Agents move into review and deploy as GitHub, Cursor and CircleCI ship the week's biggest devtools changes

The week in devtools

The dominant move this week was agents getting wired into the delivery pipeline itself rather than sitting beside it. GitHub shipped agentic autofix for code scanning alerts and a new frontier model in Copilot within the same week, while Cursor added deploy monitoring and a security reviewer on every pull request. The editor-and-host boundary is dissolving: the tools that write code now also review, ship and watch it.

Underneath that, the infrastructure vendors are repricing and re-plumbing around the same shift. CircleCI metered its test-intelligence features and moved all new API work to v3, and Buildkite spent the week on failure-handling tooling and narrower token scopes. Governance features, license policy, approvals, audit-log alerts, kept shipping at a steady clip beneath the AI headlines.

Leaders

GitHub had the heaviest week: agentic autofix for code scanning alerts went generally available, Gemini 4 Argon landed in Copilot on arrival, and open source license compliance reached GA for Enterprise Cloud through rulesets. It is the third frontier model added to Copilot in a month, which makes model breadth a standing feature rather than an event.

CircleCI took Smarter Testing to general availability, metering test impact analysis, dynamic splitting and auto-rerun per test atom while keeping basic runs free. API v3 also arrived, declared the only home for new API work, with UUID resource IDs and cursor pagination across endpoints. Dynamic Parallelism, still experimental, sizes node counts to the tests actually selected.

Cursor added Rollouts, a per-PR deployment monitor, and opened the Origin app marketplace with more than 20 integrations and public submissions. Together with Security Review on every PR, it now covers repo, review, deploy and observe inside one product.

incident.io shipped its agent skills as a plugin that installs into any coding harness, and reported Investigations running about twice as fast, with median time to an accurate message down from 6.7 to 3 minutes.

Wildcards

Skipper is off-pattern in the useful way: no AI at all, just four new path predicates that let routes distinguish an encoded %2f from a slash, in a project that tags a release for nearly every merge.

Payload CMS moved 4.0 from canaries to beta with a redesigned admin, TanStack Start support and a rewritten MCP server, a major release arriving in the middle of a week otherwise dominated by incremental GA announcements.

Resend became provisionable from the Stripe Projects CLI, extending distribution through other platforms' setup flows rather than its own signup page.

Themes that compounded

• Agents moved into review and deploy stages: autofix at GitHub, Rollouts at Cursor, Investigations at incident.io.
• MCP surfaces kept spreading: Redocly added custom MCP tools in Realm 0.138.0, Buildkite shipped an MCP server for build diffs, and Payload CMS rewrote its own.
• Fast model onboarding became table stakes; Retool added GPT 6.1 Sol and Claude Sonnet 5.5 and now bundles model access in the Business plan.
• Usage-based metering crept into CI, as CircleCI metered Smarter Testing features.
• Reliability and governance work continued at Infisical, with webhook auth on alert channels and approvals extended to secret changes.

Watch this week

Watch whether Cursor's marketplace and GitHub's autofix pull CI vendors into integrations or into competition, since CircleCI and Buildkite are already listed as Origin apps. Also watch Payload's next beta tag and CircleCI's Dynamic Parallelism, the two items still labelled experimental or beta that could graduate on the current release cadence.