Devtools spent the week building the plumbing for agents — plugin standards, identities, and token custody — not more agents.

The week in devtools

Devtools shipped agents' infrastructure this week, not more agents. Of 134 products that moved, 78 carried a spark and 465 an improvement, but the sparks cluster around one question: not "can we add an assistant" but "how does an outside agent authenticate to, discover, and operate our surface." GitHub made that explicit by co-publishing Agent Plugins 1.0 — a plugin written once that runs in VS Code, the Copilot CLI, the Copilot app, and clients GitHub does not own — with AWS, Microsoft, OpenAI, Anysphere, and Vercel as co-signers. In the same week Resend shipped support for that same Agent Plugins Standard, folding its per-vendor Codex and Claude integrations into one interface any conforming client can install. A standard only counts once someone else adopts it, and that happened inside seven days.

The second directional move is custody and identity. If agents are going to act on user accounts, someone has to issue their credentials and hold their tokens. WorkOS shipped three sparks toward exactly that — agent identities registering through an open protocol, and a token proxy that calls third-party APIs so the calling app never touches a user's access token — while pairing it with a reversible SCIM migration bridge that reads less as a capability than as a switching-cost play. Auth0 is one seam over, extending its delegation model from API calls to full browser sessions with an RFC 8693 act claim naming who is actually driving. Underneath both, the recurring shape of the week is an infrastructure vendor absorbing the layer customers used to build themselves, then putting an agent on top of the data it now owns.

Leaders

GitHub is the clearest expression of the platform bet. Agent Plugins 1.0 stops extending Copilot alone and publishes an interface across competing agent clients, sitting directly on the MCP and agent-skills work of the prior month; the weekly frontier-model additions to Copilot now read as inventory management, while portability is the actual differentiator. Separately it modernized the OAuth surface with opt-in expiring tokens and refresh — the kind of change that only matters once app authors have somewhere to migrate to.

WorkOS is assembling an agent stack in two halves that clearly want to converge: Agent Registration issues agents first-class AuthKit identities through the open auth.md protocol, and the Pipes Token Proxy holds the credential so applications call third-party APIs without ever seeing a user's token. The choice of an open protocol over a proprietary flow is the strategically loaded detail.

Prowler shipped the sharpest beat of a three-release arc: every finding now carries a Lighthouse Skills menu where a Triage Decision judges whether the finding is real and closes it when it is not. Actions came in 5.35.0 and page context in 5.37.0; 5.39.0 hands the assistant the decision itself, every write path still bound to the asking user's RBAC. Azure management-group onboarding landed in the same release.

Windmill made dbt a first-class runtime — push a project, and dbt build runs on your own workers with per-model progress and retries — a week after moving BigQuery and Snowflake out of the Enterprise tier into the community build. Together they make a full warehouse-plus-dbt trial possible on a free self-hosted instance; the trial is the strategy, with Enterprise repositioned around scale and governance rather than feature access.

Cursor turned Auto mode into Cursor Router, converting model selection from a user's pick into per-request dispatch across a cost-intelligence curve, billed at the routed model's rate and on by default for Teams. It is the pricing spine of a cloud-agent strategy that now launches agents from iOS, iPad, and Slack, and pairs nearly every feature with an admin control.

Wildcards

Expo went the other way on agents: it wound down the Expo Agent closed beta outright, published plainly rather than left to expire. With no in-house assistant, its free MCP server and a new Claude desktop connection become the strategy — conceding the assistant layer and defending the build, test, and deploy pipeline beneath it.

Kata Containers shipped the one release in the sector that has nothing to do with AI: 4.0.0 replaces its Go runtime with a Rust one and makes runtime-rs the default across x86_64, ARM, and s390x and three hypervisors. In a feed dominated by agent plumbing, a memory-safe isolation boundary for confidential computing is a reminder that the low-level substrate is still moving.

Themes that compounded

• The Agent Plugins Standard went from GitHub's announcement to Resend's adoption in the same week, turning a spec into an actual interoperability layer.
• MCP is now the operating surface, not a feature: Prowler, Honeycomb, and Buildkite all route real operations — triage, onboarding, test ranking — through MCP rather than the UI.
• Identity for agents became a named product line at WorkOS and a delegation extension at Auth0, both leaning on open, standards-based claims.
• CI vendors keep absorbing the adjacent layer: Depot took test results GA and stood up its own git host in beta, while Buildkite exposed test-reliability metrics through both an API and an MCP tool.
• "Absorb what the customer would otherwise build" ran through Merge adding hundreds of generic MCP connectors to Agent Handler and Honeycomb turning on threshold-free Anomaly Detection.

Watch this week

The near-term signal is adoption of the Agent Plugins Standard beyond GitHub and Resend: if a third and fourth vendor conform, the standard stops being GitHub's and becomes the sector's, and the per-vendor connector work that Merge and v0 are doing gets cheaper. Expect WorkOS to converge Agent Registration and its token proxy into a single documented stack, and Auth0's act-claim delegation to keep widening. On the CI side, watch whether Depot and Buildkite move from reporting test timing to selecting tests — both now hold the failure history that would require. And with Expo having killed its own agent, the question is how many other mid-size vendors decide the assistant layer is not theirs to win and wire into someone else's instead.