LoginSign Up
← Back to all sparks
Daily Brief · October 28, 2026

Agent SDKs and agent permissions go GA as vendors build for unattended agents

agentspermissionsmcpmajor-versionssecurity-patchesserverless
Y
Generated 2h agoDrawn from 34 products

The lead

Agent tooling stopped being a feature this week and became a platform surface. Cursor took its Agent SDK to GA on October 20: an agent is now a folder holding a prompt, typed tools, skills and MCP connections, tested with evals and deployed either to Cursor or to a team's own infrastructure. It was the day's heaviest cluster of spark-class entries.

The pattern repeats elsewhere. GitHub Copilot made assisted permissions GA across the CLI, the Copilot app and VS Code, and added GPT-6.1 Terra as a cheaper default for agentic work. Gumloop lets live artifacts create and message agents through its SDK, and Stigg added credit reservation and settlement for AI operations. Vendors are building for agents that run unattended, and the controls (permissions, spend limits, governance) are shipping in the same releases.

What moved

  • Agent controls. Beyond Cursor, GitHub shipped the same Copilot permissions and model changes on its own page, and Stigg's reserve-then-settle credits pair with its beta Agent Governance SDK to cap what an agent can spend.
  • Agents as an audience. Shopify moved its Knowledge base into the admin under an Agentic sales channel, with facts reaching agents only after the merchant publishes them; the standalone app shuts down January 15, 2027. Sanity now advertises its MCP server to agents through a server card and llms.txt, and Keboola tightened its MCP server.
  • Major-version transitions. n8n published 3.0.0 and 2.46.0 within five minutes on October 27, with a migration report flagging breaking changes. Payload CMS 4.0 beta 5 is a fix release with one breaking change that affects no first-party adapter.
  • Infrastructure for durable work. Hatchet now runs durable tasks on Cloudflare Workers, Vercel and Node, so teams no longer need long-lived workers. Teable extended Structured Query v2 to relations up to three hops deep, with a strict mode that rejects SQL-based definitions.
  • Local and live voice. Ollama added speech output on macOS with an OpenAI-compatible audio endpoint, and Krisp put Voice Translation into conference calls as a beta.

Sectors today

  • Devtools (15): the largest count, but mostly upkeep: Harbor 2.16 RC1 adds arm64 builds, while Tolgee and ESPHome shipped patch releases.
  • Analytics (6): security was the theme, with Countly and ThingsBoard closing token, session and sandbox holes.
  • Development (4): CodeRabbit moved review status to a GitHub check run, and Kubernetes shifted conformance toward workloads.
  • Collaboration (4): Teable led; AFFiNE and SiYuan stayed on canary and beta upkeep.
  • HR and recruiting (4): Ashby added cited candidate-history summaries to its Chrome extension, and Tanda restricted bank-detail edits to payroll staff.
  • Communication and messaging (4): Element 1.12.33 simplifies recovery keys, and Fonoster reached v0.33 in a week.
  • Marketing automation (4): n8n and Gumloop led; Buttondown closed an API send loophole.
  • Project management (4): NocoBase lets developers build plugins inside a running app, and Camunda opened its 8.11 cycle.
  • AI and ML platforms (3): Arize Phoenix pinned out a compromised LiteLLM release while LiteLLM trimmed what failed-request logs keep.
  • CRM (2): Twenty 2.52 lets apps run their own account-connection flows.
  • Education (2): Tutor 21.0.10 drops trust in a compromised CA across its Open edX images.

Watch tomorrow

Three threads look likely to continue. n8n and Payload are both mid-transition, and each feed shows fix releases arriving every few days, so expect 3.0.x patches and possibly a Payload release candidate. Hatchet's serverless package is at 0.1.0, which usually means quick follow-ups. Cursor and Copilot both point to more admin-facing controls for agent actions. Separately, a few feeds are crawl-source noise rather than product news: Service Fusion, Metricool and Employment Hero produced only buyer guides and advice posts, so treat their absence from the sector reads as a data issue, not a quiet day.