Tag: ai-agents

A headersHelper field on url marketplaces and catalog entries runs a local command that prints HTTP headers, so an internal plugin catalog behind S3 or an artifact repo can authenticate with a short-lived token. Here is the schema, the consent prompt, and the header names Claude Code drops.

MCP error -32022 means your client opened at 2025-11-25 but the server only serves 2026-07-28. Make one side dual-era instead of pinning a version.

Cursor shipped Builds for Cloud Agents on August 13, 2026: a bootable filesystem snapshot of an already prepared machine. Cursor reports 3x faster time to first token. The lever you control is the install vs start split in .cursor/environment.json.

Stop shipping SKILL.md folders inside every agent deployment. Serve them from an MCP server and pull them with UseMcpSkills on Microsoft.Agents.AI.Mcp 1.18. Includes the exact skill://index.json shape, a working C# server, the wire trace, and the SEP-2640 drift that will bite you.

Since August 3, 2026 you can pick a reasoning level next to the model when you start a Copilot cloud agent task. The Agent Tasks REST API has no equivalent parameter, so scripted dispatch cannot set it. Here is where the control exists, which levels each model exposes, what lands on the wire, and how to pin a default instead.

Semantic Kernel .NET 1.80.0 ships a breaking change: the OpenAPI plugin's default HttpClient no longer follows redirects, closing an SSRF bypass. Here is what changes and why your own HttpClient reopens the hole.

Claude Code and GitHub Copilot both ship allowedMcpServers and deniedMcpServers, but the matchers behave differently. serverName is a fallback that a single serverCommand entry silently disables, deny is a union while allow is not, and an invalid allowlist locks everything out.

Agent Plugins 1.0 says plugin.json at the root and mcp.json beside it. Claude Code 2.1.x wants .claude-plugin/plugin.json and .mcp.json. Here is what each client actually loads, tested against a real plugin, and the dual-layout directory that satisfies both.

MCP 2026-07-28 mirrors the JSON-RPC method and target name into HTTP headers so a gateway can route, throttle, and audit without parsing the body. Here is a working gateway, plus the header-body agreement rule that will bite you.

A write tool that asks before it writes needs three things the MCP SDK does not give you: an approval bound to the exact diff, a precondition on the file it previewed, and an integrity-protected requestState. Verified end to end on @modelcontextprotocol/server 2.0.0 against protocol revision 2026-07-28, including the argument-swap that gets past a naive confirm.