LoginSign Up
← Back to Infra & APIs
Weekly · Infra & APIs · Week of October 26, 2026

Devtools shipped evidence and trust controls for agents: Currents traces, incident.io Extensions, CircleCI OIDC v3 and GitHub's package firewall.

agent-toolingsupply-chain-securityoidcmcpsecurity-advisoriesci-cd
Y
Generated 2h agoDrawn from 15 products

The week in devtools

Two forces shaped the busiest sector in the feed: agents as a first-class user of developer tools, and trust boundaries around the build. Currents shipped a trace API designed for agents and shareable AI context for test failures, incident.io let teams connect internal tools to its Nexus agent, and Aviator introduced Verify, which checks each pull request against its stated intent. On the trust side, CircleCI issued V3 OIDC tokens that name where code and config came from, and GitHub previewed a package firewall for install-time malware.

The common pressure behind both is that machine-written code and machine-run pipelines produce more artifacts than humans can read. The tools that shipped this week produce evidence for a reviewer or an agent to consume: a verdict, a trace, a lineage, a signed claim.

Leaders

GitHub shipped the week's most consequential spark: a package firewall in public preview, aimed at malware that steals credentials on CI hosts and developer machines during install. Around it came Dependabot support for npm 12, pnpm 11 and 12 and Bun 1.4, dependency versions in the Dependabot alerts REST API and one-click conversion of branch protections to rulesets.

incident.io launched Extensions, which let teams feed its Nexus agent their own debugging knowledge and connect internal or third-party tools to it. A week earlier it shipped a plugin that puts its agent skills into any coding harness, and in September Investigations got twice as fast. Extensions goes the opposite direction from the plugin: tools in, rather than skills out.

Currents opens each project on a health verdict that says whether the suite is healthy, which way it trends and what to fix first. Beneath that sit a trace API built for agents, a .md endpoint on every shareable failure link, scoped personal access tokens and a hosted MCP server with OAuth.

CircleCI spent the week on trust: V3 OIDC tokens whose subject claim names the checkout source and ref and the config source and ref, scoped API tokens and a runner orchestrator rebuilt to distrust compromised eMudhra and Comodo AAA roots. Smarter Testing went generally available on October 13.

Aviator introduced Verify on October 20, which checks every pull request against what the change is supposed to do and the team's standing rules, so reviewers weigh evidence rather than reading the whole diff. It follows an October 1 beta in which an LLM separates flaky check failures from real ones.

Wildcards

Parse Server shipped more than fifteen security alphas in under two weeks, nearly all tied to advisories. The latest stops a crafted dot-notation key from polluting a shared prototype when a class has a trigger or LiveQuery.

Jackett ships almost daily to keep hundreds of torrent indexers working. The latest build removes the dead 52movie tracker, which had been added only eight days earlier, and fixes dontorrent's search selectors.

Themes that compounded

  • Evidence for agents and reviewers shipped in Currents (trace API), Buildkite (an MCP server that diffs against the last green build) and Aviator (Verify).
  • Scoped credentials and signed claims appeared in CircleCI, Buildkite (a retry-only API scope), Infisical (KMS-backed signing keys for internal CAs) and Tailscale (self-serve identity provider changes).
  • Advisory patches landed in Skipper, whose v0.28.46 fixes a flaw in the OPA request-body filter a week after its cache() advisory, and in Parse Server.
  • Same-week frontier model support continued at Retool, which added Gemini 4 Argon days after its previous model drop.
  • MCP showed up as a documentation feature in Redocly, with a Copy MCP server URL page action, and as a provisioning path in Resend via Stripe Projects.
  • Language and lockfile coverage widened at Semgrep: Objective-C in alpha in 1.182 and Bun lockfiles in 1.179.

Watch this week

The advisory cadence at Parse Server and Skipper suggests more fixes in the same code paths, because both have disclosed several flaws in short succession. CircleCI paired its OIDC V3 token format with scoped API tokens, so expect follow-ups around token migration. incident.io has now shipped three sparks in a few weeks, so the next entry is likely to extend Extensions or the plugin. Tailscale has MagicRoute in beta and the 1.104 client focused on memory use, which points to further operability fixes rather than new primitives.