Tag: ai-agents

Semantic Kernel .NET 1.80.0 ships a breaking change: the OpenAPI plugin's default HttpClient no longer follows redirects, closing an SSRF bypass. Here is what changes and why your own HttpClient reopens the hole.

Claude Code and GitHub Copilot both ship allowedMcpServers and deniedMcpServers, but the matchers behave differently. serverName is a fallback that a single serverCommand entry silently disables, deny is a union while allow is not, and an invalid allowlist locks everything out.

Agent Plugins 1.0 says plugin.json at the root and mcp.json beside it. Claude Code 2.1.x wants .claude-plugin/plugin.json and .mcp.json. Here is what each client actually loads, tested against a real plugin, and the dual-layout directory that satisfies both.

MCP 2026-07-28 mirrors the JSON-RPC method and target name into HTTP headers so a gateway can route, throttle, and audit without parsing the body. Here is a working gateway, plus the header-body agreement rule that will bite you.

A write tool that asks before it writes needs three things the MCP SDK does not give you: an approval bound to the exact diff, a precondition on the file it previewed, and an integrity-protected requestState. Verified end to end on @modelcontextprotocol/server 2.0.0 against protocol revision 2026-07-28, including the argument-swap that gets past a naive confirm.

Mapping 200 internal REST endpoints to 200 MCP tools puts 200 KB of JSON schema in front of every request. The 2026-07-28 spec also made the usual escape hatch illegal: tools/list MUST NOT vary per-connection, so per-session dynamic registration is gone. Here are the three levers that still work, with measured wire sizes and verified code on @modelcontextprotocol/server 2.0.0.

Tightening a team's default permission mode to Manual is a one-line settings change interactively and a silent outage in CI, because headless runs turn every ask into a deny and still report success. Measured on Claude Code 2.1.224, including the trust gate that drops your allowlist but keeps your mode.

The 1M-token context window is now the default on Claude Opus 5, Opus 4.8/4.7/4.6, Sonnet 5, and Sonnet 4.6, with no beta header and no long-context premium. Here is when deleting the vector store actually pays off, the 10x cache-read rule that decides it, the ~30% tokenizer inflation that breaks your sizing estimate, and the seven-step migration with a verification line on each one.

Claude Code 2.1.224 adds claude self-hosted-runner, a public beta that executes cloud sessions on machines you provision. Here is the setup, the one-user runner rule, and what still leaves your network.

The GitHub, Postgres, and Slack MCP servers from modelcontextprotocol/servers were archived in 2025 and their npm packages are deprecated. They pin SDK 1.0.1, which cannot negotiate past protocol 2024-11-05. Here is the audit script, the current replacement for each, and the two pointers in the archive README that are themselves stale.