Diff

MCP servers: expose workflows, not one tool per endpoint

The clients moved: Claude Code and Codex now do layered discovery (search → inspect → execute) and code mode on their side, so a server that mirrors every API endpoint as a tool just bloats the context window and confuses tool selection. What's left for the server is the part only it knows — ergonomic workflow tools that bundle the calls a job actually needs (Neon collapses create-branch, attach-compute, get-connection-string into one). If you're designing tools an agent will call, the unit is the job, not the API. Six minutes, and the before/after makes the rule concrete.

Neon Postgres6 min video

Read — youtube.com6 min

One-to-one API tools bloat context and confuse tool selection
Layered discovery (search/inspect/execute) now lives client-side in Codex and Claude Code
Code mode: the agent writes a script in a sandbox and returns only the result
Workflow-level tools still matter — bundle the three calls a job needs into one
The server defines what tools exist; the client decides how to discover and execute them

Why read anyway — The Neon server before/after is the whole argument in one picture. original ↗

via neon postgres (youtube, 200k views)

shiftagents

DeepMind's Schmid: the agent is now a markdown file and a sandbox

Philipp Schmid builds the same PR-review agent three times on stage, deleting code each pass, until what's left is an AGENTS.md and a bash script that installs the GitHub CLI — no tool schemas, no Python loop. The third version works because a hosted sandbox does the loop, tool routing, session state, and compaction server-side, with a network proxy that injects credentials so the agent never sees a token. His closing heuristic is the one to keep: if your harness gets more complex as models improve, you're overengineering it. For anyone who owns an agent platform, that's a direct question about how much orchestration code is actually load-bearing.

AI Engineer20 min video

Read — youtube.com20 min

v1: hand-written Python loop with function-call parsing — can't answer 'what's the weather in SF' because nobody gave it a tool
v2: a framework generating schemas from signatures — same failure
v3: remote agent in a sandbox reaches for search and answers, because nobody told it what its tools were for
What moves server-side: loops, routing, session state, compaction. What stays yours: instructions, rules, skills, evals
Teams have thrown out thousands of lines of orchestration for a couple hundred lines of markdown

Why read anyway — Watching the code get deleted live is the point; 20 minutes, the last 4 are the takeaways. original ↗

via ai engineer (youtube)

debateindustry

Cantrill: alarm without expertise is a breach of trust

A former Anthropic employee said publicly that many researchers there believe AI could kill everyone by decade's end, citing critical-infrastructure hacking and bioweapons. Bryan Cantrill's reply isn't 'that's wrong' — it's that the burden of specificity sits with whoever raises the alarm, and 'hacking infrastructure' or 'extinction-level bioweapons' with no mechanism from someone with no expertise in either is fear spreading on borrowed authority. It's the counterweight to last week's Pachocki essay: same stakes, opposite view on what experts owe the public. Read both and you have the shape of the actual argument.

Read — bcantrill.dtrace.org7 min

Opens with his own story: a fake virus scare he started as a student, and how fear, once lit, couldn't be put out
'Domain experts implicitly hold the public's trust — and we must not abuse it'
The claims rely on hand-wavy extrapolation; the person making them is expert in none of the named domains
Doesn't argue the risk is zero — argues the standard for raising alarm must scale with the alarm

Why read anyway — The student story is what makes the argument land; the summary can't carry it. original ↗

via bryan cantrill — the contagion of fear · simon willison

Managed Agents now auto-evaluates each tool call individually

Managed Agents permission policies now include auto: instead of blanket rules (always run / always block a given tool type), the server evaluates each agent.tool_use and agent.mcp_tool_use call and decides to run, deny, or pause for human approval on a per-call basis. The evaluation decision surfaces in the event's evaluation field alongside evaluated_permission, so you can audit why each call was handled the way it was. Previously, granular per-call oversight meant either manual approval routing or complex static policy trees; auto makes the server the dynamic per-call gatekeeper. If Policy Assistant uses Managed Agents for protocol execution, this is the upgrade path from static permission policies to dynamic per-call evaluation — closer to the Sentinel pattern Meta built for Muse, but inside the Claude Platform.

DeepSeek V4.1 Flash: 552B MoE, native vision, 60% cheaper cached reads

DeepSeek released V4.1 Flash on September 10 — a 552B-parameter mixture-of-experts model (8B active on input, 16B on output) with native vision, 1M token context, and a new Causal Encoder-Decoder architecture that cuts the KV cache to ~890 bytes per token (roughly one-quarter of V4-Flash). Pricing: cached input at $0.003/MTok (60% lower than V4-Flash), uncached at $0.15/MTok, output at $0.60/MTok. V4 Pro is being discontinued. The cached-read price is the headline: for cache-heavy agentic loops, V4.1 Flash is now competitive with Fable 5.1's $0.25/MTok cache reads on a cost-per-task basis, while being multimodal. If you track model economics and cost per agentic task, this is the new reference point for what a Flash-tier open-weight model costs at scale.

Fable 5.1 thinking blocks persist across turns — and bind to your prefix

Since the September 1 launch, Claude Fable 5.1 preserves thinking blocks in conversation history so the model can build on its own previous reasoning in later turns. Two constraints matter for production: (1) thinking blocks replay only to Fable 5.1 or newer — earlier models silently receive them empty; (2) on accounts created August 31 or later, if anything before a thinking block changes between turns (system prompt, tools, earlier messages), replaying that block returns a 400 error. The thinking-binding-controls-2026-08-01 beta header gives you control: prefix_mismatch_behavior chooses between rejecting or silently dropping mismatched blocks, and input_transformations in the response reports what was dropped. If Policy Assistant runs multi-turn sessions that inject per-turn context into the system prompt or swap tool specs mid-conversation, this binding behavior is the new constraint to test against — it can silently fail unless you opt in to the beta header.

Fable 5.1 cache reads dropped 75% — now $0.25/MTok

Cache reads on Claude Fable 5.1 cost $0.25/MTok (0.025× base input price), compared to $1/MTok (0.1×) on Fable 5 and all other models. For a heavily cached agentic loop with a large system prompt or tool spec, this cuts the cache-read cost by three-quarters automatically once you are on Fable 5.1. The cost improvement alone strengthens the Fable 5.1 migration case — though the breaking change on tool_choice: any/tool (those now return 400; switch to auto or the strict tool-use pattern) needs a check before migrating, if Policy Assistant forces tool selection via tool_choice.

`clear_at` lets per-turn reminders render once and cost nothing after

clear_at: "next_user_message" on a mid-conversation system message makes it render once (after a tool result, for example), then silently drop to zero tokens on every subsequent request — while staying in the array byte-for-byte so the prompt cache prefix stays intact. The pattern it solves: per-turn reminders like "verify your previous step" or "request independent reads in one turn" that would otherwise pile up in message history and inflate costs over a long agentic loop. The constraint worth knowing: the cleared message must be re-sent byte-for-byte unchanged on every subsequent call; editing or removing it breaks the cache and any bound thinking blocks. If Policy Assistant has per-turn instruction patterns in its protocol loops, this is the clean fix.