Devtools vendors are opening internals to coding agents, and CI is where it shows first.

The week in devtools

The dominant move this week is access, not features. Vendors are exposing their data and controls to AI agents through hosted MCP servers, scoped tokens and API endpoints, and they are doing it in the layers that sit around the editor: CI, test reporting, observability and deployment. The product is increasingly the thing an agent can call.

The sharpest version of that came from CI. A tool that runs another vendor's workflow files unchanged turns migration cost into a config flag, and it shows how much of the category now competes on compatibility rather than syntax.

Leaders

GitHub spent the week on Copilot. Computer use now lets Copilot operate desktop apps on macOS and Windows, HydraFusion appears in the model picker as a model combiner, and GPT-6.1 Sol went generally available. Copilot code review also became requestable through REST and GraphQL with a per-request effort level, which makes review a callable step in someone else's pipeline.

CircleCI now runs GitHub Actions YAML on its own Linux runners in preview, connects to Cursor Origin repositories and exposes CI through a hosted MCP server. It is also pruning: Bitbucket Data Center support ended October 1. Widening the front door while closing a side one is a deliberate narrowing of who CircleCI is for.

Buildkite put Buildkite Cache into public preview, moved secrets management into pipeline settings and gave its Remote MCP server per-organization connections. A formal support policy now sets an end date on agent v3. The pairing of new agent-facing controls with fleet hygiene is the same pattern CircleCI shows.

Currents shipped a VS Code and Cursor extension for CI test runs and added a Markdown endpoint to shareable failure links, so an agent can read a failure without logging in. That is a small feature with a clear target reader.

Wildcards

Chromatic is selling the ability to merge past flaky tests, quarantining them rather than blocking the pull request, while previewing visual testing for React Native. Most of this week's peers added access; Chromatic added tolerance.

MISP is on a long security-remediation run. Release 2.5.47 patched 27 CVEs including an authenticated remote code execution, alongside PostgreSQL support and a first AI analysis feature. It is a threat-intelligence platform behaving like a project in an audit, not a product on a roadmap.

Themes that compounded

• Hosted MCP servers or agent plugins appeared at CircleCI, Buildkite, Currents and Railway.
• Retool and ToolJet both added new frontier models to their AI builders, with GPT-6.1 Sol arriving at both.
• Security patching dominated the long tail: Skipper fixed two advisories, Parse Server shipped a stream of authorization fixes, and MISP closed a large batch of CVEs.
• API surface kept growing at Resend, which added account usage and broadcast duplication endpoints and a Stripe Projects integration.
• Pricing and plan limits moved at Currents with new plans and at ToolJet, which began enforcing Cloud workspace limits as its AI builder shifted to paid tiers.

Watch this week

Watch whether CircleCI's Actions-compatible runner moves from preview to general availability, and whether Buildkite or another CI vendor answers with its own compatibility layer. Watch also for the October 15 removal of SigNoz's v1 alert history APIs, which is a hard date in the feed, and for the next GitHub Copilot changelog, since its output has been near-daily.