🛠️ Hacker News Tools

[Other] The Vercel breach: OAuth attack exposes risk in platform environment variables <i>Vercel April 2026 security incident</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47824463">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47824463</a> - April 2026 (485 comments)<p><i>A Roblox cheat and one AI tool brought down Vercel&#x27;s platform</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47844431">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47844431</a> - April 2026 (145 comments)

[Other] Show HN: Daemons – we pivoted from building agents to cleaning up after them For almost two years, we&#x27;ve been developing Charlie, a coding agent that is autonomous, cloud-based, and focused primarily on TypeScript development. During that time, the explosion in growth and development of LLMs and agents has surpassed even our initially very bullish prognosis. When we started Charlie, we were one of the only teams we knew fully relying on agents to build all of our code. We all know how that has gone — the world has caught up, but working with agents hasn&#x27;t been all kittens and rainbows, especially for fast moving teams.<p>The one thing we&#x27;ve noticed over the last 3 months is that the more you use agents, the more work they create. Dozens of pull requests means older code gets out of date quickly. Documentation drifts. Dependencies become stale. Developers are so focused on pushing out new code that this crucial work falls through the cracks. That&#x27;s why we pivoted away from agents and invented what we think is the necessary next step for AI powered software development.<p>Today, we&#x27;re introducing Daemons: a new product category built for teams dealing with operational drag from agent-created output. Named after the familiar background processes from Linux, Daemons are added to your codebase by adding an .md file to your repo, and run in a set-it-and-forget-it way that will make your lives easier and accelerate any project. For teams that use Claude, Codex, Cursor, Cline, or any other agent, we think you&#x27;ll really enjoy what Daemons bring to the table.

[Other] CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production <a href="https:&#x2F;&#x2F;www.brex.com&#x2F;journal&#x2F;building-crabtrap-open-source" rel="nofollow">https:&#x2F;&#x2F;www.brex.com&#x2F;journal&#x2F;building-crabtrap-open-source</a>

[API/SDK] Show HN: GoModel – an open-source AI gateway in Go; 44x lighter than LiteLLM Hi, I’m Jakub, a solo founder based in Warsaw.<p>I’ve been building GoModel since December with a couple of contributors. It&#x27;s an open-source AI gateway that sits between your app and model providers like OpenAI, Anthropic or others.<p>I built it for my startup to solve a few problems:<p><pre><code> - track AI usage and cost per client or team - switch models without changing app code - debug request flows more easily - reduce AI spendings with exact and semantic caching </code></pre> How is it different?<p><pre><code> - ~17MB docker image - LiteLLM&#x27;s image is more than 44x bigger (&quot;docker.litellm.ai&#x2F;berriai&#x2F;litellm:latest&quot; ~ 746 MB on amd64) - request workflow is visible and easy to inspect - config is environment-variable-first by default </code></pre> I&#x27;m posting now partly because of the recent LiteLLM supply-chain attack. Their team handled it impressively well, but some people are looking at alternatives anyway, and GoModel is one.<p>Website: <a href="https:&#x2F;&#x2F;gomodel.enterpilot.io" rel="nofollow">https:&#x2F;&#x2F;gomodel.enterpilot.io</a><p>Any feedback is appreciated.

[Other] Show HN: VidStudio, a browser based video editor that doesn't upload your files Hi HN, I built VidStudio, a privacy focused video editor that runs in the browser. I tried to keep it as frictionless as possible, so there are no accounts and no uploads. Everything is persisted on your machine.<p>Some of the features: multi-track timeline, frame accurate seek, MP4 export, audio, video, image, and text tracks, and a WebGL backed canvas where available. It also works on mobile.<p>Under the hood, WebCodecs handles frame decode for timeline playback and scrubbing, which is what makes seeking responsive since decode runs on the hardware decoder when the browser supports it. FFmpeg compiled to WebAssembly handles final encode, format conversion, and anything WebCodecs does not cover. Rendering goes through Pixi.js on a WebGL canvas, with a software fallback when WebGL is not available. Projects live in IndexedDB and the heavy work runs in Web Workers so the UI stays responsive during exports.<p>Happy to answer technical questions about the tradeoffs involved in keeping the whole pipeline client-side. Any feedback welcome.<p>Link: <a href="https:&#x2F;&#x2F;vidstudio.app&#x2F;video-editor" rel="nofollow">https:&#x2F;&#x2F;vidstudio.app&#x2F;video-editor</a>

[Database] A type-safe, realtime collaborative Graph Database in a CRDT

[Other] Your hex editor should color-code bytes

[Other] Show HN: WeTransfer Alternative for Developers

[Other] Anthropic says OpenClaw-style Claude CLI usage is allowed again

[Other] Show HN: Palmier – bridge your AI agents and your phone Hi HN — I built Palmier.<p>Palmier bridges your AI agents and your phone.<p>It does two things:<p>1. It lets you use your phone to directly control AI agents running on your computer, from anywhere.<p>2. It gives your AI agents access to your phone, wherever you are — including things like push notifications, SMS, calendar, contacts, sending email, creating calendar events, location, and more.<p>A few details:<p>* Supports 15+ agent CLIs<p>* Supports Linux, Windows, and macOS<p>* What runs on your computer and your phone is fully open source<p>* Works out of the box — no need to set up GCP or API keys just to let agents use phone capabilities<p>* Your phone can act as an agent remote: start tasks, check progress, review results, and respond to requests while away from your desk<p>* Your phone can also act as an agent tool: agents can reach into phone capabilities directly when needed<p>* Optional MCP server: if you want, Palmier exposes an MCP endpoint so your agent can access phone capabilities as native MCP tools. This is optional — you can also use Palmier directly from the phone app&#x2F;PWA, with those capabilities already built in<p>* Still in alpha stage, with bugs. Opinions and bug reports very welcome<p>The basic idea is that AI agents become much more useful if they can both:<p>* interact with the device you actually carry around all day<p>* be controlled when you are away from your computer<p>Palmier is my attempt at that bridge.<p>It already works with agent CLIs like Claude Code, Gemini CLI, Codex CLI, Cursor CLI, OpenClaw, and others. You can run tasks on demand, on a schedule, or in response to events.<p>Would especially love feedback on:<p>* whether this feels genuinely useful<p>* which phone capabilities are most valuable<p>* which agent CLIs I should support next<p>* what feels broken, awkward, or confusing<p>Site: <a href="https:&#x2F;&#x2F;www.palmier.me" rel="nofollow">https:&#x2F;&#x2F;www.palmier.me</a><p>Github:<p>* <a href="https:&#x2F;&#x2F;github.com&#x2F;caihongxu&#x2F;palmier" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;caihongxu&#x2F;palmier</a><p>* <a href="https:&#x2F;&#x2F;github.com&#x2F;caihongxu&#x2F;palmier-android" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;caihongxu&#x2F;palmier-android</a><p>Happy to answer questions.

[Other] How to make a fast dynamic language interpreter

[Other] Show HN: MCPfinder – An MCP server that finds and installs other MCP servers I’ve been building and using agents heavily lately. The Model Context Protocol ecosystem is growing insanely fast, but discovering and configuring new tools is still highly manual. Every time I needed to connect an agent to a new service, I had to browse registries, figure out the transport type, identify required env vars, and manually update &quot;mcp.json&quot; files.<p>So I built MCPfinder. It aggregates servers from the official MCP registry, Glama, and Smithery (around 25,000 combined entries) into a deduplicated, ranked catalog.<p>But the real twist is the DX: MCPfinder is itself an MCP server :D<p>You only install it once as your &quot;base capability&quot; via standard stdio: npx -y @mcpfinder&#x2F;server<p>From then on, when you tell your AI, &quot;I need to query my PostgreSQL database,&quot; the magic happens autonomously.<p>It&#x27;s completely free, AGPL-3.0 licensed, and built purely to optimize AI-tool surface discovery.<p>I&#x27;d love to hear your thoughts, feedback, or edge cases where JSON generation for specific platforms is acting up.

[DevOps] Show HN: Holos – QEMU/KVM with a compose-style YAML, GPUs and health checks I got tired of libvirt XML and Vagrant&#x27;s Ruby&#x2F;reload dance for single-host VM stacks, so I built a compose-style runtime directly on QEMU&#x2F;KVM.<p>What&#x27;s there: GPU passthrough as a first-class primitive (VFIO, OVMF, per-instance EFI vars), healthchecks that gate depends_on over SSH, socket-multicast L2 between VMs with no root and no bridge config, cloud-init wired through the YAML, Dockerfile support for provisioning.<p>What it&#x27;s not: Kubernetes. No clustering, no live migration, no control plane. Single host. Prototype, but I&#x27;m running it on real hardware. Curious what breaks for people.

[Other] Verus is a tool for verifying the correctness of code written in Rust

[DevOps] Show HN: Git Push No-Mistakes no-mistakes is how I kill AI slop. It puts a local git proxy in front of my real remote. I push to no-mistakes instead of origin, and it spins up a disposable worktree, runs my coding agent as a validation pipeline, forwards upstream only after every check passes, opens a clean PR automatically, and babysits CI pipeline for me.

[Other] Kimi vendor verifier – verify accuracy of inference providers

[Other] Changes to GitHub Copilot individual plans

[Other] Highlights from Git 2.54

[Other] Show HN: Ctx – a /resume that works across Claude Code and Codex ctx is a local SQLite-backed skill for Claude Code and Codex that stores context as a persistent workstream that can be continued across agent sessions. Each workstream can contain multiple sessions, notes, decisions, todos, and resume packs. It essentially functions as a &#x2F;resume that can work across coding agents.<p>Here is a video of how it works: <a href="https:&#x2F;&#x2F;www.loom.com&#x2F;share&#x2F;5e558204885e4264a34d2cf6bd488117" rel="nofollow">https:&#x2F;&#x2F;www.loom.com&#x2F;share&#x2F;5e558204885e4264a34d2cf6bd488117</a><p>I initially built ctx because I wanted to try a workstream that I started on Claude and continue it from Codex. Since then, I’ve added a few quality of life improvements, including the ability to search across previous workstreams, manually delete parts of the context with, and branch off existing workstreams.. I’ve started using ctx instead of the native ‘&#x2F;resume’ in Claude&#x2F;Codex because I often have a lot of sessions going at once, and with the lists that these apps currently give, it’s not always obvious which one is the right one to pick back up. ctx gives me a much clearer way to organize and return to the sessions that actually matter.<p>It’s simple to install after you clone the repo with one line: .&#x2F;setup.sh, which adds the skill to both Claude Code and Codex. After that, you should be able to directly use ctx in your agent as a skill with ‘&#x2F;ctx [command]’ in Claude and ‘ctx [command]’ in Codex.<p>A few things it does:<p>- Resume an existing workstream from either tool<p>- Pull existing context into a new workstream<p>- Keep stable transcript binding, so once a workstream is linked to a Claude or Codex conversation, it keeps following that exact session instead of drifting to whichever transcript file is newest<p>- Search for relevant workstreams<p>- Branch from existing context to explore different tasks in parallel<p>It’s intentionally local-first: SQLite, no API keys, and no hosted backend. I built it mainly for myself, but thought it would be cool to share with the HN community.

[Other] Kimi K2.6: Advancing Open-Source Coding