#developer-tooling

Headless permission defaults for 12 coding-agent CLIs: which write files without asking, which refuse until you pass a flag, and which actually sandbox.

One fixed Python task, run twice through eight headless coding-agent CLIs, with tokens, wall-clock time and list-price cost measured for every run.

We checked 19 widely deployed MCP servers for documented instruction surfaces beyond tool descriptions. Only one discloses one. Undocumented is the finding.

GitHub brought Copilot to Slack and Microsoft Teams on August 21, both public preview. The cloud sandbox bills on its own rates, worded differently per surface.

MCP promoted its Rust SDK to Tier 1 on August 21 with 67/67 server and 50/50 client conformance. No new protocol version shipped alongside it.

On August 19 Cursor's cloud agents gained PR subscriptions, goals and per-task VMs, and Codex cloud added GitLab in beta. Agents now persist past one prompt.

Claude Code v2.1.234 hardened the remaining pre-approval NTLM path accesses. Codex CLI 0.148.0 added Bedrock and session forking. What changed for operators.

CVE-2026-75130 scores 9.0 under CVSS 3.1 and 6.4 under CVSS 4.0. Context7 2.1.2 and earlier are affected; no public fix documented as of Aug 22, 2026.

Grok 4.6 reached Cursor the day it launched. The argument that switching cost has moved to the harness, set out with its counter-evidence alongside it.

Git history is the cheap part of a code-host move. The bill sits in runners, packages, deploy trust, branch rules and webhooks. An inventory-first framework.

Both terminal harnesses ship bash sandboxing off by default. The differences that hold up are openness, model freedom and what each vendor publishes.

Remotion makes video a React build target, but an agent cannot easily judge whether the finished motion is any good — and the licence turns on company size.

Vercel's skill packs bundle agent skills behind one install command and an update command, with no versioning, checksums or provenance documented.

Anthropic flips Claude Code to auto mode by default on Pro, Max and Team plans from August 14. What changes, what to pin, and what the studies show.

Claude Code 2.1.224 adds cross-session SendMessage, self-hosted runners on Team and Enterprise, and drops the 200-subagent cap. What ships, and what to guard.

Codex CLI 0.147.0 imports Cursor-managed skills and syncs imported Claude and Cursor conversations. What is actually portable across agent harnesses now.

GitHub's enterprise managed settings now allowlist MCP servers, and the Copilot impact dashboard adds an ROI section GitHub itself calls directional only.

Agent Plugins 1.0 packages skills and MCP servers in one directory format. The spec is still marked Working Draft, and vendor-specific formats keep shipping.

Muse Code fans work out to a git worktree per subagent — opt-in, in git repos — records every step in an append-only event log, and ships four built-in skills.

Visual Studio's July 2026 update ships an Agent (Preview) built on the GitHub Copilot SDK — the same SDK behind the Copilot CLI. What teams can build now.

GitHub made Copilot code review's agent skills and MCP connections generally available on July 29, one day after the MCP spec shipped. A rollout checklist.

Claude Code capped concurrent subagents at 20, banned nested spawns, then reinstated them at depth 3 in four days. The three limits that now govern fan-out.

Shopify's July 21 developer changelog previews real block and partial tags for Liquid, opens Analytics to apps, and adds metafield-scoped Events triggers.

TypeScript 7.0 RC ships June 18, 2026 with a Go-native compiler delivering ~10x faster type-checks. A 2026 upgrade guide on benchmarks, install, and risks.