Best Enterprise MCP Gateway for Security & Governance in 2026: A Practical Guide to Securing AI Agent Tool Access
MCP is changing how AI applications interact with the systems around them. An AI agent can now do...
找到 6729 篇相关文章
MCP is changing how AI applications interact with the systems around them. An AI agent can now do...
God’s Eye View was the top project on GitHub Trending when we selected it for Jian AI Lab’s daily experiment. The pitch is immediately compelling. It brings aircraft, vessels, satellites, earthquakes, wildfire data, traffic, CCTV sources, and other feeds into one 3D globe. The repository also makes a serious effort to label data as live, modeled, reconstructed, or simulated. We tested commit b22573a9db28e47c324821ebdd4c67bdb241c0e1 on Linux with Node.js 24.19.0 and npm 11.9.0. Installation and security checks We first ran npm ci --ignore-scripts , reviewed the install-script sources, and then ran the normal npm ci . Both installations succeeded with 201 packages. The root project has no preinstall, install, or postinstall hook. Transitive install scripts come from esbuild, fsevents, Puppeteer, and sharp. npm audit --omit=dev reported no known vulnerabilities in production dependencies. A common secret-pattern scan did not find hard-coded live credentials. This is a limited check, not a full source audit. The project talks to many external services, including Google Maps, OpenAI, OpenSky, AISStream, NASA FIRMS, TomTom, CelesTrak, OSM, Open-Meteo, GDELT, and Radio Browser. It is local-first, but it is not offline. Server-side keys such as OpenAI and AISStream are read by the local Vite proxy. Google Maps and Cesium tokens are intentionally delivered to the browser. Users must restrict referrers and APIs and set provider budgets and quotas. 2,588 visible assertions passed The main test suite reported 2,587 passing assertions and zero failures. A separate focus-allocation check added one more passing assertion. The visible total was 2,588 passes and zero failures. The process did not exit after the summary. We waited more than 90 seconds and interrupted it manually. The final exit code was 130. The precise result is that all visible assertions passed, while the official test command did not complete with a clean exit in this environment. This may indicate an open handle
📝 Originally published (in Japanese) at forge.workstyle.tech . The Challenge of "Silence" in Unmanned AI Avatar Live Streams When creating a live stream where an AI avatar operates autonomously, the first major hurdle you encounter is the issue of "silence." It’s not that there are no viewers—quite the opposite. Yet the avatar falls silent for long stretches, or ignores comments for tens of seconds. What human streamers do unconsciously—creating "space" in the conversation—is entirely missing from AI behavior. In this article, I’ll summarize two key challenges we tackled to prevent unmanned streams from becoming boring. The first: how to fill the silence when no comments arrive. The second: how to handle response delays when comments do arrive. The former deals with behavior during "no input," while the latter concerns the time between input and reaction. Both are two sides of the same coin in live streaming, and neither worked with a straightforward implementation. What they had in common was that brute-force attempts to "make it faster" or "make it smarter" missed the mark. We had to observe long-running streams, measure breakdowns, and redesign priorities—mundane but essential work. Reactive Alone Doesn’t Make a Stream Our initial implementation was straightforward: "Respond when a comment arrives." Functionally, it worked correctly and passed tests. The problem was what happens when no comments arrive. In an unmanned stream, the avatar stands frozen on screen for tens of seconds—blinking, but doing nothing. This is nearly an accident for a live stream. And for newly launched channels, this is the default state. Comments come only after the stream has grown; until then, silence is the norm. This was a design philosophy issue. If built as a chatbot, the AI only outputs in response to input —just like a web request/response model. But a streamer is different. Their job is to keep talking even when no one says anything. So we needed a mechanism that generates speech
Last post, I said "the book is under review." Now the paperback is live. The Kindle edition is...
I think I know why Rockstar Games debuted its "extended look" of Grand Theft Auto VI on Netflix instead of immediately dropping it for free on YouTube. Unlike most video game trailers, the almost 27-minute preview of GTA VI felt more like a slice of a prestige crime drama than any video game trailer that […]
At TechCrunch Disrupt 2026, the AI Stage is back to dig into the single hottest topic in the community for the past few years, presented by Google for Startups.
Standardized driver interface aims to let devices talk to AI and each other.
Hey everyone! 👋 Finding reliable, free public APIs for side projects or learning is always a hassle because many listed APIs eventually go down or become paid. To solve this, I created Awesome Free APIs Live — an open-source, curated collection of 50+ free public APIs across AI, developer tools, security, and open data. ⚙️ How It Works Daily Health Checks: Powered by GitHub Actions , an automated script tests endpoints daily and updates live status badges. Zero Dead Links: Broken endpoints are flagged automatically so developers don't waste time debugging dead services. Categorized & Searchable: Clean, categorized UI hosted on GitHub Pages. ### 🔗 Links 🌐 Live Directory: shilpshakti.github.io/awesome-free-apis-live ⭐ GitHub Repository: github.com/ShilpShakti/awesome-free-apis-live Contributions are very welcome! If you know of any great free APIs, feel free to open a PR or check out the open issues on GitHub.
Google completed its August 2026 spam update after a rollout that began on August 18 and finished on August 21. The update was a routine spam-enforcement release rather than a newly announced flagship policy change, but third-party tracking indicates that its ranking effects were substantial for some websites. For site owners dependent on organic search , the central message is straightforward: Google’s enforcement against spam remains active, and abrupt visibility changes can be severe when a site falls on the wrong side of its quality and manipulation assessments. Google recorded the release and completion of the rollout in its official Search Status Dashboard incident entry . The company listed the start time as August 18, 2026, at 09:27 PDT, and marked the incident complete on August 21, 2026, at 01:49 PDT. It was Google’s third announced spam update of 2026, following spam updates in March and June. The official notice establishes the timing of the rollout, not a detailed account of which sites or tactics were affected. That is where independent ranking data adds useful context. SE Ranking’s analysis, later reported by Search Engine Land, found that 16.71% of URLs that had ranked in the Top 10 dropped beyond position 100 for the same keyword during the August update. Its July baseline showed 9.2% making that same move. The August share was therefore roughly 82% higher than the baseline. What the ranking data shows A move from the Top 10 to beyond position 100 is not a minor fluctuation. It can effectively remove a page from the search results that most users see, with an immediate effect on clicks and leads for pages that previously generated traffic. The SE Ranking figures do not prove that every observed loss was caused by Google’s update, nor do they identify every affected site type. They do, however, provide a market-wide indication that the August rollout coincided with sharper movement than a normal July comparison period. Measure July baseline August 20
Previously, on Day 3: Explained stopword removal, stemming, and lemmatization in NLP, including how they simplify and normalize text for analysis using practical examples and Python code. Text Vectorization: Turning Words into Numbers Computers work with numbers, not text. To handle language, a Natural Language Processing (NLP) system must convert words, sentences, or documents into numerical data. Usually, this means turning them into vectors—ordered arrays of numbers. This process is called text vectorization . A vector is a mathematical summary of a piece of text. The details and meaning behind the numbers depend on which vectorization method is used, but all serve a common purpose: to translate language into something a machine can process. For example, imagine building a program to filter spam emails. The program can't directly understand words like "WINNER" or "sale." Every word must be mapped to a number before the program can look for patterns in messages. What is the Bag-of-Words Model? Bag-of-Words (BoW) is the simplest and most common way to vectorize text. BoW ignores grammar and word order. It treats each document as a "bag" containing words, just counting how many times each word appears. For example, the sentences "dog bites man" and "man bites dog" will produce the same vector in a BoW system. Both have the words "dog," "bites," and "man," each once. The meaning is very different to a human, but to BoW, they're identical. This straightforward approach makes BoW fast and effective for many tasks, especially where quickly spotting key words is enough—for example, spam detection. From Words to Vectors: Building a Vocabulary The first step in BoW is to build a vocabulary . This is a list of all unique words seen across your dataset (called a "corpus"). Suppose your dataset contains two sentences: "cat sat on the mat" "dog sat on the log" List all unique words: ["cat", "sat", "on", "the", "mat", "dog", "log"] The word order in the vocabulary doesn't matte
We held off on posting a benchmark for a long time. Not because we didn't have runs - because most memory benchmarks you read are a number with no way to check it. A blog says "X%", and you have no idea what reader answered the questions, what judge scored them, how much context the retriever was allowed to feed, or whether an LLM quietly did the hard part inside the "memory" layer. So the number tells you almost nothing about the memory system. Here is one we're comfortable standing behind, because you can run it yourself. The result On LongMemEval-S , the full 500-question set, Engrava 0.6.0 scored 81.6% micro in August 2026 - 81.76% averaged across the six question categories. The run uses the canonical LongMemEval scorer (pinned to a known upstream commit), the standard gpt-4o-2024-08-06 reader and judge over the OpenAI API, and a top_k of 20 retrieved turns. Nothing about the reader, the prompt, or the scorer is ours; the only thing we swapped in is the memory. It is compared against the previous release: 0.5.0, run in July 2026, scored 82.4% micro / 82.58% macro on the same 500 questions, same reader, same judge, same scorer, same top_k . Both rows are on the leaderboard, both verified , and both ship their reproduction artifacts. We are leading with 0.6.0 because that is the version this post is about; the older row stays because removing it when the number goes down is exactly the move that makes benchmark pages worthless. 0.5.0 (2026-07-10) 0.6.0 (2026-08-11) micro 82.4% 81.6% macro 82.58% 81.76% n 500 500 Both figures are dated on purpose. This post is a record of two specific runs, not a running scoreboard; the current table, whatever version is newest when you read this, lives on the Engrava benchmarks page . The run also has no LLM in the memory pipeline. Ingestion and retrieval are deterministic - hybrid search over a typed graph, no model doing extraction, summarization, or re-ranking behind the curtain. In the benchmark's own terms this is a Group A
Dozens of companies came together to publish an open letter titled "A call for collective action on cyber defense."
Google has renamed NotebookLM as Gemini Notebook , placing its source-grounded research tool more directly inside the Gemini ecosystem. The change is more than a new label. Google is connecting notebooks with Gemini and Google Search, documenting broader source engagement through Deep Research and Expert Intelligence, and adding the ability to run code in notebooks for eligible higher-tier users. For teams that assemble information from documents, web pages, spreadsheets, presentations and specialist publications, the direction is clear: Gemini Notebook is intended to become a workspace for combining sources rather than treating each source as a separate research task. The practical value depends on the quality and permissions of the material a user adds, but the product is moving toward a more connected knowledge workflow. What changes with Gemini Notebook In its July 16, 2026 announcement, Google's official Gemini Notebook update confirmed that NotebookLM continues under the Gemini Notebook name. Google described the change as part of a wider integration with Gemini tools and surfaces, including the Gemini app and Google Search. The renamed service retains the notebook model: users bring together sources and ask questions based on that supplied material. Google Help documentation describes supported and discoverable sources across the web, Google Drive, Gemini Chats and other surfaces. Examples include web URLs, YouTube videos, PDFs, ePub files and Drive content. In relevant contexts, the documentation also references Google Docs, Sheets, Slides and Google Play Books content. Google uses Expert Intelligence to describe a source-engagement framework that helps people work with trusted sources. The related announcement says this begins with eligible Google Play ebooks in Gemini Notebook, allowing readers to combine authors' expertise with other sources in a notebook. Eligibility matters. The available material does not establish that every Play Books title can be us
xAI accused of training Grok on real and AI-generated child pornography.
Nvidia is nabbing critical infrastructure for open models as interest grows.
Zoph, who co-founded Thinking Machines Lab alongside Mira Murati and also served as the startup's CTO, led a brief stint at OpenAI and is now at Google.
Netflix and Rockstar Games finally debuted their "extended look" at Grand Theft Auto VI. It showed that the new game looks to keep much of the spirit of GTA - exploration, driving, crimes, shooting, and cinematic story scenes. But everything just looks much better than previous entries, with impressive graphics, densely-packed rooms, and detailed environments. […]
Google's AI note-taking app, Gemini Notebook, can now pull information from the books you've purchased. The new "Expert Intelligence" feature allows you to bring titles from Google Play Books directly into Gemini Notebook, which means you can ask questions about the material, as well as generate plans, infographics, AI podcasts, and more based on their […]
Tech industry is perplexed by Trump’s plan to win AI race by taxing data centers.
Indexar o código fora do repo: como economizar tokens sem jogar o projeto no contexto Pessoal, o agent precisava achar um símbolo. Trabalho de um minuto. Na prática, ele abria arquivo atrás de arquivo, colava dump de teste no papo e a janela sumia. Às vezes a fatura também. Não era o modelo burro. Era eu pagando o monorepo inteiro pra responder a pergunta errada. A pergunta mudou. Deixei de ser “qual tool faz o agent entender o repo?” e virei: o que é memória de domínio, e o que é só custo de ler código nesta sessão? Tem um segundo motivo, e ele não é economia. Um índice de símbolos é um mapa do seu sistema : quem chama o quê, onde está o fluxo crítico. Se esse mapa mora no git, no cache de CI ou num serviço que o agent também escreve, o blast radius não é só token. É superfície. Duas contas, um prompt Memória de domínio é política. O que pode ser lembrado, por qual porta se entra, o que é canônico. Notas, contratos, “onde a gente decide X”. Indexer de código não resolve isso. Code-read barato é custo de sessão. Achar caller e símbolo sem despejar o working tree no prompt. Isso não deveria virar a sua base de conhecimento. Eu misturava. O indexer virava KB. O vault virava grep sem porta. Os dois falhavam, e a sessão inchava igual. Economizar token aqui não é trocar de modelo da semana. É separar camada. E decidir onde o mapa vive . O que eu mudei na mesa O mapa de símbolos saiu do working tree. Cache local, fora do repo , fora do git. Reindex é operação de máquina, não de PR. O agent consulta o índice; não precisa reler o monorepo pra “quem chama essa função?”. Quatro perguntas que eu faço antes de indexar um repo (vale colar no README do setup): O índice vive na minha máquina ou sai dela (cloud, CI, cache compartilhado)? Entra em contexto de agent que também tem tool de escrita ? Como eu apago e revogo? Quem mais lê isso? Índice ≠ fonte de verdade versionada. Least privilege no que entra no contexto continua valendo. Depois, parei de mandar firehose de CLI cru. tes