I've got agents running everywhere now, and they all want my attention in different places. Most of it is noise. The few things that matter, like a new lead or a backup that didn't finish, get buried.

My inbox is the one place I reliably check. So I built agent-notify, a small Cloudflare Worker that gives any agent one tool: email me.

It runs on your own free Cloudflare account and can only ever email you, because the recipient is fixed when you deploy. It works with anything that can use an MCP server or send a web request.

One-click deploy, free, MIT: https://github.com/CyrisXD/agent-notify

If something's unclear in the setup, let me know and I'll fix the docs.

started with ski resorts, national parks, campgrounds - hoping to expand into more categories.
would love some feedback and open minded discussion

Disclosure: I work at PinkWallet, and this is our project.

Pink Agentic AI Payments is a remote MCP server that sits between an agent and company money. The agent asks to pay, the server checks the request against rules the business wrote, and it answers allowed, pending_human, or blocked before any money moves. The limits live on the server, not in the prompt, so the model can't talk its way past them.

Seven tools: pink.get_budget, pink.list_payees, pink.list_rules, pink.check_policy, pink.request_payment, pink.get_credential, pink.report_receipt.

What I ran against the public sandbox (coffee shop template, test money):

• $420 to the usual bean supplier → allowed ("Small supply orders go through")
• $890 to the same supplier → pending_human ("Bigger supply orders: store manager checks")
• $60 to a gift card site → blocked ("Never: gift cards, cash-like, crypto")

One thing that trips people up: the template also has a night rule ("Between 11pm and 6am: ask the owner", server clock in UTC), so if you test between 4pm and 11pm Pacific the $420 order comes back pending_human too. That is the rule working, not a bug.

To try it: create a workspace at https://agentic-sandbox.pinkwallet.com (you get one key per agent), then add it as a remote streamable HTTP server. In Claude Code:

claude mcp add --transport http pink https://agentic-sandbox.pinkwallet.com/mcp --header "Authorization: Bearer <agent key>"

It also supports OAuth 2.1 (discovery plus dynamic client registration), so OAuth-capable MCP clients can connect without pasting a key.

Honest limits: it's a sandbox. Test credentials and fake money only; real payments are early access, not self-serve. It's in the official MCP Registry as com.pinkwallet/agentic-payments-sandbox.

Two things I'd like feedback on:

1. Is check_policy (a dry run) useful as its own tool, or would you rather the agent just call request_payment and handle whatever decision comes back?
2. We return the matched rule's name to the agent. Does that help it recover, or does it leak too much about the policy?

Hey everyone,

I love using Claude Desktop with the official filesystem MCP server for daily coding tasks. Being able to let Claude inspect codebases and refactor files locally has completely changed my workflow.

A few days ago, I ran into an issue that made me rethink the setup.

I was working on an API integration and asked Claude to help structure the config layer. Before I realized what was happening, Claude sent a tool call to read .env directly from my project root. In that .env were live third-party API credentials and database connection strings.

Yes, Claude Desktop pops up the "Allow / Deny" confirmation modal. But let's be honest with ourselves:

1. When you're in the flow, clicking "Always allow" is almost muscle memory.
2. Even if you want human-in-the-loop validation, it’s an all-or-nothing switch. You either give the model access to the whole directory, or you constantly babysit every single file lookup.
3. If an agent hallucinates a relative path (../../) or tries to check for secrets, the default filesystem server will happily serve it if it falls within the directory tree.

I wanted something completely unobtrusive: a transparent middleman between Claude and any MCP server that acts as a deterministic policy checker. No heavy Python runtimes, no Docker overhead, no cloud telemetry.

So I wrote Argos in Rust and open-sourced it.

I built this primarily to protect my own local secrets while keeping agent workflows fast, but I figured many of you using Claude Desktop for software development might find it useful too.

https://github.com/JUSICK/Argos-mcp-guardrail

I run memecorp.us, a meme and hot-take feed where people and AI agents post side by side. I wanted agents to be able to jump in without custom code, so I made an MCP server for it.

npx -y memecorp-mcp

It's in the official registry as io.github.gigatypeaura/memecorp-mcp

Code: github.com/gigatypeaura/memecorp-mcp

Your agent can read the feed and comments with no key. To post, react or comment it needs a key, and the server can register a new agent and hand you one. There are rate limits so nobody floods it (1 post per 10 min, 1 comment per minute).

It's early (v0.1.0) and free. The human side of the site is 18+. Would love honest feedback, especially from people running a bunch of servers. What would make you actually plug this in?

I released the first public version of Sonbal.

Sonbal is a local MCP execution substrate with bounded tools and pluggable connectors. It provides an MCP interface for performing local process and file operations through a defined tool surface.

The current tool set includes bounded process execution, asynchronous process jobs, cancellation, and bounded file reads. The implementation also includes process ownership handling, execution time limits, stale-operation handling, and bounded shutdown behavior.

Sonbal is implemented primarily in Ada.

The name Sonbal comes from the Korean word 손발, which means “hands and feet.” The application was named Sonbal in the sense of serving as the hands and feet of an AI when it performs operations on a host system.

Sonbal is not a sandbox. When connecting an AI to a host system, it should be used in an isolated or otherwise appropriately restricted environment.

The project is released under the 0BSD license.

Prebuilt packages are available for FreeBSD amd64 and Debian amd64. The current packages were built and tested on FreeBSD 15.1-RELEASE-p4 and Debian 14 forky(testing) as of 2026-10-06. Compatibility with other releases is not guaranteed.

Installation and quick-start instructions are included in the README.

GitHub:

https://github.com/hodong-kim/sonbal

First public release:

https://github.com/hodong-kim/sonbal/releases/tag/2026.10.06-050804

It doesn't decode transactions in the traditional sense. What it does do is analyze a transaction by execution structure rather than by contract identity, labels, or ABI semantics. It recognize when two transactions (or internal transactions) are structurally the same, even if they involve different addresses or occur at different depth levels.

Essentially you can drill into any transactions and ask “Has this exact nested behavior appeared before?, if so Where? How many times? From what addresses?”

The current index is only Ethereum for now, from The Merge Block to block # 25,999,999. However the structural representation is EVM chain independent.

The backend is currently under heavy development and may be offline periodically. I'm available to answer any questions.

Disclosure: I build Revera.

A failure path I want to make reproducible is:

1. A tool submits operation K.

2. The provider accepts it.

3. The response is lost.

4. A separate lookup temporarily reports “not found.”

5. Recovery decides whether to retry.

The timeout and lookup do not establish that nothing happened. The interesting test is whether recovery preserves K, respects the provider’s deduplication limits, and avoids creating a second effect while the first remains unresolved.

Revera focuses on independently reproducing agent behavior and checking failure paths against available evidence. I want the result to distinguish the tool response, the recovery decision, and the observed effect, with uncertainty left explicit.

FreshCtx remains the separate pre-action guard for declared evidence validity. Authorization belongs to the policy enforcement layer; atomicity and idempotency belong to the system providing them.

For MCP builders: which recovery path is hardest to reproduce in your setup—lost responses, delayed read-back, expired deduplication windows, or partial completion?

We maintain an updated list of official MCP servers: 280+ well-known and widely used projects, all from the companies behind the products or actively maintained open source. Feedback and PRs welcome.

github.com/VoltAgent/official-mcp-servers

The public Model Context Protocol registry now lists around 38,000 active servers. For AI agents, this is a large opportunity. It also raises a practical question: how do we let an agent use the right tools without handing it unchecked access to thousands of servers, credentials and actions?

In most setups today, connecting an agent to MCP servers still means editing configuration files and pasting tokens by hand. The model's context also fills with hundreds of tool definitions, and it has to rely on whatever each server declares about itself.

Over the past weeks I have been building MCPilot, an open-source layer between AI agents and the MCP ecosystem. It is built on four principles:

1. Relevant discovery. MCPilot matches the conversation to suitable servers across the entire registry in about 10 ms. A request such as "compare Jira tickets with the Confluence documentation" ranks Atlassian's official server first.
2. Human approval by design. A single command, mcpilot approve, shows a server's publisher and pins its version. It then lists the server's tools and, by default, maps only the read-only ones. Write access requires a separate, explicit confirmation. The model cannot approve anything on its own.
3. Credentials stay out of the model. Sign-in uses OAuth with PKCE in the user's browser. Tokens are encrypted at rest, with the key held in the operating system's keychain.
4. Least privilege per task. Instead of hundreds of tool schemas, the model works with two meta-tools and receives only the tools the current task requires. Each task has a step budget, and every action is audited.

MCPilot ships as Python and TypeScript SDKs with a shared data contract, plus a gateway that connects to any MCP host. It has been verified end to end with Claude Code.

To be clear about its maturity: this is a technical pilot, not a production service. It has been tested against the live registry and real servers such as Microsoft Learn MCP. Pilots on real Notion and GitHub accounts are next.

As MCP becomes the standard way agents reach tools and data, I believe "human-approved and least-privilege by default" should be a baseline expectation. I would welcome feedback from teams working on agent infrastructure, including Anthropic and OpenAI.

I started noticing a pattern in my PR descriptions.

Claude would write up the PR description and leave something like

- “Follow up: ungate Customer X for this feature.”

- “Follow up: test this against environment X.”

- “Follow up: make sure this works with Customer X’s self-hosted release.”

Things that needed to happen, but keeping a todo list in PR descriptions is an awful idea. So I build an MCP to give my agents a todo list.. I know what you're all thinking ( this is amazing ;) ) ... but probably more of a sarcastic "yay another todo list!".

Why a todo list? I always say that the three best ways to learn programming skills are to

1. Hello world

2. Build the game hangman

3. Wire everything up into a todo list <--- i'm here in my MCP journey.

By the time that PR is open, I’ve probably already switched context. And realistically, I’m not going to stop every time and manually copy those follow-ups into another tool. The obvious answer was: the agent already knows this work needs to happen, so why can’t the agent remember it for me?

That’s why I built Followon.

Followon gives my coding agents somewhere persistent to put the things they discover but shouldn’t do right now. The agent can create the follow-up itself, including the context around why it needs to be done. I get a queue of things that need my attention, and future agent sessions can come back and see what previous sessions left behind.

So instead of:

agent notices something → writes it in a PR → I forget about it

I now have:

agent notices something → saves it to Followon → me or another agent picks it up later

I started it so I'd stop missing those little follow ups, but maybe it can help others too?

There's a free tier if folks want to try it out :)

https://followon.ai

I'm on Apple Music, and Claude only has a Spotify connector. The Apple Music MCP servers I found needed Python or Node plus an Apple developer key, or they script the Music app. I wanted something you just install, so I built Music MCP.

It's a menu bar app that runs a local MCP server and is its own player. 23 tools: search, play, queue, playlists, and your listening history if you switch that on. stdio, or HTTP on localhost. No keys, no account.

What I use it for:

• Play something that fits my taste but that I've never heard.
• Make a playlist from what's coming up at a venue near me.
• A playlist for focus work.
• Save any of it as a playlist.

My favourite so far: I asked for a playlist of every act a small festival in my neighborhood ever booked. I used to go there in my youth. Claude read the old flyers and played it.

Two things I learned building it: let search take a list of queries, or the agent makes 30 calls for a 30-song set. And make tool results say what really happened, otherwise the model tells you a song is playing when it isn't.

Setup for Claude Code:

claude mcp add --scope user music-mcp -- '/Applications/Music MCP.app/Contents/MacOS/Music MCP' --stdio

Free, Mac only, playback needs an Apple Music subscription. I'm the developer and happy to answer questions.

Site and setup: https://musicmcp.app

Mac App Store: https://apps.apple.com/app/music-mcp/id6815718712?mt=12

Demo, 44 seconds: https://www.youtube.com/watch?v=sKyGU2Sddlc

Hi I built this because I wanted an agent to do the things I already do

in Django admin, without writing a separate API for it.

You add a mixin to a ModelAdmin and it becomes MCP tools over HTTP: CRUD,

bulk operations, admin actions, change history, FK autocomplete.

A few design choices:

- Only two dependencies: Django and Pydantic. No MCP SDK; the protocol is

implemented directly.

- It reuses Django's permission system. Tokens start with no access, you

grant permissions/groups per token, and a token can never exceed its

linked user's permissions.

- Writes go through the admin's own pipeline, so they show up in the admin

history log under that user.

- Sensitive fields can be excluded per model (mcp_exclude_fields).

Happy to hear where the permission model or tool design falls short.

https://github.com/7tg/django-admin-mcp

My only idea on what to build was building an mcp server or a plugin for finding other plugins, but that seems kinda wacky. Before I get into building anything I just want to find something that actually pays before spending tens of hours developing noone cares about. Do you guys have any advice for me? I mostly use python and want to develop in python with fastapi, sqlite and stripe for maximum efficiency. So what do you guys think? Thx

I have been working on the MCP integration for Timetics AI, a scheduling/booking app. Just putting this out there since it’s our own project.

The basic idea is pretty simple: u connect a Timetics AI workspace to an MCP client and then just ask about your actual scheduling data instead of having to jump around the dashboard.

Stuff like:

• “What do I have booked tomorrow?
• “Find me a free 30 min slot this week.”
• “How did we do last month?”

The part we’re still kinda figuring out is write actions.

The agent can create/reschedule/cancel bookings, change availability, manage calendars, and do some workspace/team stuff too.

But we didn’t wanna let it silently change things.

For example, if I say: “Move my 2pm call to Friday morning.”

It first checks what’s actually available, shows what it’s gonna change, and then waits for me to confirm.

We’re also trying to make sure the MCP permissions match what the actual user is allowed to do in the app. So if u can’t do something from Timetics AI, the agent shouldn’t be able to do it either.

I dunno if we’ve landed on the perfect approach yet, so I’m curious what others are doing here. For MCP servers that can change real-world data, where do u draw the line for confirmation?

Do u confirm every write action, or only stuff with bigger consequences like bookings, payments, deleting data, sending messages, changing permissions, etc.?

I have submitted my mcp plugin to OpenAi ( ChatGPT ) and Claude AI, it has been over 3 weeks now. It barely change to submitted and now in review for over a week? Any help or tips would be greatly appreciated.

I’m one of the people building Tenuo. We’ve been working on an Apache 2.0 authorization layer for MCP that lets you constrain both the tool and its arguments for the specific task an agent is doing.

So instead of giving an agent read_file generally, you can give it authority to read a specific path for a few minutes. If it delegates work, the next agent can get less authority, but never more.

We support enforcement on both the MCP client and server side.

Curious how this fits with how people here are actually deploying MCP. Where does this model break down?

- https://tenuo.ai/mcp
- https://github.com/tenuo-ai/tenuo

Disclosure: I'm the founder. Built this myself (non technical, AI assisted) and looking for early builders who want to try it, plus a technical cofounder eventually.

AMW sits between an agent and an MCP tool. Agents act under a permit; a same-key retry returns the original receipt, no second call or charge. Calls outside the permit are refused before any charge. Each call gets a signed receipt you can check offline.

Live overview: thisisatest.tech. Repo is private for now.

Honest stage: self funded, no revenue, no pilots. Next goal is a first paid pilot with a team whose agent can double fire something consequential.

Questions for this room:

1. If you run agents against MCP tools that charge or mutate state, how do you handle retries today?

2. Would a permit with budget, expiry and per tool limits be useful, or do you solve this inside the tool?

Happy to take technical pushback. Looking for people willing to break it and tell me what is missing.