The single-file, stdlib-only Python tool (macOS only) confines a run to the folders you grant, blocks your home folder, and routes every API call through a loopback proxy that holds the real key, prices each response, and kills the run once the budget is spent. Its Codex CLI adapter is weaker: per the README it hasn't been tested against a live CLI and needs the key in the run's environment (write-up).
The YC W24 team rebuilt its LiteLLM based gateway as a tiny event dispatch core, so providers (Mistral's is 22 lines), MCP, realtime voice, fallbacks, and PII redaction are all plugins, and an OpenAI, Anthropic, or Gemini client can call any model with tools and reasoning translated. It's pre alpha, MIT/Apache 2.0, and runs locally from source (GitHub), with a paid hosted version for observability and evals…
Now in free public preview for GitHub Enterprise Cloud, it sits between coding agents or Actions runners and the upstream registry, checking metadata requests and downloads against admin policy (a configurable cooldown for new versions, Advisory Database malware and vulnerability alerts, attestation downgrades), with an exception request if something is wrongly blocked. It only covers npm for now, each agent or host has to be pointed at the firewall, and it will move to metered billing at GA…
A dev only SDK, stripped from production builds, instruments your running web, Electron, or Tauri app's DOM, network, routing, console, and state (Redux, Zustand, TanStack Query, Pinia) and exposes it over MCP, so Claude Code, Cursor, Codex, or Copilot can act and get back a yes, no, or unknown verdict with the evidence and the file:line to fix. It runs over a localhost only bridge, needs Node 20.11+, starts with npx @reticlehq/server init (not npx reticle , which is someone else's package), and sends anonymous usage counts unless you opt out (Show HN)…
Microsoft's security stack now discovers 60 kinds of local agents (35 newly added), registers them under their own Entra Agent ID instead of the user's, and is introducing Dynamic Permissions that start an agent with no access and grant only task scoped, time bound rights. New Dynamic Agent Risk and Conditional Access can then block writes, narrow reachable resources, or stop an agent mid task if it hits a prompt injection, though Microsoft gives no rollout or licensing details yet…
The Oct 20 release brings persistent PTYs to Windows x64 and ARM64, an opt in todowrite task list via { "experimental": { "todo": true } } , TUI and plugin commands that can outlive Bun's five minute fetch deadline, restored session archiving, editable saved permissions, and compaction that summarizes the whole conversation and kicks in earlier. Plugin, SDK, and HTTP message/event integrations must adopt renamed fields (provider replay data is now native ), though existing sessions and credentials still load with no database migration…
Spotted something we missed? Start a thread.
