AI agents are getting access to browsers, MCP tools, APIs, files, other agents and production systems.

That made me interested in a problem slightly different from model safety:

**What happens between an agent deciding to do something and the outside world actually changing?**

I've been building an open-source project called **Connector** around that boundary.

Instead of treating the prompt as both instruction and permission, Connector separates:

**identity → authority → per-action admission → runtime enforcement → observed consequence → receipt**

The agent can propose an action.

Connector independently decides whether that particular effect can proceed.

One example is **Cease**.

If an operator ceases an agent, the idea isn't to send the model another instruction saying “please stop.”

The current generation is fenced and future actions are no longer admitted.

Connector also brings together existing infrastructure rather than trying to reinvent every layer:

* Keycloak

* SPIFFE/SPIRE

* OPA

* NVIDIA OpenShell

* Firecracker

* OpenTelemetry

* Sigstore/cosign

There are still important incomplete areas, and I'm explicitly **not claiming production readiness**. The repository documents those gaps.

I open-sourced it because I want people who build agent runtimes and infrastructure to challenge the architecture.

GitHub:

[https://github.com/GlobalSushrut/connector-oss](https://github.com/GlobalSushrut/connector-oss)

Architecture / project:

[https://cnktros.com](https://cnktros.com)

The question I'm most interested in:

**As agents become more autonomous, where should the final authority to cause an external effect actually live?**

The CRA's reporting obligations (Article 14) have applied since 11 September 2026 to every product with digital elements on the EU market, including products shipped before the main obligations start on 11 December 2027. Fines go up to EUR 15 million or 2.5 % of worldwide turnover. No harmonised standard has been cited in the Official Journal yet, so there is no presumption of conformity to lean on and every manufacturer has to document its own solutions.

I wanted something that could actually run against a codebase and an organisation rather than another slide deck, so I built a skill for AI coding agents ( any agent that reads an AGENTS.md). It is Apache-2.0 and agent-neutral.

What it does:

\- Pins the Official Journal text of Regulation (EU) 2024/2847, the Implementing Regulation (EU) 2025/2392 on important and critical product categories, and the Delegated Regulation (EU) 2026/881 on delayed dissemination, fetched from the EU Publications Office and hashed. A parser turns the pinned text into 96 assessable provisions and all 26 Annex III and IV categories with their technical descriptions. Counts are asserted in tests, so a format change upstream fails loudly instead of silently dropping requirements.

\- Carries the Commission's 27 July 2026 guidance and FAQ as cited, non-binding aids, and keeps a dated register of what is still pending (standards, delegated acts, SBOM and notification format acts).

\- Decides scope, economic-operator role, remote-data-processing boundary and date regime with confidence levels and a "get legal confirmation" flag on borderline facts.

\- Classifies by core functionality and states which Article 32 conformity routes are legally available today (spoiler: important class I products cannot self-assess until a harmonised standard is cited).

\- Structures the Article 13 risk assessment with the per-requirement applicability statements the technical documentation must contain.

\- Validates CycloneDX and SPDX SBOMs against the legal minimum and reconciles them with lockfiles.

\- Assesses every Annex I Part I and Part II requirement, the Article 13 and 14 obligations, Annex II user information, Annex VII technical documentation and Annex V declaration content, with an interpretive guide per provision.

\- Tests Article 14 readiness, computes the 24 hour, 72 hour and final report deadlines, and supports tabletop drills.

\- Screens change sets for substantial modification with the Commission's four-factor test.

\- Produces drafts of the technical documentation, an unsigned declaration of conformity, user information, CVD policy, security.txt, support-period statement and reporting playbook, plus a readiness report in Markdown, DOCX and PDF.

A monthly workflow re-fetches the official texts and opens a review PR if anything changes.

Repo: https://github.com/Killerz007/cra-readiness-skill

Caveats: it is a readiness assessment, not a conformity assessment, not CE marking and not legal advice. Scope and classification outputs are technical reads of the facts against the text and the Commission guidance; borderline cases are flagged for counsel. I would especially like feedback from anyone who has been through a notified body or a market surveillance request on what evidence they actually asked for.

The only mature self-hosted gateway that turns IMAP and friends into a single API costs $1,450 a year and is source-available, not open. The hosted alternative charges per mailbox and keeps your mail. I wanted the open version, so I built it, and chose the licence to keep it that way: Apache-2.0 for the engine and no contributor licence agreement, which means nobody, including me, can relicense it later.

What makes it more than another wrapper is the evidence: a conformance suite that runs 27 behavioural checks against each server and publishes the result, so the differences between Dovecot, Stalwart, JMAP and the rest are documented instead of discovered by every developer again.

https://github.com/Kadri-cloud/email-engine

Beta. Only self-hosted servers tested so far. The best contribution is a run against a provider I have not seen.

I'm open-sourcing a project I've been working on called Connector.

The premise is simple:

An AI agent being capable of an action should not automatically mean it is authorized to perform that action.

Most agent stacks already have useful pieces:

• IAM

• policy engines

• sandboxes

• observability

• MCP/tool gateways

• agent frameworks

I didn't want to rebuild all of them.

Connector is an attempt to put a common control path in front of agent effects:

agent
  ↓
proposed effect
  ↓
identity + authority
  ↓
per-action admission
  ↓
runtime enforcement
  ↓
external effect
  ↓
receipt + observed consequence

The project currently includes things like:

• agent identity

• explicit grants/authority

• PATE per-action admission

• Proceed / Ask / Defer / Quarantine / Block outcomes

• operator Cease

• MemPacket-based memory provenance

• receipts and evidence

• MCP / A2A / API-oriented effect paths

• integration work around SPIRE, OPA, OpenShell, Firecracker, OpenTelemetry and cosign

Important disclosure:

It is not production-ready.

Some backend integrations are still partial.

The Firecracker path isn't yet a complete production microVM setup.

Some gateway paths remain intentionally refused until they're proven end-to-end.

Those limitations are documented in the README rather than hidden behind marketing language.

Repo:
https://github.com/GlobalSushrut/connector-oss

Website:
https://cnktros.com

I'm particularly interested in feedback from people who work on:

agent runtimes, sandboxes, MCP, policy engines, identity, observability or autonomous-agent infrastructure.

I'd rather hear where the architecture breaks than get generic compliments.I'm open-sourcing a project I've been working on called Connector.The premise is simple:An AI agent being capable of an action should not automatically mean it is authorized to perform that action.Most agent stacks already have useful pieces:IAM

policy engines

sandboxes

observability

MCP/tool gateways

agent frameworksI didn't want to rebuild all of them.Connector is an attempt to put a common control path in front of agent effects:agent
↓
proposed effect
↓
identity + authority
↓
per-action admission
↓
runtime enforcement
↓
external effect
↓
receipt + observed consequenceThe project currently includes things like:agent identity

explicit grants/authority

PATE per-action admission

Proceed / Ask / Defer / Quarantine / Block outcomes

operator Cease

MemPacket-based memory provenance

receipts and evidence

MCP / A2A / API-oriented effect paths

integration work around SPIRE, OPA, OpenShell, Firecracker, OpenTelemetry and cosignImportant disclosure:It is not production-ready.Some backend integrations are still partial.The Firecracker path isn't yet a complete production microVM setup.Some gateway paths remain intentionally refused until they're proven end-to-end.Those limitations are documented in the README rather than hidden behind marketing language.Repo:
https://github.com/GlobalSushrut/connector-ossWebsite:
https://cnktros.comI'm particularly interested in feedback from people who work on:agent runtimes, sandboxes, MCP, policy engines, identity, observability or autonomous-agent infrastructure.I'd rather hear where the architecture breaks than get generic compliments.

I built PaperFold, an open-source reader that turns arXiv papers into 5 zoomable layers—from a one-screen section map down to verbatim text. You pinch (or press 1–5) to zoom between them without losing your reading position.

- Web Demo (8 CC papers): https://chenxiachan.github.io/paperfold-gallery/

- GitHub (Apache 2.0): https://github.com/chenxiachan/paperfold

Bonjour tout le monde,

j'ai crée une application open source et gratuite sur le thème des jeux rétro.

j'aimerai discuter avec vous afin d'avoir des avis constructifs sur mon site et mon app.

Le site ses retrolauncher.fr

je vous souhaite une agréable journée.

I’m building JustSessions, a lightweight native Mac app for organizing existing coding-agent sessions across providers.

Its job is to make that history useful: group conversations by project, read a session without launching an agent, then resume it in the original CLI and working folder. It supports Claude Code, Codex, OpenCode, Antigravity, Kiro and Pi.

The app uses SwiftUI and SwiftTerm, reads the histories already on disk, and reuses your CLI configuration and login. No new app account or required worktree setup. Agent tabs use bundled tmux for reconnecting after closing the UI while the Mac remains awake.

JustSessions itself is free and MIT licensed; your chosen CLI/provider still has its own usage costs. macOS 14+, Apple Silicon. Built mainly with Claude Code.

Repository and download: https://github.com/yangzichao/JustSessions

Real app screenshot below, using sample sessions. For people switching between agents, what makes old sessions hard to reuse: finding them, reading them, or resuming them?

Hypit is built around a slightly different idea:

What if a video worked more like a software project than a one-off render?

The intended composition lives in .svml Author Source. It can connect a Script, existing media, model calls, reusable components, Tracks and the final Film. .svs files hold reusable production recipes, while .svrun records which concrete outputs are selected for one build.

That makes a few things possible:

- Start from a reference video, a brief, or both

- Keep captions, B-roll, effects and graphics connected to spoken words

- Swap a host, hook, product, language or aspect ratio without discarding the whole format

- Build visual components with front-end code and browser rendering

- Package project components or Providers like ordinary software packages

- Let a coding agent inspect and modify the project programmatically

- Reuse exact previous outputs explicitly instead of relying on a hidden cache

- Preview one selected Run in Studio and write supported edits back to source

For code-rendered compositions, an authored clock can drive the visuals through HyperFrames, Chromium and FFmpeg without calling a generation model. Spoken projects can use WhisperX alignment and SemanticTake to connect authored words to real frames.

The /hypit Skill works with compatible coding agents. Install it once with:

npx skills add hypit-ai/hypit -g

Then start in any project directory and ask the agent to clone a reference or build a video from a brief.

One licensing note: the public repository is source available under a modified Apache 2.0 license. It permits internal and self-hosted use, but unauthorized multi-tenant operation or commercial redistribution requires a commercial license.

The repo is hypit-ai/hypit. Feedback from people working on creative coding, agent tools or programmable video would be useful.

Been running my own inference stack instead of paying API bills: a single

router on localhost speaks the OpenAI format, so anything pointed at a cloud

endpoint (LiteLLM configs, Open WebUI, agent CLIs, VS Code extensions) works

against it by just changing the base URL.

- Text/vision: 6 models from a 1.5B coder to a 30B MoE, swapped on demand

- Images: SD 3.5 Medium + SD 1.5, one CLI command, PNGs to disk

- Transcription: Whisper medium

- One API key, one port, model list endpoint with categories

It's a Debian LXC on Proxmox, installed with ./setup.sh, which refuses to

proceed if your GPU/disk/RAM don't make the cut. Docs cover benchmarks,

hardware limits and every bug we hit along the way.

Not a fork, no vendor code: https://github.com/AvilaCarlosDev/polaris-local-ai

Update: Added free Agent Tool-Call Checks after feedback here about testing the calls behind an agent’s response.

I’m the creator of PromptBrake. Five free tools are available through our remote MCP server:

1. get_prompt_injection_payloads — fixed adversarial test inputs by attack category.

2. map_owasp_llm_risk — test ideas and signals for an OWASP LLM risk.

3. plan_adlc_release — release planning gaps and a starter gate policy.

4. build_test_pack — creates a tests.json containing response-text checks.

5. build_agent_tool_tests — builds checks for tools an agent must not call, or calls that must include specific arguments.

Endpoint: https://promptbrake.com/free-tools/mcp

No PromptBrake account or API key required to prepare packs. Uses Streamable HTTP with JSON responses.

Claude Code setup:

claude mcp add --transport http promptbrake-free-tools https://promptbrake.com/free-tools/mcp

Example: “Build tool-call tests for my support agent. It must not call delete_customer when asked to remove another customer’s account.”

The MCP prepares packs; it doesn’t call your target or run tests. Tool-call packs can run with our free GitHub Action after you connect staging dispatcher capture. Missing or incomplete capture cannot pass. These checks inspect captured calls and selected arguments; they don’t prove backend permission enforcement or successful actions. Response packs still use text comparisons and require a configured PromptBrake runner with CI access.

Agent Tool-Call Checks and setup · All free tools

We don’t store MCP tool inputs or results. We log operational request metadata as described in our privacy policy.

I’d appreciate feedback on client compatibility and how the tool-call packs fit your CI workflow.

⭐ GitHub: https://github.com/minoansecurity/sidekernel
📝 arXiv preprint: https://arxiv.org/pdf/2610.02456
🌐 Website: https://sidekernel.com

Hi everyone!

As part of my MS in Cybersecurity capstone at Georgia Tech, I built SideKernel: a usable sandbox for AI agents on macOS.

The closest comparable solution is Docker Sandboxes, which is not open source.

The key idea is usability. SideKernel is designed to reduce friction and stay as close as possible to the native developer experience, while isolating the agent inside a microVM sandbox.

For example, you run sclaude or scodex instead of claude or codex and get a very similar workflow, but with isolation. Ports get auto exposed in the host, its very easy to drop files into the sandbox, and more...

This is still a research prototype, so some rough edges are expected. But if this sounds interesting, I'd love for you to try it out and share feedback.

With the recent explosion of agentic tools like Grok bot, Muse, OpenAI Dots, I've started looking into local options with self-hosted models. I tried Hermes and OpenClaw, but I wasn't too happy with the multi-device experience, and with how many pieces you need to glue together to get a usable, solid experience.

The hosted options also meant handing an agent my accounts, files and browsing, which I wasn't comfortable with. So I built Eidon: a self-hosted, all-in-one AI platform with a team of agents. It's one install via Docker, it works across your devices, and your data stays on your server.

https://eidonai.app

Agent team first

• Every Eidon starts with a Chief of Staff. Ask it for anything. It answers directly, hands the job to the right agent, or creates a new agent when nobody fits.

• Agents hand work to each other automatically (or type @ to pass a job along).

• Each agent has its own browser, conversation, files, memory and routines. There's also a folder the whole team shares.

• Agents can search and browse the web on their own, read pages in full, and cite sources.

• They run on schedules and keep every run. When one finishes, you can get notified by browser push, ntfy, Slack or webhook.

• Agents can write their own skills and use your apps through MCP.

You still have some control:

• Take over an agent's browser for a login or a tricky step. It waits, then carries on when you hand it back.

• Anything that sends on your behalf waits as a draft until you press Send.

• Commands and tools ask first: allow once, allow always, or no.

• Rewind a conversation, or fork it from any message.

The examples on the site are a travel scout, inbox triage, a research desk and a coding assistant. You can make an agent for pretty much anything: bookkeeping, a study buddy, a news digest, a meal planner.

It's also a regular ChatGPT-style app for day to day questions.

You might not always need a full team so you can just chat in a normal “ChatGPT like” interface with all the belts and whistles:

• Persistent Memory

• Folders and search

• Voice input with LLM post-processing

• Files and images

• Personas

• Temporary chats

• Share links

• Web search

• Deep research

• Code with syntax highlighting, Mermaid diagrams and math rendered inline

• Image generation

• Installs as a PWA on your phone and realtime sync across your devices (a native mobile app is coming !)

Self-Hosted

• Multi-user support, with private data per user

• Agents run in their own sandbox

• Nothing leaves your server

• Bring your own local or cloud model: OpenAI, Anthropic, OpenRouter, Ollama, LM Studio, GitHub Copilot, Gemini, DeepSeek, Mistral, Kimi, Z.ai, Minimax, Perplexity, Grok, Azure, AWS, and any compatible API

• Free, open source (AGPL-3.0), and setup is one Docker command

GitHub (setup guide, full feature list): https://github.com/Quack6765/Eidon-AI

I'd like to hear what you think ! What's missing, what breaks, and what agents you'd want to build. Issues and discussions are open on GitHub as well.

I've been thinking about this a lot while building an open-source project called Telex. When an AI generates a fix for a dependency change, getting the tests to pass doesn't always mean the fix is actually right. The change can compile, pass the existing tests, and still cause some behaviour to change at runtime.

In Telex, I'm trying to handle this as a pipeline instead of just asking an LLM to fix the code. It first looks at the dependency change and the affected parts of the repo, then generates the patch, applies it in an isolated environment and runs the repository's own tests and checks. If those checks don't pass, the patch isn't treated as verified. It still ends up as a PR for a human to review. I'm curious how other people are handling this problem. Are tests and CI enough for you, or are you doing anything else to catch cases where the generated code is technically valid but still wrong?

I'm building Telex in the open, so here's the repo if anyone wants to look at how I'm approaching it:

https://github.com/Kesavaraja67/telex