This Week's Highlights — issue 003, September 5, 2026
THE AI TOOLCHAINNO. 003The best tooling updates that shipped this week.
Every feature release from the 187 tools on our watchlist goes into the daily newsletter. Once a week we read the whole field side by side and choose our top picks, judged on two questions:how deep and complete is the single best capability in the release, andhow much it changes what you can actually do.
A tool is judged on everything it shipped that week, so a project that releases daily gets credit for the sum — and still only takes one slot. We would rather run a short list than a padded one.
A read across the whole week before you read any of it: what stands out in this week's picks, grouped by what it lets you do. Every tool named links to its pick below.
- govern
Approve an MCP server on cited evidence, and find out when it changes under you
Gram's Temporal-backed agent assembles a dossier — code-host signals, OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data. advisories, domain registration, direct OAuthOAuthAn open authorization protocol that lets a user grant a third-party application access to their account on another service without sharing their password, using scoped tokens instead of credentials./tools probing — and runs daily drift detection against already-approved servers, so a tool that silently changes its behaviour after review is caught rather than trusted forever. AI SAFE² adds MCP-14–19 and ships machine-readable manifest and dataset files, which makes the control set something a scanner can consume instead of a PDF someone reads.
- govern
Roll out an agent policy in observe mode before it can break anyone's session
FailproofAI's daemon enforces live hooks across 12 agent CLIs fail-closed, and digest-pinned policy packs plus observe-before-enforce let a team watch what a new rule would have blocked before flipping it on — the usual failure is a guardrail that lands hard and stalls every developer at once. nono's sandbox flag refuses PATH hijacks and its glob allow/deny lists let a profile be composed rather than rewritten per project.
- operate
See what your coding agent's hooks and context are actually doing
New Insights, Hooks Runtime, Tasks & Jobs and Context tabs plus nine config-health checks covering sandbox isolation and channel-plugin risk turn an agent setup from something you configure and hope about into something you can inspect while it runs; GitLab secret detection was expanded alongside it.
Security work dominates today: xalgorix can now confirm exploit hypotheses against live routes instead of leaving pentest findings as guesses; Gram turns MCPMCPModel Context Protocol, an open standard from Anthropic that lets an AI model call external tools and data sources through a uniform interface, so cyber tools can expose capabilities directly to LLM-based agents. server approval into an evidence workflow with drift checks; FailproofAI moves agent CLI policy enforcement into a fail-closed local daemon.
- govern
Approve MCP servers from evidence, then keep checking them
Gram now builds a cited dossier for MCPMCPModel Context Protocol, an open standard from Anthropic that lets an AI model call external tools and data sources through a uniform interface, so cyber tools can expose capabilities directly to LLM-based agents. server review, probes server behavior directly, and runs daily drift detection against approved servers, so approval is no longer a one-time Slack judgment that silently goes stale. AI SAFE² v3.1 adds machine-readable MCP control manifests and scanner rules, giving governance teams policy artifacts they can wire into enforcement instead of tracking MCP risk in prose.
- govern
Fail closed when agent CLIs violate local policy
FailproofAI added a background daemon with live-hook enforcement across 12 agent CLIs, local
failproofai audit, digest-pinned policy packs, and observe-before-enforce rollout. nono v0.75.0 adds composable proxy profiles, glob allow/deny lists, and a sandbox flag that refuses PATH hijacks, reducing the chance that an agent run escapes through an ambient tool or credential path.
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
Autonomous multi-agent scanning now coordinates parallel specialists through a durable hypothesis/evidence ledger, with an authz_matrix that replays each request as two accounts and anonymous to flag cross-account IDOR/BOLA, plus one-call deterministic confirmers (verify_sqli, verify_ssti, verify_xxe, verify_oob) that prove exploitation and a whitebox source-to-runtime bridge that discovers hidden routes black-box crawling never reaches and drives them to confirmed RCE.
xalgorix built out a full evidence-driven, multi-agent pentesting architecture this window — a shared hypothesis/evidence ledger backing new one-call confirmation tools for SQLiSQLiSQL injection, an attack technique where malicious SQL is inserted into an input field to manipulate a database query. Cyber tools target or detect it because it remains one of the most common ways applications expose backend data., XSSXSSCross-site scripting, a web vulnerability where an attacker injects malicious scripts into pages viewed by other users, letting cyber tools test or exploit browsers without touching the server directly., SSTISSTIServer-Side Template Injection, a vulnerability class where user input is embedded directly into a server-side template engine and executed, letting attackers run arbitrary code on the host., XXE, and blind (OOB) vulnerabilities, plus a whitebox source-to-runtime bridge (scan_source_sinks, scan_source_routes, probe_hypothesis) that maps source-code sinks to live routes. It also shipped a benchmark harness for detection scoring, findings re-test API endpoints, native Z.AI provider support, and a string of smaller UI, notification, and mobile-scanning improvements.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40what it does and how it works or what changed
- specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds verify_sqli, a deterministic one-call verifier for error-based SQL injection: accepts a hypothesis_id (or url) plus a parameter, issues three scope-gated requests (benign baseline, single-quote broken, doubled-quote balanced), and records exploit-proven CWE-89 evidence in the ledger. Reports confidence 0.95 when the balanced request recovers (classic break/recover) and 0.8 when it still errors, sharing DBMS-error detection logic with the reporting impact-gate via reporting.LooksLikeSQLError. Respects scan session auth, scope checks, rate policy, cancellation, and is disabled in passive mode.
$ verify_sqli --hypothesis_id <hypothesis_id> --parameter id
$ verify_sqli --url https://example.com/items?id=1 --parameter id
Adds ingest_har command that accepts a HAR file captured during an authenticated session, registers its session credentials (Authorization, Cookie, and API-key headers) for use by subsequent http_request and authz_matrix calls, and seeds the ledger with the HAR's authenticated endpoints as role=authenticated hypotheses via a new internal/har parser that extracts exercised endpoints (skipping static assets), their parameters, and session headers with host-scope filtering. A new role=b parameter registers a second captured session as role B, enabling true two-account IDOR/BOLA testing where authz_matrix replays each request as role A, role B, and anonymous to flag cross-account object access.
authz_matrix replay requests across both identities and anonymous.$ ingest_har path=second_user.har role=bauthz_matrix calls run against the authenticated business-logic surface.$ xalgorix ingest_har captured_session.harAdds verify_xxe, a deterministic one-call XXE confirmer that accepts a URL or ledger hypothesis ID: it POSTs a benign baseline XML document, then an XXE payload using a DOCTYPE with an external SYSTEM file:// entity, and confirms exploitation when the target file's contents appear in the probe response but not the baseline. It mirrors the safety envelope of verify_sqli and verify_ssti (internal-host scope check, request-rate gate, session auth, no redirect following, disabled in passive mode) and records exploit-proven CWE-611 arbitrary-file-read evidence directly in the ledger without auto-reporting.
$ verify_xxe https://target.example.com/xml-endpoint$ verify_xxe <hypothesis_id>Adds verify_ssti(hypothesis_id, parameter) (or url+parameter) to confirm server-side template injection via randomized operands — {{a*b}} for Jinja2/Twig/Nunjucks and ${a*b} for Freemarker/JSP-EL/Velocity — proving evaluation when the computed product appears in the probe response but not the baseline. On confirmation it records exploit-proven evidence in the ledger and instructs the agent to report High CWE-1336, respecting scan session auth, rate policy, cancellation, internal-host scope checks, and passive-mode disablement like sibling verify helpers.
$ verify_ssti(hypothesis_id="<hypothesis_id>", parameter="<parameter>")$ verify_ssti(url="<url>", parameter="<parameter>")Adds POST /api/findings/retest to actively re-check a single stored finding without launching a full target scan, and GET /api/findings/retest/{id} to poll the status and verdict of a running or completed re-test job. Introduces an opaque auth_profile argument (primary / secondary / none) for per-job credentials that remain server-side and never appear in job state or tool schemas; terminal jobs report a meaningful_attempt field with counts of request, affected-request, and affected-variant.
still_vulnerable, fixed, or inconclusive.$ curl -s https://xalgorix.example.com/api/findings/retest/<id> \ -H 'Authorization: Bearer <token>'
Adds scan_source_sinks command to sweep an attached source tree for dangerous sinks — RCE/command injection, SQLi, SSRF, file I/O→LFI, template→SSTI, deserialization, open redirect — using the same curated patterns as code_search. Each hit is seeded into the shared ledger as a source-sink: data-flow hypothesis tagged with file:line (the first automated populator of Hypothesis.DataFlow); sink classes map to canonical vuln classes (cmdi→rce, fileio→lfi, template→ssti), bounded to 40 seeds per sweep with idempotent dedup by class + file:line, feeding claim_next_hypothesis so specialists can trace each sink to a reachable route. Degrades to a black-box fallback message when no source tree is configured; discovery-only classes (secrets, auth, crypto) are excluded from seeding.
Adds internal/bench, a benchmark harness with deliberately vulnerable challenge apps (reflected XSS, IDOR, open redirect, error-based SQLi) that deterministically scores scan findings against expected vulnerability class and endpoint, plus the xalgorix-bench operator command (build via go build ./cmd/xalgorix-bench) that wires the real agent and prints a per-class detection scorecard. The challenge library later gains SSRF, SSTI, LFI/path-traversal, and command-injection classes, and two whitebox-specific challenges — whitebox-cmdi and whitebox-node-rce — that require the full source-to-runtime bridge (scan_source_sinks, scan_source_routes, probe_hypothesis, auto-seeding) to find hidden routes and confirm RCE, enabled by new SourceFiles/SetSourceRepo support on Challenge. A -timeout flag (default 8m, via bench.RunWithTimeout) bounds each challenge scan while still scoring partial findings gathered before the deadline, alongside class-based scorecard reporting.
Adds scan_source_routes tool that extracts HTTP route declarations from source code across Flask/FastAPI, Django, Express, Spring, Go routers, and Rails, seeding each as a hypothesis with a real, reachable path — including internal/admin routes a black-box crawler never reaches. Correlates routes with dangerous sinks by handler-file co-location (seeded class-typed by worst sink class present, with a data-flow note e.g. 'POST /admin/exec reaches an RCE sink'), seeds uncorrelated routes as idor leads, bounds seeding to 40 hypotheses per sweep with idempotent dedup by vuln class and path, and degrades to black-box fallback when no source is configured.
Adds probe_hypothesis tool that resolves a source-route hypothesis (or ingested/authenticated endpoint) against the scan target, issues a baseline HTTP request, and records the response as evidence — promoting confirmed routes to testing, flagging 401/403 as authz_matrix candidates, and marking 404/connection failures as blocked. It uses the scan session's auth, honors request-rate policy and cancellation, refuses to probe the operator's own machine via a self-scope check, skips file:line source-location endpoints, does not follow redirects (treating a 3xx to /login as a signal), and is disabled in passive mode.
Adds native Z.AI (Zhipu GLM) provider support with two endpoint tiers — Z.AI standard API (https://api.z.ai/api/paas/v4) and Z.AI Coding Plan (https://api.z.ai/api/coding/paas/v4) — both selectable in first-run setup and Settings → LLM provider list, authenticated by API key. Routes glm-* model IDs to Z.AI automatically and normalises any-case GLM IDs to lowercase before sending (e.g. GLM-5.3 → glm-5.3) so newly released model IDs aren't rejected.
Adds XALGORIX_PPROF_ADDR environment variable to enable an opt-in loopback pprof debug server for runtime profiling.
$ XALGORIX_PPROF_ADDR=127.0.0.1:6060 xalgorixIntroduces authz_matrix, a multi-role authorization matrix for deep-testing authorization logic where autonomous scanners are weakest. Uploaded scan-context artifacts (OpenAPI/Swagger specs, HAR files, Postman collections, Burp exports) now seed the shared hypothesis ledger as bounded, role-scoped IDOR/BOLA authorization hypotheses at scan start, directly driving authz_matrix and evidence-driven specialists rather than serving as passive briefing text. Role assignment is automatic (authenticated when the artifact carried a live session, anonymous otherwise), and seeding is deduplicated by class, endpoint, parameter, and role to prevent scheduler flooding.
Adds verify_oob, a ledger-integrated out-of-band (OAST) verification capability that polls a planted interactsh token to confirm blind vulnerabilities (blind SQLi, RCE, CMDi, XXE, SSRF) and records blind-execution proof in the shared ledger. Applies class-aware verdicts: SSRF requires an assessed non-scanner HTTP interaction, while blind RCE/CMDi/XXE/SQLi are confirmed by any genuine non-scanner callback (HTTP or DNS).
Adds XALGORIX_NOTIFY_SCAN_COMPLETE environment variable (default false) to opt in to Discord and Telegram notifications when a scan completes, separate from per-vulnerability alerts.
Introduces verify_xss, a browser-backed XSS execution verification tool for confirming exploitability beyond static detection. Later extended to confirm XSS execution via console.* API calls and DOM markers (document.title / window.name), covering non-dialog and DOM-only sinks in addition to JS dialogs.
Adds claim_next_hypothesis tool that atomically claims the highest-confidence queued hypothesis, optionally scoped to a vuln_class lane, assigns it to the calling agent, and transitions it to testing in one locked step — eliminating duplicate-claim races between parallel specialists.
Adds optional hypothesis_id parameter to report_vulnerability: on a successful report, attaches the finding as finding_ref evidence to the named ledger hypothesis and marks it proven, eliminating a separate add_hypothesis_evidence call. Empty or unknown hypothesis_id values are silently ignored.
Whitebox source now auto-seeds the ledger at scan start: route↔sink correlations are seeded class-typed and at higher confidence when a route's handler file contains a dangerous sink, matching the behaviour already provided by uploaded OpenAPI/HAR context. Auto-seeding is deterministic, bounded by per-sweep caps, idempotent (the ledger deduplicates), and a no-op when no source is configured.
Supports split-APK bundle formats (.apks, .xapk, .aab) and allows sparse APKs that were previously rejected.
Adds multi-file Postman collection upload with automatic variable and authentication resolution in the context view.
Enables selection of which out-of-band interaction types (DNS, HTTP, SMTP) count as callbacks.
Adds native web_search support via the MiniMax provider, routing web search queries through MiniMax's own search capability; adds a configurable Gemini safety threshold to support authorized security testing use cases; and adds recommendations for current frontier models.
Adds evidence-driven multi-agent assessments that coordinate scan-scoped parallel specialist agents via a durable hypothesis/evidence ledger, the shared backbone that later hypothesis-claiming, source-seeding, and verification tools build on.
Adds a light theme to the web UI with a light/dark/system toggle for display preference control.
Adds Simplified Chinese (zh-CN) language support to the interface.
Displays LLM token usage and a hosted cost note at the end of each scan run.
Adds an interactive wizard for first-run onboarding to guide new users through initial setup.
Adds Cloudflare, Auth0, 1Password, and Tailscale integrations for investigating identity configurations, HTTP traffic, Zero Trust activity, and device changes during alert triage, and sharpens Autonomous Hunt to prioritize actionable exposure and compromise findings over posture noise.
Cotool unified its Detection and Response agents into one configurable tab and added Hunt alert threshold settings, while also shipping new investigation integrations for Cloudflare, Auth0, 1Password, and Tailscale plus broad improvements to alert triage, Slack notifications, and threat models.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40what it does and how it works or what changed
- specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds a Cloudflare integration for investigating HTTP traffic, firewall events, Zero Trust Gateway activity, DNS, zones, and devices; an Auth0 integration for investigating identity configurations, users, audit events, and sign-ins; a 1Password integration for investigating sensitive item activity and audit events; and a Tailscale integration for investigating devices, users, and configuration changes across tailnets.
Hunt alerts now consolidate source attribution and activity details when automatic response-agent triage is skipped, and alert investigation more broadly gains clearer source attribution, more readable structured payloads, and optional feedback when closing alerts as benign or false positives.
Detection and Response agents are now unified under a redesigned Agents tab, with a fully editable system prompt and all Response-agent configuration options now available on every agent.
Adds Hunt settings for configuring minimum exposure thresholds and compromise signal overrides when creating alerts.
Alert triage now attaches evidence to every detection hit, gives response agents prior-alert context, handles duplicate alerts, and escalates uncertain cases for human review.
Slack alert notifications now include concise evidence summaries, in-message status controls, and threaded follow-up with the assigned response agent.
Autonomous Hunt now prioritizes actionable exposure and compromise findings while reducing posture and hygiene noise.
The Detections overview gains infinite scrolling, compact filters, bulk disable, and consistent true-positive metrics.
Threat models gain safer regeneration, persistent progress, longer-running generation, and automatic availability to the default response agent.
The Linear integration adds duplicate issue handling, and the Notion integration adds paginated database queries.
safe execution paths for agents - zero trust, zero setup, zero latency.
New --strict-broker-path refuses to start when a filesystem grant overlaps a directory on PATH, stopping sandboxed processes from planting hijack binaries that later run outside the sandbox with full host privileges; adds glob allow/deny lists for env vars and hostnames plus PATH sanitization for host-side credential and URL brokers.
nono v0.75.0 adds profile composition to nono proxy, a PATH-hijack-refusing sandbox flag, glob-based allow/deny lists, and a phantom-token format field for ambient credentials.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40what it does and how it works or what changed
- specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds a format field to CommandCredentialConfig for ambient credentials, allowing a literal template such as sk-ant-oat01-{} so prefix-sniffing clients correctly classify the phantom token.
{
"command_policies": {
"credentials": {
"claude-api": {
"type": "proxy",
"upstream": "https://api.anthropic.com",
"credential_key": "keyring://anthropic:api.anthropic.com/example",
"env_var": "ANTHROPIC_API_KEY",
"inject_header": "x-api-key",
"credential_format": "Bearer {}",
"format": "sk-ant-oat01-{}"
}
}
}
}Adds --extends <PROFILE> flag to nono proxy, enabling profile layer composition at proxy startup. It requires --profile, is repeatable, and uses the same merge semantics as nono run --extends.
$ nono proxy --profile my-profile --extends extra-domains
Adds --strict-broker-path flag to sandbox args, refusing to start when a filesystem grant overlaps a directory on PATH — preventing sandboxed processes from planting hijack binaries that later run outside nono with full host privileges.
Sanitizes PATH for host-side credential and URL brokers, preventing bare-name broker resolution from picking up attacker-planted binaries in writable directories.
Adds glob pattern support for env var and hostname allow/deny lists in profile and proxy configuration.
Adds an initial set of tool sandbox examples demonstrating per-tool child sandbox policies.
The Universal Governance, Risk, Compliance (GRC) Operating System with Integrated Security for Agentic AI, Non-Human Identities, and Swarm Governance. AI SAFE² + AI Sovereignty Maturity Model (AISM), NEXUS-A2A Protocol, FORGE-Act, Marshal Plan for AI [Dual License: MIT + CC-BY-SA]
Adds six new MCP security controls (extension capability negotiation, header/body assertion integrity, state-handle binding, round-trip replay resistance, catalog provenance, and authorization-chain/audience/SSRF binding) plus 12 scanner rules and three explicit enforcement planes, giving teams machine-readable coverage for the agent-to-tool attack surface.
AI SAFE² v3.1 adds six new MCPMCPModel Context Protocol, an open standard from Anthropic that lets an AI model call external tools and data sources through a uniform interface, so cyber tools can expose capabilities directly to LLM-based agents. controls (MCP-14–19) bringing the CP.5.MCP profile to 19 controls, breaks compatibility by re-anchoring five existing MCP controls to framework-owned governance state, and ships machine-readable manifest/dataset files alongside three enforcement planes, a protocol-independent persistence vocabulary, and an expanded 64-rule scanner registry.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40what it does and how it works or what changed
- specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Re-anchors MCP-4, MCP-7, MCP-8, MCP-11, and MCP-13 from protocol session state to framework-owned governance state — verified principals, capability grants, provenance baselines, delegation chains, and governed state handles — so controls survive protocol changes such as MCP 2026-07-28. Implementations that anchored these controls to MCP session constructs must be re-implemented against the new bindings.
Adds ai-safe2.manifest.json and AGENTS.md as first-class machine entry points, exposing framework version, component versions, normative paths, control counts, enforcement planes, persistence vocabulary, and conformance boundaries so agents and compliance bots can consume the framework without scraping prose. Also adds skills/mcp/data/mcp-profile-v3.1.json, a machine-readable MCP profile covering all 19 CP.5.MCP controls, and skills/mcp/data/ai-safe2-controls-v3.0.json, the 161-control core dataset for automated consumption.
Adds MCP 2026-07-28 as the primary binding for CP.5.MCP, with a twelve-month legacy compatibility window for MCP 2025-11-25; server/discover is optional under the primary binding and its absence is not treated as a scanner failure.
Adds six new CP.5.MCP controls: MCP-14 (Extension Capability Negotiation), MCP-15 (Header and Body Assertion Integrity), MCP-16 (State Handle Binding and Lifecycle), MCP-17 (MRTR Round-Trip Integrity and Replay Resistance), MCP-18 (Catalog Cache Integrity and Provenance Revalidation), and MCP-19 (Authorization Chain Integrity, intended-resource/audience binding, and SSRF boundaries), bringing the MCP profile to 19 controls. MCP-19 introduces an explicit conformance boundary: a deployment must evidence intended-resource, audience, or equivalent binding before protected dispatch — opaque bearer-token possession alone does not satisfy the control.
Scopes the Challenge Lab by enforcement plane — maturity, framework/profile conformance, the plane exercised, and required evidence — adding v3.1 MCP cases covering header/body desynchronization, catalog/schema drift, replay, audience/resource confusion, endpoint impersonation, SSRF, and legacy state-handle misuse.
Formalizes a protocol-independent persistence vocabulary with four canonical values — request, handle_scoped, durable, and swarm_shared — replacing protocol-owned session language at the governance boundary.
Establishes three explicit enforcement planes — north-south (agent to model provider), east-west (agent to agent), and agent-to-tool (agent to MCP server or tool) — with the rule that a successful control result on one plane does not automatically establish coverage on another.
Expands the scanner rule registry to 64 rules by adding 12 new grouped CP.5.MCP v3.1 rules covering the new controls MCP-14–MCP-19 and the re-anchored MCP-4, MCP-7, MCP-8, MCP-11, MCP-13.
Adds a dedicated Agent Discovery and Manifest Integrity CI gate that verifies manifest claims against the repository, failing on incorrect claims and broken paths.
- !Controls MCP-4, MCP-7, MCP-8, MCP-11, and MCP-13 now bind to framework-owned governance state rather than protocol session state; implementations that anchored those controls to MCP session constructs must be re-implemented against the new bindings.
native macOS app that gives you a real-time dashboard for your Claude Code and Cowork sessions, with analytics, conversation history, security hardening, real time secrets detection and project insights.
Adds config-health checks that flag Claude Code channel plugins (Telegram, Discord, iMessage) as prompt-injection and permission-relay surfaces, plus new checks for filesystem isolation, sandbox network allowlists, and credential masking, and expands secret detection to nine GitLab token families — turning agent config auditing into concrete findings.
Claudoscope v1.1.0 adds four new observability tabs (Insights, Hooks Runtime, Tasks & Jobs, and Context), nine new config-health checks spanning sandbox isolation and channel-plugin risks, and expanded GitLab secret detection, while merging its Health, Hardening, and Routing rails into one.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40what it does and how it works or what changed
- specificity0–30names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds SKL014, a check that flags any skill restricted only to the TodoWrite or Task* tools, which Claude Code 2.1.233 removed from Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models unless CLAUDE_CODE_ENABLE_TODO_TOOLS=1 is set.
allowed-tools list will trigger SKL014 after Claude Code 2.1.233 removed TodoWrite and Task* tools from newer models without the opt-in env var.$ CLAUDE_CODE_ENABLE_TODO_TOOLS=1 claudeAdds a Tasks & Jobs rail surfacing Claude Code's background jobs from ~/.claude/jobs/ (state, timeline, tokens, result) and per-session task lists from ~/.claude/tasks/ (checklist with dependency chips), with jump-to-session links and a daemon status line; job providerEnv maps are never decoded.
Adds an Insights tab inside the Analytics rail (Usage/Insights toggle) that reads session facets from ~/.claude/usage-data/ written by Claude Code's /insights command, joining outcome, friction, satisfaction, goal, and session-type data to the cost engine — including outcome distribution, friction frequency, average cost by outcome, and per-session facet detail.
Adds the CHN check family (CHN001-CHN003) to the Plugins category of Config Health: CHN001 flags each enabled channel plugin (Telegram, Discord, iMessage, fakechat) as a prompt-injection and permission-relay surface, CHN002 flags channel plugins enabled under Vertex or Bedrock where they are silently ignored, and CHN003 surfaces the channelsEnabled org-policy key.
Extends secret detection with nine additional GitLab token families beyond glpat-: runner, OAuth, pipeline-trigger, agent, import, service-account, CI-build, feature-flag, and deploy tokens, with the glpat-/gldt- pair classified as a critical account-level credential; also adds the glab credential store to the hardening sandbox baseline, matching the existing gh entry.
Adds a Hooks Runtime tab inside the Hooks rail (Configuration/Runtime toggle) surfacing per-hook fire counts, failures, average and max duration, session counts, and a 'not in config' badge for commands seen in transcripts that match no current hook, with Stop-hook batches marked inline in the chat view.
Adds CFG013 through CFG018 config health checks covering filesystem isolation, sandbox network allowlist, credential mode: "mask" without TLS, sandbox binary overrides, remoteControlAtStartup in project settings, and cross-session messages auto-accepted under bypassed permissions.
Recognizes DirectoryAdded as a hook event (Claude Code 2.1.219) so matchers targeting it are evaluated correctly instead of flagged as dead config; reads additionalMarketplaces as an alias for extraKnownMarketplaces (Claude Code 2.1.232); and displays source URLs or commands for archive and command plugin sources (2.1.224/2.1.229).
Adds a Context tab with a per-session chart of context-window utilization per assistant turn against the model's ceiling, showing compaction events, peak context, peak utilization, and a flag for sessions that mix model generations across the Claude 4.7 tokenizer change.
Sessions started with --worktree or /fork now show their worktree and branch in the session header; sessions that opened a pull request or GitLab merge request link to it from the header; and Claude Code's ai-title generated session names are now used as session titles.
Merges Health, Hardening, and Routing into a single Health rail with a section toggle, reducing icon-rail clutter.
Upgrading to v1.1.0 triggers a one-time full reparse of all transcripts on first launch, required by a parser version bump introduced to support the new Hooks Runtime tab.
- !Hooks Runtime requires a one-time full reparse of all transcripts on first launch due to a parser version bump.