MCP & tool use

How models connect to the outside world: the MCP ecosystem, function calling and tool integrations.

760 picksRelated topicsAgents AI coding Open source

Latest picks

341–360 of 760

May 12Tuesday

AI HOT (Curated Pool)May 12, 11:42

Large npm Supply-Chain Attack Hits TanStack, Mistral AI, UiPath, and Others

Socket identified the Mini Shai-Hulud supply-chain attack, where attackers used three GitHub Actions flaws to publish nearly 373 malicious versions across more than 160 npm package names, affecting projects including TanStack, Mistral AI, and UiPath and stealing AWS, GCP, Kubernetes, GitHub tokens, and SSH private keys during installation.

Why it matters: HKR-H/K/R all pass: named projects create the hook, Socket provides concrete counts and mechanisms, and credential theft matters to AI engineering teams. It is a strong security incident, not a core model or product release, so it stays in the 78–84 band.

Take

Mini Shai-Hulud is a supply-chain permissions failure wearing an npm incident costume. Socket’s numbers are not small: attackers used three GitHub Actions flaws to bypass 2FA, then pushed nearly 373 malicious versions across 160+ package names tied to TanStack, Mistral AI, UiPath, and others. Install hooks went after AWS, GCP, Kubernetes, GitHub tokens, and SSH private keys.

AI teams have spent the last year wiring agents, RAG stacks, eval harnesses, and internal tooling through npm and GitHub Actions. The release path still often carries frontend-library-era assumptions. Cleaning the malicious versions closes the public package wound; it does not rotate copied cloud keys, GitHub tokens, or Kubernetes credentials. For AI infra teams, the uncomfortable part is that the attacker did not need model access, prompt injection, or a fancy exploit—just CI/CD trust that was too broad.

AI HOT (Curated Pool)May 12, 10:19

Thinking Machines Releases Native Multimodal Interaction Model for Real-Time Human-AI Collaboration

Thinking Machines released an interaction model that natively receives audio, video, and text input, processes foreground interaction at 200-millisecond intervals, and uses a background reasoning model for long-horizon planning and tool calls.

Why it matters: HKR-H/K/R all pass: this is more than a model notice, with a two-layer foreground/background interaction design. Pricing, access scope, and benchmarks are missing, so it sits at the lower end of 85-94.

Take

Thinking Machines’ sharp move is splitting “presence” into a 200 ms foreground loop and a slower reasoning backend. The disclosed mechanism matters: native continuous audio, video, and text input; the foreground model handles interruption and immediate feedback; the backend handles long-horizon planning and tool calls. That is system design, not another agent chain with nicer prompts.

I don’t buy the “unified interface” framing yet. The hard parts are state sync, latency budget, and writing tool results back without breaking the live interaction. OpenAI’s Advanced Voice already taught users what low-latency audio feels like, but it did not expose this kind of architecture. If Thinking Machines only has a polished demo, GPT-class products catch it. If the 200 ms loop holds under video plus tools, this becomes a serious collaboration substrate.

Computing Life · YageMay 12, 08:00

How AI Caused and Fixed My Insomnia

The author used AI to build a HealthKit export app in about 5 minutes and run multivariate regression, finding that the last post-dinner AI usage time correlated negatively with sleep duration; after avoiding AI at night, average sleep increased by 1 hour and 40 minutes.

Why it matters: HKR-H/K/R all pass: a first-person quantified experiment links post-dinner AI use to shorter sleep, then reports +1h40m after stopping. Personal-blog scope keeps it below major industry-update territory.

Take

This is not wellness content; it is a heavy AI user treating himself like a production system. He used AI to build a HealthKit export app in 5 minutes, pulled Apple Watch, caffeine, alcohol, glucose, blood pressure, and hourly activity data, then ran multivariate regression. The strongest negative correlate was not coffee. It was the last post-dinner AI session. After cutting night AI use, average sleep rose by 1 hour and 40 minutes.

I buy the direction, not the strength. This is one person over dozens of days, and the piece does not give coefficients, p-values, or the control table. Causality stays in self-experiment territory. The useful mechanism is sharper: AI lowers the cost of coding, cleaning, and modeling, so people keep doing high-cognition work at night. The Cursor-style productivity story rarely prices that in: tasks do not disappear; the stopping point moves later.

Computing Life · YageMay 12, 07:00

How AI Caused and Fixed My Insomnia

The author used AI to build a HealthKit export tool and run multivariate regression, found that post-dinner AI use correlated negatively with sleep duration, and added 1 hour 40 minutes of average nightly sleep after avoiding AI for several weeks.

Why it matters: HKR-H/K/R all pass: the personal reversal is clickable, the HealthKit/regression setup adds testable detail, and sleep loss hits AI practitioners directly. Scope is anecdotal, so it stays at the featured floor.

Take

The sharp part is not that AI diagnosed insomnia; it is that AI turned “light computer use after dinner” into sustained cognitive labor. The author spent five minutes generating a HealthKit export app, pulled Apple Watch, iPhone, Withings-style health streams, then ran multivariate regression. The strongest negative correlate was the last evening AI session; after several weeks off post-dinner AI, average sleep rose by 1 hour 40 minutes.

I buy the mechanism more than the causal claim. This is one person, a few weeks, and the article does not give p-values, coefficients, or a randomized crossover. Still, every heavy agent user knows the loop: run several sessions, poll outputs, split tasks again, keep reading. There is no idle wait. Compared with YouTube or games, late-night AI looks less like screen time and more like sneaking a strategy meeting into bed.

Sinocism (Bill Bishop)May 12, 06:13

Trump China Visit; China’s Next Generation Industrial Policy; Standardizing AI Agents

China’s CAC, NDRC, and MIIT issued an implementation document on AI agent standardization, targeting privacy leakage, unauthorized actions, and loss of behavioral control from high-autonomy, high-permission agents, while tying the work to a 2027 target for new intelligent terminals and AI agent adoption above 70%.

Why it matters: HKR-H/K/R all pass: the China agent-policy hook is concrete, with a 2027 >70% target and named autonomy/permission risks. It clears featured, but it is policy guidance rather than a major model or product launch.

Take

China’s CAC, NDRC, and MIIT tied agent standardization to a 2027 adoption target above 70%, which makes this a device-policy story, not a chatbot-safety memo. The named risks are specific: privacy leakage, unauthorized actions, and loss of behavioral control. That wording assumes agents will hold real permissions across phone assistants, on-device stewards, and cloud agents.

I think enforcement will land harder than the document’s bland title suggests. China’s pattern on recommendation algorithms, deep synthesis, and generative AI was clear: registry first, safety review next, product teams adapt later. Agents touch a worse surface area: purchases, app control, enterprise data, and identity flows. OpenAI and Anthropic are still selling guardrails as product trust. Beijing is making guardrails part of the industrial rollout target.

r/LocalLLaMAMay 12, 05:17

I catalogued every way local models break JSON output and built a repair library across 288 model calls

Reddit user kexxty ran 288 structured-output calls through OpenRouter models, including Llama 3, Mistral, Command R, DeepSeek, and Qwen, and found similar JSON failure categories across local and API-only models. The MIT-licensed Python library outputguard validates against JSON Schema, applies 15 ordered repair strategies, includes 2,001 tests, and has no LLM provider dependency.

Why it matters: HKR-H/K/R all pass: 288 tests, the outputguard library, and a 15-step repair chain give practitioners reusable detail. Source is a single Reddit post, so it stays in the 72–77 featured band, not 78+.

Take

The useful part is not “local models break JSON too”; it is the boring repair layer turned into code. The summary says 288 OpenRouter calls across Llama 3, Mistral, Command R, DeepSeek, and Qwen. outputguard validates with JSON Schema, then applies 15 ordered repair strategies, backed by 2,001 tests. That is more honest than the usual “turn on function calling and ship it” advice.

I don’t buy the title’s “every way.” Reddit returned 403, so model versions, prompts, schema complexity, temperature, and failure distribution are not visible here. And 288 calls is a smoke test, not a taxonomy of structured-output failure. Still, it hits the part practitioners keep rediscovering: structured output is not a model feature once it enters an agent pipeline. It becomes I/O fault tolerance, even with OpenAI or Anthropic JSON modes.

AI HOT (Curated Pool)May 12, 04:45

Introducing Daybreak: Frontier AI for Cyber Defenders

OpenAI introduced Daybreak for cyber defenders, combining OpenAI models, Codex, and security partners; the post does not disclose pricing, launch timing, or concrete defense metrics.

Why it matters: OpenAI’s Daybreak announcement clears HKR-H/R as a security-focused product hook, but HKR-K fails: no defense metrics, access terms, or pricing. That keeps it in the 72–77 product-update band.

AI HOT (Curated Pool)May 12, 02:48

Using LLMs in Script Shebang Lines

Simon Willison demonstrates using an LLM command in a script shebang line, with fragments generating SVG, the -T option calling llm_time, and a YAML template defining Python tools to compute 2344×5252+134 and return 12,310,822.

Why it matters: HKR-H/K/R all pass: Simon Willison shows a reproducible LLM-in-shebang workflow with concrete flags. Impact stays within CLI/script automation, not a model or platform release, so it sits in the low featured band.

AI HOT (Curated Pool)May 12, 01:34

Replit launches parallel agents with support for 10 concurrent agents

Replit launched parallel agents that run up to 10 agents concurrently, with each agent holding an independent copy of the app, working on its own machine, and merging the results through an agent workflow.

Why it matters: HKR-H/K/R pass: the post gives a concrete 10-agent parallel workflow with isolated app copies and merge. This is a mid-weight dev-tool update, below a Cursor Agent-mode-scale launch, so it sits at the featured threshold.

Take

Replit is betting on concurrency, not a smarter single coding agent. The concrete hook is strong: up to 10 agents run at once, each gets an independent app copy, works on its own machine, then merges through an agent workflow. That fits UI variants, scaffolding, migrations, and isolated chores. It gets fragile fast on shared state, architecture changes, and test-coupled work.

The missing product is the merge layer. The snippet says “agent workflow” handles merging, but gives no conflict rate, rollback path, CI gate, or human approval model. Devin, Cursor, and Claude Code have all shown the same pattern: generation is rarely the last bottleneck; context boundaries and review cost are. If Replit nails task decomposition plus test-backed merging, this is useful for small teams. If not, ten agents just fail in parallel.

AI HOT (Curated Pool)May 12, 01:27

Personal Intelligence Customizes Travel Itineraries

Gemini App says Personal Intelligence generates personalized travel itineraries when users connect Gmail, Google Photos, Google Search, and YouTube history, and the post says users can choose connected apps and manage personalization settings at any time.

Why it matters: HKR-H/K/R all pass: the Google data integration is the hook, mechanism, and practitioner nerve. Scope, permission controls, and evals are not disclosed, so this stays at the low featured band.

Take

Gemini is showing Google’s unfair advantage here: not itinerary writing, but lawful access to personal exhaust. The post names Gmail, Google Photos, Google Search, and YouTube history. That bundle is closer to a personal memory substrate than most assistant integrations, including the usual ChatGPT calendar-and-email demos.

I don’t buy the travel-planning wrapper. Trip generation is a solved demo; the hard parts are permissioning, revocation, explanations, and misuse boundaries. The post says users can choose connected apps and manage personalization settings, but gives no default state, retention rule, or long-term memory policy. Google has the distribution to make this normal. It also carries the privacy debt that makes every “personal intelligence” launch feel like a consent stress test.

AI HOT (Curated Pool)May 12, 01:22

Anthropic Launches Claude Platform on AWS

Anthropic launched the Claude platform on AWS, letting AWS customers use existing authentication, billing, and committed-spend credits to access the full Claude API feature set, including hosted agents, code execution, and the Files API.

Why it matters: HKR-K and HKR-R pass: Anthropic brings Claude Platform into AWS procurement, billing, and committed spend. HKR-H is weak because this is distribution, not a model or capability launch.

AI HOT (Curated Pool)May 12, 00:20

The Evolution of Human-Computer Interfaces: From Text to Interactive Neural Video

Karpathy argues that LLM output is moving from Markdown toward richer HTML, while interactive neural video still has an open problem: how to combine neural generation with precise traditional software.

Why it matters: HKR-H/K/R pass: Karpathy gives a fresh UI frame, a concrete Markdown→HTML→neural-video path, and a builder-facing product question. Single X post with no data keeps it at the featured floor.

Take

Karpathy’s useful claim is that LLM output should move from Markdown to HTML first. That is a product decision, not a sci-fi interface take. HTML carries layout, charts, widgets, and interaction; Markdown mostly carries hierarchy and prose. For ChatGPT Canvas, Claude Artifacts, and Copilot-style flows, the output container defines what the model can actually hand back.

I don’t buy the neural-video endgame yet. The snippet says the hard part is still unsolved: combining generated interactive video with precise traditional software. Software UI needs state, coordinates, permissions, replayable actions, and deterministic failure modes. Diffusion video is strong at continuous appearance, weak at exact control. Teams shipping agents should chase reliable executable HTML, component state, and event bindings before selling “interactive neural simulation” as an interface.

May 11Monday

AI HOT (Curated Pool)May 11, 23:37

Anthropic open-sources full-stack financial AI templates

Anthropic open-sourced a financial services AI template library on GitHub, including 10 end-to-end agents, 7 vertical industry plugins, and MCP connectors for 11 financial data providers, with deployment paths from personal plugins to enterprise APIs and integrations for Microsoft 365 and private cloud.

Why it matters: HKR-H/K/R all pass: Anthropic shipped a reusable finance-agent template library with GitHub artifacts and concrete counts. It is not a model release, so it stays below 85, but the open-source MCP vertical stack clears featured.

Take

Anthropic is trying to own the finance AI implementation playbook, not the model leaderboard. The repo has 10 end-to-end agents, 7 vertical plugins, and MCP connectors for 11 financial data providers. It also names Microsoft 365, private cloud, and enterprise API deployment paths, which maps cleanly to research, banking, and risk workflows with budget owners.

I don’t buy the “new industry standard” framing. Finance buyers get stuck on permissions, audit trails, model risk controls, and vendor liability. The body gives no benchmarks, compliance attestations, or named bank deployments. Compared with OpenAI pulling enterprises through ChatGPT Enterprise, Anthropic is giving Claude a consulting-delivery kit that SIs can package tomorrow. That lowers sales friction, but templates still have to survive the audit swamp before they become production infrastructure.

AI HOT (Curated Pool)May 11, 21:46

AntLingAGI Releases Trillion-Parameter Ring-2.6-1T Model

AntLingAGI released Ring-2.6-1T, a trillion-parameter thinking model available for free on OpenRouter until May 15, with adjustable thinking intensity, agent-oriented multi-step execution, tool calling, and tasks covering math logic and scientific research.

Why it matters: HKR-H/K/R all pass, but the post is thin: no benchmarks, pricing, architecture, or training details. Treat as a mid-weight model launch on OpenRouter, not a same-day must-write.

Take

Ring-2.6-1T’s signal is not the trillion-parameter label; it is AntLingAGI using OpenRouter for cold-start distribution. The free window runs until May 15, and the feature list is packed: adjustable thinking intensity, multi-step agent execution, tool calling, math logic, and scientific research tasks. But the snippet gives no context window, throughput, pricing, SWE-bench score, or math benchmark. One trillion parameters proves a heavy cost profile, not stable agent performance.

I don’t buy the “production environment” framing yet. OpenRouter is great for developer sampling and model switching, but it is weak evidence for enterprise deployment. Qwen, DeepSeek, and Claude built trust through reproducible scores, API economics, or both. Ring-2.6-1T currently has a free funnel and a parameter story.

AI HOT (Curated Pool)May 11, 14:00

OpenAI Launches DeployCo to Help Enterprises Build Businesses Around Intelligence

OpenAI launched DeployCo, an enterprise deployment company focused on moving AI systems into production, while the RSS snippet does not disclose pricing, customer names, deployment scope, or launch timeline.

Why it matters: OpenAI launching DeployCo is a real enterprise strategy signal: HKR-H has a separate-company hook and HKR-R hits deployment competition. HKR-K is weak because pricing, customers, and timing are absent, so it sits at the featured floor.

Take

OpenAI is going after services revenue here, not launching another API wrapper. The numbers are unusually blunt: over $4B in initial investment, Tomoro bringing about 150 FDEs and deployment specialists, plus TPG, Bain, McKinsey, Capgemini, and Goldman Sachs on the same cap table. That smells closer to a scaled Palantir FDE model than a SaaS expansion, except OpenAI also controls the model roadmap.

The sharp clause is “majority-owned and controlled by OpenAI.” Consultancies sold playbooks, cloud vendors sold compute, and model labs sold tokens; DeployCo tries to stitch those into one enterprise budget line. The weak spot is equally concrete: no pricing, no named customers, no deployment SLA. Without those, the $4B reads like a very expensive license to become the AI systems integrator.

Xinzhiyuan · WeChatMay 11, 13:05

The Second Half of Agent Evaluation: Why a Live Benchmark Is Needed

Claw-Eval-Live evaluates 13 frontier models on 105 tasks, and the top model stays below a 70% pass rate, while HR tasks average only 6.8% pass rate.

Why it matters: HKR-H/K/R all pass: the live benchmark hook is specific, and the post gives 105 tasks, 13 models, HR at 6.8%. Claw-Eval-Live still lacks proven field impact, so this sits in the lower featured band.

Computing Life · Share · YageMay 11, 08:00

DeployCo Arrives: OpenAI and Anthropic Form AI Deployment JVs with PE on the Same Day

OpenAI and Anthropic announced AI deployment joint ventures with private equity on May 4, and the snippet cites divergent terms, including a 17.5% guaranteed return versus no guaranteed return.

Why it matters: HKR-H/K/R all pass: the angle has tension, the facts include PE JVs and a 17.5% floor, and the nerve is model-lab commercialization. Single-source commentary keeps it in the 78–84 band, not must-write.

Take

DeployCo is not ordinary channel sales; it is model labs pushing enterprise deployment risk onto PE. On May 4, OpenAI and Anthropic announced AI deployment joint ventures, and the snippet gives one sharp contrast: OpenAI side at a 17.5% guaranteed return, Anthropic side at zero. That gap is too loud. One side is paying for deployment speed; the other is protecting the model-vendor position.

I don’t buy the clean “AI rollup evolution” story without the contracts. PE is good at fragmented cash flows, not at absorbing model reliability drift. Copilot and ChatGPT Enterprise already showed the hard part is workflow change and liability, not demo quality. The body does not disclose equity, customer sourcing, cloud commitments, or buyback terms, so 17.5% reads as either demand proof or financial engineering.

Computing Life · Share · YageMay 11, 08:00

Google shuts down Project Mariner; Anthropic and OpenAI also hit limits

Google quietly shut down Project Mariner on May 4, and the post says Google, Anthropic, and OpenAI reached the same conclusion: standalone browser agents do not work, while GUI automation still has room outside headless dedicated environments.

Why it matters: HKR-H/K/R all pass: the shutdown date, route-level claim, and Google/OpenAI/Anthropic contrast carry signal. Single-source summary lacks an official notice or failure metrics, so this stays in the low featured band.

AI HOT (Curated Pool)May 11, 04:01

Codex autonomously completes a security audit and earns a bounty

A user instructed Codex to earn $5; Codex spent about 22 hours finding an open-source security audit bounty, submitting a valid PR, communicating with maintainers, passing GitHub verification, and ultimately receiving a $16.88 payment.

Why it matters: HKR-H/K/R all pass: a Codex agent allegedly closed a bounty loop in 22 hours with concrete money and workflow details. Single social-post evidence lacks reproducible logs, so it stays below P1.

AI HOT (Curated Pool)May 11, 02:44

MachinaCheck: Multi-agent CNC manufacturability analysis system built on AMD MI300X

MachinaCheck runs Qwen 2.5 7B locally on AMD MI300X to analyze STEP files for CNC manufacturability, reducing drawing review for quote analysis from 30–60 minutes to 30 seconds while using 192GB HBM3 to keep customer design data on-premises.

Why it matters: HKR-H/K/R all pass, but this is an AMD hackathon project on Hugging Face, not a broad model or platform launch. Concrete numbers carry it to the featured threshold.