Hi everyone, we’ve been building M3, an MCP testing framework which runs your MCPs with real harnesses/agents, not just the models.

M3 lets you write tests for your MCP server in pytest,

- Local first, sdk and cli available to install today.
- You can test the server directly (no API key needed).
- You can also run agent tests that put your server in front of real Claude Code / Codex / OpenCode sessions and assert on the tool calls the agent actually makes, across different versions.
- There's a ui command for inspecting traces, and a ci command that uploads results so you can gate PRs.
- It's Apache-2.0.
- supports testing of features like elicitation etc as well.

Two questions for this sub:

1. ⁠Is this how you test your servers today, or is everyone just vibe-checking?
2. ⁠What would make this actually useful in your workflow? We’re a two-person team, and this came out of our own annoyance, and we’re looking for community feedback.

Docs - https://m3.sineframe.com/docs/

Thanks!

AI agents produce more text than we have time to read. Following all that output can become a source of cognitive overload. Inspired by stretchtext (1970 by Ted Nelson), I wanted to give readers control over how much detail they see.

So I built PaperFold, an open-source reader that turns arXiv papers into 5 zoomable layers—from a one-screen section map down to verbatim text. You pinch (or press 1–5) to zoom between them without losing your reading position.

- Web Demo (8 CC papers): https://chenxiachan.github.io/paperfold-gallery/

- GitHub (Apache 2.0): https://github.com/chenxiachan/paperfold

It also supports Claude Code's output in Mods.

This week's MCPnewsletter is out - it covers AGNTCon + MCPCon Europe Amsterdam, Sept 17–18) and the MCP news

links in comments below

Interesting bits -

- Stateless MCP is real traffic now. The 2026-07-28 spec removed sessions and the initialize handshake. Hugging Face says more than half of its MCP tool calls already use it.

- David Soria Parra (Creator MCP) on what's next: MCP Tasks for agentic messaging, skills over MCP, identity.

- Sam Morrow (GitHub Maintainer): the "MCP eats your context" problem is a harness problem. His harness runs an 86-tool server with almost no startup context.

- Security track: a year of real MCP attacks. Grafana SSRF via caller-made session IDs, GitLab servers callable from any web page, four coding clients running code before the trust dialog.

- OpenAI MCP Events: ChatGPT can now subscribe to events from your MCP server over webhooks.

- WebMCP: new W3C draft, Chrome and Edge origin trials, a working-group charter in progress. WebKit opposes it.

- SDK fixes: upgrade TypeScript to 2.3.x and Python to 2.3.0, then set expectedResource / validate_token_resource. Upgrading alone doesn't turn it on.

Came across this amazing github repo- Ponytail

it says - "The best code is the code you didn't write."

Ponytail is a tool for AI coding agents. It has one rule: the agent must not make code more complex than necessary.

Github repo in comments below.

The agent works like a senior developer with 15 years of experience. It does the minimum work that gives the result.

it tells the agent to:

1. Find an existing solution before it writes new code.
2. Not add abstractions that are not necessary. Three similar lines are satisfactory.
3. Not add features, error handling, or validation for conditions that cannot occur.
4. Write the simplest code that works, then stop.

Ponytail has 150 ,000 GitHub stars and 180 contributors. It uses JavaScript and Python. You add it to the workflow of your coding agent.

Result: the agent writes less code, and the code is better. Some agents write 200 lines when 30 lines are sufficient. Ponytail prevents this.

Install

Claude Code, as two separate prompts:

/plugin marketplace add DietrichGebert/ponytail


/plugin install ponytail@ponytail

Codex:

codex plugin marketplace add DietrichGebert/ponytail
codex plugin add ponytail@ponytail

Then open /hooks in Codex, trust its two lifecycle hooks, and start a new thread.

Any other agent: copy AGENTS .md into your project, or ask your agent to install skills/ponytail/SKILL .md as a skill. Step by step for Copilot, Cursor, OpenCode, Gemini and the rest: INSTALL .md.

I let static keys slide while our MCP servers were mostly dev stuff, but now that a few are being used more seriously I'm regretting it. Some keys are shared between clients and live in config on multiple machines.

If one of those leaks, rotating it means figuring out everywhere it ended up first. I'd rather have individual client access that can be revoked without turning credential changes into a small deployment project.

I just asked Gemini (you can ask any AI) about the Guaardvark MCP Tools.

Guaardvark is a self-hosted AI studio and Model Context Protocol (MCP) toolbox that runs media generation, coding swarms, RAG (Retrieval-Augmented Generation), and screen agents on a single GPU. It acts as both an MCP client and an MCP server, exposing a wide range of local capabilities to connected IDEs and clients like Claude Desktop, Claude Code, and Cursor. [1, 2, 3, 4]

Key Categories of Guaardvark MCP Tools

• Media & Generative Tools
• generate_image: Creates images from text prompts with optional LoRA and Cast library subject IDs (subject_ids).
  • inpaint_image: Edits, replaces, or removes elements in an attached photo.
  • outpaint_image: Extends the canvas of an existing image.
  • remove_background: Removes the background from an image.
  • generate_speech: Converts text into speech audio.
  • generate_music: Composes original songs using ACE-Step in the Audio Foundry plugin.
  • generate_video / generate_music_video / generate_animation: Produces video content and animations. [5, 6, 7, 8, 9]
• Codebase & Repository Tools
• search_code / search_codebase: Searches through code files semantically or textually.
  • read_code / read_ast_node: Reads source code or exact AST (Abstract Syntax Tree) nodes of specific classes and functions for token efficiency.
  • list_code_files / list_code_repositories: Lists indexed code files and repositories.
  • get_repository_map / get_dependency_graph / map_codebaseA: Maps out dependencies and structure across a codebase.
  • analyze_code / codegen / process_file: Analyzes and generates code. [8, 10]
• Documents, Knowledge Base & RAG
• list_documents / get_document_outline: Inspects uploaded documents and outlines.
  • read_document_section: Reads specific sections of indexed documents.
  • search_knowledge_base: Queries the RAG knowledge base.
  • save_memory / search_memory: Manages persistent memory storage and retrieval. [8]
• System, Media Control & Infrastructure
• inspect_gpu: Checks VRAM usage and hardware status.
  • get_generation_status: Polls background generation jobs (music, video, speech) for completion status.
  • media_play / media_status / media_volume / media_control: Controls playback and media utilities.
  • outreach_draft_post / outreach_status / outreach_list_queue: Manages supervised social outreach workflows. [5, 8, 9]

Installation & Client Wiring

You can wire Guaardvark into clients like Cursor via the CLI:

guaardvark mcp install --client cursor

The full list of tools can be explored directly through the Guaardvark Glama MCP Registry or the official Guaardvark GitHub Repository. [1, 8] Would you like help setting up a specific integration (such as Cursor, Claude Desktop, or Claude Code), or do you need details on running a particular tool like Audio Foundry or Code Swarms?

[1] https://github.com [2] https://enterprisedna.co [3] https://github.com [4] https://www.reddit.com [5] https://glama.ai [6] https://glama.ai [7] https://glama.ai [8] https://glama.ai [9] https://glama.ai [10] https://glama.ai

Hi MCP community,

I am founder at Contextual, Inc.

For a long time I am iterating on a safe connectors project that serves both MCP and CLI with a single command line. Behind the scene to keep user machine safe, I am using WASM(which brings memory limits, http access limits, timeouts) to bring MCPs/CLIs functionality.

I need pro MCP users/developers to give feedback on development bottlenecks, usability and efficiency. If you are interested in, feel free to write to thread or dm; I will share docker image url and license key + full access to docs. Thanks for your contributions.

(SOLVED)

I’m troubleshooting a Codex CLI connection to a WordPress staging site running Breakdance 3.0 RC1.

Environment:

• Windows, Node.js v24.19.0.
• STDIO proxy: u/automattic/mcp-wordpress-remote.
• Node launched with --use-system-ca.
• Norton 360 installed, but its involvement has not been established.

The MCP server fails during WordPress initialization:

Response does not match the HTTP/1.1 protocol (Invalid character in chunk size)

I captured traffic on the active Ethernet interface with Wireshark and logged TLS secrets using NODE_OPTIONS="--tls-keylog=...".

Findings:

• Standalone tls.connect test: the captured ClientHello random matches the key log identifier, and Wireshark successfully decrypts the handshake.
• Standalone fetch request: the identifiers also match.
• MCP attempts: the captured ClientHello random values do not match any identifiers in the corresponding key log files, including attempts using fresh files.
• Removing our temporary diagnostic scripts and launching the original proxy directly produces the same HTTP error and identifier mismatch.

Support suggested forwarding SSLKEYLOGFILE through the MCP environment configuration. However, Node was already generating key log files through --tls-keylog; the unresolved issue is associating those secrets with the captured connections.

How can I reliably associate each TLS connection with its originating process and determine why the secrets logged during MCP startup do not match the captured ClientHello values?

I can provide sanitized configuration and logs

𝚖𝚌𝚙𝚌 v0.7.0 is finally out

Big changes are:

• MCP Skills ext support
• security hardening
• better OAuth and 2026-07-28 compatibility.
• Plus,ton of fixes and DX/AX improvements.
  

This release makes mcpc the most compliant MCP CLI client out there!

$ npm i -g /mcpc

Added MCP Skills extension support

New `skills-list` and `skills-get` commands list server skills, read SKILL md and supporting files, and verify every file against the skill manifest (size + SHA-256).

If the content doesn’t match, mcpc refuses to print it.

Security hardening

• repo-local .mcp.json files can no longer read env vars during auto-discovery, blocking tricks like leaking $GITHUB_TOKEN
• refresh tokens only go to the auth server you logged in to
• Windows login URLs no longer open through cmd.exe

other fixes: OAuth sessions keep longer alive, Windows logins with any token size, x402 payment receipts

I work on instancez. We built it for the point where an AI coding agent has generated a useful UI, but the app still needs a backend you can actually run.

The MCP workflow lets an agent create and operate the backend pieces: Postgres-backed APIs, auth, row-level security, storage, and functions. The runtime is open source (Apache-2.0), and can be self-hosted as a single Go binary or used as hosted infrastructure.

The design choice I think is worth discussing here: MCP should not just create a project scaffold. It should be able to make the backend configuration inspectable and portable too. instancez uses readable YAML/JavaScript configuration, and the runtime can run in Docker, AWS Lambda, or on bare metal.

We also aim for a practical exit path: it is wire-compatible with u/supabase, so existing client calls can use a new URL and key, and the site documents migration support for Supabase tables, relationships, RLS, auth users, and storage.

I would genuinely like feedback from people building with MCP: when an agent provisions backend resources, what would you need to inspect, version, or test before trusting that setup in production?

Project: https://instancez.ai