The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Nuclei v3.10.0 adds per-host HTTP client pooling for improved scan throughput and connection efficiency.
└──▷ GET THIS VERSION
$ git clone --branch v3.10.0 https://github.com/projectdiscovery/nuclei.git
# already have the repo? check out this version:$ git checkout v3.10.0
Adds per-host HTTP client pooling, reducing connection overhead and improving parallelism when scanning many distinct hosts.
trufflehog discovers, classifies, and validates leaked credentials
TruffleHog v3.95.8 adds Octopus Deploy detection, Prometheus engine metrics, and a flag to drop unverified JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. results.
└──▷ GET THIS VERSION
$ git clone --branch v3.95.8 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.95.8
└──▷ TRY IT
Suppress noisy unverified JWT hits when scanning a repo where JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. are common but you only care about confirmed leaks.
Adds Prometheus metrics exposing engine channel depths/capacities, worker counts, and bytes/chunks/secrets found — enabling real-time observability of scan progress.
New --drop-unverified-jwt-results flag suppresses JWT detector results that are unverified with no verification errors, reducing noise in high-volume scans.
Azure SAS token detector now matches tokens regardless of query-parameter order and handles URL-encoded timestamps, catching tokens emitted by tools like Azure Storage Explorer that were previously missed.
Grafana detector updated to treat HTTP 401 responses as unverified (instead of verified), tightening classification of rotated/revoked tokens.
Cloudflare Blog is a publication sharing updates, technical insights, and announcements about Cloudflare's internet security, performance, and developer infrastructure products.
Cloudflare Monetization Gateway lets you charge any caller for any resource via x402x402A proposed HTTP payment protocol revival using status code 402, enabling machine-to-machine micropayments over HTTP so cyber tools can gate API access or resources behind automated, per-request cryptocurrency payments. stablecoin payments at the edge.
└──▷ HOW TO FIND IT
Gate a premium API route so any agent caller — with no prior account — must pay $0.01 per request before your origin is reached.
📍In the Cloudflare dashboard, go to Monetization Gateway › Payment Rules › Create Rule. Set the route expression to http.request.uri.path matches "/api/premium/*", verb to GET/POST, price to $0.01 USD (stablecoin), then Save and Deploy.
Monetize unauthenticated traffic by converting 401 responses into 402 Payment Required — no origin code changes needed.
📍In the Cloudflare dashboard, go to Monetization Gateway › Payment Rules › Create Rule. Enable Intercept HTTP 401 responses and set the 402 price and stablecoin asset. Callers that would have received 401 will instead receive a 402 with payment instructions.
New Cloudflare Monetization Gateway enables usage-based payment enforcement at the edge for web pages, datasets, APIs, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool calls — no origin billing system required.
Supports the x402 open protocol (HTTP 402 Payment Required), allowing agentic callers to discover price, pay in stablecoins, and receive access in a single HTTP round-trip with no prior account or API key.
Flexible payment rules API lets you gate specific REST verbs, routes (e.g., /api/premium/*), or unauthenticated callers with per-request pricing as low as fractions of a cent.
Variable pricing support enables charging different amounts based on task complexity — for example, up to $2 for compute-intensive requests like image generation.
Interceptor mode converts HTTP 401 Unauthorized responses from your origin into 402 Payment Required with pricing instructions, monetizing unauthenticated traffic without origin changes.
+4 moreshow less
Payment verification and enforcement runs across Cloudflare's 330+ city global network, keeping x402 handshakes low-latency and shielding origins from payment verification load.
Rules manageable as code via Cloudflare API and Terraform, making paid endpoints first-class infrastructure config.
Sellers can accumulate stablecoins (e.g., USDC, OUSD) and redeem them for fiat currency, with peer-to-peer settlement targeting sub-second finality.
Optional integration with Web Bot Auth allows combining verified agent identity with usage-based pricing in a single request.
Cloudflare launches AI search quality research program and Pay Per Use experiments to compensate content creators.
└──▷ HOW TO FIND IT
Express interest in the Ceramic.ai pay-per-query or You.com pay-per-content programs to start earning compensation when your content appears in AI search results.
📍Navigate to the Cloudflare interest form linked in the blog post (blog.cloudflare.com/making-ai-search-smarter/) and submit your details to opt in to the Ceramic or You.com compensation programs.
If you operate an answer engine and want to integrate Cloudflare's freshness/traffic signals to crawl smarter and reduce redundant fetches.
📍Contact aeo@cloudflare.com to join the crawl-quality research program as an answer engine partner.
Launches research program to share content-freshness and traffic signals with answer engines, enabling smarter crawling that skips unchanged pages and surfaces higher-quality content.
Introduces Pay Per Use model (evolving from Pay Per Crawl), letting AI companies pay content owners per query or per result rather than per crawl.
New partnership with Ceramic.ai enables a pay-per-query model where publishers are compensated each time their content appears in Ceramic search results.
New partnership with You.com enables on-demand, per-content payments by agents for specific premium content without upfront commitment.
Adds Answer Engine Optimization (AEO) reporting for participating publishers, showing top queries driving content appearances, specific snippets surfaced, average ranking position, and more.
Cloudflare launches granular AI traffic controls for all tiers, BotBase bot directory for Enterprise, and a new content-use signal in robots.txt.
└──▷ USE IT
Express a strict content-use preference in robots.txt so crawlers know they may index and link but must not store or reproduce content beyond excerpts.
ini
# robots.txt — manually authored or via Cloudflare managed robots.txt
User-agent: *
Content-Signal: search=yes,ai-train=no,use=reference
Allow: /
Allow only Search, SEO, and Ads Verification bots up to the reference content-use level — useful for a publisher that wants discoverability but no content reproduction.
📍In the Cloudflare dashboard, go to Security › Bots › Bot Management configuration card › BotBase, filter by classification (Search, SEO, Ads Verification), then set content use level to reference and block all other classifications.
Find a specific bot's detection ID in BotBase to target it precisely in a Security rule — useful when you want to allow one verified agent while blocking the rest of its category.
📍In the Cloudflare dashboard, go to Security › Bots › Bot Management configuration card › BotBase, search for the bot by name, copy its Detection ID, then reference that ID in a custom Security rule.
New per-category AI traffic controls — Search, Agent, and Training — available to all customers including Free tier, replacing the single Block AI Bots toggle.
New default enforcement (September 15, 2026): Training and Agent crawlers blocked by default on ad-serving pages for new domains; multi-purpose crawlers (e.g., Googlebot, BingBot) subject to the most restrictive applicable rule.
Introduces BotBase, a searchable database of all known bots and agents with taxonomy classification, detection IDs, and Security-rule integration — available to Enterprise Bot Management customers via the Bot Management configuration card.
New content use signal (use=) extends Content Signals in robots.txt with three levels — immediate, reference, and full — letting owners express how crawlers may store and reshare content.
Managed robots.txt now automatically includes use=reference alongside existing search=yes,ai-train=no Content Signals for all customers who have enabled it.
+3 moreshow less
Bot Management customers gain the ability to combine content-use levels with bot classifications (Search, Agent, Training, SEO, Ads Verification, etc.) to build nuanced allow/block rules without managing individual bots.
BotBase tracks content-use behavior per bot; verified bots that abuse content signals lose Verified status.
Expanded bot taxonomy now classifies bots with multiple simultaneous behaviors (e.g., a crawler that is both Search and Training) rather than a single primary label.
Cloudflare launches Attribution Business Insights dashboard for Bot Management customers to analyze AI crawler impact.
└──▷ HOW TO FIND IT
Check your site's crawl-to-referral ratio over the past 30 days to quantify how extractive a specific AI crawler is before entering a licensing conversation.
📍In the Cloudflare dashboard, go to Security › Bots › Attribution Business Insights, set the time range to 30 days, and review the crawl-to-referral ratio column in the per-bot-operator breakdown.
New Attribution Business Insights dashboard gives Bot Management customers a dedicated analytics hub for AI crawler and bot traffic, with no manual filtering required.
Adds site-wide and per-bot-operator crawl-to-referral ratio metrics, viewable across 24-hour, 7-day, and 30-day windows.
Introduces updated bot taxonomy that classifies AI crawlers as Training, Search, or Agent — going beyond a generic AI Crawler label.
Top bots breakdown surfaces each bot's country of origin, bandwidth consumption, and current allow/block status in a single view.
Per-operator breakdown consolidates all bots owned by a single AI company, enabling data-driven content licensing and business negotiations.
Wiz Blog is a cloud security publication that shares research, threat intelligence, best practices, and insights on vulnerabilities, compliance, and cloud infrastructure protection.
Wiz MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. is now generally available, connecting AI agents and assistants to the Wiz Security Graph, AI Agents, and reusable AI Skills.
└──▷ HOW TO FIND IT
Let an AI agent surface only exploitable vulnerabilities an attacker could chain to reach sensitive data — ranked by remediation priority rather than raw CVE severity.
📍Surface only the open vulnerabilities an attacker could realistically chain to reach sensitive data, explain the attack path for each, and rank them by what to remediate first.
Operationalize a penetration test report by importing it into Wiz, mapping findings to cloud assets, and creating tracked Penetration Test Findings — eliminating the static-report problem.
📍Import this penetration test report into Wiz, map findings to my environment, and create Penetration Test Findings.
Give a security leader an auditable compliance gap analysis by comparing an internal framework against existing Wiz policies and publishing results to a documentation tool.
📍Compare our internal security framework against existing Wiz policy coverage, identify the gaps, recommend custom rules to close them, and produce an auditable coverage summary.
Introduces Wiz MCP (general availability): a secure integration layer that connects AI assistants, custom agents, and AI-powered applications to the Wiz platform.
Enables AI to query and reason over the Wiz Security Graph — including findings, issues, vulnerabilities, attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., identities, cloud infrastructure, code, data, and runtime relationships.
Exposes Wiz AI Agents (Red, Blue, and Green) through MCP so external AI can consume agent analyses and recommendations without recreating the same reasoning.
Provides access to Wiz AI Skills — predefined, reusable agentic playbooks for vulnerability triage, remediation, threat investigation, compliance mapping, and more.
Supports an Import Security Reports Skill that extracts findings from external penetration test reports, maps them to cloud resources, and creates Penetration Test Findings in Wiz.
+3 moreshow less
Supports a Custom Compliance Mapping Skill that maps internal security frameworks against existing Wiz policies, identifies gaps, recommends custom rules, and generates auditable coverage summaries.
Enables Green Agent–driven code-to-cloud remediation from the IDE: traces Wiz Issues to responsible repositories, generates fixes, and opens pull requests.
Enables Blue Agent–powered SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows: correlates threats with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. data, builds investigation timelines, and creates remediation tickets with documented findings.
8 details in Everything
1 more release in this issue
· 2026-06-30 → 2026-07-02
Wiz adds Secure Architecture Opportunities, WizOS Migration Skill, and Green Agent WizOS remediation to accelerate container hardening.
└──▷ HOW TO FIND IT
Find which container image types carry the most CVE risk and get a prioritized migration plan before touching any Dockerfiles.
📍In the Wiz console, go to Findings › Secure Architecture Opportunities, filter by image type (e.g., Python, nginx), and review the associated vulnerabilities, security issues, and estimated effort score to pick your highest-impact migration target.
Patch a critical container CVE without leaving your AI coding agent — let the WizOS Migration Skill swap the base image automatically.
📍In your AI coding agent, invoke the WizOS Migration Skill against your Dockerfile; the skill identifies the appropriate WizOS replacement image and applies the base-image swap directly in the file.
Accelerate MTTR on a critical container finding by routing a WizOS fix straight to an engineering issue with full context.
📍In a Wiz Green Agent remediation recommendation for a container image CVE, click Send to Coding Agent — Wiz opens a repository issue, tags your AI coding agent, and passes the specific WizOS image and migration context for automated resolution.
New Secure Architecture Opportunities page (public preview) in Wiz Findings groups WizOS migration candidates by image type (e.g., Python, nginx) with associated CVEs, related issues, and estimated migration effort for risk-ordered prioritization.
New WizOS Migration Skill for AI coding agents surfaces the correct WizOS replacement image from Dockerfile context and can apply the base-image swap directly within the development environment.
Wiz Green Agent now includes WizOS image recommendations in remediation guidance for container CVEs, with a Send to Coding Agent action that automatically opens a repo issue and passes full context to the coding agent for hands-off migration.
eksctl v0.229.0 adds cluster version rollback support and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instance store for EKS on Outposts.
└──▷ GET THIS VERSION
$ git clone --branch v0.229.0 https://github.com/eksctl-io/eksctl.git
# already have the repo? check out this version:$ git checkout v0.229.0
└──▷ TRY IT
Roll back a cluster to a previous Kubernetes version after a failed upgrade by declaring rollback behaviour in your ClusterConfig.
$ eksctl upgrade cluster -f cluster-rollback.yaml
Adds cluster version rollback support via rollbackConfig in the ClusterConfig spec.
Adds EC2 instance store support for EKS on Outposts node groups.
CrowdStrike Blog is a cybersecurity publication sharing threat intelligence, research, and insights on adversaries, vulnerabilities, and endpoint protection best practices.
Falcon Cloud Security June 2026 expands real-time CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps., Cloud Risks, DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores., and CIEM to Azure and Google Cloud.
Extends real-time CSPM to Google Cloud, surfacing new assets, misconfigurations, and cloud risks within minutes of introduction — matching existing AWS and Azure coverage.
Expands correlated Cloud Risks breach-path detection to Azure and Google Cloud, previously limited to AWS environments.
Adds adversary-informed risk prioritization to Azure and Google Cloud, mapping known adversary activity to cloud attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. across all three major cloud providers.
Introduces DSPM for Google Cloud Storage, enabling agentless discovery, sensitive data classification, and exposure identification alongside existing AWS and Azure DSPM coverage.
Adds CIEM for Azure, allowing security teams to analyze permissions, understand effective access, and identify excessive entitlements across AWS and Azure using a unified workflow.
+1 moreshow less
Extends container image assessment to Windows container workloads, building on existing Linux container image assessment capabilities.
Microsoft Security provides comprehensive cybersecurity solutions, tools, and threat intelligence to help organizations protect identities, data, endpoints, and cloud environments from cyberattacks.
Microsoft Security June 2026: AI agent protection, multicloud DB coverage, Entra backup GA, and unified identity risk scoring.
Introduces Codename MDASH (private preview): a multi-model agentic scanning system that discovers, validates, and routes software vulnerabilities into Defender workflows and engineering pipelines for closed-loop remediation.
Expands Microsoft Defender endpoint protection to discover 25+ types of local AI agents and Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) servers on managed Windows and macOS devices, with runtime prompt-injectionprompt-injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. detection and blocking for coding agents such as GitHub Copilot CLI and Claude Code.
Adds Advanced Hunting support for investigating AI agent exposure across an environment (preview).
Extends Microsoft Defender for Cloud database threat protection (GA) to open-source relational databases on AWS RDS, adding anomalous-access and brute-force detection alongside automated sensitive data discovery.
Ships Microsoft Purview customizable reports (GA) in Data Security PostureData Security PostureAn organisation's overall state of readiness to protect data, covering where sensitive data lives, who can reach it, and whether controls are correctly applied — giving cyber tools a continuous risk baseline to act on. Management (DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.), enabling role-specific, exportable report views with out-of-the-box and custom report creation for data security trend analysis.
+2 moreshow less
Broadens Defender for Cloud multicloud coverage with approximately 90 additional AWS and Google Cloud resource types and 200+ new security recommendations spanning cloud-native apps, identities, data services, and workloads.
Introduces a unified identity risk score that aggregates behavior, access patterns, and threat intelligence across accounts, sessions, and applications into a single explainable signal, with automatic Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. policy enforcement triggers.
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Claude Code v2.1.198 adds Chrome GA, automated draft PRs from background agents, /dataviz skill, and AWS gateway support.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.198 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:$ git checkout v2.1.198
└──▷ TRY IT
Get notified in your hook handler when a background agent needs input or completes, so you can automate follow-up actions.
$ # In your Notification hook handler, inspect the event type:
# agent_needs_input — agent is waiting for a response
# agent_completed — agent finished its work
claude agents
Use the new /dataviz skill inside a session to get chart design guidance and validate color palettes for dashboards.
$ /dataviz
Launches Claude in Chrome as generally available.
Adds agent_needs_input and agent_completed Notification hook events in claude agents so background sessions fire alerts when they need input or finish.
New /dataviz skill provides chart and dashboard design guidance with a runnable color-palette validator.
Adds Claude Platform on AWS (anthropicAws) as a gateway upstream provider; model-not-found responses now advance the failover chain instead of failing hard.
Background agents launched from claude agents now automatically commit, push, and open a draft PR when they finish code work in a worktree.
+4 moreshow less
Built-in Explore agent now inherits the main session's model (capped at opus) instead of always running on haiku.
Subagents and context compactioncontext compactionCondensing an AI conversation or working history to free space in the model's context window. A summary preserves useful information, but details can be lost. now inherit the session's extended thinkingextended thinkingIntermediate reasoning a model writes out before its final answer. Reasoning models generate it automatically and it is often billed as extra output tokens. configuration, improving output quality on delegated tasks.
Removes the /agents wizard; subagents are now created by asking Claude directly or editing .claude/agents/.
Subagents now treat messages from their launching agent as normal task direction (never as user approval), clarifying the trust model.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!The --bg flag combined with --print/-p is now rejected up front instead of silently creating an unattachable session.
!The /agents wizard has been removed; subagents must now be created by asking Claude or by editing .claude/agents/ directly.
2 more releases in this issue
· 2026-06-29 → 2026-07-01
Claude Code now defaults to Claude Sonnet 5 with a native 1M-token context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it. and promotional pricing through August 31.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.197 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:$ git checkout v2.1.197
Switches default model to Claude Sonnet 5, featuring a native 1M-token context window for working across very large codebases in a single session.
Introduces promotional pricing of $2/$10 per million input/output tokens for Claude Sonnet 5 through August 31.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Claude Sonnet 5 is now the default model in Claude Code, replacing the previously default model
Claude Code v2.1.196 adds org-default models, clickable file attachments, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. security hardening, and an always-on stream watchdog.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.196 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:$ git checkout v2.1.196
└──▷ TRY IT
Inspect which MCP servers are approved before trusting a cloned repo — untrusted servers now show as pending instead of silently starting.
$ claude mcp list
Adds organization default model support — admins configure it in the org console and users see Org default or Role default in /model when no personal selection is made.
Adds readable auto-generated names for sessions at startup, making sessions easier to identify and reference.
Adds clickable file attachments in chat — Cmd/Ctrl-click a file to reveal it in Finder/Explorer.
Security hardening: claude mcp list/get no longer auto-spawn MCP servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces now show a ⏸ Pending approval indicator instead.
Enables the streaming idle watchdog by default for all providers — aborts and retries any response stream that produces no events for 5 minutes; set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to opt out.
+4 moreshow less
Disables Remote Control when ANTHROPIC_BASE_URL points at a non-Anthropic host, consistent with existing Bedrock/Vertex/Foundry behavior.
Simplifies agents view navigation from a foreground session — now requires a single ← press instead of two.
Improves /code-review workflow by consolidating five cleanup finders into one, cutting token usage by ~25%.
Improves background agent resilience — workers killed by a daemon restart auto-resume from their last state when the agents view next opens.
Lightweight coding agent that runs in your terminal
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.143.0-alpha.33 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.143.0-alpha.33
Surfaces rollout/session budget exhaustion to the user instead of silently aborting.
Enables image generation when using provider-based authentication.
Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool call error metrics for tracking MCP tool failures.
Traces MCP startup latency in OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. for diagnosing slow MCP server initialization.
Instruments rollout persistence bytes for observability into context-window compaction.
0 more releases in this issue2 more releases in this issue · 2026-06-29 → 2026-07-02
$ git clone --branch rust-v0.143.0-alpha.32 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.143.0-alpha.32
Enables image generation when using provider-based authentication (not just API-key flows).
Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool call error metrics for observability into MCP tool failures.
Traces MCP startup latency via OTELOTELAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. for diagnosing slow MCP server initialization.
Remote plugins enabled by default and max reasoning effort promoted to first-class in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. picker.
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.143.0-alpha.31 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.143.0-alpha.31
Enables remote plugins by default — no configuration required; set features.remote_plugin to false to opt out.
Promotes max to a first-class reasoning effort level, rendering it as a productized Max label in the TUI reasoning picker (relevant for AWS Bedrock GPT-5.6 catalog users).
Uses model metadata (include_skills_usage_instructions) to drive skills usage instructions, enabling per-model skill rendering control starting with gpt-5.5.
Autonomous coding agent as an SDK, IDE extension, or CLI assistant.
Cline v4.0.5 adds Claude Sonnet 5 support across Anthropic, Bedrock, Vertex, Claude Code, SAP AI Core, OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code., and Vercel AI Gateway.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.5 https://github.com/cline/cline.git
# already have the repo? check out this version:$ git checkout v4.0.5
Adds Claude Sonnet 5 (including 1M-context variant) to the model picker across Anthropic, Bedrock, Vertex, Claude Code, SAP AI Core, OpenRouter, and Vercel AI Gateway providers.
Sets Claude Sonnet 5 as the new default/recommended model for providers where Sonnet is the default path (Anthropic, Claude Code, Bedrock, OpenRouter/Cline defaults).
an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM
Goose v1.40.0 adds 13+ new AI providers, hooks system with tool-use denial, local code review, new CLI slash commands, and prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. mitigation.
└──▷ GET THIS VERSION
$ git clone --branch v1.40.0 https://github.com/aaif-goose/goose.git
# already have the repo? check out this version:$ git checkout v1.40.0
└──▷ TRY IT
Cap how much output a noisy tool can return so long responses don't blow the context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it..
$ GOOSE_MAX_TOOL_RESPONSE_SIZE=32768 goose run --recipe audit.yaml
Run an AI-powered local code review on the current working directory before opening a pull request.
$ goose review
New /status slash command in the CLI to check session state at a glance.
New goose review subcommand for running local AI-powered code review.
Adds a hooks system for extensibility, including PreToolUse denial to block tool calls before execution and blocking Stop hook decisions.
Prompt injection mitigation enabled by default.
Supports 13+ new model providers: Together AI, EmpirioLabs, OrcaRouter, NEAR AI Cloud, Perplexity, Alibaba/Qwen via DashScope, Databricks AI Gateway, Scaleway, Vercel AI Gateway, xAI SuperGrok OAuth, OpenAI GPT via AWS Bedrock mantle endpoint, GLM-5.2, and MLXMLXApple's machine-learning framework for Apple silicon, which uses the unified memory shared by CPU and GPU to run and fine-tune models on a Mac. models for local inference.
+11 moreshow less
New GOOSE_FAST_MODEL environment variable to designate a fast model for lightweight operations.
Unified thinking effort control and canonical thinking modes across all supported providers.
Cache token tracking for accurate per-session cost reporting.
Encrypted Nostr session sharing.
Peek mode for async background tasks in summon, plus context parameter and working_dir override for delegate tasks.
New TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. subcommand (goose-cli tui) with built-in diff viewer.
Chat history search in the desktop navigation panel.
Session import and deep links (goose://new-session, goose://resume) including initial prompt support.
Image read tool for ingesting local images.
Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. support in the deeplink generator.
Linux musl CLI builds for broader Linux compatibility.
Desktop app gains per-window tab scoping, searchable model picker, session tab hover previews, and streamlined WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. setup.
└──▷ GET THIS VERSION
$ git clone --branch v1.17.13 https://github.com/anomalyco/opencode.git
# already have the repo? check out this version:$ git checkout v1.17.13
Adds searchable v2 model picker and model management flow in the composer for easier model switching.
Adds hover preview for session tabs showing the project, path, branch, and server at a glance.
Streamlines WSL server setup with clearer distro checks and guided install flows.
3 details in Everything
1 more release in this issue
· 2026-06-30 → 2026-07-01
OpenCode v1.17.12 adds yolo auto-approve mode, live SDK event streams, paged session history, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. resource autocomplete.
└──▷ GET THIS VERSION
$ git clone --branch v1.17.12 https://github.com/anomalyco/opencode.git
# already have the repo? check out this version:$ git checkout v1.17.12
Adds yolo mode to the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. that auto-approves all permission prompts without manual confirmation.
Adds a live event subscription stream to the SDK for real-time session monitoring.
Adds SDK access to active sessions.
Adds paged durable session history via a new API endpoint.
Adds session permission request create and fetch endpoints to the SDK/API.
+4 moreshow less
Autocompletes MCP resources directly in the Desktop composer.
Adds workspace controls when starting a new session in the Desktop app.
Shows stored token and cost totals in the Desktop session context.
Cursor is an AI-powered code editor that helps developers write, edit, and understand code faster using integrated large language model assistance.
Cursor team marketplaces now support centrally managed Team MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers and org-group access controls.
└──▷ HOW TO FIND IT
Centrally publish approved MCP servers so team members can install them locally without configuring servers themselves.
📍In the Cursor dashboard, go to Dashboard -> Integrations & MCP, configure your Team MCP servers, then enable them in the team marketplace so members can install from the marketplace.
Restrict a team marketplace to a specific organization group rather than the entire team or a SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. directory group.
📍In the Cursor dashboard, go to Dashboard -> Plugins -> Team Marketplaces, select the marketplace, and restrict access to the desired organization group.
Enables admins to configure Team MCP servers once and distribute them to cloud agents, the agents window, IDE, and CLI via a team marketplace — members install approved integrations locally without manual server setup.
Adds organization group support for team marketplace access control, letting admins restrict marketplace visibility to specific org groups (in addition to existing SCIM directory groups).
Windsurf is an AI-powered IDE and coding assistant that helps developers write, edit, and debug code faster using intelligent suggestions and automation.
Windsurf snapshot-20260702 covers v3.3.18: ACU usage display, configurable subagent models, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry pre-warming, and commit attribution control.
└──▷ USE IT
Suppress Devin attribution in commit messages — useful when org policy requires clean, tool-agnostic commit history.
yaml
# In your Devin Local config file
attribution: false
Enables configuring subagents with a default model, giving teams control over model selection per agent role.
Kiro is an AI-powered IDE by AWS that uses "specs" to translate requirements into structured plans, then automatically generates and implements code.
Kiro adds AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role assumption for sandboxes and a standardized OAuth flow for third-party service Powers.
└──▷ HOW TO FIND IT
Grant Kiro's sandbox scoped AWS access so agent tasks and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers can call AWS APIs without long-lived keys.
📍In the console, go to Settings › Agent › Sandbox › AWS Credentials and configure the IAM role Kiro Web should assume.
Authorize a third-party service (e.g., Stripe or Figma) once so the agent can use it across all future tasks without re-prompting.
📍In the console, go to Settings › Agent › Manage Powers, select the desired Power, and complete the authorization flow.
New IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role for Sandbox: configure a role that Kiro Web assumes to supply the agent, CLI tools, and MCP servers with auto-refreshing, short-lived AWS credentials during task execution.
New Authorize Powers flow: connect third-party services (Figma, Stripe, Supabase, etc.) once via a standard authorization flow in Agent settings; tokens are encrypted at rest and never exposed to the sandbox or agent.
Instant revocation: disconnecting a Power immediately revokes access to the linked third-party service.
Claude Sonnet 5 is now available in Kiro IDE, CLI, and Web with 1M context and stronger agentic reasoning.
└──▷ HOW TO FIND IT
Switch to Claude Sonnet 5 in the Kiro IDE or CLI to leverage its stronger agentic coding and longer autonomous runs.
📍Restart your IDE or CLI, then open the model selector and choose Claude Sonnet 5.
Adds Claude Sonnet 5 to Kiro IDE, CLI, and Web — Anthropic's most agentic Sonnet model with stronger reasoning, tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions., and coding performance approaching Opus 4.8.
Supports full 1M token context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it. at a 1.3× credit multiplier, matching Sonnet 4.6 pricing.
Available to Kiro Pro, Pro+, Pro Max, and Power customers in AWS US-East-1 (N. Virginia) and AWS Europe (Frankfurt) with cross-region inference support.
Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.
CrewAI 1.15.2a1 adds inline skill definitions, a stream frame protocol for Flows, and new tool/app types in CrewDefinition.
└──▷ GET THIS VERSION
$ git clone --branch 1.15.2a1 https://github.com/crewAIInc/crewAI.git
# already have the repo? check out this version:$ git checkout 1.15.2a1
Supports inline skill definitions, enabling skills to be declared directly within agent or crew configurations without separate files.
Introduces a stream frame protocol for Flows, defining a structured message format for streaming Flow execution events.
Adds tool and app type options to CrewDefinition, expanding the kinds of crew artifacts that can be declared.
Adds a generated Flow Definition authoring skill for AI coding agents, guiding them when scaffolding or editing Flow definitions.
Get up and running with Kimi-K2.6, GLM-5.1, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
Gemma 4 on Apple Silicon gets ~90% faster token generation via automatic multi-token prediction (MTP), no config required.
└──▷ GET THIS VERSION
$ git clone --branch v0.31.1 https://github.com/ollama/ollama.git
# already have the repo? check out this version:$ git checkout v0.31.1
Enables automatic multi-token prediction (MTP) for Gemma 4 on Apple Silicon, delivering ~90% faster token generation on coding-agent workloads with no configuration or output changes.
Adds minimum-version enforcement for ollama launch hermes-desktop, automatically upgrading older Hermes CLI installs (v0.16.0+ required) instead of failing silently.
Improves streamed tool-call parsing so closing braces or brackets inside JSON string argument values no longer cause tool calls to be silently dropped as plain text.
THE CYBER TOOLCHAIN