AI Coding Live News

Apple Creator Studio adds AI assistants built on Apple models and OpenAI to Logic Pro, Keynote, Pages and Numbers, plus MCP support so external agents can edit iWork documents

On October 27 Apple announced a major Apple Creator Studio update: Logic Pro for Mac plus Keynote, Pages and Numbers gain beta intelligent assistants that Apple says are powered by a combination of Apple-built models and OpenAI and understand document context. Keynote, Pages and Numbers also add Model Context Protocol (MCP) support, letting external AI agents read content, make edits and run automated actions inside the apps. Pixelmator Pro adds natural-language Generate Fill, and Keynote introduces the open JSON-based .keyx format. The update ships free to existing subscribers on the App Store in November; pricing stays $12.99 per month or $129 per year.

Apple Creator Studio adds AI assistants built on Apple models and OpenAI to Logic Pro, Keynote, Pages and Numbers, plus MCP support so external agents can edit iWork documents

Key Takeaways

  • Logic Pro for Mac, Keynote, Pages and Numbers gain beta assistants that Apple says run on a combination of Apple-built models and OpenAI
  • Keynote, Pages and Numbers support MCP so external AI agents can read content, edit and automate actions (requires macOS 27 or later)
  • Keynote adds the open JSON-based Keynote Interchange Format (.keyx), designed to be readable by external tools and AI agents
  • Assistants are U.S. English only and need an Apple Intelligence-capable device on iOS, iPadOS or macOS 27; free update for subscribers in November
  • Pricing unchanged at $12.99 per month or $129 per year, $2.99 per month for education
Read full story

MCP reference servers v2.1.0 fix eight vulnerabilities: upgrade filesystem and everything to 2.0.1 and fetch to 2026.10.24

On Oct 25 (UTC) the official Model Context Protocol servers repo shipped v2.1.0, fixing eight vulnerabilities in three reference servers: symlink races, trailing quote/whitespace path bypasses and case-insensitive symlink bypasses in filesystem; cross-origin calls over HTTP/SSE in everything; and IDNA host-name and NAT64 internal-address reachability plus robots.txt not rechecked after redirects in fetch. The maintainers warn that npm users still on date versions (2025.x/2026.x) will not be offered the upgrade and must install 2.0.1 explicitly, and that the filesystem write issue is only partly fixed on Windows.

Key Takeaways

  • Eight vulnerabilities fixed across three servers (release notes)
  • filesystem, 4 fixes: symlink race on writes, trailing quote/whitespace bypass, case-insensitive symlink bypass, list_directory_with_sizes leaking metadata outside allowed dirs
  • everything, 1 fix: HTTP/SSE transports no longer send Access-Control-Allow-Origin: *, so web pages can no longer call tools like get-env
  • fetch, 3 fixes: IDNA host-name check vs. connection mismatch, NAT64-wrapped private IPv4, robots.txt not rechecked after redirects
  • Date-versioned npm installs must run npm install @modelcontextprotocol/[email protected] explicitly; Windows is only partly fixed
Read full story

WEFT: Whole-System Evolution for Tool-Use Post-Training Scales Agentic Interaction with MegaMCP State Isolation

Recent attempts to scale tool-use post-training for autonomous agents have focused primarily on synthesizing standalone execution environments. However, environments constitute merely one component of a holistic agentic interaction system comprising environments, tasks, harnesses, and evaluators; scaling environments in isolation yields inconsistent training signals. Researchers from Fudan University introduce WEFT (arXiv:2609.36887), a whole-system evolution framework for tool-use post-training. WEFT coordinates environment breadth, task complexity, and interaction diversity, applying execution-driven self-evolution to attribute failures and iteratively revise flawed components. To ensure optimization stability and concurrency reliability, WEFT introduces prefix-preserving sampling, atomic-turn credit assignment, and MegaMCP—a Model Context Protocol infrastructure providing isolated, recoverable state management across concurrent rollouts. WEFT-8B and WEFT-14B outperform matched environment-scaling baselines across BFCL V4, tau^2-Bench, and Claw-Eval, with WEFT-14B beating Agent-World-14B by 6.41, 2.23, and 12.27 percentage points, while WEFT-35B-A3B excels on long-horizon benchmarks like Toolathlon-Verified.

WEFT: Whole-System Evolution for Tool-Use Post-Training Scales Agentic Interaction with MegaMCP State Isolation

Key Takeaways

  • Pioneers WEFT, co-evolving environments, tasks, harnesses, and evaluators to overcome the limits of isolated environment synthesis
  • Integrates prefix-preserving sampling, atomic-turn credit assignment, and MegaMCP isolation for resilient tool-use post-training
  • WEFT-14B surges past Agent-World-14B by 6.41 pp on BFCL V4, 2.23 pp on tau^2-Bench, and 12.27 pp on Claw-Eval
Read full story
Linked Models & Agents:

SkillSeek Solves Marketplace-Scale Agent Skill Retrieval: Two-Stage IR with MCP Slashes Cost by 46% Over LLM Loops

Anthropic's Agent Skills (packaged into SKILL.md directories) encapsulate procedural know-how for LLM agents, with open aggregations expanding beyond 230,000 skills. While prior literature relied on expensive LLM-mediated loops within the agent decision process, SkillSeek introduces a two-stage IR pipeline (BGE-base bi-encoder + small cross-encoder) exposed via Model Context Protocol (MCP). Evaluated across 89 SkillsBench tasks on OpenHands, SkillSeek matches or exceeds LLM-mediated retrieval loops while slashing per-trial spend from $51.30 to $27.54 (a 46.3% reduction).

SkillSeek Solves Marketplace-Scale Agent Skill Retrieval: Two-Stage IR with MCP Slashes Cost by 46% Over LLM Loops

Key Takeaways

  • Slashes per-trial retrieval spend from $51.30 to $27.54, reducing token costs by 46.3%
  • Matches costly LLM-mediated loops across 89 SkillsBench tasks via BGE-base bi-encoders and compact cross-encoders
  • Native Model Context Protocol (MCP) server support enables seamless drop-in integration with OpenHands, Claude Code, and agent harnesses
Read full story
Linked Models & Agents:
ADSponsored

MCP TypeScript SDK 2.2.0: M2M OAuth expectedIssuer, auto-paging list*, CJS jose types + Client.listen hang fixes

MCP’s TypeScript monorepo shipped v2.2.0 on 2026-09-28: client/server/core/server-legacy/codemod aligned at 2.2.0. M2M OAuth providers should pass expectedIssuer; fetchToken() throws AuthorizationServerMismatchError on issuer mismatch. Cursor-less listTools/listPrompts/listResources/listResourceTemplates now follow nextCursor (capped by listMaxPages). Fixes the 2.1.0 CJS jose types regression and Client.listen() unhandled rejection / send hang.

MCP TypeScript SDK 2.2.0: M2M OAuth expectedIssuer, auto-paging list*, CJS jose types + Client.listen hang fixes

Key Takeaways

  • Shipped v2.2.0 — client/server/core/server-legacy/codemod aligned; node/express/hono/fastify unchanged
  • M2M OAuth: pass expectedIssuer; fetchToken throws AuthorizationServerMismatchError on mismatch
  • list* without cursor auto-follows nextCursor (listMaxPages cap)
  • Fixes CJS jose types regression and Client.listen() rejection/hang
  • Install: npm i @modelcontextprotocol/[email protected]
Read full story

cf-mailroom: Open-Source Self-Hosted Email System for Humans and AI Agents on Cloudflare via MCP

Indie developer wong2 released cf-mailroom, a fully self-hosted email system powered by Cloudflare (Workers, Email Routing, D1, R2, Web Push) designed for seamless human-agent collaboration. While humans interact through a responsive Gmail-like web UI, AI agents access mailboxes via the Model Context Protocol (MCP) with scoped OAuth permissions. The platform features automated natural-language email labeling, intelligent agent draft generation with custom playbooks, and one-click human approval workflows.

cf-mailroom: Open-Source Self-Hosted Email System for Humans and AI Agents on Cloudflare via MCP

Key Takeaways

  • Serverless native: runs completely on Cloudflare Workers, D1 database, R2 object storage, and Email Routing
  • Dual access: Gmail-style web UI for humans and MCP server endpoints for AI coding/productivity agents
  • Human-in-the-loop: inbound mail auto-triaged and replied by agent drafts, pending one-click approval
  • Zero Trust security: protected by Cloudflare Access and scoped OAuth authentication
  • Instant deployment: one-click Cloudflare deploy button with automatic D1 schema migrations
Read full story

MCP TypeScript @modelcontextprotocol/server 2.1.0: request-time OAuth scopeChallenge + 4 MiB body cap

The official MCP TypeScript SDK shipped @modelcontextprotocol/[email protected] on 2026-09-23 (npm). Headline: request-time scopeChallenge callbacks on tools, resources, resource templates, and prompts that return the exact scope set for an insufficient_scope challenge; createMcpHandler and Streamable HTTP answer HTTP 403 before handler/SSE setup. Patches add a default 4 MiB request body limit and JSON-RPC batch cap of 100, treat request id 0 as a real id, stop sending notifications/cancelled for initialize, and enforce Mcp-Name on modern tasks routes. For Agent gateways wiring MCP to OAuth resource servers, this is a permissions + DoS hardening minor.

MCP TypeScript @modelcontextprotocol/server 2.1.0: request-time OAuth scopeChallenge + 4 MiB body cap

Key Takeaways

  • Shipped: @modelcontextprotocol/[email protected] on GitHub + npm
  • Auth: scopeChallenge/requireScopes (#1624); 403 insufficient_scope per Authorization spec
  • Hardening: 4MiB body default, batch≤100; request id 0 treated as real
  • Protocol: no cancel notify on initialize; Mcp-Name checked on modern tasks routes
  • Docs: MCP architecture + typescript-sdk repo; npm i @modelcontextprotocol/[email protected]
Read full story

Amap Launches 'Qianyu' Spatial Intelligence Platform: 56 MCP Tools & 23 Skills for Autonomous Physical Agents

At the 2026 Apsara Conference, Alibaba's Amap launched 'Qianyu', an open platform for spatial intelligence. Packaging over 80 million POIs, 5 million kilometers of roadway, and 7,500 square kilometers of 3D spatial models into modular Agent primitives, Qianyu exposes 56 MCP (Model Context Protocol) capabilities and 23 Skill APIs to empower physical robots, delivery drones, and autonomous vehicles.

Amap Launches 'Qianyu' Spatial Intelligence Platform: 56 MCP Tools & 23 Skills for Autonomous Physical Agents

Key Takeaways

  • Expands AI from digital text comprehension into physical spatial decision-making and environmental reasoning.
  • Releases 56 standardized MCP tools and 23 Skill endpoints compatible with Claude, Qwen, and DeepSeek agents.
  • Delivers vertical agents across transportation, logistics, and robotics, accelerating spatial routing by 8.4x.
  • Accessible via the Amap Open Platform with both no-code visual configuration and full API SDKs.
Read full story
Linked Models & Agents:

AGNTCon + MCPCon Europe Kicks Off: Spotlight on MCP 2.0 and Production Agent Stack

AGNTCon + MCPCon Europe launched in Amsterdam, gathering frontier builders from Anthropic, Cursor, and Cloudflare to define the agent stack. Discussions centered on the MCP 2.0 specification, emphasizing end-to-end security, bidirectional streaming, and production-grade multi-agent interoperability.

Key Takeaways

  • Europe largest agent stack conference gathering over 1,500 core systems engineers
  • Shapes the MCP 2.0 roadmap: bidirectional streaming and cross-cloud sandbox auth
  • Transitions agentic orchestration from prototype tinkering into enterprise SLA production
Read full story

JetBrains 2026.2.2 Ships AI Agent Setup Widget with Deep Model Context Protocol Support

JetBrains released Rider and ReSharper 2026.2.2 featuring a dedicated AI Agent Setup widget. Developers can visually discover, configure, and authenticate MCP-compliant external tools, databases, and agent skills directly within the IDE.

Key Takeaways

  • Out-of-the-box AI Agent Setup widget embedded in Rider and ReSharper
  • Native Model Context Protocol (MCP) support for seamless tool and agent linking
  • Granular permission management and audit logging for enterprise codebases
Read full story
Linked Models & Agents:
ADSponsored

Google Home MCP early access: Claude, ChatGPT and other agents can control smart-home devices

Google Home opened early access to a Model Context Protocol (MCP) server for US Google Home Premium Advanced subscribers. Any MCP-capable agent—Claude, Hermes, OpenClaw, ChatGPT, Google Antigravity—can securely connect to the Home ecosystem: review camera summaries, monitor activity, control Nest doorbells/thermostats and Matter lights, and build custom dashboards. Setup means creating a Google Cloud project, configuring Home MCP, then handing the config to an agent for sign-in and permissions. It covers Google Home and Works with Google Home / Matter devices, rolling out over coming weeks.

Key Takeaways

  • US Premium Advanced early access: Home MCP lets MCP agents safely drive cameras, Nest, and Matter devices
  • Works with Claude, Hermes, OpenClaw, ChatGPT, Google Antigravity for summaries, monitoring, control, dashboards
  • Needs a Google Cloud project + Home MCP config; agent-guided sign-in; rolling out over weeks
Read full story
Linked Models & Agents:

MCP ships Agent Skills extension: skills/list and skills/get load SKILL.md on demand

The Model Context Protocol added a Skills extension (modelcontextprotocol/ext-skills). Servers declare io.modelcontextprotocol/skills; clients discover with skills/list, fetch metadata with skills/get, then load SKILL.md and supporting files via resources/read only when needed, instead of stuffing every skill into context. Spec: modelcontextprotocol.io/extensions/skills/overview.

Key Takeaways

  • Official repo modelcontextprotocol/ext-skills, maintained by the Skills Over MCP Working Group.
  • Flow: skills/list then skills/get then resources/read so SKILL.md loads on demand and saves context.
  • Servers must declare resources plus io.modelcontextprotocol/skills; optional directoryRead for directory listing.
Read full story

Gemini Business: custom MCP server connections for private data and internal tools

TestingCatalog reports Google Gemini Business now supports custom MCP server connections so agents can attach private data and internal tools. The post also asks how soon consumer Gemini will get the same.

Key Takeaways

  • Gemini Business adds custom MCP server connections.
  • Agents can attach private data and internal tools.
  • Community is watching whether consumer Gemini follows.
Read full story

Cline launches official MCP extension registry and hot-plugging for instant PostgreSQL, Linear, and GitHub tool access

Open-source coding assistant Cline launched its official Model Context Protocol (MCP) marketplace. Developers can now browse, configure, and hot-plug over 150 community-audited MCP servers (databases, issue trackers, CI/CD, and local dev tools) directly inside VS Code without manual JSON setup.

Key Takeaways

  • Eliminates manual JSON config files with one-click IDE MCP server discovery and install.
  • 150+ community-audited tools available on day one with fine-grained permission control.
  • Supports mid-session hot-reloading of tools without interrupting ongoing agent steps.
Read full story

Microsoft & GitHub Announce Copilot Workspace 3.0: Claude 3.7 & Custom MCP Extensions

GitHub launched Copilot Workspace 3.0 bringing Anthropic Claude 3.7 Sonnet reasoning and custom MCP tool ecosystems to GitHub PR workflows.

Key Takeaways

  • Automates GitHub Issue to Spec, multi-file code plan, and test suites in a unified web workspace
  • Extends MCP protocol support to Azure DevOps, Datadog metrics, and internal SQL data assets
  • Enterprise security audit gateway guarantees proprietary code never leaves designated VPCs
Read full story