Posts

PromptShield is a prompt injection scanner that audits repositories for malicious instructions and hidden Unicode before AI agents ever consume them. It statically scans agent instruction files, detects zero-width character attacks and taint patterns, and maps findings to the OWASP Agentic Top 10 (2026) so teams can block supply-chain and prompt-injection risk in CI/CD. What Is PromptShield and Why Repo Scanning Matters PromptShield belongs to a fast-growing category of tools built to answer one uncomfortable question: can you trust the instructions your AI agent is about to read? As coding agents like Claude Code, Codex, and Cursor become the default way teams ship software, the files those agents read — READMEs, AGENTS.md files, MCP configurations, and skill definitions — have become a new attack surface. ...

LabLLM is a free, native macOS app (Swift/SwiftUI) that lets you train tiny language models from scratch on Apple Silicon — no cloud, no subscription, everything stays on your Mac. Released as a beta in August 2026, it bundles a model builder, dataset browser, tokenizer, training dashboard, LoRA and DPO fine-tuning, a sampler, a chat window, and checkpoints into one GUI, so you can watch a small LLM “emerge” live on your own machine. ...

Apeireth is a pure Safe Rust project that bills itself as an “AGI Operating System” base — a cognitive microkernel with continuous topological memory and a causal world model, built with #![forbid(unsafe_code)] across 16–17 crates. It is extremely early-stage: created September 4, 2026, roughly 27 stars, one fork, and all benchmarks are self-reported. This review separates the ambitious vision from the verifiable reality so you can judge whether it is a genuine foundation or an overpromised prototype. ...

Frugal Tokens is a free, local, read-only web dashboard that shows exactly how many tokens each of your AI coding agent sessions consumed and what those tokens cost, across OpenCode, Claude Code, PI, Codex, and Cursor. It runs entirely on your machine, never mutates your agent databases, and surfaces hidden costs like prompt-cache misses that most developers never see. This guide walks you through installing it, pointing it at your agents, and reading the per-session explorer to cut your coding agent spend. ...

A local-first control plane agent like Swarm watches every Claude Code session on your machine live so you can see each agent’s tool calls, reasoning, token spend, and cost from one dashboard instead of cycling through terminal tabs. It keeps a ledger of who holds which task and worktree, turns CLAUDE.md “never do X” prose into real permission decisions, and runs entirely offline with no account and no telemetry. What Is a Local-First Control Plane for Coding Agents? A control plane is the management layer that decides how the agents underneath it behave. In IT operations, the control plane and the data plane are separated: the data plane does the work, while the control plane watches, meters, and governs. ra3orblade/swarm applies that same separation to AI coding agents, with one crucial twist: the entire control plane runs on your own machine. ...

dsh-auto-review is a DeepSeek Harness plugin that puts a read-only second model on the approval chain, deciding allow or deny for every tool request and returning a structured verdict with a reason. It fails closed by default, so any crash, timeout, or schema mismatch resolves to rejected rather than a silent grant, and it feeds deny reasons back to the calling model so the agent learns instead of retrying blindly. ...

DeepSeek Harness (dsh) is an open-source agent harness by DeepSeek AI, built on an everything-is-a-plugin architecture powered by Cordis, where the model adapter, tool registry, session log, and even the agent loop itself are replaceable plugins. You can launch it in seconds with npx @deepseek-ai/dsh web, connect a DeepSeek API key in Settings, and start delegating file edits, command runs, and multi-agent workflows. This 2026 handbook is a source-backed guide to its agents, plugins, and runbooks. ...

MobARK (Mobile Application Reverse Kit) is a self-hosted, open-source mobile appsec platform for Android and iOS that pairs static analysis with a built-in AI Agent. Its defining feature is an AI Agent that chats with your decompiled code through a local LLM (Ollama, LM Studio, or BYOK), so no binary or source data leaves your infrastructure by default. It is Apache-2.0 licensed, requires Python 3.11+ and Node 18+, and runs as a four-container Docker Compose stack. This review covers its features, privacy model, limitations, and how it compares to MobSF and commercial MAST tools in 2026. ...

DeepSeek Harness (dsh) records every agent run as a durable series of session events — reasoning deltas, tool calls, tool results, step starts and ends, and turn boundaries — and dsh trace compare is the workflow for visualizing and contrasting those exploration paths side by side. Instead of staring at linear chat logs, you render agent execution as a graph (a DAG) where parallel tool calls fan out from a single reasoning step and results fan back in, letting you pinpoint exactly where two runs diverge, stall, retry, or branch. This guide walks you through the session-event format, the native trajectory view, community comparison tools, and the pitfalls to avoid. ...

Rungraph is an open-source, zero-instrumentation tool that reads the agent session transcripts already on your disk and renders them as interactive graphs. With a single npx rungraph command, it visualizes the orchestrator, subagents, and tool calls of any Claude Code, Codex, Hermes Agent, opencode, or Cursor run — then lets you ask, in plain language through an MCP server, “what happened?” and lights up the exact nodes the answer refers to. ...