标签：#ai

Anthropic shipped Claude Fable 5 on June 9, 2026 — its first generally available Mythos-class model, priced at $10 per million input tokens and $50 per million output. That is exactly double Claude Opus 4.8, and the benchmark deltas are real: SWE-Bench Pro 80.3% vs 69.2%, FrontierCode 29.3% vs 13.4%. But the price is not the migration story. The API behavior is. Fable 5 ships three breaking changes that will silently misbehave in any integration that assumes Opus-era semantics. This post covers what actually changes in your code, what the bill looks like, and where the traps are. I run model intelligence at TokenMix , where we track pricing and API behavior across 300+ models. Everything below is sourced from Anthropic's launch docs, migration guide, and pricing page — verified June 10, 2026. The 60-second version Price: $10/$50 per MTok. Every rate is exactly 2× Opus 4.8 — cache reads $1, 5-min cache writes $12.50, 1-hour writes $20, batch $5/$25. Specs: 1M context, 128K max output, no long-context surcharge. Model ID: claude-fable-5 on the Claude API; anthropic.claude-fable-5 on Bedrock; anthropic/claude-fable-5 on OpenRouter. Breaking change 1: Adaptive thinking is always on. thinking: {"type": "disabled"} returns an error. Breaking change 2: Refusals are HTTP 200 responses with stop_reason: "refusal" — not error codes. Breaking change 3: Safety classifiers reroute flagged requests to Opus 4.8 (under 5% of sessions), and rerouted requests bill at Opus rates. No ZDR: 30-day data retention is mandatory. Zero-data-retention accounts don't see the model at all. Breaking change 1: thinking is no longer optional On Opus 4.8 you could disable thinking to trade quality for latency. On Fable 5 you cannot — adaptive thinking is permanently on, and the model decides how much to think per request. Your replacement lever is the effort parameter: { "model" : "claude-fable-5" , "max_tokens" : 16000 , "effort" : "high" , "messages" : [ ... ] } Five levels: low , medium , high ,

GitHub is not just a source code platform anymore. For most engineering organizations, GitHub is part identity system, part software supply chain, part CI/CD platform, part secret store, part deployment orchestrator, and part production change-control system. That means we should secure GitHub like a production control plane. This guide is written from the perspective of a CISO tightening GitHub across an organization. It is not a high-level best-practice list. It is a practical hardening baseline we can apply, audit, and improve over time. The goal is simple: Nobody should be able to compromise our source code, workflows, secrets, build systems, release process, or production environments because GitHub was loosely governed. How to Use This Guide Use it in three layers: Layer Audience Purpose Executive baseline CISO, Head of Engineering, Platform leadership Define why GitHub is a Tier-0 engineering control plane Security standard Security, Platform Engineering, AppSec, DevSecOps Define mandatory controls, evidence, exceptions, and ownership Operational runbook SOC, repository owners, release engineers Support onboarding, monitoring, detection, incident response, and quarterly review Control language in this guide should be interpreted as follows: Term Meaning Must / Required Mandatory baseline control unless a documented exception is approved Should / Recommended Strongly expected control; deviations require documented rationale May / Optional Context-dependent control based on repository classification and risk Exception Time-bound, risk-accepted deviation with owner, compensating controls, and review date Every mandatory control should eventually map to: Control ID → Requirement → Owner → Enforcement → Evidence → Monitoring → Exception path Section 29 provides the operational enforcement map that tells administrators where to find each GitHub setting, what to configure, and what evidence to retain. This prevents the standard from becoming a long checklist that no

Last week I shipped something that would have sounded reckless two years ago: an MCP server that lets an AI agent write to a merchant's live Shopify store. Create discount codes. Build customer segments. Draft WhatsApp campaigns against real order data. Read-only agent integrations are everywhere now, and they're fine — but a read-only agent is just a chatbot wearing a dashboard. The useful version is the one that does the thing . The dangerous version is also the one that does the thing. A hallucinated SELECT is a wrong answer; a hallucinated discount code is free product going out the door. So before turning writes on, I sat down and listed every way an agent could hurt a store. Then I built one guardrail per failure mode. Here's the list — it's short, and I think it generalizes to any agent surface that touches business data. 1. Read-only by default. Writes are a per-token opt-in. The lazy design is one API key that can do everything the app can do. Instead, every agent token starts read-only — list customers, inspect segments, read campaign stats. Write capability is a separate flag the merchant flips per token: { "token" : "fav_mcp_…" , "scopes" : [ "read" ], // default "writeEnabled" : false // explicit opt-in , per token } This sounds obvious. It is obvious. It's also the single most-skipped step I see in agent integrations, because it's friction during development. Build the friction in anyway — "the agent could read everything but couldn't have sent that" is a sentence you really want available to you later. 2. Caps live in the tool schema, not the prompt. Early on I had a system prompt that said something like "never create discounts above 30%." You can guess how durable that is. Prompts are suggestions; schemas are physics. So the caps moved into the tool's input validation itself — the shape of it: // create_discount — validated server-side, not prompt-side { percentage : z . number (). min ( 1 ). max ( 100 ), // hard ceiling, enforced in the service exp

The Model Context Protocol is everywhere right now. Every agent tutorial opens with "first, set up your MCP servers." And yet the agent stack running on the machine I'm typing this from — search monitoring, Telegram alerting, social posting, a voice assistant — contains exactly zero MCP servers. Everything talks to external services through direct API calls. That's not a rejection of MCP. It's a protocol, not a movement — and the flood of agent-architecture content keeps turning plumbing decisions into identity decisions. You're not an "MCP shop" or "behind." You're making a per-workload integration choice, and it comes down to two gates: one decides whether MCP is even the relevant category, the other decides whether it's worth the overhead. Gate one — relevance: does a model pick the tool at runtime? MCP exists to solve a specific problem: a language model, mid-session, deciding which tool to use. The protocol standardises how a model discovers tools, what their schemas look like, and how results come back. That's its entire reason to exist — it's a model-facing protocol. If no model is ever choosing, MCP isn't the relevant category; you'd share a library or stand up a plain service. Now look at what most automation actually is. My morning report pipeline: Cron fires at 8:30 Script calls the Google Search Console API Script formats the numbers Script posts to Telegram The model isn't deciding anything here. There's no runtime tool choice — the model's only job in pipelines like this is reading the data at one step, not fetching it. The call order is fixed, every day, forever. For this workload, MCP isn't the question. One subtlety that matters later: gate one is evaluated over a tool surface's consumers , not over the workload in front of you. The cron pipeline will never pass it. But the search-data access underneath it might — the day a model-driven client wants the same data. The pipeline isn't an MCP candidate; the surface can become one. Either way: being an

DEV.to Article: How I Built an FTIR Analysis Platform with Claude Title: How I Built an FTIR Analysis Platform with Claude (and What I Learned About AI-Assisted Development) Tags: python, chemistry, opensource, ai Published: true (can publish immediately on DEV) The Backstory I'm a materials science graduate, not a software developer. I know FTIR spectroscopy — identifying polymers, interpreting functional group peaks, matching unknown samples against reference libraries. But when I needed to search FTIR spectra programmatically, I hit a wall: the existing tools were either expensive enterprise packages or Excel macros from the early 2000s. So I decided to build my own. And I used Claude (Anthropic's AI assistant) as my coding partner. This is the story of how a domain expert with basic Python skills built a production FTIR search platform — 135,000 spectra, MCP server, API, community features — with AI writing about 70% of the code. Step 1: The Core Algorithm FTIR spectrum matching sounds complex, but the core is simple geometry: given a set of peak positions from an unknown sample, find the library spectra with the most matching peaks within a tolerance window (typically ±5 to ±15 cm⁻¹). What Claude helped with: Writing the initial peak-matching loop Setting up the Django project structure Designing the database schema for the spectral library What I handled: Understanding which tolerance values actually work (different wavenumber regions need different tolerances) Validating match results against known materials Rejecting the first three algorithm designs that looked correct on paper but failed on real data Lesson: AI can write the code faster than you can, but it can't tell you if the chemistry is right. Domain expertise is the bottleneck, not code. Step 2: Parsing FTIR Instrument Files This was the hardest technical challenge. FTIR instruments output data in at least 6 different formats: Format Origin Difficulty SPA Thermo Nicolet Medium — binary, proprietary S

The Agent Revolution Is Here and It's Messy So here's what I'm seeing across the AI landscape right now: agents have stopped being this theoretical concept and become a genuine operational problem for enterprises. And I mean that in the most interesting way possible. The AI agents stack is now mature enough that O'Reilly published a formal breakdown of the six layers between your LLM and a production agent. That's the moment you know something has crossed from experimentation into infrastructure. Companies like Workday are shipping Agent Passport, which basically lets you verify and continuously monitor every AI agent you've deployed against standards like OWASP LLM Top 10 and NIST AI RMF. This is enterprise hardening in real time. But here's the thing that got my attention: the security failures are becoming more creative. Meta's AI customer support agent was weaponized to steal Instagram accounts. It's not that the model was broken—it's that we're still learning how to run production AI safely at scale. Every new capability creates a new surface area. Every surface area gets tested by someone. The multimodal shift is accelerating too. Google dropped Gemma 4 12B last week—an encoder-free multimodal model that runs natively on audio and video. More importantly, it runs on a 16GB laptop. We've hit the inflection point where local multimodal inference isn't a compromise anymore, it's genuinely viable. CVPR 2026 had 4,089 accepted papers, with multimodal AI doubling its share. The academic momentum is undeniable. What's happening in the real world is different though. I'm watching small-business owners deploy entire armies of AI agents—on their finances, customer service, email management. The New York Times ran this piece about what happens when you let agents loose on your actual business. The answer is: sometimes brilliant, sometimes chaos, always operational learning. The local AI trend is real but it's not about ideology anymore. It's about economics and latency.

This is a story about a company that rolled out an AI interview system — and the lunch break I spent...

Your MCP server works. But does anyone know it exists? We scored 39,762 MCP servers. 54% scored Grade C — solid code quality, zero community adoption. They're invisible to the AI agents that need them. Here's how to go from invisible to discovered. What Your Grade Actually Means Our scoring uses an additive model: Composite Grade = Quality Score (0-100) + Community Bonus (0-60) + Trust Bonus (0-30) Grade Score What it means B+ 86+ Very good — close to elite B 76-85 Good — your target C+ 66-75 OK — getting there C 46-65 Average — this is 54% of all tools D 21-45 Needs work F 0-20 Critical If you're at C, you're not failing. You just haven't been discovered yet. Step 1: Fix Your Quality Score (Quick Wins) Quality Score is 5 dimensions. Here are the fastest fixes: Token Efficiency (25%) Every token in your tool definition counts against the agent's context window. Bad: 500+ tokens OK: 200-350 tokens Good: 100-200 tokens Elite: ≤50 tokens Fix: Cut redundant parameters. Shorten descriptions. Use concise naming. Most tools can save 40-80 tokens in 15 minutes. Schema Correctness (25%) Agents need machine-readable schemas. Fix: Add a type field. Define properties . Include required fields. A well-structured schema can add 30+ points to your quality score instantly. Description Quality (20%) Write for AI agents AND humans. AI agents need clarity. Humans need to understand what your tool does at a glance. A good description serves both. ❌ Bad (confuses everyone): "PDF tool" ✅ Good (clear to both agents and humans): "Extracts text and tables from PDF files. Supports multi-page documents. Returns structured JSON with page numbers." ✅ Better (humans can instantly understand, agents can parse): "Extracts text and tables from PDF files. Example: extract_tables('report.pdf') → [{page: 1, rows: [[...]]}]. Supports multi-page documents." A human scanning GitHub repos decides in 3 seconds whether to try your tool. An AI agent scanning tool definitions decides in 3 milliseconds. Serve

In times when people believe that "AI can code a website in 2 days" (see: how to leverage AI as a...

Studies and vendor-reported benchmarks suggest that AI-powered growth systems can compress...

AI coding tools are powerful. But they’re also wasteful. A tiny helper-function question does not need Claude Sonnet. A huge architecture review probably does. That gap costs money. So I built Badgr Auto. It’s a local OpenAI-compatible proxy that routes each AI coding request to the cheapest model that can handle it. Point your coding tool at: http://localhost:8787/v1 Badgr Auto can route between: local models cheaper OSS cloud models premium models So instead of paying premium prices for every request, you can use: local for small tasks OSS cloud for normal coding work premium only when it actually matters It also tracks: actual cloud spend which route was used fallback events tokens safely removed estimated savings vs premium models The goal is simple: stop wasting premium tokens on cheap tasks. First launch is small: small task → local normal task → cheaper cloud hard task → premium provider fails → fallback duplicate code → safely removed receipts → clear spend trail AI coding is only going to get more expensive if every agent step goes to the top model. Badgr Auto is my attempt to make AI coding cheaper without making it worse.

Something changed in software engineering, and I do not think we have fully named it yet. For years, the job was mostly about writing code directly. Then autocomplete got better. Then chat-based coding assistants arrived. Now the workflow is shifting again: we describe goals, hand off chunks of work to agents, inspect their output, tighten the tests, and decide what gets merged. That is not the same job with a faster keyboard. It is a different shape of work. I would call it agentic engineering. The engineer is becoming a director Agentic engineering does not mean the engineer disappears. If anything, it makes the engineer's judgment more visible. A coding agent can read files, make changes, run commands, open pull requests, and iterate through errors. GitHub describes Copilot agent mode as a workflow where the agent can plan, edit, run terminal commands, and keep working until a task is complete. Google describes Jules as an asynchronous coding agent that can take a task, work in a virtual machine, and produce a pull request. Anthropic's Claude Code guidance talks openly about using multiple Claude sessions in parallel, giving agents clear context, and treating them like workers that need direction. That is the shift. The engineer is no longer only the person typing every line. The engineer is also the person deciding what should be built, what constraints matter, how to verify the result, and when the agent is wrong. Prompting is too small a word for this People often describe this work as prompting, but that undersells it. A prompt can be a single instruction. Agentic engineering is more like delegation. You define the task, provide the relevant context, set the boundaries, create checks, review the work, and decide the next move. If the agent goes in the wrong direction, the failure is not always the model's fault. Sometimes the task was too vague. Sometimes the repository had no tests. Sometimes the acceptance criteria lived only in someone's head. This is why

Would you treat a serious illness without seeing a doctor, relying only on whatever your favorite AI...

Google just made it significantly cheaper to enjoy its budget AI subscription tier.

Target: pnpm/pnpm Issue: pnpm/pnpm#12240 PR: pnpm/pnpm#12301 Public branch: https://github.com/scarab-systems/pnpm/tree/fix/deps-status-no-manifest Latest pushed commit: cb68ac1af0dcffbe4fb607a10b0df2046d2490ba This field test targeted a pnpm command-routing failure where pnpm self-upgrade could fail outside a project directory with: ERR_PNPM_NO_PKG_MANIFEST The issue looked simple at the surface: a global/self command should not require a project manifest just because the current working directory is not inside a package. But the repair boundary was more specific than “ignore missing manifest.” The problem was in the dependency-status verification path. When dependency status was unavailable because there was no project manifest, the command could fall through into the auto-install path. That made a self-upgrade/global-style command behave as if it needed a local project manifest. Failure shape The failing behavior was: pnpm self-upgrade run outside a project directory dependency status cannot be established from a project manifest the command path falls into install/manifest expectations result: ERR_PNPM_NO_PKG_MANIFEST That is the wrong ownership boundary. A self-upgrade command should not inherit project-manifest preconditions when there is no local project context. Boundary The boundary here is: global/self command execution versus project dependency-status verification Dependency-status verification can be useful when a command is operating inside a project. But when there is no project manifest and the command is not recursive/all-projects, “dependency status unavailable” should not automatically mean “try to auto-install project dependencies.” There are two different cases: Dependency status is unavailable because there is no project manifest. Dependency status is unexpectedly unavailable even though a root project manifest exists. Those cases should not behave the same. The repair preserves that distinction. What changed The patch updates: exec/commands/src

Have you ever stared at two different medicine boxes, squinting at the tiny font of the active ingredients, wondering: "Can I actually take these together?" Modern healthcare is complex, and drug-drug interactions (DDI) are a leading cause of avoidable ER visits. In this tutorial, we’re going to leverage GPT-4o Vision , React Native , and the FDA OpenData API to build a "Drug Conflict Scanner." We will utilize multimodal AI to transform messy pill-box photos into structured data and cross-reference them against official medical databases for safety. By the end of this guide, you'll master GPT-4o OCR structuring and automated knowledge graph verification for real-world health tech applications. 🚀 The Architecture 🏗️ The logic flow involves capturing images of multiple medicine labels, using GPT-4o's multimodal capabilities to extract chemical compounds, and then querying the FDA's database for potential interactions. graph TD A[React Native App] -->|Capture Multi-Photo| B[Node.js Backend] B -->|Image Buffer| C[GPT-4o Vision API] C -->|Structured JSON: Ingredients| B B -->|Search Interactions| D[FDA OpenData API] D -->|Drug Labels & Warnings| B B -->|Safety Report| A A -->|UI Alert| E{Safe or Warning?} Prerequisites 🛠️ To follow along, you'll need: GPT-4o API Key (via OpenAI) Node.js (for our backend relay) React Native (Expo is recommended for camera access) An account at open.fda.gov (though the public API works for limited requests) Step 1: Extracting Ingredients with GPT-4o Vision Traditional OCR struggles with curved medicine bottles and shiny packaging. GPT-4o excels here because it understands context. We don't just want text; we want the Generic Name of the drug. The Backend Logic (Node.js) // backend/scanner.js import OpenAI from " openai " ; const openai = new OpenAI ({ apiKey : process . env . OPENAI_API_KEY }); async function analyzeMedicineLabels ( imageUrls ) { const response = await openai . chat . completions . create ({ model : " gpt-4o " , messages :

Migrated 4 of 7 Notion automations to an MCP server in one weekend Two workflows stayed in Notion because the database UI beat any tool call MCP scope rule: one tool does one verb, never a Swiss Army function Result: 12 manual steps collapsed into 3 Claude prompts per publish I spent a weekend pulling four automations out of Notion and rebuilding them as MCP tools. Three of them got faster and one got worse before it got better. The biggest lesson was not about code. It was about deciding which jobs should never leave Notion in the first place. Why I Moved Off Notion In The First Place My Notion setup was not broken. It was just slow in a specific way. I had seven automations stitched together with Notion buttons, formula properties, and two third-party connectors. Every blog publish meant clicking through four pages, copying a title here, pasting a tag list there, and triggering a sync that took 90 seconds to confirm. Multiply that by the 18 articles I push in a normal month and the clicking adds up. The breaking point was a Tuesday where I lost 40 minutes to a connector that silently stopped firing. No error, no log, just a row that never updated. I checked the connector dashboard and it told me everything was healthy. It was not healthy. That kind of invisible failure is the worst kind because you trust it until you do not. MCP changed the math for me. An MCP server lets Claude call my own functions directly. Instead of Claude writing text and me ferrying that text into Notion by hand, Claude can call a tool that does the writing into my systems. The model becomes the operator, not just the writer. If you want the deeper context on what MCP actually is and why it matters at scale, MCP: The 97 Million Agentic Foundation goes through the bigger picture. So I made a list. Seven automations, sorted by how much human judgment each one needed. The ones at the top were pure mechanical steps: format this, push that, fetch a status. The ones at the bottom needed me to loo

A SaaS interface that works well for US users may confuse or alienate users in China, Germany, or Japan. Cultural differences affect everything from layout preferences to color meanings, form field expectations, and payment preferences. This guide covers the cross-cultural UX principles applied at tanstackship.com , a SaaS serving users across English, German, and Chinese markets. Cultural Dimensions and UI Impact Hofstede's Dimensions Applied to SaaS Design Dimension High vs Low UI Impact Power Distance Acceptance of hierarchy Navigation depth, permission displays Individualism vs Collectivism Personal vs group focus Social proof, testimonials Uncertainty Avoidance Tolerance for ambiguity Error messages, help text density Long-term Orientation Pragmatic vs normative Pricing display, trial periods By Market UX Element US (Low PD, High IND) DE (Low PD, High UA) CN (High PD, High COL) Navigation Flat, exploratory Structured, organized Hierarchical, guided Error handling Forgiving, "try again" Specific, detailed Authority-mediated Social proof Individual testimonials Expert reviews + data Group endorsement Pricing Monthly preferred Annual preference (trust) Discount attraction Help/Support Self-service docs Detailed documentation Chat + personal support Color meanings Green=success Green=environment Red=prosperity Color and Visual Design Color Meanings Across Cultures Color Western (US/EU) China Germany Japan Red Danger, passion Prosperity, luck Financial (deficit) Life, energy Blue Trust, technology Trust, immortality Trust, stability Trust, calm Green Success, nature Health, harmony Environment Youth, energy White Purity, clean Mourning Clean, efficiency Purity Yellow Warning, caution Imperial, power Jealousy Courage Practical Application // Adapt color scheme based on locale const colorSchemes = { en : { primary : " #2563EB " , // Blue — trust success : " #16A34A " , // Green — success danger : " #DC2626 " , // Red — danger warning : " #F59E0B " , // Yellow — warnin

GitHub shipped a small changelog entry this week that says more about the future of coding agents than most of the launch demos. Security validation for third-party coding agents is now generally available. Not just for GitHub's own Copilot cloud agent. For third-party agents too, including Claude and OpenAI Codex. The feature sounds boring in the best possible way. When an agent creates code, GitHub can run CodeQL, check new dependencies against the GitHub Advisory Database, and use secret scanning to detect tokens, API keys, and other sensitive material. If it finds a problem, the agent tries to fix it. That is not the flashy part of agentic coding. It is the important part. Because once agents are allowed to act inside repos, the question stops being "which model wrote this diff?" and becomes "can the repository apply the same policy to every automation actor?" authorship is the wrong abstraction We still talk about generated code as if authorship is the primary thing that matters. Was this written by Copilot? Claude? Codex? A human with tab completion? A human who pasted something from a chat window and cleaned it up? A junior engineer following a Stack Overflow answer from 2018? Those distinctions matter for procurement and product marketing. They matter less for the repository. The repository has a simpler problem: a change is trying to enter the system. It may introduce a vulnerability, add a risky dependency, leak a secret, violate an internal rule, or be perfectly fine. That is why the GitHub change is interesting. It moves the useful boundary from "our approved coding assistant" to "any coding agent operating in this repository." the agent is now an actor For years, repository automation was mostly boring and legible. CI ran tests. Dependabot opened dependency updates. Release bots bumped versions. Linters complained. Security scanners commented. Humans reviewed. The automation could be annoying, but its shape was predictable. Coding agents are different.

Parents want one thing, and one thing only, out of AI: to add a list of soccer games or "spirit week" theme days from an email or a poorly formatted flyer onto their calendar in one shot. And I have good news for parents with iPhones - the new Siri can finally do this. After […]