Shown on HN Nov 4, npx qamcp-cli your-link checks a server for hidden instructions in tool descriptions, leaked secrets in errors, missing safety labels, bad-input handling and speed, with every result verified by code rather than an AI and only read-only tools ever run. It also ships a GitHub Action that fails the build when a server's score drops, plus a free monitor for one server.
Built on Thinking Machines' Inkling Small (276B total, 12B active), it's available now in Devin Desktop and the Devin CLI, free for Pro, Max and Teams plans through Nov 30. There's no public API, per token price or weights yet; Cognition says it's building a program to share weights with partners and researchers…
OpenAI plans to fold Pierre's Git backed Code Storage service into Codex; Pierre's open source projects stay open and existing Code Storage customers keep access after closing. Terms weren't disclosed and the deal still needs regulatory approval (Axios)…
Conductor has stopped taking new users and plans a new interface in early 2027; its cloud service goes read only Nov 13 and shuts down Nov 20, when cloud data deletion begins, so export or move workspaces to the local app before then. Terms weren't disclosed (InfoWorld)…
In Positron 2026.10, turning on the MCP: Enabled setting lets agents like Claude Code, Codex, OpenCode, Kiro, Gemini and Copilot CLI see your loaded data, plots and consoles and run code there, labeled with the agent's name. Posit warns that this amounts to unrestricted shell access under your credentials, so trust decisions fall to your agent harness…
In a mid October run with an upcoming cyber model, the pipeline reproduced 1,724 kernel bugs and built working local privilege escalation exploits for 948 of them, about $1,279 each, with human researchers reviewing results before reporting fixes to maintainers. The 948 counts validated exploits, not merged patches (HN)…
Spotted something we missed? Start a thread.