标签：#t

GitHub热门项目 | The Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents. | Stars: 2,367 | 444 stars today | 语言: Rust

I've always been the gamer in the family. When my son was born nearly 11 years ago, gaming was one of the things I looked forward to sharing with him. Pulling up a chair next to me, he would watch as I played Sea of Thieves with friends, often wearing the too-big-for-his-head headset to talk […]

I built a voice assistant that controls 45 AI tools. I say "Hey Jarvis" and it executes. What It Does Command Action "generate content" Creates YouTube scripts for 9 channels "research quantum computing" Deep research via Tavily + AI "write email about meeting" Drafts email, copies to clipboard "start focus" Starts Pomodoro + blocks apps "code review" Reviews git diff with AI "summarize" Summarizes clipboard content "find file tax PDF" Natural language file search Architecture Mic → Whisper (offline) → Intent Classify → Router → Ollama → say (TTS) Key Features Offline speech (Whisper local) Wake word: "Hey Jarvis" Global hotkey: Ctrl+Space Command chaining: "research AI then write blog" Memory across conversations Hindi + English Setup brew install portaudio pip install SpeechRecognition pyaudio openai-whisper python voice_commander_pro.py 🔗 github.com/amrendramishra/ai-tools 🌐 amrendranmishra.dev

hi, i am Aniruddha Adak, a full-stack developer from kolkata who spends way too much time building things with ai tools, shipping apps, and reading way too many github readmes at 2 am. i built 27 apps in 45 days using no-code and ai tools last year. that experience taught me one thing very clearly: the landscape of ai tooling for developers is moving insanely fast, and it is genuinely hard to keep up. so i sat down and did something about it. this is my deep research post on every ai tool, agent, builder, reviewer, and framework that developers, software engineers, and ai engineers should actually know about right now. i have organized it into categories so you can find what you need quickly. no fluff. just the tools, their sites, and what they do. why i wrote this i keep seeing developers waste time because they do not know the right tool exists. someone is manually reviewing pull requests for a week straight, not knowing coderabbit exists. someone else is hand-writing supabase schemas when emergent can do it in seconds. another person is spending days on a landing page when v0 can scaffold it in one prompt. this post is my attempt to fix that. i went through github repositories, dev communities, product hunt launches, and research aggregators to compile this. it is long. that is intentional. bookmark it. section 1: ai-native ides these are not just editors with a chatbot plugged in. these are environments built from the ground up around how language models think and work. tool site what it does cursor https://www.cursor.com forked vscode, codebase-aware context windows, multi-file edits with copilot-style background indexing windsurf https://windsurf.com cascade ai agent that writes files, runs terminal checks, and fixes things in real-time zed https://zed.dev built in rust with gpui, super low latency, native multiplayer coding support replit https://replit.com cloud ide with a full autonomous agent that runs inside serverless virtual workspaces google antigravit

AWS released an official Agent Toolkit that plugs Claude Code, Codex, and Cursor directly into your AWS account through a single MCP server. Instead of wiring up IAM roles and endpoints by hand, you install one plugin and the agent can search AWS docs, run sandboxed Python, and follow curated cloud skills with full CloudTrail audit logging. What the AWS Agent Toolkit Actually Is The Agent Toolkit for AWS is an open-source project (published on GitHub at aws/agent-toolkit-for-aws ) that bundles two things: The AWS MCP Server — a managed server that gives agents access to AWS through the Model Context Protocol. Agents can search AWS documentation and pull service information without authentication. To actually execute AWS API calls, run Python in a sandboxed environment, or follow curated skills, the agent authenticates through your existing IAM credentials. Agent plugins — single-install packages that bundle the MCP server configuration and a curated set of agent skills, so you don't configure endpoints and install skills one by one. The point is consolidation. One endpoint, IAM-based access controls, CloudWatch metrics, and CloudTrail logging of every API call for audit visibility. Which Agents It Supports Per AWS's own documentation, plugins ship for Claude Code, Codex, and Cursor . Kiro connects to the AWS MCP Server directly without needing a plugin, and any MCP-capable agent can point at the server manually. The install flow is refreshingly short for Claude Code: /plugin install aws-core@claude-plugins-official /reload-plugins The aws-core plugin is the recommended default — it bundles the MCP server config and skills covering service selection, infrastructure as code (CDK and CloudFormation), serverless, containers, storage, observability, billing, SDK usage, and deployment. A second plugin, aws-agents , provides additional agent-oriented capabilities. Why This Matters for Coding-Agent Users Until now, getting an agent to safely touch your cloud account meant h

✓ Human-authored analysis; AI used for formatting and proofreading. Delivery teams have DORA. Four metrics — deployment frequency, lead time for changes, mean time to restore, change failure rate that predict whether a team is shipping well. Thoughtworks recently added a fifth: rework rate, measuring how much of the pipeline is consumed by fixing work previously considered complete. These metrics changed how delivery organizations operate. Because they're leading indicators. They tell you the trajectory before the outcome arrives. A team with increasing lead times is heading for trouble. A team with rising rework rate is accumulating debt. You see it in the metrics before you see it in the incidents. Security teams have no equivalent. What security teams measure today Finding counts. "We found 247 misconfigurations this quarter." More scanning produces more findings. A team that scans more frequently or adds a new tool sees the number go up which looks worse even if posture is improving. Finding counts measure scanning effort, not security health. Compliance percentages. "We're 94% compliant with CIS Benchmarks." This measures the last audit, not the current trajectory. A team at 94% today might be at 87% next week if three Terraform changes introduced misconfigurations. The percentage is a snapshot, not a trend. It rewards breadth of coverage over depth. 94% across 200 checks sounds better than 100% across 50 checks, even if the 50 are the ones that matter. Incident counts. "We had two security incidents this quarter." This is a trailing indicator. It measures failures that already happened. A team with zero incidents might have excellent posture or might have excellent luck. You can't tell. By the time the count goes up, the damage is done. None of these answer the question delivery teams answer with DORA: are we getting better, and how fast? The mapping The five DORA metrics adapt directly to security posture. The definitions are concrete and measurable from eval

Intro An MCP server can look like another API layer: expose existing REST endpoints as tools and call it a day. Both receive input, execute backend logic, and return a result. But they operate under different assumptions. This two-part series explains why directly wrapping REST APIs is a bad default. This first article covers the differences in their runtime environments. The second will discuss how those differences should affect MCP design (you already know how to design a good REST API ). We can see those differences more clearly by comparing the two across several dimensions. Dimensions The consumer With REST, developers encode control in application logic. The application knows when to call an endpoint, what arguments to send, and how to handle the response. Those decisions are made during development. With MCP tools, much of that control moves to the AI agent. The model interprets the request, chooses a tool, constructs its arguments, evaluates the result, and decides what to do next. The harness can restrict it, but the model is still part of the control flow. A REST client already knows why it is making a call. An agent must first decide whether a tool is relevant at all. MCP tools The context A REST application can draw from application state, cookies, memory, and user input. Code written by a developer determines which parts become request parameters. An agent can draw from the current request, conversation history, and previous tool results. The MCP server does not see this context automatically, but the model may turn parts of it into tool arguments at runtime. The difference is who selects what reaches the backend: predetermined code or a model reasoning over a changing conversation. The action model REST APIs tend to expose focused, fine-grained operations that application code can compose. Keeping endpoints simple and stable limits regressions because a developer has already written and tested the workflow that connects them. With MCP, the agent often

Playing the game of writing technical post was funny two years ago. Now, I am a mod and it is...

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on the data center buildout, follow Emma Roth. The Stepback arrives in our subscribers' inboxes on Sunday at 8AM ET. Opt in for The Stepback here. How it started Years before the AI boom threatened local power […]

New climate evidence adds context to these long voyages.

We found lots of math-filled and science-rich toys for tiny nerds to assemble, bake, squish—or even tear apart and rebuild.

Apple has announced several new Child Safety features coming soon to iPhones and other devices. Here’s what’s changing.

Researchers cobbled together funding and time to show how quantum computing could aid in the development of drugs to help underserved populations and combat rare diseases.

Earlier this month I shipped two premium templates — a SaaS landing page and a developer portfolio. Not a startup, not a SaaS, just templates. This post is about the two constraints I built them under, why they made the code better, and a few things I learned launching as a solo dev with zero audience. Constraint 1: zero dependencies beyond next, react, and tailwind Open the package.json of most templates and you'll find 20+ packages: icon libraries, animation libraries, carousel plugins, UI kits, utility libraries. Every one of them is a version conflict waiting to happen for the buyer, and most are replaceable with a few lines of code in 2026. What I used instead: Icons → inline SVG components. An icon component is ~10 lines. You need maybe 15 icons for a landing page. Animations → plain CSS. Scroll-blur navbars, gradient glows, an animated "typing" terminal — all doable with keyframes and transitions. No framer-motion. The dashboard mockup in the hero → pure CSS. Divs, borders, gradients. It looks like a product screenshot but it's ~80 lines of JSX and weighs nothing. Result: both templates land at ~100KB first-load JS, npm install takes seconds, and there is nothing to break when Next.js 16 arrives. Constraint 2: every piece of content in ONE typed config file The thing I hated most about templates I've used: content is smeared across 30 components. Changing a headline means hunting through JSX. So both templates keep all content in a single file — lib/content.ts for the landing page, site.config.ts for the portfolio. Headlines, nav, pricing tiers, testimonials, project lists, even the lines that animate in the fake terminal. Components are pure renderers of that config's TypeScript type. Two things surprised me here: TypeScript becomes your content linter. Forget an alt text, malform a link, give a pricing tier three features when the type expects a non-empty array — the build fails. Content mistakes surface at compile time. It forces better component design. W

Автор: Владислав Штер, соло-фаундер экосистемы SovereignПоследнее обновление: Июль 2026 года Поиск критических уязвимостей через нейросетевой консилиум Egregor. Десктопное приложение Egregor находит критические уязвимости в смарт-контрактах с помощью одновременной работы нескольких ИИ-моделей. Этот инструмент создан для Web3-разработчиков, которым необходимо проверять сложный код без риска пропустить ошибки, свойственные одиночным нейросетям. В ходе тестирования консилиум Egregor обнаружил 4 критические проблемы (включая уязвимость Reentrancy и вечные права деплоера) в смарт-контрактах SovereignBank Web3, тогда как 13 ручных проверок одиночными топовыми ИИ (Claude, Gemini, ChatGPT, DeepSeek, Grok) назвали код полностью чистым. Используйте платформу Egregor для проведения глубокого аудита кода, чтобы получать верифицированные решения вместо догадок одной модели. Защита от эхо-камеры и слепых зон алгоритмов в программе Egregor Система Egregor устраняет эффект эхо-камеры и систематические слепые зоны нейросетей за счет встроенных механизмов Anti-Groupthink и "Адвоката дьявола". При анализе сложной логики одиночные нейросети часто вежливо соглашаются друг с другом, но алгоритмы Egregor запрещают моделям принимать чужие выводы без подтвержденных в коде фактов. Во время аудита смарт-контракта механизм перекрестной проверки в Egregor отсеял неподтвержденные гипотезы и позволил 5 моделям в разных ролях перекрыть слепые зоны друг друга. Запускайте локальный консилиум Egregor, чтобы система сама отделяла реальные баги от шума и выдавала финальный вердикт Модератора с оценкой уверенности от 1 до 5. Стоимость многоуровневого анализа кода на платформе Egregor Программа Egregor кардинально снижает финансовые затраты на профессиональный аудит кода до нескольких центов. Данное решение идеально подходит для инди-разработчиков и участников хакатонов, у которых нет бюджетов в тысячи долларов на заказ проверок у специализированных аудиторских компаний. Полноценный комплексный прогон мо

OrbitLens Ace → ace.orbitlens.io A busy quarter is easy to stage. Code that's still there in two years isn't. Pick any metric a team has ever used to judge people, and someone has quietly figured out how to move it without doing the underlying thing. Lines of code rewarded typing, so people typed. Commit counts rewarded committing, so commits got smaller and more frequent. Velocity rewarded closed points, and points drifted upward until a "3" meant nothing. DORA measured how often you deploy, so teams shipped trivial changes just to move it. Even churn — the number the "code health" tools lean on — is something you can lower on purpose, which means you can manage the number instead of the mess underneath it. None of that requires dishonest engineers. It's Goodhart's law doing what it always does. Every one of those numbers is a measure of activity , and activity is cheap to produce. Once you're paid for activity, the fastest way to get paid more is to produce more of it — not more of whatever the activity was supposed to be a sign of. So the question worth asking isn't which activity metric is least bad. It's whether a git history contains anything at all that you can't move just by being busier. It turns out there's one. And it's not because we were clever — it's because of what the thing is actually made of. What lasts isn't something you do Take everything a person wrote, wait a while, and ask a smaller question than "did they work hard." Ask whether the specific lines are still there. Not reverted, not rewritten, not quietly swallowed by someone else's refactor. Still holding weight at HEAD. That's survival. We read it with time-decayed git blame : a line's weight fades month by month unless the line keeps existing, and it counts for more once other people have built on top of it instead of leaving it as a private island. Survival that others have built on is what we call gravity — the structural pull that outlives the person who created it. Try to game it and w

@kungfufk Since the dawn of computing, we have built Artificial Intelligence on a flawed premise: perfect rationality. We brute-force algorithms to find the optimal solution, assuming infinite time and infinite capacity. But humans don't work like that. As Herbert Simon famously coined, we operate on Bounded Rationality. We make decisions based on limited time, limited cognitive capacity, and limited information. What if, instead of forcing AI to be perfectly rational, we created a mathematical equivalent for human processing? What if we modeled human cognition using the laws of physics — wave theory, thermodynamics, and mechanical energy equations — to build a heavy, complex, but highly probabilistic AI engine? Here is a blueprint for a new field of research: Computational Cognitive Mechanics . 1. The Core Equations of Cognitive Processing To model bounded rationality mathematically, we first need to define the relationship between Knowledge ($K$), Cognitive Capacity ($C$), and Processing Time ($T$). Based on human observation, we can establish these foundational proportions: Knowledge vs. Time — The more knowledge you possess, the faster you can generate a decision. $$T \propto \frac{1}{K}$$ Capacity vs. Time — High cognitive capacity (skills, processing power) inversely relates to the time required to solve a problem. $$T \propto \frac{1}{C}$$ Knowledge vs. Capacity — This is the most fascinating limit. Knowledge does not scale linearly with capacity. Gaining true knowledge requires exponential capacity (effort/skill). Therefore, knowledge is roughly proportional to the square root of capacity. $$K \propto \sqrt{C}$$ By integrating these, we can build a baseline processing algorithm for an AI. Instead of giving an AI unlimited time to compute, we cap its computing time based on a synthetic "Knowledge and Capacity" matrix, forcing it to use heuristics — just like a human. 2. Cognitive Wave Theory & FFT: Information as Interference In physics, waves interact throug

Checkpoint-skip gate: a multi-agent pipeline can finish with task_success: true while the mandatory confirmation checkpoint never ran. checkpoint_skip_gate.py replays a recorded JSONL trajectory against a declarative spec of mandatory checkpoints and handoff contracts, offline, and blocks when the road was wrong. The verdict never consults the final metric. That is the point. AI disclosure: I wrote checkpoint_skip_gate.py with an AI assistant and ran it myself, offline, on Python 3.13.5, standard library only, no network. Every number, exit code, and hash in the output blocks below is pasted from a real local run. I ran each scenario twice to confirm STDOUT is byte-for-byte identical, and the tool prints a sha256 of its own report so you can reproduce the exact bytes. The Alberta write-up and the arXiv paper I cite are other people's work, attributed inline, and their numbers stay out of my fixtures. In short: task_success=true proves the pipeline arrived. It does not prove the mandatory steps happened, happened in order, or that each agent-to-agent handoff delivered what the next agent assumed. A trajectory can be perfectly green and structurally wrong. The gate replays a recorded trajectory against a spec you declare: checkpoints that must precede specific actions, plus contracts for each handoff (required fields, verified flags). The final metric is printed for contrast and ignored for the verdict. The demo that matters: two trajectories identical except one JSONL line, the confirm_with_user checkpoint event. Both end task_success: true . Delete that line and the verdict flips from PASS exit 0 to BLOCK exit 1 checkpoint-skipped . It also tracks unverified values across handoffs. A number that travelled a connected chain of two handoffs with no hop verifying it blocks as unverified-claim-propagated-2-hops . Everyone shared the number. Nobody verified it. Offline, keyless, zero network, fail-closed: broken input exits 2, never a silent green. The whole 8-fixture sw

Need an ultrafast drive for video editing or a rugged option to back up your photos in the field? We’ve got a solution for every situation.

Every logistics and field-sales team runs the same expensive process: a driver photographs a receipt into a WhatsApp group, and a back-office clerk manually types the invoice number, total, and date into a spreadsheet. Hundreds of receipts a week = transcription errors and thousands of wasted hours. AI vision models kill that bottleneck. Here's the pipeline that turns a blurry field photo into clean structured data in seconds. Why vision models beat traditional OCR OCR reads characters. Modern vision models (Claude Vision, Gemini Vision, GPT-4 Vision) read structure — they distinguish a tax ID from a total, and a date from an amount, even on crumpled, angled, or poorly lit receipts. No brittle per-vendor parsers. The pipeline (3–8 seconds end to end) WhatsApp image → Apps Script doPost → forward to vision model → model returns JSON { InvoiceNumber, TotalAmount, VendorName, Date, Category, confidence_score } → confidence routing: > 90 → auto-append to ledger 70–90 → flag for human review < 70 → ask driver to re-photo → write row to Google Sheet (+ link to original image) → auto WhatsApp confirmation to driver The confidence_score is the whole trick — it's what stops bad extractions from silently polluting your ledger. Model selection (this drives your bill) Gemini Vision — cost-efficient default, strong multilingual OCR, great on clean receipts. Claude Vision — highest accuracy on degraded receipts; use for high-stakes flows. GPT-4o Vision — competitive, strong structured extraction. Pattern: Gemini for the first pass, escalate only low-confidence cases to Claude / GPT-4o. The economics ~500 receipts/week: vision API $10–40 + WhatsApp API $30–60 + Apps Script free = ~$40–100/month . Versus a clerk at ~25 hrs/week = $2,000–4,000/month in loaded labor. Per-receipt cost: $0.005–0.02 (compress images to ~1024px to cut it further). Accuracy: 92–97% on legible receipts, 75–85% on handwritten/damaged — hence the confidence routing. Pitfalls to avoid Auto-appending with no c