The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
Portkey is an AI gateway and observability platform that helps developers manage, monitor, and optimize LLM API calls with routing, caching, and reliability features.
Portkey adds vault-backed credentials, weekly rate limits, cross-cloud GCS logging, and four new guardrail integrations in March 2026.
└──▷ HOW TO FIND IT
Pull API keys from your own vault at request time instead of storing them in Portkey — critical for orgs with strict secrets governance.
📍In the Portkey console, go to your Virtual Key or Integration settings and add a secret_mappings block pointing to your AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault path. Portkey will resolve the credential at runtime.
Cap a team's weekly LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. spend and keep chat completions under a separate limit from embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. calls.
📍In the Portkey console, open Budget & Rate Limit Policies, set a rpw (requests-per-week) budget window for the relevant virtual key or config, then add an endpoint-scoped limit targeting the chat completions route independently from embeddings.
Route Bedrock guardrail evaluation to a private regional endpoint instead of the default public Bedrock URL.
📍In the Portkey console, open the Bedrock guardrail plugin configuration and set customHost to your private or regional Bedrock-compatible endpoint URL.
Introduces weekly rate and budget windows (rpw) so spend caps align with team planning cycles, not just per-minute or monthly aggregates.
Adds endpoint-scoped rate limits so chat completions, embeddings, and admin routes can each carry independent limits instead of a single global rule.
Enables GCP Workload Identity Federation log storage (gcs_assume) from AWS-hosted gateways via GCP_WIF_AUDIENCE and GCP_WIF_SERVICE_ACCOUNT_EMAIL, eliminating static GCP keys in AWS.
Allows organization admins to include archived workspaces in analytics graphs and filters; saved filters now also accept workspace slugs alongside IDs.
Integrates Zscaler AI Guard as a guardrails partner, applying Zscaler Detection Policies to LLM inputs and outputs via beforeRequestHook/afterRequestHook with a required policyId.
+6 moreshow less
Integrates Akto Agentic Security as a guardrails partner to scan LLM traffic for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. and sensitive data leakage via configurable hooks and timeout.
Adds required metadata key–value guardrails that block requests missing or carrying invalid metadata fields before they reach the model.
Supports DeepInfra tool callingtool callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. (tools, tool_choice, parallel_tool_calls) plus completions and embeddings endpoints.
Adds DeepSeek deepseek-chat tool calling (tools, tool_choice, stream_options) and deepseek-reasoner reasoning effort mapping with reasoning_content in streams.
Extends Bedrock batch inference to support embeddings in addition to chat completions.
Adds Azure AI Foundry rerank support for Cohere rerank models (e.g., cohere.Cohere-rerank-v4.0-pro), with the gateway stripping the cohere. prefix for the provider.
Cloudflare is a cloud-based platform that provides website performance optimization, DDoS protection, CDN services, and application security to safeguard and accelerate internet traffic.
Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds new SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., LFI, XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. obfuscation, Adobe ColdFusion, and WordPress rules plus generic RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives./Auth Bypass/Info Disclosure detections.
Adds two new SSRF detection rules blocking restricted-protocol and obfuscated-host request forgery attempts.
Adds a new LFI path traversal detection rule to the Cloudflare Managed Ruleset.
Adds three new XSS rules targeting JavaScript bracket-concatenation obfuscation across body, headers, and URI.
Adds targeted blocking rules for Adobe ColdFusion file-upload path traversal (CVE-2026-48276) and directory-sequence path traversal (CVE-2026-48282).
Adds blocking rules for WordPress unauthenticated SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. (CVE-2026-60137) in both the Cloudflare Managed and Free Rulesets.
+2 moreshow less
Adds blocking rules for WordPress remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. (CVE-2026-63030) in both the Cloudflare Managed and Free Rulesets.
Deploys new emergency detection rules for Generic Rules - Unauthenticated RCE, Generic Rules - Auth Bypass - 2, and Generic Rules - Information Disclosure.
Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds three new/improved managed rules for SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. obfuscation, and generic DoS detection.
New detection rule for Command Injection - Obfuscation (rule ID ...761e7a4c), deploying in Log mode on 2026-07-27.
New detection rule for Generic Rules - DoS (rule ID ...90dcdb0a), deploying in Log mode on 2026-07-27.
Improved SSRF - Cloud - Beta detection rule (rule ID ...c2e84e2d), deploying in Log mode on 2026-07-27.
GitGuardian SaaS is a secrets detection platform that scans code repositories and developer workflows to identify and remediate exposed credentials and sensitive data.
GitGuardian adds @mention notifications in incident notes, source health for new integrations, and oversized PR scanning on Business plan.
└──▷ HOW TO FIND IT
Loop in a teammate or an entire team on a critical incident without leaving GitGuardian.
📍In the console, open any incident › add a note or feedback › type @ and select a member (@name) or team (@team-name) from the searchable list. The mentioned users receive an email linking directly to the incident.
Filter the incident list to only incidents from active sources, setting aside noise from archived or deleted ones.
📍In the console, go to the Perimeter page or Incident list › open the source status filter › select Monitored (or exclude Archived / Deleted) › save as a view for reuse.
Reduce false positives on a Custom Source install by limiting scans to detectors that can verify secret validity.
📍In the console, go to the Custom Source install settings › enable 'use only detectors with validators' › save. Subsequent scans on that source will drop matches whose detector has no validator before the validity check runs.
Adds @mention support in incident notes and feedback — type @ to tag a member by @name or an entire team by @team-name, triggering email notifications that link directly to the incident.
Extends source health management (auto-pause, auto-resume, and recovery guidance) to ServiceNow, JFrog Container Registry, JFrog Package Registry, and Microsoft OneDrive sources.
Introduces per-source status indicators (Monitored, Unmonitored, Unreachable, Archived, Deleted) on the perimeter page and incident list, with filterability and saveable views.
Enables scanning of oversized pull requests (>200 commits, >60,000 files, or >300,000 lines changed) via repository cloning on the Business plan, bypassing GitHub API rate limits.
Adds opt-in 'use only detectors with validators' option for Custom Source (BYOS) installs, dropping unverifiable matches before validity checks to reduce noise.
EMBA v2.0.3 adds legacy SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS support to reach end-of-life devices modern OpenSSL can no longer connect to.
└──▷ GET THIS VERSION
$ git clone --branch v2.0.3-legacy-time https://github.com/e-m-b-a/emba.git
# already have the repo? check out this version:$ git checkout v2.0.3-legacy-time
Supports legacy SSL/TLS ciphers during live analysis, enabling vulnerability detection on old embedded devices that modern OpenSSL rejects.
Expands CSV log output across additional modules for richer machine-readable reporting.
Adds entropy file checking to aid detection of encrypted or compressed firmware regions.
dfvfs 20260717 switches to pyfsfat as the default FAT file-system back-end.
└──▷ GET THIS VERSION
$ git clone --branch 20260717 https://github.com/log2timeline/dfvfs.git
# already have the repo? check out this version:$ git checkout 20260717
Promotes pyfsfat to the default back-end for FAT file-system parsing, replacing the previous default.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
!pyfsfat is now the default FAT back-end; setups relying on the previous default FAT back-end behavior may see differences in FAT volume parsing on upgrade.
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Syft v1.49.0 adds support for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image index manifests in root OCI layouts.
└──▷ GET THIS VERSION
$ git clone --branch v1.49.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.49.0
Supports application/vnd.oci.image.index.v1+json manifests in root OCI layout directories, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation from multi-platform OCI index artifacts.
Trend Vision One is a unified cybersecurity platform that integrates extended detection and response (XDR) across endpoints, networks, email, and cloud environments.
File Password Analysis now covers all inbound security functions—spam, content filtering, and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.—not just virus scanning.
└──▷ HOW TO FIND IT
Enable File Password Analysis under your inbound policy so decrypted attachment content is automatically scanned by spam filtering, content filtering, and DLP—closing the gap attackers exploit with encrypted attachments.
📍In the console, go to Email and Collaboration Security → Cloud Email Gateway Protection → Inbound Protection, then enable File Password Analysis in your inbound policy.
3 more releases in this issue
· 2026-07-16 → 2026-07-21
Agentless Vulnerability & Threat Detection now supports AWS eu-south-2 (Spain) region for scanning and VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Log detections.
└──▷ HOW TO FIND IT
Enable coverage for the new Spain region by updating your existing CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stack via Cloud Accounts settings — no redeployment required.
📍In the console, go to Cloud Security → Cloud Accounts → AWS and perform a stack update on your existing deployment to enable the eu-south-2 (Spain) region.
Supports deploying Agentless Vulnerability & Threat Detection in the AWS eu-south-2 (Spain) region.
Supports Cloud Detections for AWS VPC Flow Logs in the AWS eu-south-2 (Spain) region.
Zero Trust Secure Access on-premises gateway can now stamp user identity into the X-Authenticated-User header for upstream proxies.
└──▷ HOW TO FIND IT
Propagate authenticated user identity to an upstream proxy so it can enforce per-user policies or logging.
📍In the console, go to Zero Trust Secure Access → Secure Access Configuration → Internet Access and AI Secure Access Configuration and enable the option to pass user information to the upstream proxy.
Trend Vision One AI Scanner adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-driven agentic red-teaming that dynamically adapts attack prompts based on target AI app responses.
└──▷ HOW TO FIND IT
Configure and run an agentic attack scan to continuously validate AI application defenses against adaptive, LLM-driven attack sequences.
📍In the console, go to AI Security → AI Application Security → TrendAI Artifact Scanner, configure an agentic attack by defining your attack objective, then run it alongside your existing attack presets or custom prompts.
New agentic attacks capability in AI Scanner uses an LLM-driven attacker model that generates and iterates attack prompts dynamically based on target AI application responses, rather than a static prompt library.
Agentic attacks are configured through the TrendAI Artifact Scanner and can run alongside existing attack presets, attack objectives, and custom prompts in the same scan.
Enables continuous red-team validation of AI defenses — guardrails, system prompts, and model behavior — against evolving, adaptive adversarial techniques.
Automox is a cloud-native endpoint management platform that automates patching, configuration, and software deployment across Windows, macOS, and Linux devices.
Automox Policy Results Report gains Partial status, per-package failure reasons, and raw log side panel.
└──▷ HOW TO FIND IT
Spot runs that need attention after a patch cycle by filtering the Policy Results Report for Partial outcomes, then expanding a device row to see which package failed and why.
📍In the Policy Results Report, use the Results filter and select Partial to isolate mixed-outcome runs. Expand any device row to view per-package results and failure reasons. Click View Raw Logs on a failed package to open the full log in the side panel.
Adds Partial as a new policy run result status when some patches succeed and others encounter errors, replacing a single pass/fail outcome.
Adds per-package breakdowns in the device table for Successful, Failed, or Partial runs, showing plain-language failure reasons (e.g., The application is currently running, Pending system restart).
Raw logs for individual packages now open in a side panel via View Raw Logs, keeping detail accessible without cluttering the table.
Replaces the stacked bar chart and legend in the Results column with a direct count of each status, with definitions moved to filter tooltips.
Tines is a no-code automation platform that helps security and operations teams build workflows to automate repetitive tasks and incident response processes.
Tines extends change control to cover all case elements defined in the storyboard.
Tines lets you visually configure case creation and write rich-text descriptions directly in the storyboard editor.
└──▷ HOW TO FIND IT
When building a case-creation workflow, configure all case fields and format the description visually without leaving the storyboard.
📍In the storyboard, add a Create Case tile, then use the visual editor to define case fields and apply rich-text formatting to the description and block content.
Enables visual definition of all case fields when building with the create case tile in the storyboard.
Supports rich-text formatting for case descriptions and block content within the storyboard editor.
Qualys Patch Management is a cloud-based tool that automates the discovery, prioritization, and deployment of patches across IT assets to reduce vulnerabilities.
Qualys TruRisk Eliminate adds AI-Powered Patch Reliability Score and zero-touch automation for low-risk application patching.
└──▷ HOW TO FIND IT
Use Patch Now to immediately deploy patches for a specific CVE directly from the vulnerability finding in Qualys Patch Management.
📍In the Qualys Patch Management console, locate CVE-2026-8933 in the vulnerability list, then click Patch Now (to the right of the vulnerability) to add it to a patch job targeting vulnerable assets.
New AI-Powered Patch Reliability Score uses crowd-sourced signals from patch deployments across the internet to assess whether a patch is safe to deploy before rollout.
New zero-touch patch automation enables low-risk applications (e.g., browsers and standalone software) to receive patches automatically after a one-time job setup, with no manual intervention required.
Supports autonomous remediation workflow: high-reliability patches deploy with confidence while low-reliability patches are flagged for review, balancing speed and production safety.
Qualys VMDR is a cloud-based vulnerability management platform that continuously discovers, assesses, prioritizes, and remediates security vulnerabilities across IT assets.
Qualys VMDR adds QID coverage to detect CVE-2026-8933, a high-severity LPE in snap-confine on Ubuntu 24.04/25.10/26.04.
└──▷ HOW TO FIND IT
Search the Qualys Vulnerability Knowledgebase for the new QIDs to verify coverage and prioritize patching of affected Ubuntu systems.
📍In the Qualys VMDR console, go to Vulnerabilities › Knowledgebase and search for CVE-2026-8933 to retrieve the associated QIDs and confirmed detection status.
New QID detection(s) for CVE-2026-8933, a high-severity Local Privilege Escalation in snap-confine affecting default Ubuntu Desktop 24.04, 25.10, and 26.04 installations.
Intruder is a cloud-based vulnerability scanner that continuously monitors and identifies security weaknesses in internet-exposed systems, APIs, and web applications.
Intruder now surfaces Microsoft 365 configuration risks across Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Exchange Online, SharePoint, and Teams within Azure cloud scans.
└──▷ HOW TO FIND IT
Unlock full M365 security coverage by updating your existing Azure integration's permissions in the Intruder console.
📍In the console, go to your Azure integration settings and update the integration's permissions following the steps outlined in the M365 setup guide to enable the full set of Microsoft 365 checks.
Adds Microsoft 365 configuration security checks covering Entra ID, Exchange Online, SharePoint, and Teams as part of existing Azure cloud security scans.
Automatically runs a subset of M365 checks with existing Azure integrations, with full coverage unlocked by updating integration permissions.
Censys is an internet intelligence platform that continuously scans and indexes internet-connected devices, helping security teams discover and monitor exposed assets and vulnerabilities.
Censys adds Argo CD scanner, three AI tool fingerprints, and three Microsoft SharePoint RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. risks to ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them..
└──▷ TRY IT
Identify Microsoft SharePoint servers at risk of unauthenticated RCE (CVE-2026-50522) in your ASM workspace.
$ risks.name: "Vulnerable Microsoft SharePoint Server [CVE-2026-50522]"
Surface SharePoint servers flagged for the CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal.-listed authenticated deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. RCE (CVE-2026-45659) across your inventory.
$ risks.name: "Microsoft SharePoint Server Authenticated Deserialization RCE [CVE-2026-45659]"
Adds new endpoint scanner for Argo CD (ARGOCD), available to Starter, Search, and Core users.
Adds fingerprints for three AI/no-code tools: Anything LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., Capacity, and Softr.
Adds three new ASM risks for Microsoft SharePoint Server covering CVE-2026-45659 (authenticated deserialization RCE, CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-listed), CVE-2026-50522, and CVE-2026-58644 (both unauthenticated deserialization RCE).
Publishes Censys ARC Rapid Response advisory for Microsoft SharePoint Server RCE [CVE-2026-50522, CVE-2026-58644] with platform, ASM, and legacy search queries to identify exposed instances.
Axonius is a cybersecurity asset management platform that discovers, inventories, and manages all devices, users, and cloud assets across an organization's IT environment.
Axonius 9.0.1 adds 5 new adapters, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. advanced role/scope mapping, custom compliance values, and dozens of adapter enhancements.
└──▷ HOW TO FIND IT
Assign roles from one SAML attribute (e.g., group membership) and data scopes from another (e.g., department) for fine-grained SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access control.
📍In the console, go to Settings › Access Settings › SAML, enable Advanced Mapping, then configure the Role mapping table with your group-membership claim and the Data Scope mapping table with your department claim.
Override Axonius default compliance benchmarks with your organization's own thresholds for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application settings.
📍In the console, go to SaaS Applications › Settings, locate the setting to customize, and set a Custom Setting Recommended Value to define your compliance standard.
Give all dashboard viewers a consistent default filter view without overriding individual saved preferences.
📍In the console, open a Dashboard, click Saved Filters, hover over the target filter, click the 3-dot menu, and select Set as Default.
New Bold Security adapter: inventories endpoints, agent status, and browser extension protection.
New EasyDNS adapter: fetches domain registrations, zone management, and DNS record configurations.
New Google Threat Intelligence ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. adapter: discovers internet-facing assets including domains, networks, network services, and aggregated security findings.
New Lenovo Device Orchestration adapter: fetches devices and users with AI-driven fleet health, hardware diagnostics, and warranty data.
New One Identity Safeguard adapter: fetches managed devices with privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. context including credential vaulting and session monitoring.
+34 moreshow less
SAML Advanced Mapping now supports independent role and data scope assignment via separate mapping tables, each matched to a different SAML claim.
Users can define Custom Setting Recommended Values for SaaS application compliance, overriding Axonius defaults with organization-specific standards.
Dashboard Saved Filters: users with Edit Dashboard permissions can now set a saved filter as the system default for a dashboard.
Abnormal Security adapter now fetches SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. tokens as a new Secrets data source for inventorying API tokens.
Archer IRMIRMInsider Risk Management: a discipline focused on detecting and responding to threats from employees or contractors with legitimate access, giving cyber tools behavioral analytics and policy-enforcement hooks for internal actors. adapter adds support for fetching Application Settings (password policies, session timeouts, lockout policies) via a new Fetch Application Settings advanced setting.
Arnica.io adapter adds severity-level filtering for findings (critical, high, medium, low, info, unknown) to improve query performance.
Check Point Infinity adapter enriches firewall policies with associated threat profiles and mitigated CVEs when threat profile fetching is enabled.
Cisco Meraki adapter enables custom parsing support for devices.
Cisco Secure Access adapter is now available in the Agent Coverage Workspace for tracking agent deployments and coverage gaps.
Cisco Webex adapter now fetches Activities as a new asset type, with optional role information and OAuth authorization enrichment for users.
Cloudflare Zero Trust adapter now fetches tunnel connections as Network Services.
CrowdStrike Falcon adapter now fetches AWS ECSAWS ECSAmazon's managed container orchestration service that runs Docker containers on clusters of EC2 instances or Fargate, letting tools offload scheduling, scaling, and infrastructure management to AWS. Fargate assets as Serverless Functions.
CyberArk Endpoint Privilege Manager adapter adds support for Software assets and fetching installed programs.
CyberArk Idaptive adapter adds a new advanced setting to control whether device entities are fetched during discovery.
CyberArk Privileged Account Security adapter adds a Parse Device from User Account advanced setting to create devices from account address domain values.
Duo Beyond adapter now fetches application-level account settings including MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements, password policies, and lockout thresholds.
Freshdesk adapter now fetches Tickets.
GitHub adapter adds options to fetch SSH keys as Secrets and repository last login per user.
Jamf Pro adapter adds an option to fetch device compliance information from Jamf's Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. API.
Jira Service Management adapter adds support for Groups and URLs entity types from Jira Insight.
Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. adapter adds the option to fetch printers as Devices.
Microsoft Defender for Endpoint adapter adds detailed vulnerability information fields (summary, impact, remediation) and changes the default for vulnerability aggregation to True.
NodeZero adapter adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. fields, network services data per pentest endpoint, and Active Directory password audit findings.
Observium adapter now fetches Network Devices.
Oracle Cloud adapter adds support for fetching Vaults, Vault Secrets, Keys, and Volume Backup Policies via the generic adapter engine.
Qualys Cloud Platform adapter adds a new advanced setting to fetch software install paths via the CSAM API.
Rapid7 Nexpose/InsightVM adapter replaces the boolean vulnerability rich text setting with granular per-field selection.
ServiceNow relationship settings consolidated into a dedicated Relationship enrichment configuration section with Disabled, Fetch always, and Use cached relationships modes.
Akamai Kona WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adapter adds an advanced setting to use the OS DNS resolver instead of Quad9 when parsing URL IP addresses.
Google Security Operations SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. adapter's Queries advanced setting now accepts a single delimited string with a configurable Delimiter setting.
CyberArk Privilege Cloud adapter adds a configurable Safes page size setting to prevent timeouts on large safe volumes.
New Relic adapter adds an option to enrich Windows Services onto parent HOST devices instead of creating separate device records.
Abion adapter adds a new endpoint to fetch domain-specific information including hosts and contacts data.
Custom Files adapter now fetches Application Settings.
39 details in Everything
└──▷ BREAKING ON UPGRADE
!HPE Aruba Networking ClearPass Policy Manager: the Extended Info Fetch Window (Days) value is now constrained to 0–90; existing configurations with values outside this range must be updated.
!Microsoft Defender for Endpoint: the default value for vulnerability aggregation has changed to True, which may alter existing fetch behavior on upgrade.
DNSFilter is a cloud-based DNS security platform that blocks malicious websites, filters unwanted content, and protects networks from cyber threats in real time.
DNSFilter redesigns the Query Log with multi-select filters, cross-org toggling, second-level timelines, and shareable URLs.
└──▷ HOW TO FIND IT
Share a precise cross-org Query Log investigation with a colleague by bookmarking the URL with active filters intact.
📍In the Query Log, select the target Sites, Roaming Clients, and Users via the filter bar, set a custom timeline down to the second, then copy the URL from your browser — paste it to a colleague or save it as a bookmark to restore the exact view.
Redesigned DNS Query Log with a top-level filter bar supporting multi-select across Sites, Roaming Clients, Relays, and Users.
MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admins can now toggle between organizations directly from the Query Log without losing active filters, enabling faster cross-org investigation.
New custom timeline picker lets analysts narrow Query Log search windows down to the second.
Active filters persist in the URL, making Query Log views bookmarkable and shareable.
New Query Log data columns added: Resolved IPs, Query Type, and Roaming Client OS Type.
+1 moreshow less
Any page in the app can now be set as a custom default landing page, opened automatically upon login.
Ping Identity is an identity security platform that provides authentication, single sign-on, multi-factor authentication, and access management solutions for enterprises.
Ping Identity adds Rich Authorization Requests (RFC 9396) support, per-client authorization detail types, and a new Patch Object node v2.0.
└──▷ HOW TO FIND IT
Restrict which authorization detail types a specific OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client may request, scoping RAR to only the types relevant to that client.
📍In the Admin console, go to Applications › OAuth 2.0 Clients › <your client> › Advanced and set the Authorization Detail Type(s) field to the permitted types, then save.
New realm-level OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Provider setting Enable Rich Authorization Requests with RCS enables processing of authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. requests when an RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. is configured and controls advertisement of authorization_details_types_supported on the well-known endpoint.
Supports configuring Authorization Detail Type(s) on individual OAuth 2.0 clients to control which RFC 9396 Rich Authorization Request detail types each client can request.
Dynamic client registration requests can now include authorization_details_types to declare the authorization detail types a client supports.
Adds the ability to skip signature verification when importing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata.
New v2.0 of the Patch Object node always updates the managed identity object as Advanced Identity Cloud, removing the Patch as Object configuration option (v1.0 is deprecated but remains functional in existing journeys).
SailPoint is an identity security platform that helps organizations manage and govern user access to applications, data, and systems across the enterprise.
SailPoint ISC admins must now specify an approved integration when creating API or Personal Access Tokens.
Requires admins to select an approved integration when creating API or Personal Access Tokens, enabling per-integration traffic visibility.
Introduces the Unified Platform Access Program, enabling deeper product integrations tied to specific tokens.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!When creating an API or Personal Access Token, admins must now specify the approved integration — existing token-creation workflows that do not supply an integration will require updating.
SailPoint admins can now view, edit, and bulk-manage all Personal Access Tokens org-wide, plus a new Bulk update PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. expiration API.
└──▷ HOW TO FIND IT
Audit and revoke stale PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. across your org before they become a security risk — reach this without contacting individual users.
📍In the Admin console, go to Admin → Security Settings → Personal Access Tokens to view all tokens in the environment, then select one or more tokens and edit their expiration dates in bulk.
New admin screen under Admin → Security Settings → Personal Access Tokens lets admins view and manage all PATs in the environment, not just their own.
Admins can edit individual PATs or modify multiple tokens at once using bulk operations.
Admins can change or remove expiration dates on any PAT across the organization.
New Bulk update PAT expiration API enables programmatic management of PAT expiration dates at scale.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Any Personal Access Token created before February 5, 2026 that has never had an expiration date added or removed will automatically be assigned an expiration date 6 months (180 days) from the release date (production rollout: 7/28/2026), which may break long-lived integrations relying on those tokens remaining non-expiring.
JumpCloud is a cloud-based directory platform that manages user identities, devices, and access to applications and networks across organizations.
JumpCloud Agent 2.147.7 adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.OTP MFAOTP MFAAn authentication scheme that combines a one-time password — a code valid for a single login or short window — with a second factor, so stolen passwords alone cannot grant access. support across all OSes and reduces SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. noise on Linux.
Adds SMS OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. authentication factor support for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. on logins and password changes across all managed device OSes.
Self Service App Catalog now processes state changes only for applications the user interacts with, eliminating unnecessary retries and speeding up app management.
Removes unnecessary sudo usage from Linux agent operations, reducing SIEM security alerts and improving system audit log clarity.
Auth0 is a cloud-based identity platform that provides authentication and authorization services, enabling developers to securely add login and access control to applications.
Auth0 launches Anonymous Sessions beta: stateless guest sessions with seamless linking to authenticated users
└──▷ HOW TO FIND IT
Enable anonymous sessions for a specific application and API, and set session length, via the Auth0 dashboard.
📍In the Auth0 dashboard, go to Applications › <your application> and enable Anonymous Sessions. Then go to APIs › <your API> and enable Anonymous Sessions. Finally, set the session length under Tenant Settings › Anonymous Sessions.
New POST /anonymous/token endpoint creates, refreshes, and retrieves access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for unauthenticated (anonymous) sessions.
Supports seamless session linking — anonymous sessions can be tied to authenticated users via pre-registration and post-login Actions.
Activity Preservation carries anonymous session data across devices onto the authenticated user profile upon login.
New tenant-level setting to configure anonymous session length.
Per-application and per-API configuration options to enable anonymous sessions.
Pi v0.81.0 adds local llama.cpp model management, full provider extensions, Qwen Token Plan support, and expanded usage accounting.
└──▷ GET THIS VERSION
$ git clone --branch v0.81.0 https://github.com/earendil-works/pi.git
# already have the repo? check out this version:$ git checkout v0.81.0
└──▷ TRY IT
Connect to a local llama.cpp router and search for a Hugging Face model to download and load — without leaving the Pi session.
$ /login
/llama <model-search-query>
Adds built-in llama.cpp router support via /login connection setup and /llama subcommand for Hugging Face model search, download, explicit load/unload, and live progress.
Enables extensions to register complete pi-ai providers with native authentication, model refresh, filtering, and custom streaming behavior.
Adds Qwen Token Plan and Qwen Token Plan China as built-in providers with regional endpoints and API-key authentication.
Expands usage accounting to persist tool, compaction, and branch-summary usage in session totals and statistics.
Adds get_available_thinking_levelsRPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. command and RpcClient.getAvailableThinkingLevels() method for querying model thinking-level options.
+1 moreshow less
Exports message and tool execution lifecycle event types from the package root for consumer use.
Lightweight coding agent that runs in your terminal
Adds route-aware HTTP client pooling and system proxy support across daemon, plugins, and remote backends.
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.145.0-alpha.29 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.145.0-alpha.29
Adds a route-aware HTTP client pool (RouteAwareClientPool) that selects the correct outbound proxy route per request URL, reusing clients by resolved route with a bounded cache of 16 routes.
Honors system proxy settings in the daemon updater, remote plugins, and cloud environment discovery.
Supports CARGO_HTTP_CAINFO as a custom CA source in managed proxy/MITM environments.
Makes external session detection limits configurable via maxSessionAgeDays and maxSessions in the external-agent config detection request.
Adds optional providerId to externalAgentConfig/import for analytics attribution of external agent imports by provider.
+3 moreshow less
Preserves thread settings (including approvals_reviewer) across restarts for goal-first and forked threads.
Adds an optional releases.openai.com installer source for fetching Codex release artifacts.
Mirrors Rust release artifacts and metadata to Cloudflare R2 for additional distribution resilience.
8 details in Everything
0 more releases in this issue2 more releases in this issue · 2026-07-21
$ git clone --branch rust-v0.145.0-alpha.28 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.145.0-alpha.28
Enables parallel write_stdin tool calls across independent terminal sessions, serializing per-session I/O for safety.
Supports custom transports for Amazon Bedrock provider connections.
Adds audio output support to dynamic tools and code mode.
Adds occurrence search for paginated thread history.
Adds batched executor capability discovery.
+13 moreshow less
Makes parent-owned sub-agent threads read-only in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..
Renders inline visualization links in the TUI.
Launches managed network proxies on remote executors.
Codex CLI adds Esc key to interrupt running sessions and updates bundled model metadata including GPT-5.6 context windowscontext windowsThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it..
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.145.0-alpha.27 https://github.com/openai/codex.git
# already have the repo? check out this version:$ git checkout rust-v0.145.0-alpha.27
Enables pressing Esc to interrupt a running agent session mid-task, with Esc now documented as an interrupt key in the status indicator.
Updates bundled GPT-5.6 model variants with 272,000-token context windows and refreshed model instructions.
Adds personality instruction variables for GPT-5.6 model variants and includes a GPT-5.5 availability notice in the bundled catalog.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The auto_review and permissions message fields and the legacy supports_reasoning_summary_parameter flag are removed from the bundled model catalog.
OpenHands cloud-1.47.0 gates Agent Canvas behind SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. authentication.
└──▷ GET THIS VERSION
$ git clone --branch cloud-1.47.0 https://github.com/OpenHands/OpenHands.git
# already have the repo? check out this version:$ git checkout cloud-1.47.0
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Claude Code v2.1.216 adds sandbox filesystem-isolation bypass, smarter /context warnings, and improved /fork, /ultrareview, and /code-review ultra feedback.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.216 https://github.com/anthropics/claude-code.git
# already have the repo? check out this version:$ git checkout v2.1.216
└──▷ USE IT
Allow a sandboxed session to read/write the filesystem freely while still blocking unexpected network egress — useful when your task requires broad file access but you still want outbound network control.
json
# In your Claude Code settings (e.g. .claude/settings.json)
{
"sandbox": {
"filesystem": {
"disabled": true
}
}
}
Adds sandbox.filesystem.disabled setting to skip filesystem isolation while keeping network egress control active.
Adds explicit context-window overflow warning to /context and surfaces failed /compact as a visible error.
Improves /fork confirmation to include the new session name, claude attach id, and whether the copy shares the checkout.
Improves /ultrareview diff-too-large error to display configured limits, measured diff size, and the largest contributing files.
Improves /code-review ultra empty-diff message to name the exact base ref and suggest passing an explicit base.
+3 moreshow less
Improves spend-limit rejection prompt to show the server's stated reason.
Background sessions: /mcp and /install-github-app now park a needs input request in the agent view when no client is attached.
Adds safety guardrail to /rewind: skips files reachable via symlinks or hard links and reports how many paths were skipped.
Crush v0.86.0 adds LSPLSPLanguage Server Protocol, the standard way editors get code intelligence such as completions, go-to-definition and errors from a separate per-language server. Coding agents use it to understand code. rename/replace tools, scrollable sidebar, removable attachments, and SSH-friendly OAuth URL copy.
└──▷ GET THIS VERSION
$ git clone --branch v0.86.0 https://github.com/charmbracelet/crush.git
# already have the repo? check out this version:$ git checkout v0.86.0
└──▷ TRY IT
Get aggregate token/cost stats across all sessions or a specific directory tree without opening the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..
$ crush stats --all
Scope stats to a particular project directory when working in a monorepo.
$ crush stats --crawl-dir ./services/auth
Adds lsp_rename tool: renames a symbol and all its references across the project via LSP.
Adds lsp_replace_symbol tool: replaces, inserts before/after, or deletes an entire function, method, or class by name via LSP.
Enables scrollable sidebar with keyboard (l/h/j/k/g/G/arrows) and mouse-wheel navigation when sidebar content overflows.
Adds clickable ✕ button on attachment chips to remove attachments with the mouse.
Adds <kbd>u</kbd> keybinding in the OAuth dialog to copy the verification URL — enables authentication over SSH where auto-browser-open is unavailable.
+2 moreshow less
Adds quit-dialog hint showing that pressing Ctrl+C twice skips the confirmation prompt.
Adds --all and --crawl-dir modes to the stats subcommand.
Hermes v2026.7.20 slashes first-token latency 80%, adds password-manager secret sources, live subagent transcripts, and terminal subscription management.
└──▷ GET THIS VERSION
$ git clone --branch v2026.7.20 https://github.com/NousResearch/hermes-agent.git
# already have the repo? check out this version:$ git checkout v2026.7.20
└──▷ TRY IT
Export a session history as a Hugging Face-ready trace with secrets scrubbed — useful for building fine-tuning datasets from real agent conversations.
$ hermes sessions export --redact
Manage your Nous subscription tier without leaving the terminal — view your plan, preview upgrade cost, and apply changes.
$ /subscription
Watch a subagent work in real time by tailing its live transcript as soon as it launches.
$ tail -f <transcript-file>
Cuts cold-start first-turn latency ~80% (4.3s → 0.9s) across CLI, TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., gateway, desktop, and cron.
Streams reasoning model thinking live by default (display.show_reasoning on) — no more waiting at a spinner.
Adds /subscription and /topup commands to manage your Nous plan and billing directly from the terminal or TUI.
Adds /deny <reason> command to tell the agent why a command was refused so it can course-correct.
Introduces user-defined deny rules that block commands even under yolo mode.
+15 moreshow less
Enables smart approvals by default — an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. reviewer independently assesses flagged commands instead of prompting the user each time.
Adds Bitwarden and 1Password (op:// references) as pluggable SecretSource providers, so API keys no longer need to live in plaintext .env files.
Makes delegate_task subagent dispatches produce live tail-able transcript files per child agent.
Adds a durable delivery-obligation ledger in state.db so final responses are redelivered on next boot if the gateway crashed before platform delivery (covers Telegram, Discord, Slack, and others).
Supports profile-based message routing in a single multiplexed gateway — route guilds, channels, or threads to fully isolated profiles.
Adds hermes sessions export with Markdown, Quarto, HTML, prompt-only, and Hugging Face trace output formats, a --redact secret-scrubbing pass, and filters by age, workspace, and platform.
Adds Fireworks AI and DeepInfra as first-class model providers, plus Upstage Solar.
Adds new model catalog entries: GPT-5.6 (Sol/Terra/Luna + Pro variants), grok-4.5 (GA), moonshotai/kimi-k3, claude-fable-5/claude-sonnet-5, tencent/hy3 (GA), and LM Studio JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. local model loading.
Adds max and ultra reasoning-effort tiers with per-model config overrides and per-slot effort in MoA presets.
Adds a terminal execution backend picker (local/docker/ssh/modal/daytona/singularity) with per-backend health probes in the Desktop Capabilities tab.
Adds a declarative memory provider panel with full-config modal in the Desktop settings.
Adds a per-job model picker in the desktop cron create/edit dialog.
Adds per-session color override and project-inherited color/icon in the desktop session sidebar.
Delivers 14× less markdown-splitter CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. via incremental block lexing, virtualized review-pane diffs, and eliminated per-token sidebar re-renders in the desktop app.
Scopes Vertex credentials away from subprocess env, adds a shared credential-read guard for media/vision/image-gen local file reads, adds webhook body-size caps across all aiohttp servers, and redacts bot tokens in Telegram transport errors.
Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.
CrewAI 1.15.5 adds authentication support for skill registry downloads.
└──▷ GET THIS VERSION
$ git clone --branch 1.15.5 https://github.com/crewAIInc/crewAI.git
# already have the repo? check out this version:$ git checkout 1.15.5
Supports authenticated downloads from the skill registry, enabling access to private or restricted skills.
ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.
ToolHive v0.40.0 adds RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. for agentic delegation and early MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. 2026-07-28 revision support.
└──▷ GET THIS VERSION
$ git clone --branch v0.40.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.40.0
Adds RFC 8693 OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Token Exchange grant handler to the embedded authorization server, enabling agents to exchange a user token for a delegated token carrying both the user (sub) and the acting agent (act.sub) — the foundation for agentic delegation.
Adds request-parsing support for the upcoming MCP 2026-07-28 (Modern) stateless revision, including a revision classifier, Mcp-Method/Mcp-Name headers, _meta vocabulary, and server/discover/subscriptions/listen authz registration (dormant until wired into proxy routing).
Migrates MCP protocol handling from mark3labs/mcp-go to the official modelcontextprotocol/go-sdk via the toolhive-core/mcpcompat compatibility shim.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The stdio bridge now forwards only progress/message notifications; tools/list_changed and similar notifications are dropped, so dynamic-capability servers may show stale capability lists until clients re-list.
A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
SysReptor 2026.58 adds plugin management UI, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. identity API token auth, and AI agent delete confirmation.
└──▷ GET THIS VERSION
$ git clone --branch 2026.58 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2026.58
Enables enabling/disabling plugins directly from the settings web UI.
Supports SSO identity API for API token authentication.
AI agent now prompts for confirmation before reverting changes (delete).
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Forgot password functionality via email is disabled when ALLOWED_HOSTS is unset.
THE CYBER TOOLCHAIN