Devtools spent the week retrofitting its whole stack around autonomous coding agents.

The week in devtools

The dominant move this week was not a product but a posture: nearly every meaningful release retrofitted an existing tool for autonomous agents rather than human operators. GitHub added Google's Gemini 3.6 Flash and Claude Opus 5 to Copilot within days of their releases and shipped Code Quality to GA under an explicit thesis — AI writes more code faster, so quality gates have to keep pace. Render, WorkOS, and Depot each pushed their core primitive — deploys, identity, CI — down to something an agent can drive over MCP or short-lived credentials. The through-line is that the buyer these teams are building for is increasingly a program, not a person.

Two mechanics kept recurring underneath that shift. The first is secretless auth: static API keys are being replaced by scoped, revocable OIDC and OAuth so agents can hold access without holding a long-lived secret. The second is model routing as an owned layer — whoever decides which model serves a request controls both quality and cost. Both are infrastructure bets that the agent era is permanent, and both showed up across otherwise unrelated products this week.

Leaders

GitHub had the busiest week in the sector — two sparks and twelve improvements. Code Quality reaching GA on Enterprise Cloud and Team is the headline, but the quieter story is model neutrality: adding both Gemini 3.6 Flash and Claude Opus 5 to Copilot within a day or two of each launch, while the cloud agent gained trigger surfaces in Linear, mobile, and failed Actions checks. GitHub is wiring the coding agent into every entry point it can reach and building the review gate to govern what it changes.

Render shipped the week's cleanest secretless-auth story: managed OIDC now issues short-lived tokens for Anthropic and OpenAI, so AI apps deployed on Render never store a model-provider key, and its MCP server now authenticates Claude Code, Codex, and Cursor over OAuth instead of long-lived tokens. Nearly every release this month either widened the MCP surface or extended OIDC to another provider.

WorkOS moved from a backend you call to an identity layer you operate. Its Management MCP server exposes hundreds of operations to agents, and a new session-aware Widgets API pushes WorkOS data into the browser so developers build UI client-side rather than proxying through their own backend. Both point at a platform meant to be driven from more surfaces than a server SDK.

Honeycomb is rebuilding observability around the agents it now has to monitor. The new Canvas makes investigation a real-time human-plus-agent surface, and Agent Timeline reached GA as a first-class view for debugging multi-agent systems — 60 days of tool calls, token counts, and P95 latency at a glance. The parallel work is governance: multi-team OAuth and Activity Log going GA so an enterprise buyer can permission and audit the agent layer.

Cursor put its own model router under Auto mode. Cursor Router inspects each request and routes it to a frontier or price-efficient model, exposed as three optimization modes — Intelligence, Balance, and Cost. Owning routing lets Cursor manage the economics of every request, the same strategically loaded position GitHub is reaching for from the other direction.

Wildcards

Depot made the boldest move of the week: Depot Code, a diskless git server backed by S3 that mirrors GitHub repos and plugs straight into Depot CI, entered private beta. It takes a build-acceleration company into source control — vertical integration down to owning the repo, not just the runners.

Warp shipped no features at all. Its feed this week was a set of strategy essays framing the terminal's pivot to a cloud software factory — a manifesto arguing agents belong in the cloud, not on individual desktops. It is the clearest statement of the sector's direction precisely because it is not a changelog.

Themes that compounded

• Secretless auth spread past a single vendor: Render issued OIDC tokens for model providers, Depot added GitLab OIDC trust, and Auth0 opened anonymous pre-login sessions.
• MCP became table stakes: GitHub, WorkOS, Buildkite, and Resend all shipped or refined MCP servers to make their surface agent-operable.
• Model routing emerged as an owned layer, with Cursor building an in-house router and GitHub treating Copilot as a model-neutral routing point.
• Agent-observability matured from novelty to governance, with Honeycomb permissioning and auditing its agent surfaces for enterprise buyers.
• Coding assistants became a distribution channel: Resend shipped a Claude connector and Codex plugin to meet developers inside their assistant rather than its own dashboard.

Watch this week

Watch whether the agent-review and governance gates move from preview to GA — GitHub signaled its agent-automation controls are headed there, and Honeycomb is already permissioning its agent surfaces for enterprise. Watch the secretless-auth pattern reach more providers: Render went from AWS to model APIs in weeks, and the natural next targets are GCP and any external service a hosted app calls. And watch Depot — if Depot Code moves toward GA with tight CI coupling, it validates that owning the full source-to-CI stack, not just accelerating someone else's, is where dev-infra margins are headed.