找到 18098 篇相关文章
GitHub热门项目 | AI-powered job search system built on Claude Code. 14 skill modes, Go dashboard, PDF generation, batch processing. | Stars: 48,805 | 197 stars today | 语言: JavaScript
GitHub热门项目 | The best-benchmarked open-source AI memory system. And it's free. | Stars: 53,647 | 228 stars today | 语言: Python
GitHub热门项目 | LLM驱动的 A/H/美股智能分析：多数据源行情 + 实时新闻 + LLM决策仪表盘 + 多渠道推送，零成本定时运行，纯白嫖. LLM-powered stock analysis system for A/H/US markets. | Stars: 40,920 | 339 stars today | 语言: Python
GitHub热门项目 | A framework for building, orchestrating and deploying AI agents and multi-agent workflows with support for Python and .NET. | Stars: 11,059 | 29 stars today | 语言: Python
GitHub热门项目 | The Frontend Stack for Agents & Generative UI. React + Angular. Makers of the AG-UI Protocol | Stars: 32,362 | 350 stars today | 语言: TypeScript
GitHub热门项目 | Give your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees. | Stars: 21,280 | 127 stars today | 语言: Python
GitHub热门项目 | A Simple and Universal Swarm Intelligence Engine, Predicting Anything. 简洁通用的群体智能引擎，预测万物 | Stars: 64,478 | 324 stars today | 语言: Python
Never underestimate the power that a cheap tablet holds over a kid under six. The Skylight Buddy is a device with one job: to be a cute little guy that helps your kid track routines and chores. It's $139.99, plus an optional subscription. And to my surprise, even though it offers a pretty limited set […]
Just wanted to share my journey after 3.5 years of building a live web analytics tool from scratch, and without AI: WireBoard.io As a web publisher for the last 15 years, I used UA (before GA4) and then Chartbeat. I always loved real-time. At the beginning of the internet I spent my time on IRC, which was great and a huge change from newsgroups and forums. A few years later, Chartbeat was changing its customer base and focusing on big news publishers, and my workflow was about to change with it. I loved being able to watch my traffic live and spot anything unusual, day by day, compared to the same day the previous week. So I decided to replace it with my own product, but with the things their tool was missing. I spent about 8 months thinking it through and sketching different architectures to handle the load and the logic of the data processing pipeline. Then I learned to code in Go (which was surprisingly easy) and built an MVP. After some iterations, I worked on the frontend (Laravel + React) and kept improving the product based on user feedback. The features I couldn't find anywhere else: Truly real-time data via streaming instead of polling. Merging data from different websites into one chart, so I can see at a glance whether traffic is unusual "today" compared to last week. A flexible dashboard, arranged like widgets on a phone. I mostly worked on this quietly and didn't talk about it much on social media or anywhere else, since I'm a dev and not a marketer. This is my biggest project, and I've enjoyed the long journey. All of this happened before the AI era, which turned out to be good timing: I can work on the codebase knowing exactly what does what and where. Over the last 6 months I've experimented with using Claude on some parts of the project (only the frontend), but in limited areas: Performance improvements (useMemo, etc.) Security reviews (not strictly needed, but reassuring when it confirms what I expected) CMS (blog section) The tech stack: Data proc
TL;DR: Non-human identities (service accounts, API keys, workload identities, certificates, OAuth apps, machine-to-machine access) now outnumber humans over 1:1 in most cloud-native orgs. The biggest security risks are unmanaged lifecycle, overprivileged access, and exposed credentials across SDLC and cloud environments, not just secret storage. The best NHI security tools in 2026 fall into four major categories: Secrets Detection and Exposure Prevention NHI Lifecycle and Governance Platforms Machine Identity and Certificate Management Vault and Authorization Extensions Most enterprises require layered coverage across detection, governance, and lifecycle automation. Adopting this multi-layered strategy enables organizations not only to find leaks but also to close the structural gaps that allow them to occur. Why Non-Human Identities Are the Fastest-Growing Attack Surface in 2026 In 2026, attackers rarely try to " hack passwords ". Instead, they exploit the massive, often unmonitored web of non-human identities (NHIs) that power modern automation. They specifically look for hardcoded API keys, overprivileged service accounts, stale OAuth tokens, misconfigured workload identities, unrotated certificates, and shadow SaaS integrations that slip through the cracks of traditional security programs. This is a problem because machine identities far outnumber human users. However, most security programs rely on frameworks designed for human-centric access. IAM Strategy for CISOs: Securing Non-Human Identities Thankfully, top non-human identity protection tools help secure this critical attack surface. By understanding the categories of enterprise NHI security solutions, you can build a strategy that provides complete visibility and robust security controls across your entire infrastructure. What Do Non-Human Identities (NHIs) Include Today? Non-human identities are the digital identities used by machines, services, and applications to authenticate and communicate with other
AI medicine-awareness bot worked — but only in English, the one language most of the people I built it for can't read. Here's the problem, the one-day sprint to fix it, and how GitHub Copilot got me through it. GitHub Finish-Up-A-Thon submission. I shipped this project months ago, but it was never truly finished — it was missing the one feature that decided whether a real person in my own community could use it. This challenge was the push that made me sit down and close that gap in a single night. The problem we face In India, you can walk into most pharmacies and buy prescription drugs without a prescription. We've quietly normalized something genuinely dangerous, and the research is blunt about it. A simulated-patient study in Bengaluru sent two researchers into 261 pharmacies with fake symptoms. Antibiotics were handed over without any prescription at roughly two-thirds (66.7%) of them. Not a single pharmacy warned about side effects. Only about one in five even mentioned that a doctor's prescription was needed. The "guidance" most people walked out with was "take it twice a day" — and nothing else. ( study ) Here is the part that kept me up at night: it's not because people are careless. The shopkeeper isn't a doctor. The label is printed in tiny English. A proper consultation costs time and money many families simply don't have. So people take what they're handed — and hope it's fine. Why it's important This isn't a small inconvenience. Taking the wrong medicine, or the right medicine the wrong way, is one of the biggest drivers of antibiotic resistance — the slow disaster where medicines stop working. The landmark 2019 Lancet GRAM study estimated 1.27 million deaths worldwide were directly attributable to drug-resistant infections in a single year. In India alone, an estimated 297,000 deaths were directly attributable to AMR, and about 1.04 million were associated with it. ( Lancet GRAM 2019 , India figures ) I'm not a doctor and I can't change how medicines
If you've ever built an Electron app that needs a backend, you know the problem. You want something lightweight, something that runs on Node, something where you don't spend three hours configuring Swagger, and something that doesn't make you feel like you're setting up a microservices architecture just to expose two endpoints to your own desktop UI. I've shipped Electron apps with Express. I've tried Fastify. Both work, but they leave you doing a lot of plumbing yourself. Then I found DaloyJS , and honestly, it clicked. The Electron Backend Problem Here's the thing about Electron: your renderer process is basically a browser, and your main process is a Node.js server. When you need data from external APIs, or you need a clean layer between your UI and your business logic, you want a BFF, a Backend for Frontend. A thin server that composes upstream calls, holds the session, and returns exactly the shape your UI needs. DaloyJS was built for this role. The docs even say so plainly: typed upstream client, fetchGuard for safe egress, session handling, and edge runtime support. That combination is exactly the BFF toolkit. Contract-First Means Less Glue The killer feature for desktop apps is contract-first routing. You define a route once, and DaloyJS gives you validation, OpenAPI 3.1 docs, and a typed in-process client all from the same source. No stale spec files. No writing types by hand. Here's what a basic Electron BFF route looks like: import { z } from " zod " ; import { App , requestId , secureHeaders , rateLimit } from " @daloyjs/core " ; import { serve } from " @daloyjs/core/node " ; const app = new App ({ bodyLimitBytes : 1 << 20 , requestTimeoutMs : 5 _000 , docs : true , // auto-mounts /docs and /openapi.json }); app . use ( requestId ()); app . use ( secureHeaders ()); app . use ( rateLimit ({ windowMs : 60 _000 , max : 120 })); app . route ({ method : " GET " , path : " /settings/:userId " , operationId : " getUserSettings " , request : { params : z . objec
There are more IoT protocols out there than most teams will ever need. That sounds overwhelming until you realize most connected products only use two or three; one for local communication, one for cloud connectivity, and sometimes one for device management. The problem is not the number of options. The problem is that the protocol you pick at the design stage gets baked into your firmware, your cloud pipeline, and your data model. Change it later and you are rewriting half of your stack. Here is a practical breakdown of the protocols that matter for most developers building connected products today. The Three Layers You Are Choosing Across IoT protocols sit in three distinct layers, and you typically pick one from each: Application Layer → MQTT, CoAP, HTTP, AMQP (how data reaches your cloud) Network Layer → LoRaWAN, NB-IoT, LTE-M, Wi-Fi, BLE (how data travels physically) Industrial Layer → Modbus, OPC UA, Profinet (machine-to-machine on the factory floor) A soil moisture sensor on a farm might use LoRaWAN at the network layer to push data 10 kilometers to a gateway and MQTT at the application layer to deliver that data to a cloud dashboard. Two protocols, two layers, one product. The Big Three for Cloud Connectivity MQTT - The Default for a Reason Publish-subscribe model. Lightweight. Three QoS levels for delivery guarantees. Run over TCP with TLS encryption. Roughly 70% of cloud-connected IoT deployments use MQTT today. A basic publish looks like this: import paho.mqtt.client as mqtt client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2) client.tls_set() client.connect("broker.example.com", 8883) client.publish("sensors/temperature", '{"value": 23.5, "unit": "C"}') Use when: You need real-time telemetry, bidirectional device control, or guaranteed message delivery across unreliable networks. HTTP - Not for Telemetry, But Still Essential Too heavy for continuous sensor data. But it is the standard for OTA firmware updates, cloud API integrations, and management das
The dangerous part of web extraction is not the error. The dangerous part is a clean JSON response that looks correct and is not. If an AI agent uses that output, the mistake does not stay inside a scraper. It moves into a report, a lead list, a price alert, a CRM update, or an automated decision. So before you trust any web extraction API in an agent workflow, test whether it fails honestly. Here is the checklist I use. 1. Test a real page, not a demo page Demo pages are usually polite little museum exhibits. Use pages that behave like the actual internet: a JavaScript-heavy product page a search results page a page with missing fields a login-gated page a blocked or rate-limited page a thin page that has layout but little useful content If the tool only looks good on clean static pages, you have not learned much. 2. Check whether the API separates fetch success from extraction success A page can return HTTP 200 and still be useless. Common examples: the final page is a login screen the visible content is a bot challenge the useful data loads after hydration and never appeared in the fetch the page contains a generic country selector instead of the product the source has navigation text but no actual item data The extractor should not treat these as success just because the request completed. A better response says something like: { "status" : "failed" , "failure_type" : "login_required" , "extracted" : null , "next_step" : "Use a public URL, authorised access, or sample content." } That is boring. Boring is good here. Boring means the agent can stop safely. 3. Ask for fields that are not on the page This is the easiest lie detector. Ask the extractor for something impossible: Extract the product name, price, stock status, warranty length, CEO name, office address, and refund policy. If the page only contains product name and price, the API should say the other fields are missing or low confidence. It should not politely invent them because the schema asked nicely.
I Built a Python Package to Fix SSE Resumability in the MCP SDK Your MCP server crashed. Your client reconnected. Every event from that session? Gone. The Gap The Model Context Protocol Python SDK ships with a built-in EventStore that powers SSE stream resumability — when a client reconnects with a Last-Event-ID header, the server replays the events it missed. This works great in development. The catch: that store lives entirely in memory. Restart the process, roll a new deployment, or — in a multi-worker setup — have the reconnecting client land on a different pod, and the session is gone. The store was local to the process that died. Resumability silently returns nothing. This isn't a bug in the SDK. It's a scope decision — the in-memory store is a correct, useful default for single-process development. But the moment you deploy to production, you need something durable. That's the gap mcp-persist fills. What It Does mcp-persist adds three drop-in EventStore backends — SQLite , Redis , and PostgreSQL — that survive process restarts and work across multi-worker deployments. Pick the one that fits your infrastructure; the API is identical across all three. pip install "mcp-persist[sqlite]" # no external service needed pip install "mcp-persist[redis]" # for multi-worker deployments pip install "mcp-persist[postgres]" # for teams already running Postgres The Two-Line Setup Wiring resumability by hand is tedious — you need a store, a StreamableHTTPSessionManager , a Starlette lifespan to open and close both, and a Mount . The with_persistence() helper collapses all of that. Pass your FastMCP instance, get back a runnable ASGI app: import uvicorn from mcp.server.fastmcp import FastMCP from mcp_persist import with_persistence mcp = FastMCP ( name = " MyServer " ) app = with_persistence ( mcp , backend = " sqlite " , url = " events.db " , ttl = 3600 ) uvicorn . run ( app , host = " 127.0.0.1 " , port = 8000 ) # MCP endpoint at /mcp Switching to Redis is a one-word change:
TL;DR I built AutoMaintainer , a multi-agent AI system that transforms GitHub issues into production-ready pull requests during the Qwen Cloud AI Hackathon. It coordinates specialized agents (Issue Analyst, Developer, QA, Security, Documentation, Reviewer) to solve problems like a real engineering team—all while keeping humans in control. Here's what I learned. The Problem Open-source maintainers face a brutal reality: 📚 Overwhelming issue backlogs 🔄 Repetitive bug fixes and documentation gaps ⏱️ Code review bottlenecks 😴 Burnout from handling everything solo Existing AI tools help write code, but they don't orchestrate the entire workflow: planning, development, testing, security review, documentation, and human approval. What if we could build an AI engineering team that collaborates like real developers? The Solution: AutoMaintainer AutoMaintainer is a multi-agent orchestration system that mirrors a real software company: Issue Analyst – Reads GitHub issues, extracts requirements, assesses severity Architect – Analyzes repo structure, designs the implementation approach Developer – Writes code, updates files, creates new modules QA Tester – Generates tests, validates fixes, checks edge cases Security Agent – Scans for vulnerabilities, prevents dangerous patterns Documentation – Updates changelogs, PR summaries, release notes Reviewer – Scores code quality, recommends improvements Human Approval Gateway – Final human review before merge The result? A pull request that's analyzed, built, tested, secured, documented, and reviewed—all before a human ever sees it. Tech Stack Frontend Next.js – React framework for the dashboard UI Tailwind CSS – Rapid, utility-first styling TypeScript – Type safety for the frontend layer Backend FastAPI (Python) – Lightweight, async-first API Qwen-compatible LLM API – AI model integration for all agents SQLite + Async (aiosqlite) – Persistent pipeline and memory storage Redis-ready architecture – Prepared for distributed queuing Integr
Hi everyone, Kacper and Filip from Software Mansion here. This week, TanStack Start is once again in the spotlight. The React Compiler in Rust is on its way. React Router and Remix shipped important security patches – update immediately. There's also a fresh batch of releases from TanStack Form, XState Store, shadcn, React Aria, and more. On the React Native side, this week was dominated by App.js Conf 2026 in Kraków. Gesture Handler 3.0, Swift Package Manager support for React Native, and Legend List 3.0 were among the highlights, alongside Expo announcements like EAS Observe. Let's go! 💡 Subscribe to the official newsletter to receive an email every week! 💸 Sponsor Atomic CRM: The Open-Source CRM Toolkit for Developers Stop struggling with locked-in CRMs and expensive seats. Atomic CRM gives you the power of a professional CRM with the total freedom of open-source. It’s the only toolkit that combines a high-end user experience with data sovereignty. No more lock-in, no more "renting" your contacts. Everything you need is already there: Native Mobile App for on-the-go access. Intuitive Kanban Boards for pipeline management. Built-in Email Tracking to stay on top of leads. Free SSO for seamless team integration. MCP Server Integration for productivity gains. Why settle for a black box SaaS when you can own the entire platform? Deploy Atomic CRM on your own infrastructure in minutes and regain control over your most valuable asset: your data. ⚛️ React TanStack Start Gaining Momentum: 📜 TanStack Start Adds First-Class Rsbuild Support - TanStack Start now supports Rsbuild / Rspack alongside Vite via a new plugin adapter, covering SSR, streaming, HMR, Server Functions, and RSC. 📜 Lovable - Building apps using TanStack Start - The AI App builder is now using TanStack Start with SSR by default for all new projects. 📜 The Conductor Rewrite: What They Changed to Make It Fast - Migrating their Tauri desktop app from React Router to TanStack Router significantly reduced re-re
submitted by /u/Quirky_Inevitable630 [link] [留言]
We've been running AI across a team for about two years. Expected the hard parts to be the models. They weren't. The problem that cost us most early on was context. We had a system making customer-facing recommendations without access to the business-specific knowledge it needed to answer accurately. Spent too long trying to fix it at the prompt level. The context layer didn't exist, and prompting didn't fill that gap, it just made it less obvious until something downstream failed badly enough to trace back to it. That failure pushed us to map the other places where AI builds break structurally rather than technically. We found five more, and they kept showing up across different stacks and different team sizes in roughly the same order. The first is identity, when you move from one person's AI to a team's AI, shared context without role-based permissions either creates noise or recreates the same knowledge silos you were trying to escape. The second is decision memory, records of what was decided aren't the same as memory of why, and that gap compounds quietly until a new team member gets a confident wrong answer from a system referencing reasoning that was abandoned months ago. The third is attention. Dashboards only work if someone looks at them, and the failure mode of every dashboard ever built is the same: critical things slip through when life gets busy. The fourth is write-back. Manual logging is a tax on the busiest moments, and the more important the work, the less likely anyone stops to document it. The fifth is governance, when the same agent that builds something also evaluates it, that's not a check, it's a loop grading its own homework. The sixth is economics, at solo scale AI cost is a rounding error, at team scale you're looking at a vendor invoice with no way to connect spend to specific workflows or outcomes. Which of these have you hit? And did they show up in this order or did something else surface first? If you're interested, we turned these i
LinkedIn’s Karthik Ramgopal and Prince Valluri discuss leveraging AI as a new execution model for large-scale engineering. They explain how to move beyond fragmented implementations by building platform abstractions for orchestration, structured context, and safe tooling like MCP. They share architectural insights from real-world coding, observation, and UI testing agents built at LinkedIn. By Karthik Ramgopal, Prince Valluri