Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Search
Search results for “MCP OAuth”
Find published research by company, product, platform or technology.
Showing 21–40 of 60 dossiers
Fitbit’s legacy Web API shuts down October 30 — integrations must move to Google Health API
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
Vercel lets coding-agent harnesses use your existing subscriptions without handing tokens to the sandbox
The change separates three things that are often bundled together: the harness, the subscription that pays for it, and the sandbox that executes it. Builders can switch among supported coding agents behind one interface while reusing existing subscription access and reducing credential exposure inside agent runtimes.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
Google Cloud extends Agent Identity into Cloud Run with automatic Agent Registry registration
Agent Identity is moving from a standalone credential boundary into a mainstream serverless runtime. Cloud Run can now assign agent identities and register agents/MCP servers automatically, reducing custom discovery and identity plumbing while keeping the runtime integration itself in Preview.
Google opens a direct Search ingestion pipeline for large forums and social platforms
Large forums and social platforms can apply to push trending public posts and interaction counts to Google via OAuth and JSON-LD. Stable public URLs, attribution, moderation and fast updates are required; indexing and ranking are not guaranteed.
GitHub adds credential inventory to its selective incident-response kill switches
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
Wails 3.0 reaches stable release with a new Go desktop architecture — mobile remains experimental
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
GitHub Copilot can now operate desktop apps, not just code
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Ada gives customer-service agents sandboxed Python tools with controlled network access
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
Coolify 4.5.3 repairs access controls, deployment healthchecks and retry hazards after 4.5 launch
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
SaaSCloud & InfrastructureMarketing & DistributionHostingEmail & LifecycleSaaS OperationsActive dossier
Stalwart 1.0.1 fixes credential exposure and tenant isolation — 1.0 migration still needs care
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
Artificial IntelligenceWeb DevelopmentAI AgentsWordPressBrowsers & Web StandardsDeveloper ToolsActive dossier
WebMCP gives websites a structured tool layer for browser agents
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Laravel AI SDK patches an SSRF path in its Vercel and AG-UI file adapters
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Anthropic’s Model Hardware Standard gives AI agents a shared interface for physical devices
MHS is an attempt to make microscopes, liquid handlers, robotic arms and other programmable hardware look like a consistent tool surface to AI agents. It is still a research preview, but the interoperability layer is already being tested with research institutions and hardware vendors.
Web DevelopmentSaaSCloud & InfrastructureProduct & GrowthDeployment & DevOpsSaaS OperationsDeveloper ToolsActive dossier
Formbricks 6.1 ships scoped surveys and a breaking single-use-link migration after SpiceDB switch
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureDeployment & DevOpsInference & APIsDeveloper ToolsActive dossier
LiteLLM 1.107.0 was backdoored on PyPI and Docker: startup hooks stole credentials even without an import
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Gmail will stop sending as third-party addresses in January 2027
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
TanStack AI 1.0 stabilises its provider-neutral SDK — but the agent harness is still experimental
The three-maintainer TanStack AI project has reached stable 1.0 for its core SDK, with 23 providers; its long-running agent harness is not yet stable.
Artificial IntelligenceWeb DevelopmentAI AgentsAI CodingInference & APIsDeveloper ToolsActive dossier
OpenAI turns the Codex harness into a managed Agents API
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
Android Studio Quail 4 makes curated agent skills and offline Gemma 4 production-stable
Android Studio’s agent layer has crossed an important boundary from preview features into the stable channel: domain-specific skills are preloaded and auto-selected, while Gemma 4 can execute tool-calling code tasks locally without sending source code to a cloud model.