标签：#Python

I got tired of manually writing MCP tools for every REST endpoint I wanted to expose to an LLM. So I automated it. mcpgen reads an OpenAPI JSON or YAML file and generates a complete, ready‑to‑run MCP server in Python. 🔧 What it does Parses OpenAPI 3.0 / 3.1 specs Creates one MCP tool per endpoint (with snake_case names) Handles auth automatically (API key, Bearer, etc.) Outputs a clean, human‑readable Python script Zero runtime surprises – just mcp and httpx 🚀 Quick start bash pip install mcpgen mcpgen my-api.json -o my-mcp-server python my-mcp-server/server.py The generated server runs over stdio – ready to plug into Claude Desktop or any MCP client. 🧪 Real‑world test Recently a contributor added an OpenAPI 3.1 fixture (Xquik API) with lookupTweet and getUser endpoints. The tool generated the correct tools, including path parameters and x-api-key auth, on the first try. All 18 tests pass. It works. 🤔 Why you might want it If you’re building LLM agents that need to interact with APIs, mcpgen eliminates the boilerplate. You don’t have to write a single @app.tool() decorator by hand. It also makes it dead simple to experiment – change your API spec, regenerate the server, and you’re done. 📦 Links GitHub: JnanaSrota/mcpgen PyPI: pip install mcpgen MIT licensed, open to contributions 🙏 Feedback If you try it with your own API spec and something breaks (or works beautifully), I’d love to hear about it. Drop a comment or open an issue. Thanks for reading!

You have seen this loop before. An agent starts a “simple” task, say scrape listings, refactor a repo, research a market, or whatever. It fails, it retries, it re-reads context, it apologizes and tries all over again. Twenty minutes in and the dashboard shows six figures of tokens and zero useful outputs or deliverables. The model did not misbehave on purpose. The orchestrator never had a hard budget gate with an ROI in mind. Skillware v0.4.0 ships a new skill for exactly that gap: monitoring/token_limiter . It lets you monitor and limit any agent’s token budget in real time — Gemini, Claude, OpenAI, DeepSeek, Ollama, custom Python loops, you name it. Same skill, same JSON, any runtime. What Skillware is in a nutshell Skillware is an open registry of installable agent capabilities . Each skill is a bundle: skill.py — deterministic Python ( execute() returns JSON) instructions.md — when the model should call the tool manifest.yaml — schema, constitution, issuer Tests and docs — shipped in the wheel You load by ID, adapt for your provider, call execute() on tool use. The model decides when , the skill decides how , predictably, every time. That split matters for budget control. You do not want the LLM guessing whether it is “allowed” to spend more tokens. You want a small, auditable function that answers: continue, warn, or stop. Meet the Token Limiter This skill is a budget gate , not a kill switch wired into OpenAI or Anthropic. After each model turn, your host loop passes cumulative usage. The skill returns one of three actions: Action Meaning CONTINUE Under the soft threshold — keep going WARN Approaching the limit (default 80%) — tighten scope FORCE_TERMINATE Hard ceiling hit — stop the loop Important nuance: the skill does not cancel API sessions or kill processes. It returns a structured decision. Your orchestrator must act on it. That is by design — Skillware skills stay portable and provider-neutral. No skill-specific API keys. No network calls. Pure Python m

GitHub热门项目 | Common User Passwords Profiler (CUPP) | Stars: 6,014 | 18 stars today | 语言: Python

This article covers the MCP setup and configuration for using Google Nano Banana 2 Lite and...

A few months ago I noticed something annoying about how I worked: I was spending more time collecting information than actually thinking about it. The pattern was always the same. Open a search engine, open a dozen tabs, skim past the SEO filler and cookie banners, copy the paragraphs that actually mattered into a doc, paste the whole mess into an LLM and ask it to make sense of things. Then, a week later, do it again because whatever I was tracking had changed. At some point I stopped asking "how do I do this faster" and started asking why I was doing it by hand at all. Why the obvious answers didn't work ChatGPT and Perplexity are fine for a single question. They're worse at the part I actually needed help with, which was repetition: running the same research loop on a schedule, keeping a record of what changed, and getting a notification when it did. Neither tool is built to sit in the background and check on a topic for you. Plain scraping scripts have the opposite problem. They get you raw HTML, not understanding. You still have to strip out nav bars and footers by hand, and the moment you point one at a list-style page like Hacker News instead of a blog post, it falls apart. And bookmarking is just deferring the problem. A folder of forty saved links isn't research, it's homework you haven't done yet. I wanted something in between: automated enough to skip the tab-hoarding, but still producing something I could read and trust, not just a black-box answer. So I built Focal Harvest It's a modular CLI that runs the whole research loop, search, scrape, clean, synthesize, report, on its own, and stays lightweight enough to run on a laptop with no GPU and no database. A single run looks like this: you give it a topic and a focus area (what you specifically want answered), it searches the web, pulls and cleans the pages, synthesizes a report, and writes it to disk. There's also a loop mode, so the same query can re-run every few hours and ping you on Discord or Teleg

A few months ago I was applying for jobs and stumbled across Jobscan. It looked exactly what I needed — paste your resume, paste the job description, see how well you match. Then I saw the price. $49.95/month. As a student, that's a week of groceries. I closed the tab. But the problem didn't go away. I kept wondering — why is my resume getting rejected before a human even reads it? ATS systems are filtering people out and nobody tells you why. So I built ClearScan. What it does: Scans your resume against a job description. Shows exactly which keywords you're missing. Checks ATS compatibility across 5 platforms (Workday, Taleo, Greenhouse, Lever, iCIMS). Scores your bullet points using STAR format analysis. Gives you a transparent breakdown — you can see why you got the score you did. That last part matters to me a lot. Most tools just give you a number. ClearScan shows you the math. Where it stands: Launched today. First paying customers already. Free tier gives you 2 scans/month — enough to feel the product before deciding. Pricing starts at €3.99/month. Built for students, priced for students. Live at clearscan.fyi — would genuinely love your feedback, especially from developers who've dealt with ATS hell themselves.

I needed faster edits for technical diagrams, and a lower recurring overhead for recurring visuals. I stopped asking for new images for everything. That change started the moment I replaced "generate now, tweak later" with a fixed 8-tool matrix. TL;DR: I moved recurring illustration work into seven scriptable stacks + one 3D stack and kept image-generation AI only as a fallback. Why I rewrote this workflow When I edited an article recently, I was spending too much time redoing the same visual shape in slightly different versions. The same chart logic should not need prompt guessing each time. I asked myself: Can this be represented as text or code? Can I regenerate it exactly when requirements change? Do I need raw design freedom, or do I need deterministic structure? If the answer was mostly "text/code + deterministic output," I did not open an image-generation model first. I also kept one practical boundary: this was not an academic tool roundup. This is a log of what I actually used and in what context. The number that changed my mind: an 8-tool decision matrix The number I now defend is exactly 8 . Instead of inventing synthetic savings, I evaluate every new illustration request against this matrix. Tool Best fit Why I pick it Mermaid flow, sequence, architecture notes fastest in markdown-native writing PlantUML UML-heavy docs strict structure when Mermaid gets too loose Markmap map-style summaries converts headings directly Graphviz dependency and direction graphs compact graph semantics matplotlib numeric visualizations source-of-truth from data tables Pillow labels, badges, annotations deterministic pixel edits in Python D3.js node/link or hierarchy interactions data-driven relationship rendering Blender 3D explanatory graphics stronger structural clarity for complex scenes This is the exact set I now reach for before any image-generation request. What happened first: practical snippets I am including small runnable snippets I can reuse. 1. Mermaid for determ

I recently built a multi-agent customer support system on Azure AI Foundry and NVIDIA NIM. First time doing anything like this. Made four predictions upfront about what would happen. Three of them were wrong. Here is what I actually learned. 1. "Tokens" is not a unit of cost It is a unit of work. The price per unit of work varies by 5-10x depending on which model did the work. I was tracking total token count across both the small 9B model and the large 49B model as if they cost the same. They do not. Total tokens went up in the optimized version. Cost in dollars probably went down. I was measuring the wrong thing the whole time. 2. A verbatim hash cache on natural language traffic deflects ~0% of queries I predicted 25-40% cache deflection. The actual number was 0%. Every query in my test set was a unique string, so the hash-based cache never had a single chance to fire. A verbatim cache is not a simpler version of a semantic cache. It is a different thing entirely. If your workload is natural language, build semantic similarity caching from day one, not as an upgrade later. 3. configure_azure_monitor() does not capture OpenAI SDK calls by default You need to install and initialize opentelemetry-instrumentation-httpx explicitly: pip install opentelemetry-instrumentation-httpx==0.61b0 from opentelemetry.instrumentation.httpx import HTTPXClientInstrumentor HTTPXClientInstrumentor().instrument() Without this, your App Insights Logs will show customMetric and performanceCounter entries (CPU, memory) but nothing about what your agent actually did. 4. Pin your OpenTelemetry versions or everything breaks Installing opentelemetry-instrumentation-httpx without version pinning pulled in opentelemetry-api 1.42.1. But azure-monitor-opentelemetry-exporter needs opentelemetry-api==1.40. The conflict is silent until things start misbehaving. Pin everything to the 0.61b0 / 1.40.0 line: pip install \ "opentelemetry-api==1.40.0" \ "opentelemetry-instrumentation==0.61b0" \ "opentelem

By RUGERO Tesla ( @404Saint ). There is a persistent illusion in Industrial Control Systems (ICS) security research: that high-level libraries, abstraction frameworks, or protocol tooling give you a real understanding of Operational Technology (OT) behavior. They don’t. They hide the architecture. Determined to understand what actually happens when a Programmable Logic Controller (PLC) receives a control-plane command, I built an EtherNet/IP and Common Industrial Protocol (CIP) sandbox from scratch. No Scapy. No protocol wrappers. Just raw sockets, a Linux loopback interface, a cpppo simulator, and a passive monitoring tool ( enip_monitor.py ) capturing traffic in real time. It looked clean on paper. Then I reached the application layer. And things stopped behaving like theory. The Reality of the “Industrial Abstraction Layer” If you come from Modbus or traditional IT networking, you’re used to linear memory spaces—fixed registers, predictable offsets, and flat addressing. EtherNet/IP and CIP discard that model entirely. Instead, they introduce a structured object system wrapped inside multiple encapsulation layers: +-----------------------------------------------------------+ | EtherNet/IP Encapsulation Header (24 bytes) | | → Session control, commands (0x0065, 0x006F) | +-----------------------------------------------------------+ | Common Packet Format (CPF) | | → Routing, addressing, and transport segmentation | +-----------------------------------------------------------+ | CIP Application Layer | | → Service codes (0x4C, 0x4D, 0x10, etc.) | +-----------------------------------------------------------+ To communicate with a PLC at the wire level, your code must: Establish a session using RegisterSession (0x0065) Wrap all subsequent requests in SendRRData (0x006F) Encode routing information inside CPF structures Construct symbolic or logical paths for the CIP Message Router Ensure strict byte alignment across nested payload layers A single mistake in any layer b

Now that you are acquainted with lists, it is time to learn a little bit more about them. Today’s post is about indexing. You are going to learn more about how indexes work in lists and how to use them in code. Indexing is a lot more than calling parts of a list you might need. Developers use indexing to double-check what value is at a specific index. This makes it very helpful when debugging lists. Lists are mutable. Mutable means that any values inside a list can be changed after it has been made. At Coding with Kids, the values in the lists the students created throughout their projects would constantly change with certain values being added, removed, or changed. How to Change a Value in a List To change a value in a list, use the list name followed by the square brackets. Inside the square brackets put the number of the index you want to change. After the closing square bracket, put the equal sign followed by the value you are changing. In the example below, I have a list called grocery_cart. When I want to replace the second value in the list, I use the index value of 1 because I’m counting the way the computer counts. I print this index value to the console to doble-check what value is at this index to see if things have changed. grocery_cart = [ " chicken " , " ground beef " , " salad mix " , " blueberries " , " tuna " ] grocery_cart [ 1 ] = " cheese " print ( grocery_cart [ 1 ]) # print cheese If you have a bunch of variables in your code, you can move information stored in variables and put them inside a list. In the example below, I have different variables with various values assigned to them. name = " Lucky " age = 15 color = " orange " If I want to turn these variables into a list, , I can create a new variable called cat. After the equal sign, I will assigned the values as list items inside the square brackets. cat = [ " Lucky " , 15 , " orange " ] Indexing with Strings Developers use indexing to select specific characters in a string. Strings are simi

GitHub热门项目 | 基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。 | Stars: 1,000 | 105 stars today | 语言: Python

What building cross-service RBAC taught me about the difference between a fast check and a correct one VaultPay is a wallet microservice I built on top of AuthShield. Previous parts: Part 1 is here: I Built AuthShield and Immediately Knew It Wasn't Enough Part 2 is here: The Silent Failure I Never Saw Coming: What VaultPay Taught Me About Consistency Under Failure Part 3 is here: I Started With a Blocklist. That Was the Wrong Instinct and VaultPay Taught Me Why. Part 4 is here: I Watched Money Move Twice From the Same Request. That's When I Understood Idempotency. Part 5 is here: I Almost Hashed a Document Number That Needed to Be Read Again When I designed JWT validation for VaultPay, the only thing I was optimising for was speed. Local verification, no network call, decode the token with the shared secret, read the claims, move on. Every request gets this. It's fast - no round trip to AuthShield, no added latency on the hot path. That felt like the obvious right answer for a system processing financial transactions, where every millisecond on the request path matters. Then I asked myself a question I hadn't thought through properly: what happens if an admin gets deactivated in AuthShield right now, this second, while they still have a valid token sitting in their browser? The answer, with pure local validation, is uncomfortable. Nothing happens. The token is still cryptographically valid. The signature checks out. The claims say role: admin . VaultPay has no way of knowing that AuthShield revoked this person's access thirty seconds ago, because VaultPay never asked AuthShield. It just trusted the token. That's the moment dual-mode validation stopped being a performance optimisation and became a correctness requirement. Two Services, No Shared Database VaultPay and AuthShield are separate microservices with separate databases. AuthShield owns user accounts, login, JWT issuance, and role management. VaultPay owns wallets, transactions, KYC, and admin operations on t

I recently completed an exploratory data analysis project on the NHANES (National Health and Nutrition Examination Survey) dataset from Kaggle. It's a real-world health survey collected by the CDC covering body measurements, lifestyle habits, and demographic data from thousands of US adults. In this article I'll walk you through exactly what I did — from loading and cleaning the data all the way to running statistical tests — and share what I found along the way. The Dataset The dataset has 5,735 rows and 28 columns , but for this project I focused on 8 columns that were relevant to the questions I wanted to answer: Column Description smoking Has the person smoked at least 100 cigarettes? gender Male or Female age Age in years education Highest level of education weight Weight in kg height Height in cm bmi Body Mass Index Step 1 — Loading and Selecting Columns import pandas as pd import numpy as np import matplotlib.pyplot as plt import seaborn as sns db = pd . read_csv ( ' NHANES.csv ' ) data = db . loc [:, ( ' SEQN ' , ' SMQ020 ' , ' RIAGENDR ' , ' RIDAGEYR ' , ' DMDEDUC2 ' , ' BMXWT ' , ' BMXHT ' , ' BMXBMI ' )] data = data . rename ( columns = { ' SEQN ' : ' id ' , ' SMQ020 ' : ' smoking ' , ' RIAGENDR ' : ' gender ' , ' RIDAGEYR ' : ' age ' , ' DMDEDUC2 ' : ' education ' , ' BMXWT ' : ' weight ' , ' BMXHT ' : ' height ' , ' BMXBMI ' : ' bmi ' }) One thing worth knowing about NHANES: all the columns come in as numeric codes. 1 means Male, 2 means Female. 1 means the person smoked, 2 means they didn't. You have to map these to readable labels before doing any analysis, otherwise your charts are meaningless. Step 2 — Cleaning the Data Drop the ID column and remove nulls data . drop ( ' id ' , axis = 1 , inplace = True ) data . dropna ( inplace = True ) This brought us from 5,735 rows down to 5,406 — about 6% lost, which is acceptable. Remove outliers using the IQR method The IQR (Interquartile Range) method flags values that fall too far outside the middle 50% of

Eight months ago, a CS exam forced me to write pseudocode when I already knew how to code. Instead of studying, I rage-built an app. Today examintelligence.app is live. Here’s exactly how I got here—from vibe-coded POCs to a production hybrid AI pipeline—without the curated startup gloss. The Philosophy Behind the Build I’ve always believed studying for marks ≠ actually learning. When I was first introduced to organic chemistry, I hated it. Then I ran into GNNs in Machine Learning with PyTorch and Scikit-Learn , paired with the MoleculeNet dataset. Suddenly, everything clicked. I wanted to learn everything about it. That’s the core problem: exams optimize for pattern recognition, not curiosity. You’re forced down one prescribed path, and it rm -rf s the fun of learning in most cases. So one week before my first prelims, I decided to build exam intelligence. The plan was simple: introduce brutal efficiency using AI for what it’s actually built for: pattern recognition Parse every past paper, mark scheme, and examiner report. Distill it down to precisely what matters. Free up time for coding and creative work. Vibe-Coding the POC (and Why It Collapsed) I’m generally against vibe-coding. It’s unreliable, hard to maintain, and a security nightmare. But with prelims staring me in the face, I had no choice. I opened Claude and vibe-coded it module by module. The only code review I had time for was checking for suspicious os.system or subprocess calls. That was it. I shipped anyway. Initial stack: Gemini API (no agent frameworks, no LangGraph) Streamlit frontend PostgreSQL It validated my idea but functionally, it barely held together. After prelims, I finally looked at what the AI had actually built: Dashboard showing random stats Asked Gemini for a JSON response with 5 keys, saved only 2 Randomly created DB tables while trying to read subjects The kind of code you end up with when you let an AI cook unsupervised for a week. So I did the only reasonable thing: opened Neov

We built our first "multi-agent system" by accident. What started as a single agent that could research a topic, draft a report, check it against source data, and send a summary email had grown into a 2,000-token system prompt and a function list so long that the model kept forgetting tools existed. It wasn't a system — it was a monolith pretending to be intelligent. Breaking it apart into coordinated agents fixed most of the problems. It also introduced a new category of problems we hadn't thought about. Here's what we actually learned. When One Agent Is Enough (and When It Isn't) The temptation to add more agents is real, but the overhead isn't free. Every agent boundary you add is a place where context can get lost, latency increases, and errors compound. One agent is the right call when: The task fits in a single LLM context window without crowding The steps are sequential and each depends heavily on the prior output You need tight reasoning across all the information (summarising a document, for example) You need multiple agents when: A single agent's context window is being maxed out with tool definitions, history, or data Different steps require genuinely different "personas" or instruction sets (research vs. writing vs. fact-checking) Steps can run in parallel and the latency saving matters You want to isolate failure — if the data extraction agent fails, the report-writing agent shouldn't be affected The key question we ask: Is this one job or a pipeline of jobs? If you'd describe it to a human as "first do X, then Y takes that and does Z", you probably have a pipeline, not a single task. The Three Patterns We Actually Use 1. Supervisor-Worker A thin orchestrator agent decides what needs doing, dispatches to specialised worker agents, and stitches the results together. The workers are narrow — they do one thing and don't need to know about the rest of the workflow. This is our most common pattern. The supervisor's system prompt stays small because it's rout

GitHub热门项目 | Open-source AI hackers to find and fix your app’s vulnerabilities. | Stars: 26,385 | 88 stars today | 语言: Python

GitHub热门项目 | NumPy & SciPy for GPU | Stars: 11,351 | 172 stars today | 语言: Python

GitHub热门项目 | A feed-forward 3D foundation model for reconstructing scenes from streaming data | Stars: 7,993 | 372 stars today | 语言: Python

I Built a Free Apache Kafka Course from Scratch — Here's the Full Curriculum (and What I Got Wrong) I spent months building a free Apache Kafka course covering everything from first principles to a real-time analytics platform final project. No paywall. No "premium tier." 9 modules, 470 minutes of content, completely free. Here's the full syllabus, the Python code that actually works, and the honest mistakes I made building the curriculum — so you don't repeat them. Why I Built This Every time someone asked me "how do I learn Kafka?", I sent them to the same 3 places: The official Confluent docs (dense, assumes you already know what you're doing) A $15 Udemy course that spends Module 1 explaining what a computer is A YouTube playlist where half the videos are deleted None of them answered the real question beginners have: why does Kafka exist, and what problem does it actually solve before I write a single line of code? That's the gap I built for. The Problem With Most Kafka Tutorials Most tutorials start with: "Kafka is a distributed event streaming platform..." And then they immediately show you a Docker Compose file with 6 services. Beginners copy-paste it, something breaks, they don't know why, they quit. The real problem is that Kafka is an answer to a specific architectural problem — and if you don't understand the problem first, the solution makes no sense. So Module 1 and 2 of this course don't touch Kafka at all. They build the problem statement from scratch. The Full Syllabus (9 Modules, 470 Minutes) Module 1: Introduction to Kafka — 35 min Not "what is Kafka" — but why event streaming exists at all. What breaks in traditional request-response architectures at scale. Module 2: The Problem Statement — 30 min A real-world scenario: you're building an e-commerce platform. Orders, inventory, notifications, analytics — all tightly coupled. What happens when one service goes down? This module makes the pain visceral before Kafka enters the picture. Module 3: How

Last month, I spent three days wrestling with 500 PDF invoices. Each one had the same data—vendor name, invoice number, total amount—but the layouts were all over the place. Different fonts, missing headers, tables that somehow broke across pages. I tried regex. I tried OCR with layout analysis. I even tried building a rule-based parser that looked for keywords like "Total:" . Nothing worked reliably. Every time I fixed one pattern, another invoice broke. I was one commit away from throwing my laptop out the window. Then I took a step back. I realized I didn't need to understand every layout variation. I just needed to understand the data . And that's where AI came in. What didn’t work Let me be clear: I tried the usual suspects first. Regex. Classic. I wrote patterns like r"Total\s*:\s*\$?(\d+\.\d{2})" . Worked on 60% of invoices. The rest had "Total Due" or "Amount Total" or the dollar sign in a different place. Regex is great when you control the input. I didn't. OCR with layout parsing. I used Tesseract with --psm 6 and tried to extract lines by bounding boxes. It helped a bit, but tables with merged cells or rotated text threw it off. Plus, I had to write code to guess which box was a field name and which was a value. Rule-based parser. I built a dictionary of known vendors and their layouts. That worked … until I got an invoice from a new vendor. Maintenance became a nightmare. I was solving the wrong problem. Instead of fighting formatting, I needed to focus on meaning . The AI approach that saved me I remembered that large language models are surprisingly good at understanding context. If I could give the model the raw text from a PDF and a description of what I wanted, maybe it could extract the fields directly. Here’s the core idea: treat extraction as a structured generation task. Provide a prompt with a few examples (few-shot) or just describe the schema, and let the model output JSON. I found an API that did exactly this with a simple HTTP call. (Full d