This Week's Highlights — issue 005, July 31, 2026
THE CYBER TOOLCHAIN
NO. 005
The best tooling updates that shipped this week.
The week in numbers · Jul 24–30
Changes per week, last 12 weeks · Jul 24–30
Changes we read in that week's dailies, including docs and API changes. A gap means no daily was published.
Every feature release from the 1309 tools on our watchlist goes into the daily newsletter. Once a week we read the whole field side by side and choose our top picks, judged on two questions: how deep and complete is the single best capability in the release, and how much it changes what you can actually do.
A tool is judged on everything it shipped that week, so a project that releases daily gets credit for the sum — and still only takes one slot. We would rather run a short list than a padded one.
Focus: What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out: Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus: New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out: Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus: Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out: Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus: API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out: Governance, SOC operations, and vendor launches with no developer surface.
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
The picks in full
Wiz Defend is a cloud detection and response platform that identifies and helps remediate real-time threats across cloud environments.
Red Agent, a continuous autonomous AI pentester, is now GA—reasoning through business logic to find exploitable flaws in APIs and custom/vibe-coded apps and delivering proofs of execution with reproduction steps. New Web API Crawler, logic-driven API DAST, and Secrets Blast Radius modules also validate exposed secrets against real third-party SaaS APIs.
Wiz Defend brought its Red Agent AI pentester to general availability with three new modules for API discovery, logic-driven exploitation, and secrets validation, while also launching an AI Threat Defense partnership with Google and introducing a SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation.-focused Blue Agent.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
New API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Attacker module continuously finds and validates logic-driven exploitable risks — including OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps.
Red Agent is now generally available: a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs. It automatically ingests context from Wiz sources — API schemas, cloud resources, Runtime Sensor, code repositories, and network layers — without manual setup.
New Secrets Blast Radius module validates secrets exposed in public websites, APIs, and code repositories by executing safe checks against third-party SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. provider APIs to confirm exploitability and determine the precise scope of permissions held.
New Web API Crawler module uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs.
AI Threat Defense launched in partnership with Google, combining Wiz, Mandiant, and Google DeepMind capabilities.
Blue Agent introduced: a SecOps AI analyst that automates threat detection, triage, and containment workflows.
Intruder is a cloud-based vulnerability scanner that continuously monitors and identifies security weaknesses in internet-exposed systems, helping businesses reduce their attack surface.
AI Pentesting delivers full web app penetration tests on demand, producing a PDF report with executive summary, severity ratings, reproduction steps, and remediation. It adds whitebox testing via code-repo integration and detects access-control, business-logic, and auth-bypass flaws that require multi-step chaining and are missed by static or dynamic scanning.
Intruder launched AI Pentesting, an on-demand web application penetration testing capability that combines whitebox code analysis with logic-flaw detection and produces full PDF reports.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
A new AI Pentesting capability runs full web app penetration tests on demand, producing a PDF report with executive summary, severity ratings, reproduction steps, and remediation guidance. It supports whitebox testing via code repository integration for deeper analysis beyond surface-level scanning, and detects access control, business logic, and auth bypass vulnerabilities that require multi-step chaining and are missed by static or purely dynamic scanning. Practitioners can define custom entry points, credentials, and application context to scope tests to their real environment; to start one, go to AI Pentesting in the portal's left nav, click Start new pentest, then choose the AI Pentest option.
Lightweight coding agent that runs in your terminal
Named and pinnable sessions with thread forking, Agent Plugins manifests, and WebSocket Code Mode land in v0.146.0, giving practitioners persistent multi-thread agent workflows. The latest alpha completes MCP 2026-07-28 client support for the newest Model Context Protocol spec and exposes cached MCP tools before server startup to cut latency.
Codex CLI's biggest push this window was MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol modernization — full 2026-07-28 discovery and MCP 2026 client support plus a string of connection, caching and reliability upgrades — alongside a new Agent Plugins manifest ecosystem, remote Code Mode host support, and expanded thread management (naming, pinning, forking).
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
The app-server can connect to a remote Code Mode host over WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. via the new --code-mode-host flag (e.g. wss://...). The features.code_mode_host config table gains a disable_in_process_fallback option to prevent silent fallback to the embedded V8 host when the standalone host fails to start, and Responses Lite turn metadata gains a code_mode_tool_names field exposing normalized code-mode identifier-to-ToolName mappings for each turn.
# In your Codex config file: [features.code_mode_host] disable_in_process_fallback = true
$ codex-app-server --code-mode-host wss://example.com/code-mode --listen ws://127.0.0.1:9000
New sessions can be named via /new or /clear; users can pin important threads and switch between side conversations without closing them, and side conversations stay open when switching threads. Thread responses now include an isPinned field, with pin/unpin support via the thread/metadata/update endpoint and an isPinned filter on thread/list, plus cursor-based pagination.
Codex recognizes Agent Plugins 1.0 manifests — root plugin.json files mapping metadata, skills/, and mcp.json into Codex plugin manifests — and applies Codex-specific apps, hooks, and interface settings from the inline com.openai extension, with .codex-plugin/plugin.json as a fallback overlay. Plugins can be published to a workspace, surfaced via canPublishToWorkspace capability metadata in plugin/share/save responses. Additional plugin marketplaces are supported for Amazon Bedrock (API plugin marketplace) and Claude Code (inferred bundled marketplace); curated plugin recommendations are routed by authentication mode and prepared concurrently with MCP recommendations; remote plugin catalogs are cached by scope; and trusted plugin script attribution tracks which plugin scripts originated command executions.
Remote exec servers gain a --exit-on-stdin-close flag (and CODEX_EXEC_SERVER_EXIT_ON_STDIN_CLOSE environment variable) for graceful shutdown with telemetry flush when the parent process closes stdin, network policy callbacks for remote exec environments, exec-server HTTP and WebSocket traffic routed through the configured proxy policy, and streaming body support in route-aware HTTP requests.
$ codex exec-server --remote --exit-on-stdin-close
Threads can be forked with paginated history, including temporary forks that do not appear in thread listings. The thread/fork endpoint supports an excludeTurns: true parameter for ephemeral forks that preserve selected history and a fork preview without creating a persistent rollout.
MCP tooling gained a string of connection and performance improvements: cached MCP tools are exposed to inference before the MCP server finishes initializing; MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. discovery and authentication-status requests are routed through each server's configured runtime HTTP client for proxy-aware auth; MCP tool name prefixes can be omitted on a per-server basis; MCP connections are reused across runtime refreshes, with closed connections replaced during reconciliation; MCP runtime updates are prewarmed in the background; MCP runtimes refresh automatically when session authentication changes; all configured MCP servers reconnect on an explicit refresh trigger; MCP HTTP requests now carry a default User-Agent header for auditability; and refreshed Apps tools are preserved across MCP runtime updates.
Custom Responses API model providers can opt into the standalone web.run web search tool via the new supports_standalone_web_search model-provider setting; when enabled, standalone web search requests are routed through the custom provider's own endpoint and authentication, extending web-search capability beyond first-party models.
Exposes plugin eligibility metadata (disabledReason, eligiblePlanTypes) in app-server plugin summaries, surfacing plan-gating and admin-disabled status.
Adds parent_turn_id tracking across nested Codex agent spawns, delegated sessions, and follow-up tasks for improved request provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
Scopes pending network approvals to a turn and execution, coalesces duplicate requests within one execution, and assigns unique per-execution identifiers to user approval requests and permission hooks.
Allows hosts to customize the model-visible wait_for_environment tool and environment_id descriptions via WaitForEnvironmentToolConfig.
Supports the ent26 enterprise plan tier, including authentication, rate-limit payloads, cloud-config eligibility, and usage-limit guidance, and adds support for self-serve Business ProLite accounts.
On Windows, non-TTY processes are now terminated on interrupt, with Ctrl-C routed through the termination callback for pipe-backed processes, and Windows namespace paths in path URIs are normalized.
Operators can disable the update_plan tool via configuration, and can disable the multi-agent wait tool, giving control over multi-agent coordination primitives.
Loads cloud-managed profiles for codex sandbox, allowing centrally managed sandbox permission profiles and requirements to be sourced from cloud config bundles rather than local config.
Adds MCP 2026-07-28 discovery support and completes MCP 2026 client support, enabling Codex to use the latest Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. spec.
Model catalog entries can now supply default token-budget settings that apply automatically when no explicit token-budget configuration is set.
Adds configurable developer instructions for v2 subagents, allowing per-subagent instruction customization in multi-agent workflows.
Discovers executor-provided skills and securely reads their associated resources, including explicitly selected skills, exposing them through skill tools.
Supports incremental replay of updated thread items and enforces writer ownership for thread archive and deletion operations.
Tags turn reports with the selected turn's model and effort level.
Preserves output from hooks that exit before reading stdin, so fast-exiting hooks no longer lose stdout.
Exposes remote skill icon URLs through the app server, and exposes Browser Use requirements through the app server.
Loads thread titles concurrently during session startup, improving startup responsiveness.
Adds persisted sections for organizing threads in session history.
Routes WebRTCWebRTCA browser-native, open standard for real-time peer-to-peer audio, video, and data exchange without plugins. Cyber tools use it to tunnel traffic or exfiltrate data through connections browsers treat as legitimate. sideband joins to the Realtime API.
Supports plaintext collaboration tool messages.
Registers the Guardian V2 feature flag.
Edit and replay captured network traffic at arbitrary speeds — a suite of pcap tools for *NIX and Windows.
New AF_XDP and io_uring injection backends push replay to ~941 Mbps line rate on 1GigE hardware—a 23× improvement—while a new --loss flag simulates packet loss and the replay engine now installs as a standalone libtcpreplay static C library. Raw L3 injection for WireGuard/tun interfaces is also added.
tcpreplay 4.6.0 adds kernel-bypass and io_uring injection backends for much higher throughput, a raw-socket path for replaying onto L3-only interfaces, packet-loss simulation, a standalone static library, and a CMake build option.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
New --xdp injection backend reaches ~941 Mbps (305k pps) line rate on 1GigE hardware, a 23× improvement over the previous implementation. --xdp-queue binds the AF_XDPAF_XDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. socket to a specific adapter queue instead of always using queue 0, --xdp-no-fallback fails hard rather than silently falling back to the default injector (useful so a silent change doesn't invalidate benchmark results), and --xdp-batch-size tunes AF_XDP batch depth for very high-speed links (100GigE+) with small packets.
AF_XDP kernel-bypass backend; fall back automatically if the adapter lacks native XDPXDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. support.$ tcpreplay --xdp -i eth0 capture.pcap
AF_XDP on a specific queue without silent fallback masking results — fail loudly if XDP can't be used.$ tcpreplay --xdp --xdp-no-fallback --xdp-queue 2 -i eth0 capture.pcap
New --io-uring injection backend batches sends 64 deep via Linux io_uring, reducing per-packet syscall count 64× for roughly 11% less CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. per packet.
New --raw flag adds a PF_INET/SOCK_RAW injection path that routes packets through the kernel IP stack (routing, netfilter); it is IPv4-only and rebuilds L2 framing. This also enables replaying onto raw IP (L3-only) interfaces such as WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. and tun, which have no L2 header.
New --loss flag simulates random packet loss at a configurable percentage from 0-100%, enabling testing against non-ideal network conditions.
$ tcpreplay --loss 10 -i eth0 capture.pcap
Adds a CMake build system as an alternative to autotools, invoked via cmake -B build && cmake --build build, with full feature parity.
The replay engine is now installed as libtcpreplay, a standalone static C library.
ConductorOne is an identity governance and access management platform that automates user access reviews, provisioning, and deprovisioning across enterprise applications.
Assign an approval step in a request or review policy to the C1 AI agent, which evaluates each request against custom guidance with every decision attributed to a system identity and recorded as a reviewable, audit-logged conversation. Per-user authentication for external MCP servers, group/role access reviews, and self-service scoped API keys round out the release.
ConductorOne's headline addition this window lets policy authors delegate request and review steps to a configurable C1 AI agent with fully audited decisions, alongside access reviews that can now scope to groups and roles, queued provisioning for pre-created entitlements, per-user authentication for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and scoped personal API keys.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Policy authors can assign a workflow step in a request or review policy to the C1 AI agent, configuring agent mode (comment-only, full control, or policy-step changes), failure action (reassign or skip), and free-text approval instructions. The agent evaluates each request using built-in guidance plus the custom instructions, and every evaluation is attributed to the C1 System agent identity, labeled as an AI-agent action in the audit log, and recorded as a reviewable conversation under AI > Conversations.
Access review campaigns can now review grants held by groups or roles in addition to users, using a new Grant types selector (Users only, Resources only, or Users and resources) on the Scope tab. Campaign templates also support custom recurrence intervals (e.g., every two days, every three months) and configurable campaign durations, beyond the previous fixed presets.
Requests for entitlements created ahead of a connector sync (e.g., via Terraform) now queue and wait rather than fail, display a status reason, resume automatically after the next sync, and fall back to manual provisioning after 24 hours.
Tool enablement settings (require enablement or auto-enable) can now be configured per MCP server, independently of the tenant-wide AI governance default. Admins can register MCP servers that fail relaxable OAuth discovery checks (e.g., issuer mismatch, cross-host authorization server) by reviewing and acknowledging flagged findings. Hosted MCP servers without an admin-set tool prefix now default to the prefix declared by the connector itself, keeping tool names recognizable to AI clients.
Any user can now restrict a personal API key to a narrower role (e.g., read-only) using the Limit Scopes selector at key creation, without requiring Super Admin access.
Admins can now require per-user authentication (OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs., bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., custom header, or basic auth) for external MCP servers instead of sharing a single admin credential.
Request catalog search now includes an Entitlements matching section showing entitlements that indirectly grant access to a searched resource (e.g., a GitHub team whose repo permissions include the target repo), with a View access graph link showing the full grant chain.
C1 AI assistant reports now include a View lineage button showing the exact queries behind each number, verified against the execution log, and copyable for audit workpapers.
IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy documents on AWS resources now render as a readable, collapsible JSON tree via a View policy button on resource-level access reviews and in task details.
A new Retry failed provisioning action on access tasks lets admins retry connector provisioning in place without canceling the task and losing collected approvals.
C1 AI now renders multiple requested charts as an aligned grid with individual export and source links, and can respond with composed reports combining stat cards, a trend chart, and a data table in one response.
C1 groups can now be added to a request catalog or access profile, making group membership requestable through the standard approval, duration, and revocation flows.
A new Generate action in the CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine. editor converts a plain-English description directly into a CEL condition expression in one step, without requiring iterative AI chat.
Step-up (MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.) approvals that also require a comment now prompt for identity-provider verification in a single flow and complete once verified.
Where each pick stands · Jul 24–30
Tools with changes in each pick's category over the last 12 weeks, including the pick itself.
Each pick's release rhythm · Jul 24–30
Changes per week for the last 12 weeks. The bright bar is this week; a dash marks a week with no daily.
Which categories moved · Jul 24–30
The thick bar is this week. The thin bar is the average of the four weeks before, counting only weeks with a daily.
Who shipped the most · Jul 24–30
Changes per tool this week. Volume is not a quality score.