标签：#Agents

WebMCP lets a web page expose tools that AI agents can discover and execute inside the browser. That...

The free open source agentic program is finally invading your phone.

Overview AGENTS.md is useful. It gives AI coding agents a place to find repo-specific guidance: how to behave what conventions matter what areas need extra caution what kinds of changes should trigger review That is a meaningful improvement over sending an agent into a repo with no instructions at all. But AGENTS.md is not enough. It can tell an agent to be careful. It cannot, by itself, make execution safe, verification trustworthy, or review inspectable. For that, a repository needs more than instructions. It needs: declared safe commands a canonical verification path receipts that show what actually ran That is the difference between agent guidance and execution governance. Instructions Help. They Do Not Govern Execution. An instruction file is still prose. That means it can express intent, but it does not automatically create operational truth. For example, AGENTS.md can say: run the right checks before handoff avoid destructive commands do not edit generated files ask before touching infrastructure Those are good rules. But notice what they leave unresolved: which checks are the right ones which commands are actually safe which paths are protected structurally versus only suggested what should count as evidence that verification happened how to tell whether a failure came from code, setup, or drift That is where many agent workflows still break down. The agent may follow the spirit of the instructions and still take the wrong execution path. Safe Commands Need To Be Explicit One of the biggest gaps in agent-oriented repos is that they often declare guidance without declaring a safe command surface. The repo may tell the agent: Run tests before you finish. But that still leaves a dangerous amount of interpretation. Which task is safe? Is it: npm test pnpm test make check docker compose run test a narrower unit-test path the CI workflow itself And if several exist, which one is canonical for a routine code change? The repo should not force the agent to infer that

Anthropic’s Claude Sonnet 5 brings stronger agentic capabilities, lower pricing, and improved safety, positioning the model as a cheaper alternative to Opus, GPT-5.5, and Gemini Pro.

I was taking a break from the AIE Workshops on Monday and stepped out by the food stands to check out the crepes. That's when I saw a line literally wrapping the entire length of the Moscone West windows looking out onto Fourth Street. I couldn't imagine what a several-hundred-person line was for, and when I went to ask, they told me it was for the Context Engineering Workshop. That sent me down a rabbit hole exploring and understanding and learning. So now, for you, I will share what I got. For the past couple of years, the AI world was obsessed with prompt engineering, aka the art of speaking to a machine. But as developers move from simple chatbots to complex autonomous agents, a new discipline has taken center stage: context engineering. Mike Swift ( @theycallmeswift ), CEO of Major League Hacking ( @mlhacks ) , gave me some critical background. He pointed me to Dex Horthy of HumanLayer (who is actually speaking later this week), who basically coined the term at the first AI Engineer World's Fair. Dex's core thesis, said Swift, is that "agents get bad after about 100,000 tokens," which represents roughly 10% of their total available context window. So context engineering is essentially managing an AI's working memory. Context engineering, Swift noted, is "managing how many times the loop goes around to how much you have to remember every time you do it." It is a counterintuitive concept for humans; the more we talk about a subject, the deeper our shared understanding becomes. But models work the opposite way. They lose focus as their context window fills up. For many developers, meticulously curating this working memory is a practical necessity. I sat down with Ben Halpern ( @ben ), founder in residence at MLH and co-founder of DEV, who told me that context engineering is the "latest frontier of the optimization point" where developers can leverage their expertise. Beyond just keeping models coherent, Ben pointed out that developers who are doing product work ma

You have seen this loop before. An agent starts a “simple” task, say scrape listings, refactor a repo, research a market, or whatever. It fails, it retries, it re-reads context, it apologizes and tries all over again. Twenty minutes in and the dashboard shows six figures of tokens and zero useful outputs or deliverables. The model did not misbehave on purpose. The orchestrator never had a hard budget gate with an ROI in mind. Skillware v0.4.0 ships a new skill for exactly that gap: monitoring/token_limiter . It lets you monitor and limit any agent’s token budget in real time — Gemini, Claude, OpenAI, DeepSeek, Ollama, custom Python loops, you name it. Same skill, same JSON, any runtime. What Skillware is in a nutshell Skillware is an open registry of installable agent capabilities . Each skill is a bundle: skill.py — deterministic Python ( execute() returns JSON) instructions.md — when the model should call the tool manifest.yaml — schema, constitution, issuer Tests and docs — shipped in the wheel You load by ID, adapt for your provider, call execute() on tool use. The model decides when , the skill decides how , predictably, every time. That split matters for budget control. You do not want the LLM guessing whether it is “allowed” to spend more tokens. You want a small, auditable function that answers: continue, warn, or stop. Meet the Token Limiter This skill is a budget gate , not a kill switch wired into OpenAI or Anthropic. After each model turn, your host loop passes cumulative usage. The skill returns one of three actions: Action Meaning CONTINUE Under the soft threshold — keep going WARN Approaching the limit (default 80%) — tighten scope FORCE_TERMINATE Hard ceiling hit — stop the loop Important nuance: the skill does not cancel API sessions or kill processes. It returns a structured decision. Your orchestrator must act on it. That is by design — Skillware skills stay portable and provider-neutral. No skill-specific API keys. No network calls. Pure Python m

Elastic open-sourced Atlas, a system built on Elasticsearch that maintains three categories of memory for agents. Atlas integrates with agents via MCP and maintains per-user isolation of memories. When evaluated on question-answering capability, it scored 0.89 Recall@10. By Anthony Alford

If you've let a coding agent loose on AWS, you've watched it guess. It invents API parameters that don't exist, or hands you an S3 bucket a security review will bounce on sight. The Agent Toolkit for AWS is built to stop that. By the end of this post you'll have it running in whatever editor you use, plus a tour of what's in it and three workflows worth pointing it at. I use Kiro day to day, so I'll walk through that setup first. It also works with Codex, Claude Code, Cursor, and any other agent that speaks MCP, the Model Context Protocol, which is the open standard agents use to connect to outside tools and data. I'll cover those too. What is the Agent Toolkit for AWS? The Agent Toolkit for AWS is a free, AWS-supported set of tools that gives AI coding agents secure access to AWS, current documentation they can read mid-task, and tested procedures for the work they tend to fumble. It plugs into the agent you already use rather than asking you to switch. In practice, that shows up in a few ways, all detailed in the AWS user guide . The agent stops guessing about APIs it never saw. The models behind these agents trained on data that's months or years old, so anything AWS shipped recently is missing or wrong in their heads, and the toolkit hands them current docs and references at request time. For multi-step work like least-privilege IAM or a production serverless stack, it follows a vetted skill instead of reconstructing the steps from half-memory. Every call goes through your own IAM credentials, shows up in CloudWatch, and gets logged to CloudTrail, so you can scope an agent to read-only even when your role can write. And the toolkit costs nothing on its own; you pay only for the AWS resources the agent creates. It's the successor to the MCP servers, skills, and plugins AWS shipped under AWS Labs in 2025. Two things make me reach for it over a raw MCP setup: condition keys that let a policy tell an agent apart from a human, and skills that have been evaluated end

AI agents are hitting the same inflection point. Most people think an agent is the model, the...

Token burn and business outcomes are not correlated. More burn means more inefficiency, not more value. The electricity problem Imagine you walk into a dark room. Turning on a light helps you see. Turning on every light in the building does not help you see better. It's still the same room. Now every surface is equally lit, the contrast is gone, and you're paying for power you didn't use. Tokens work the same way. A focused prompt with clear scope is the single overhead light over your desk. A sprawling prompt with unlimited exploration is every light in the building — you're burning power, not producing insight. Tokens are electricity, not output. More throughput doesn't mean more value. I've had weeks where I burned through my allocation and looked back at the end to find nothing concrete. Code that worked but went unused. Exploratory branches that dead-ended. Agents that generated plausible-looking output that didn't survive first review. A lot of motion. Not much progress. The ceiling stops you from doing that indefinitely. It forces a moment of reflection: did this burn produce anything real? If the answer is no, more capacity isn't the fix. More discipline is. Three patterns I now use instead I started paying attention to what actually ships versus what just burns context. I gave the patterns names so I could catch myself faster: RTK — Read The Knowledgebase. A focused 15-minute read of the codebase, identifying the exact files and exact changes, saves 200K+ tokens of exploratory waste. The agent doesn't discover the shape of the task — it executes against a known one. Caveman — compress before you prompt. Strip greetings, filler words ("I think", "basically", "Let me know if that makes sense"), and closing courtesies. Every word in your prompt multiplies across every response token. Less fluff in means less fluff out. Ponytail — spec the minimum viable solution. "Robust", "scalable", "enterprise-grade", "comprehensive" — these words invite scope creep. Specif

A CFO will not act on a number an LLM eyeballed. They will not act on a number the model "estimated" by reasoning over a usage dump. And they should not — because the moment a language model emits a dollar figure it computed itself, that figure is a guess wearing the costume of a fact. This is the design constraint behind databricks-cost-leak-hunter , the pilot skill of the databricks-pack v2 rebuild shipped in the claude-code-plugins marketplace ( PR #906 ). Given a live, authenticated Databricks workspace, it surfaces real cost leaks across four named categories, ranks them by monthly dollar impact, and emits a report a finance reader can act on. The marketplace validator graded it B (88/100, zero errors). The SKILL.md is 329 lines. The single most important thing in it is a rule the model is structurally prevented from breaking: the LLM never does the dollar arithmetic. Why not just let the agent read the bill and summarize it? Because that is exactly how you ship a confidently wrong cost report. Hand a model a few thousand rows of system.billing.usage and ask it for the top cost leaks, and it will give you a fluent answer. It will add DBUs. It will multiply by a price it half-remembers. It will round. Every one of those steps is a place the model can be plausibly, invisibly wrong — and the output reads identically whether the math is right or hallucinated. The failure mode of an LLM doing FinOps is not a crash. It is a clean, well-formatted, wrong number. The fix is architectural, not prompt-engineering. The model is allowed to decide what to look for and how to explain it . It is never allowed to be the calculator. The dollar primitive: confirmed, never estimated Every confirmed figure comes from the customer's own billing tables — system.billing.usage joined to system.billing.list_prices . Not a model estimate. Not a public price list. The number Databricks actually billed. That join is defined once, as a priced CTE, and reused by every category query. Usage i

Deep into a coding session, you realize you want beta testers to try some new functionality first....

Engineering leaders have spent the past year trying to get their teams to adopt AI coding tools as quickly as possible. Now, a new set of questions has taken over: how do you measure whether any of it is worth the money, and how do you stop agents from running unchecked on production systems? Developer tooling company Warp , an open agentic development environment built from the terminal up, thinks the answer isn't picking a single agent and standardising on it — it's giving teams a way to run several at once, compare them, and govern all of them from a single control plane. As Tessl wrote back in February, orchestration has emerged as a discipline in its own right — a dedicated layer of tooling for coordinating, supervising and directing multiple agents running in parallel. Back in February, Warp launched Oz as a cloud platform for running and managing coding agents at scale. Now, Warp is taking things a step further. In May, the company expanded Oz into what it's calling the first multi-harness control plane — meaning teams can now run Claude Code, Codex and Warp Agent simultaneously through a single interface, rather than committing to any one of them. Tessl caught up with Warp CEO Zach Lloyd to discuss how engineering leaders are thinking about agent fleets, what the harness layer actually changes, and where the lines between autonomy and human oversight are really being drawn. "The wild west": how the agent gold rush became a budget problem Zach spent several years at Google, leading engineering on Docs and Sheets before co-founding photo-editing startup SelfMade . He later served as interim CTO at Time, before founding Warp in 2020, raising north of $70 million in funding from the likes of Sequoia, Google Ventures, Figma co-founder Dylan Field, and Salesforce’s co-founder Marc Benioff. That background — building collaborative tools at Google scale, then navigating the startup world — gives Zach a particular vantage point on how quickly the engineering tooling

Artificial Intelligence has brought the term "AI Agent" into almost every technology conversation. As a result, many people now use the words agent and automation interchangeably. While both are designed to reduce manual work and improve efficiency, they solve problems in fundamentally different ways. Understanding this distinction is essential if you're building software, automating business processes, or deciding where AI fits into your organization. What Is Automation? Automation is designed to execute predefined instructions. You tell the system exactly what to do, in what order, and under what conditions. Every time those conditions are met, it performs the same sequence of actions. For example: A customer submits a form. An email is automatically sent. A record is created in the database. A notification is sent to the sales team. Every step is predetermined. If the process changes, the workflow must be updated. Automation excels at repetitive, predictable tasks where consistency is more important than decision-making. What Is an AI Agent? An AI agent is not focused on following instructions. It is focused on achieving a goal. Instead of executing a rigid sequence of steps, an agent observes its environment, evaluates available information, makes decisions, and adjusts its actions as circumstances change. If one approach fails, it can try another. If new information becomes available, it can revise its strategy without requiring a developer to define every possible scenario in advance. In simple terms: Automation asks: "What steps should I execute?" An agent asks: "What is the best way to accomplish this objective?" This ability to reason and adapt is what makes agents fundamentally different from traditional automation. A Simple Example Imagine you're booking a business trip. An automated workflow might: Book the airline you specified. Reserve the hotel you selected. Email you the itinerary. It completes exactly what it was programmed to do. An AI agent, howev

There is a sentence my coding agent used to say that I now read as a warning light. You are completely right. For months I took it as a compliment. The machine agreed with me, so I figured I was onto something. I would describe a plan, watch the agent call it a strong plan, and go build it. If you work with an AI agent every day, you have heard your own version of this. Smart call. Solid approach. That makes a lot of sense. Each one is the machine nodding along while you talk. It feels good. That is the problem. What took me too long to admit An agent that agrees with everything I say stops being a thinking partner. It turns into something that flatters me into shipping my first idea. My first idea is rarely my best idea. Nobody's is. The whole point of a second mind in the room is that it pushes back when the first mind is about to walk into a wall. A yes-machine removes the one thing that made a second mind worth having. This has a name Sycophancy. These models are trained to be agreeable, because agreeable scores well in the feedback that shapes them. OpenAI said so out loud in 2025 when they pulled back a version of their model for being, in their words, overly flattering. They were pointing straight at the default behaviour. So your agent is doing exactly what it was tuned to do when it tells you that you are right. No malfunction involved. One opinion most builders have not made peace with Your agent's confident wrong answer costs more than a useless one. A useless answer wastes a minute. You see it is useless and move on. A confident wrong answer wastes a week, because you trusted it, built on it, and found out only when it broke in front of someone who mattered. Occasional wrongness is survivable. Everything is wrong sometimes. What actually bites is being wrong while sounding certain, and agreeable, and exactly like what you wanted to hear. How to tell if your agent is a yes-machine You can test it in a minute. Tell it a bad idea on purpose. Propose somethi

Introduction This article is not about introducing a new security tool. Nor is it an argument to replace Secret Scanners, SAST, or other existing security technologies. Instead, I want to propose an architectural concept for the AI era: How should security controls be positioned within a software development workflow where AI agents generate most of the artifacts? I call this concept the AI Security Gate . AI Is No Longer Just a Coding Assistant Generative AI has evolved far beyond code completion. Today's AI systems can already: Generate source code from requirements Write unit tests Refactor existing code Create pull requests Review code The next logical step is a development workflow where: AI implements, AI reviews, and AI iterates. In such a world, relying on humans as the final security checkpoint no longer scales. When AI-generated artifacts are reviewed by another AI, we need a security mechanism that operates independently of AI reasoning and executes every time without exception. What Is an AI Security Gate? I define an AI Security Gate as: A deterministic security control layer that validates AI-generated artifacts before they are accepted into a software development workflow. Two words in this definition are particularly important. Artifacts The scope is broader than source code. It includes any artifact produced by AI, such as: Source code Infrastructure as Code Dockerfiles Kubernetes manifests SQL scripts CI/CD workflows API specifications Deterministic An AI Reviewer performs reasoning. It may conclude: "This design is easier to maintain." An AI Security Gate does not reason. Instead, it verifies objective facts such as: An API key is embedded. A private key is committed. An organizational policy is violated. Its purpose is not to judge software quality. Its purpose is to enforce security rules consistently. Four Characteristics of an AI Security Gate I believe an AI Security Gate should satisfy four fundamental properties. 1. Deterministic Every exec

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

There is a habit that wastes more time than anything else when using Claude. Save this :) Writing the same instructions over and over again. Every session, you re-explain your role. You re-describe your writing style. You re-state your formatting preferences. You re-paste your company context. You re-specify what you want the output to look like. Then you do it again tomorrow. And the day after that. And the day after that. Over a month, you waste hours on instructions you have already written. Not new thinking. Not new requests. Just the same setup, repeated endlessly. Claude Projects and Skills fix this completely. Projects let you save context once and have it applied to every conversation automatically. Skills let you save entire workflows as reusable commands that you can trigger with a single sentence. Together, they turn Claude from "a tool you use from scratch every time" into "a system that already knows everything and just needs your specific request." Here is how to set them up from zero. What Are Claude Projects A Claude Project is a container for conversations that share the same context. When you create a Project, you upload knowledge files and write a system prompt. Every conversation inside that Project automatically has access to those files and follows those instructions. No re-explaining. No re-pasting. No re-describing. The context is always there. Example: you create a Project called "Content Marketing." You upload your brand guidelines, your editorial calendar, your top-performing articles, and your audience personas. You write a system prompt: "You are my content strategist. You know our brand voice, our audience, and our content strategy. Every piece of content should match our guidelines and target our defined personas." Now every conversation in that Project - brainstorming headlines, drafting articles, analyzing competitors - starts with full context. Claude already knows your voice, your audience, and your standards. One setup. Unlimited

Give a capable coding agent a real, multi-week project and watch what breaks. It isn't intelligence. It's continuity. Every session starts cold or half-remembered. Context windows fill up and compact. The thread of what we decided, what's true, and what's done starts to fray. Over a long horizon the same failures keep coming back: the agent claims state it never actually verified, reports something done with no proof it ran, quietly drifts from the project's conventions, and loses hard-won context that lived only in the last session's head. Bigger context windows don't fix this. They just postpone it. We've been building a real product with a forgetful agent as the primary engineer for weeks now, and the thing that made it work isn't a clever prompt. It's a simple recognition: transmission across a stateless agent needs two channels, and most setups only build one. The first channel is structure, which is discipline made un-forgettable. These are the deterministic guards that run whether or not the agent remembers to care: a pre-commit check that refuses a "done" without a real, verifiable artifact; a hook that blocks a sloppy search and points at the right tool instead; a scan that won't let a secret reach a transcript; a status snapshot generated from the repository's actual state instead of hand-kept prose that quietly goes stale. The rule we keep coming back to is that a guard is the system's discipline made un-forgettable. A fresh session follows the hard-won lessons without having to remember them, because the structure enforces them at the moment of action. The second channel is soul, which is the why, kept human. This is the short orientation a session reads before it starts working: who to be, what the work is ultimately for, and why the discipline exists at all. It's the difference between an agent that complies and one that understands. Structure can transmit the what, but only prose can transmit the why. And the why matters, because an agent that only fo

We built our first "multi-agent system" by accident. What started as a single agent that could research a topic, draft a report, check it against source data, and send a summary email had grown into a 2,000-token system prompt and a function list so long that the model kept forgetting tools existed. It wasn't a system — it was a monolith pretending to be intelligent. Breaking it apart into coordinated agents fixed most of the problems. It also introduced a new category of problems we hadn't thought about. Here's what we actually learned. When One Agent Is Enough (and When It Isn't) The temptation to add more agents is real, but the overhead isn't free. Every agent boundary you add is a place where context can get lost, latency increases, and errors compound. One agent is the right call when: The task fits in a single LLM context window without crowding The steps are sequential and each depends heavily on the prior output You need tight reasoning across all the information (summarising a document, for example) You need multiple agents when: A single agent's context window is being maxed out with tool definitions, history, or data Different steps require genuinely different "personas" or instruction sets (research vs. writing vs. fact-checking) Steps can run in parallel and the latency saving matters You want to isolate failure — if the data extraction agent fails, the report-writing agent shouldn't be affected The key question we ask: Is this one job or a pipeline of jobs? If you'd describe it to a human as "first do X, then Y takes that and does Z", you probably have a pipeline, not a single task. The Three Patterns We Actually Use 1. Supervisor-Worker A thin orchestrator agent decides what needs doing, dispatches to specialised worker agents, and stitches the results together. The workers are narrow — they do one thing and don't need to know about the rest of the workflow. This is our most common pattern. The supervisor's system prompt stays small because it's rout