Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,671 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Enterprise-managed auth for the Supabase MCP server
Supabase has generally released enterprise-managed authentication for its MCP server on Supabase Team and Enterprise plans, built with Anthropic and Okta. The change moves authorization for using Supabase in Claude to the organization's identity provider: an administrator authorizes the connector once, while employees receive access according to their existing Supabase projects and permissions. Each query and management action runs with the individual employee's current role, so developers and read-only members do not receive more access than they have in Supabase directly. Okta groups can restrict access, and onboarding, offboarding, and access reviews can be handled through existing identity-provider workflows rather than individual OAuth approvals; availability requires Okta SSO plus a Claude Team or Enterprise plan, with SCIM provisioning listed as a future roadmap item.
Add Cross App Access to Your OIDC Resource Application
Cross App Access allows applications such as AI agents to access resource APIs on behalf of OpenID Connect federated users. The specification relies on an Identity Assertion Authorization Grant, which is a short-lived JSON Web Token issued by the customer Identity Provider. Resource authorization servers validate this token, resolve user identities using combined issuer and subject claims, and issue locally scoped access tokens without altering single sign-on flows. Implementations must bind issuers to registered connections before verifying signatures to prevent forgery attacks. In addition, servers should not issue refresh tokens, as clients instead resubmit the grant upon access token expiration.
How We Used AI to Bring MongoDB to DynamoDB
AWS released ExtendDB, an open source adapter that lets DynamoDB workloads use pluggable storage backends, enabling them to run outside AWS. MongoDB built a storage backend for ExtendDB, allowing DynamoDB workloads to run on MongoDB anywhere, including on-premises and air-gapped environments, without changing application code. The backend maps DynamoDB concepts like partition keys, secondary indexes, transactions, and streams to MongoDB primitives, with tradeoffs such as handling numeric precision differences in the Rust layer. The project began as a hackathon experiment where an engineer used Claude Code to prototype the backend, which quickly produced a working component, then required several weeks of partnering with AWS to merge. The post emphasizes that AI changed the economics of such experiments, enabling the idea to move from thought to implementation quickly, and the backend is now available as open source.
How Indian Organizations in Regulated Industries Are Scaling with MongoDB
Indian organizations in regulated industries are modernizing legacy data infrastructures with MongoDB to achieve scale and compliance. Physics Wallah, serving over 7 million students, built a compliant multi-tenant payment platform on MongoDB Atlas using ACID transactions, Change Streams for audit trails, and native search. Flipkart uses MongoDB Atlas for high-throughput writes and real-time payment aggregation during mega sales like The Big Billion Days, with seamless horizontal sharding. IBS Software scaled three mission-critical platforms, processing billions of records and millions of searches daily with sub-100ms API responses and 99.99% uptime, while iTravel Cruise achieves 100,000 TPS at 5ms latency. Companies like Kore.ai and PineLabs use MongoDB Enterprise Advanced for on-premises deployments requiring high availability, strict security, and low-latency transaction processing.
How to Evaluate Live & Voice Agents in ADK
ADK now supports native evaluation of live, voice-based agents, addressing regressions in tool use, context continuity, turn-taking, timing, and recovery that may not appear in demos. The walkthrough builds a graph-based workflow of three single-purpose agents running gemini-live-2.5-flash-native-audio, with a mocked date-of-birth tool between stages and session state carried across the open audio stream. It shows how to author scenario-based or fixed conversations, synthesize simulated user turns with Gemini TTS, configure live mode and rubric-based multi-turn trajectory judges, and run evaluations from the CLI or AgentEvaluator. ADK Web then reconstructs the audio as transcripts with playable clips, while configurable voices, languages, invocation limits, thresholds, and per-turn metrics support repeatable debugging and CI/CD regression checks.
Ensuring reliable OpenTelemetry ingestion at scale
LogHouse’s OpenTelemetry pipeline ingests 50 million events per second and stores 177 PiB of uncompressed data, but its initial agent-to-gateway design could not reliably absorb ClickHouse backpressure. In-memory queues caused instability during short-lived spikes or database outages, while local collector write-ahead logs made gateways stateful, slowed recovery, delayed fresh telemetry behind FIFO backlogs, and took about four hours to drain 1 TiB. The team rejected adding Kafka because operating a new tier-zero service across cloud regions was not justified for this use case, then designed a custom architecture using blob storage, the OTel failover connector, overflow notifications, and a catchup collector. In staging, failover redirected 120,000 events per second to S3 without changing gateway resource usage, and recovery resumed ClickHouse writes while the catchup collector drained the queue; the design scaled from 10 million to 50 million events per second, with added regional setup and less precise recovery visibility.
Branded Login URLs and Email Workflows for Production Auth
Default authentication setups often redirect users to third-party domains and issue generic transactional emails, causing password manager failures, browser cookie restrictions, and perceived phishing risks. To mitigate these issues, teams can configure custom identity domains via DNS CNAME records to preserve origin alignment and session persistence. Developers can also capture custom user fields directly within hosted login prompts using Universal Login partials alongside pre-registration Actions rather than managing custom authentication servers. For transactional messaging, teams must replace rate-limited built-in email tools with dedicated external providers and configure SPF, DKIM, and DMARC records alongside Liquid-templated emails. Managing these configurations through version control and deployment tools maintains security standards without adding excessive infrastructure maintenance overhead.
Adding a UI to an Auth0-secured MCP server with Skybridge
Skybridge can return a React view alongside structured data from an MCP tool, allowing hosts such as ChatGPT, Claude, and VS Code to render an interface in the conversation. The tutorial scaffolds an MCP app, adds Auth0 through Skybridge’s auth0Provider, and protects the /mcp transport with bearer JWT verification before requests reach tool handlers. Auth0’s default opaque tokens create a compatibility issue because MCP clients send RFC 8707 resource indicators rather than an audience, so Skybridge advertises an authorization endpoint that includes the API audience. The view receives the verified user identity through structuredContent instead of relying on a name supplied by the model. Its additional tool calls use the same authenticated MCP session, and testing proceeds through DevTools, the Playground, real hosts, and deployment.
Beyond Visual CoT: Internalized Visual Thinking for Proactive Video Reasoning
Visual chain-of-thought methods allow multimodal large language models to reason through intermediate image generation, but synthesizing explicit visual steps creates major inference overhead during proactive video reasoning. To eliminate runtime synthesis, Internalized Visual Thinking introduces a post-training framework that jointly optimizes textual prediction and next-embedding prediction across unlabeled videos. By predicting latent representations of future frames alongside target text answers during training, the model captures motion, object transitions, interactions, and latent intent. At inference time, the model produces answers directly without generating or re-encoding future frames. IVT outperforms text-only post-training across six evaluation settings while matching or exceeding Visual CoT performance and cutting end-to-end latency by more than 5x.
Say it once: introducing Bot Preference Sync
Cloudflare announced Bot Preference Sync, a feature across all customer tiers that automatically reflects dashboard AI bot configurations directly in a site's robots.txt file. Website operators previously faced challenges synchronizing static robots.txt directives with edge enforcement rules, which led some crawlers to ignore stated preferences or attempt bypasses. Under this system, Cloudflare generates and prepends directives for Search, Agent, and Training categories to existing robots.txt files using crawler lists tracked in BotBase. Mixed-use crawlers performing both search indexing and training must meet strict transparency criteria, including honoring opt-outs and providing page-level visibility, to avoid edge blocks when training is disallowed. Additionally, onboarding workflows allow ad-supported publishers to automatically set AI model training to Disallow by default while retaining search visibility.
Build a unified AI agent architecture with DynamoDB and Bedrock
AI agent architectures on AWS frequently divide operational records and vector embeddings across separate databases, creating synchronization lag and infrastructure overhead. To resolve this fragmentation, a single DynamoDB table can store operational document attributes alongside embeddings by leveraging native vector search. An Amazon Bedrock agent directs incoming queries to AWS Lambda action groups, which run standard CRUD operations or semantic searches against the DynamoDB SearchVectors API. When items change, a DynamoDB Streams pipeline uses Amazon Titan Text Embeddings V2 to generate new embeddings and write them back to the table. This unified approach eliminates standalone vector databases while keeping semantic indexes synchronized with operational updates.
Connecting retail demand planning to campaign and store execution
Retail and consumer goods teams often split performance review, demand planning, marketing activation, store execution, and measurement across disconnected systems, making it difficult to connect analysis with results. The Databricks demo presents a unified application built on data unification, governance, and intelligence, combining point-of-sale, loyalty, supply chain, media spend, inventory, and store-operations signals with role-specific access. Users can move from KPI and forecast-versus-actual analysis to SKU or store what-if planning, audience selection, campaign activation, replenishment, price-tag updates, assigned tasks, and post-campaign measurement. Genie supports natural-language querying, while specialized agents and a coordinating supervisor connect sales insights, demand planning, audience building, in-store operations, and measurement. The stated design goal is a governed, shared workflow that lets teams test decisions, execute them across stores, and evaluate outcomes without losing operational context.
GPU-Accelerated Clustering for Financial Instruments at Scale
Quantitative strategies need instrument groupings that capture both ordinary co-movement and dependence during market stress, while remaining stable and inexpensive to recompute. The workflow constructs rolling absolute Pearson-correlation and tail pairwise dependence matrices (TPDM), factorizes them with nonnegative SymNMF using AdaptGrow, and derives soft loadings, hard argmax labels, and structural-break diagnostics. A trace-based formulation reduces estimated peak storage from approximately 20n2 to 4n2 bytes, while row-sharded distributed execution communicates O(nk) data; the system uses eigenspectrum-based selection between full-batch and block-stochastic AdaGrad. Across 250 synthetic windows, the setup tests planted membership changes and a joint tail-stress episode: ARI is intended to identify reclassification, whereas TPDM reveals co-crash dependence that ordinary correlation can miss. Reported factorization timings include 13.0 and 12.4 seconds for 100,000 instruments across four GB200 GPUs, and approximately two and four minutes for one million instruments across 64 GPUs on 16 nodes, not end-to-end timings.
A Tale of Two Flink Autoscalers
Netflix operates over 30,000 Apache Flink jobs across multiple AWS regions, ranging from managed pipelines to complex stateful DAGs. Its initial in-house autoscaler used external telemetry from Mantis and Atlas to scale TaskManagers as a single unit, cutting resource usage by 25–45% but failing on multi-operator stateful topologies. To address these limitations, Netflix adopted the Apache Flink Autoscaler library, which calculates True Processing Rate and per-vertex parallelism using internal metrics. The architecture uses Temporal workflows orchestrated within a Spring Boot application to evaluate jobs individually and prevent cross-job blast radiuses. Implementing the open-source autoscaler reduced annualized compute expenditures by 58% for client telemetry and logging, saving approximately $1.1 million.
amazon.science
SOP-Bench: A new benchmark for evaluating AI agents on real business procedures
AI agents often struggle to execute standard operating procedures because real-world business workflows contain implicit domain knowledge and procedural ambiguity that standard benchmarks overlook. To evaluate agent reliability, researchers introduced SOP-Bench, an open framework featuring more than 2,000 runnable tasks across 12 industrial domains paired with functioning tool interfaces and ground-truth answers. Domain experts authored the workflows, while an Anthropic Claude 3.5 Sonnet v2 model generated mock APIs, tool code, and edge-case datasets before expert verification. Experiments evaluating function-calling and reasoning agents across 11 frontier models revealed that newer models did not consistently outperform older versions, and providing 20 extraneous tools nearly halved task success. The benchmark, baseline agents, and evaluation code are released on GitHub and HuggingFace for reproducible testing.
What else runs on your Postgres server, and how do we stop it from taking the database down?
The Postgres VM described here runs PgBouncer instances, a backup agent, metrics exporters, a local Prometheus, a log collector, and watchdog timers alongside the database. Those processes share machine-wide resources outside Postgres’s huge-page-backed shared_buffers, so leaks, CPU saturation, or disk exhaustion can threaten database availability. ClickHouse Managed Postgres places supporting services in a cgroup v2 slice and combines Go runtime GOMEMLIMIT targets with systemd memory.high and memory.max enforcement. GOMEMLIMIT encourages earlier garbage collection, memory.high applies reclaim and throttling, and memory.max provides a hard ceiling whose OOM scope excludes Postgres because it uses a separate cgroup. CPU weights, bounded buffers, log and metric controls, disk thresholds, and exemptions for replication and monitoring sessions extend isolation across other failure modes; these controls are enabled by default.
Dispatches from O'Reilly: The right amount of spec for agentic development
As software agents make implementation faster and cheaper, engineering difficulty shifts away from typing code toward defining correctness and verifying behavior reliably. Omitting specifications forces human reviewers into expensive correction loops, while overspecification clutters model context windows with stale prose and competing instructions. To find the optimal middle ground, teams must validate specifications before coding, using one agent to draft minimal constraints and another to attack ambiguities, hidden dependencies, and missing failure modes. Multi-agent architectures demand formal interface contracts, schemas, and executable checks because interpretive drift compounds rapidly across unbounded agent handoffs. Core Extreme Programming and Agile practices such as continuous integration, small release batches, and rapid feedback loops remain essential error-detection mechanisms during agentic development.
Improved failure reports on Red Hat OpenShift with the event-driven diagnostic operator
During major infrastructure incidents, critical system logs and diagnostic evidence are frequently overwritten, lost, or erased by emergency recovery efforts before engineers can investigate. To solve this visibility gap in multi-cluster environments, an open-source event-driven diagnostic operator was developed as an automatic first information report collector. Deployed on a central hub cluster, the operator monitors Kubernetes warning events rather than relying on heavy polling. When an event matches a predefined regular expression pattern, the operator identifies the target spoke cluster, copies its kubeconfig secret, and spins up an independent must-gather job. Diagnostic data is written to off-site or shared storage with a configurable retention window, preserving forensic context without human intervention.
NVIDIA AVO Reaches 100% on ARC-AGI-3, Demonstrating a Frontier-Level General-Purpose Architecture for Long-Horizon Autonomous Agents
NVIDIA’s Agentic Variation Operators (AVO) is a general-purpose agent architecture designed to make frontier language models reliable on extended, multistep tasks. It combines tool use and execution with persistent memory, an iterative inspect-plan-implement-evaluate loop, and a supervisor that can redirect work when progress stalls. In a seven-day GPU-kernel optimization study, AVO explored more than 500 directions, produced 40 committed versions, and outperformed cuDNN by up to 3.5% and FlashAttention-4 by up to 10.5% across evaluated configurations. On the ARC-AGI-3 public set, the same architecture achieved a 100.00 RHAE score across 25 environments, completing all 183 levels in 6,624 actions; the post cautions that comparisons with other systems are not controlled ablations.
Where Security Fits in an AI Agent Stack
The post explains where security controls should sit in an emerging AI agent stack as agents gain capability and operate over longer horizons. It distinguishes behavioral controls in models and harnesses, which guide proposed actions, from authoritative infrastructure controls that bind identity, enforce policy, contain failures, and record activity. The stack is presented as layers for models, harnesses, meta-harnesses, secure runtimes such as NVIDIA OpenShell, and inference infrastructure, with the runtime boundary established before launch so tools, plugins, MCP processes, and delegated runtimes operate under policy. It recommends least privilege, isolation, explicit authorization, auditability, short-lived and task-scoped access, independent checks, and safer failure states, while describing four security profiles from isolated to adversarial workloads. The conclusion is that every high-impact external effect must pass through enforcement layers the agent cannot bypass.
Top topics
- Architecture834
- Performance816
- LLMs660
- Machine Learning622
- Open Source563
- AI Agents553
- AI470
- Developer Experience448
Weekly digest
The best engineering reads, once a week.