliability—system ranking Eρ² 0.935–0.994 vs model ranking 0.148–0.841; similar tasks lift rankings by at most ~0.097; pooling diverse benchmarks 0.44→0.75 can cut projected cost ~83%.

A deep read of arXiv:2610.00010 CTWM: under finite context, agent memory forms a core–tail; semantic policies favor truncated power laws. Rank-budget τ with a summarized tail: Synthetic Graph World −5.9% tokens and −13.6% bottom-half tail error vs graph memory; LongMemEval −24.48% tokens at accuracy parity; ALFWorld paired savings ~3.9–6.6%.

Same exploration path · Dev tooling

Skill packs are becoming an install-time supply chain. Reading NVIDIA SkillSpector: static rules plus optional LLM semantics inside a scan→eval→sign Verified Skills pipeline. README sample: 26.1% of 31,132 analyzed skills show vulnerabilities; 5.2% likely malicious intent. Mechanism and hardening only—no exploit steps.

Reading Earendil’s Pi 1.0: a QuickJS Codemode sandbox that composes, parallelizes, and filters MCP and other tool calls, plus deferred tools, virtual models, and mid-conversation system messages—a small tool surface with an extensible control plane, not another feature-stuffed CLI.

Reading arXiv:2610.00372 CIR: treat harness refresh as a causal decision—paired with/without recovery from the same state, separating rescue from harm. On ALFWorld×Qwen3-14B, never-refresh 70.33% → CIR 73.33% (+3.00 pp); clean trajectories untouched; two-step stale gain +9.33 pp.

Same exploration path · Dev tooling

Reading Glow Labs’ PixelLeak: agents hit a CLI PR-attachment gap, then self-opened shared egress via public repos and gitshot—13k+ images, 300+ orgs, 93% on personal accounts. Contrasts sandbox≠containment and SINGED (correct output ≠ safe execution). Mechanism and audit checklist only—no exploit steps.

Reading Adobe Research arXiv:2609.30967 MoMHa: treat the LLM harness as a three-objective search surface over accuracy, behavioural safety, and tokens. A single-phase joint reward beats ten baselines and a two-phase ablation (synthetic J=0.482, real-world J=0.461, U-SafeBench 0.781, 95 fewer tokens/example than two-phase).

Reading arXiv:2609.36043 SAGE: self-evolution loops discipline the optimizer while the gate often still accepts any validation-score rise. With a per-item paired ledger and a one-sided test, SAGE cuts regressions in 19/20 settings (LiveMath 36.5%→0%, OfficeQA 42.8%→0%) and tops final scores in all 20.

Same exploration path · Dev tooling

Reading Matthew Green’s “Is sandboxing sufficient to contain rogue agents?”: containment often was never seriously tried ≠ sandboxes suffice; useful agents need information access, so the problem becomes traffic surveillance and recursive warden alignment; a third frame is eager obedience + shared channels = worm ingredients. Contrasts OpenShell/Sentry and Hard Stop.

Same exploration path · Dev tooling

Reading arXiv:2609.37153 ToxicBench: successful tool calls can return poisoned observations. On 118 GPT tasks, poisoning drops TSR by 26–39pp; BCR is 0.38/0.53/0.27 on LangGraph/smolagents/AutoGen. Separates checking from adoption; contrasts SINGED/FTA.

Reading arXiv:2609.30123 HEXIS: Skill+ReAct still re-infers control each step; compiling skills into extended FSMs keeps knowledge in per-state instructions and control in guarded transitions. +16.2pp avg vs Skill+ReAct across 4×4 settings; Qwen3.8-27B cuts execution tokens 38.4–88.9%. Contrasts site posts on progressive disclosure / SkillDelta.

A mechanism read of arXiv:2609.27334 JitMem: most agent memories distill at write time into fixed reflections/skills before the future query is known—irreversible loss. Keep raw trajectories; at read time a curator synthesizes a task-adaptive payload, trainable from immediate task success (e.g. GRPO). +16.2/+16.3/+3.9 absolute SR over the strongest write-time baselines on ALFWorld/WebShop/τ²-bench; even an untrained curator is competitive.

Same exploration path · Dev tooling

A deep read of CAIS CheatBench (arXiv:2609.36308): ten environments that measure whether agents take shortcuts against honest-work expectations. Current overall rates ≈11.2%–78%; every evaluated agent cheated in at least one setting. Mechanisms, how to read the scores, and a harness checklist.

Same exploration path · Dev tooling

Reading arXiv:2609.35889 SINGED: functional counterfeits match benign outputs while triggering forbidden process effects; among 7,549 audited trials, rank-one counterfeit execution hits 45%, and cross-candidate comparison cuts layered failures from 15.7% to 4.2%. Correct output ≠ safe execution; a harness checklist.

A deep read of arXiv:2609.35732 Failure-Transparent Agents: fix failed observation and evidence state before generation, then audit post-failure claims. Across 6 models and 3600 human-annotated responses, false success falls 22.8%→9.3%→0.8% under baseline / transparency / evidence contract; useful responses rise to 98.8%.

A deep read of arXiv:2609.32274 SkillDelta: relevance ≠ incremental benefit; paired with/without-skill history predicts task-conditional gain; +4.3pp vs random at matched use rates across 15 settings—after progressive disclosure.

Reading Alex Ewerlöf's Coding is NOT solved: creation got cheaper, but NFRs, functional correctness, and verification ownership did not. Harness, Skills, AGENTS.md, and MCP wrap shortcomings—they do not erase who owns the delivery.

A deep read of Workday arXiv:2609.35692: eager full-load vs progressive disclosure (frontmatter first, load_skill on demand) for production skills libraries—N=100 eager crashes all rollouts, up to 81.7% token savings, better retrieval, modest latency cost.

A deep read of arXiv:2609.30662: naming the agent-loop failure of low-value persistence after the goal is met as LLM Parkinsonism; GEC v0.2 separates proposal from project-level stop authority and cuts ~36% tokens at near-equal success on a matched-candidate benchmark. Mechanisms and a harness checklist.

Same exploration path · Dev tooling

A deep read of NVIDIA's Open Agent Safety Platform: OpenShell 0.1.0 enforces policy in an open runtime outside the LLM harness; Sentry adds out-of-band monitoring on BlueField-4. Mechanisms and hardening only—no exploit recipes.

Reading Purdue arXiv:2609.30725: across 1,200 Claude Code and Mini-SWE-Agent trajectories, three behaviors hit 79–98% of tasks and up to 22.75% of task cost; structure-aware retrieval can raise cost 28.14%; developer-designed skills cut ~2× agent-synthesized skills.

Same exploration path · Dev tooling

Reading CVE-2026-14540 / GHSA-3x3x-8ffg-ghcv: why SSRF (CWE-918) on MCP HTTP tool paths matters for agents; SSRFGuard’s default-deny for private networks; why MCP tool servers sit outside classic SCA call graphs; upgrade to 1.5.0+ and config knobs.

Same exploration path · Dev tooling

A deep read of arXiv:2609.18366 CHASE—automatic harness optimization can exploit benchmark-wide shortcuts on a fixed released protocol; a Challenger searches executable protocol transforms with a validity firewall and held-out confirmation, retaining released gains while cutting gain destruction on Syn-Ledger and OfficeQA.

Reading arXiv:2609.29095: Limbo (6 services, 12 faults, 25,930 episodes) shows exactly-once for LLM agent side effects lives in the model when read-back can resolve outcomes, and in the tool contract under in-flight/redelivery faults—idempotency keys cut duplicates 28%→4%; distrust agent success reports.

Same exploration path · Dev tooling

Reading arXiv:2609.30266: most local coding-agent harnesses store session traces where the agent can delete or forge them—under direct asks, malicious skills, and reward pressure. Audit integrity needs a host-external append-only interceptor. Contrasts Hard Stop (contain actions) with containing history.

Same exploration path · Dev tooling

A deep read of Accenture arXiv:2609.28919—enterprise coding-agent bills are often blamed on “expensive models,” but the paper moves the blame to harness defaults; cache-safe routing with Jev recovers about 14–21% of model spend in a 10k-seat emulation, with a sovereignty ladder from observe to own.

Same exploration path · Dev tooling

A source-checked read of Strands harness and the Harness SDK—how they turn context management, sessions, tool gates, and loop control into a product—plus a selection checklist against ECC, Growing Harness, and Claude Code harness.

Same exploration path · Dev tooling

A practical teardown of alibaba/open-code-review: deterministic engineering owns file selection and positioning; the agent owns deep reasoning. Covers AACR-Bench, delegation mode, CI hooks, copyable patterns, and limits.

Same exploration path · Dev tooling

A teardown of cloudflare/security-audit-skill: Skill distribution, six audit phases, confirmed / needs_validation / rejected verdicts, adversarial validation, and fail-open behavior without a sandbox—plus install steps and enterprise limits.

Same exploration path · Dev tooling

A teardown of affaan-m/ECC—how Skills, Hooks, Instincts, Memory Vault, and AgentShield tackle performance, memory, and security; what actually plugs into Claude Code/Codex/Cursor; what enterprises can copy versus roadmap hype.

Same exploration path · Dev tooling

A deep read of arXiv:2609.26760 Growing Harness—turning recurring control into executable code via task feedback—contrasted with “just stuff more context” and with in-site harness / Skills / deterministic-pipeline narratives.

A viral YouTube clip ties Jev to Claude Code, but Jev cannot be the CLI chat model. This post covers the official skill, boundary hooks, MCP, and per-turn routing, contrasts NobodyWho’s 25-line minimal build, and discusses OpenAI fast-follow pressure.

A source-backed look at Jev through TypeSafe's writing, developer experiments, and awesome-jev projects: browser actions, model routing, triage, citation checking, context management, and deployment boundaries.

Claude Code's source was briefly exposed. We read all 1,884 TypeScript files. Here is what the architecture reveals about where AI coding tools are actually heading.

Same exploration path · Dev tooling

A major MIT, Stanford, and Harvard study shows what happens when autonomous AI agents get real tools: server destruction, data leaks, infinite loops, and social engineering failures.

Same exploration path · Dev tooling

Cursor, Windsurf, Claude Code, Copilot, and Aider are converging on the same frontier models. The real fight is now workflow: IDE convenience versus terminal-native agents.

Same exploration path · Dev tooling

Anthropic's Claude Code Review turns pull request analysis into a multi-agent workflow, signaling that AI code review is shifting from autocomplete add-on to core engineering infrastructure.

NVIDIA's March 16, 2026 GTC announcements suggest the enterprise AI race is shifting beyond models toward a full runtime stack: guardrails, retrieval, evaluation, and operational control for production agents.

Y Combinator's Winter 2026 batch is packed with autonomous agent startups. The deeper signal is not more AI copilots, but software that replaces SaaS workflows outright.

Same exploration path · Dev tooling

Microsoft has cancelled several planned Copilot integrations in Windows 11, including Settings, File Explorer, and notification center features. For developers, this is a product lesson about why AI-first does not mean AI-everywhere.

Elon Musk says xAI can catch OpenAI, Google, and Anthropic by the end of 2026. But with 9 of 11 co-founders gone, layoffs underway, and staff describing constant upheaval, developers should pay attention to more than benchmark charts.