The official MCP debugging tool published nine security advisories on 21 October. Two critical bugs let a remote MCP server run local commands. Fixes are out.
Amazon Polly speech marks give timing and UTF-8 byte ranges for synthesized words and sentences. Audio and marks require separate output choices, so a highlighting UI must keep their inputs aligned.
Anthropic’s Addy Osmani guide (Oct 1, 2026): Claude Code mods—in-session JS/TS hooks that observe, rewrite, or answer events—with custom UI and hot-reload state. On by default at 2.1.287+.
CoreWeave Forge (Fully Connected 2026 / Sep 30 news): connected run→observe→curate→improve→evaluate loop. Only CoreWeave ARIA and CoreWeave Sandboxes are explicitly Generally Available, not all of Forge. CoreWeave Forge is not Cloudflare Forge. Claims are CoreWeave’s; Agent Lens cost wording differs between the blog and the news release.
Google Cloud’s Cloud CLI remote MCP (blog Sep 30, 2026) exposes gcloud + bq via https://cloudcli.googleapis.com/mcp—Preview / Pre-GA Terms, as is; not GA. Tools run_gcloud_command / run_bq_command; MCP no extra charge, pay for GCP resources. Distinct from local gcloud-mcp, BigQuery MCP (GA SQL), and Gemini Skills.
Cloudflare launched cf in open beta (blog Sep 28, 2026): Forge-generated ~3k OpenAPI ops, JSON-default output, cf cli search, cloudflare.config.ts + Vite default. Distinct from AI Gateway Auto Router. Agent-usage % and ~40% config shrink are Cloudflare-reported. Wrangler kept during beta; 18 months maintenance after.
The Model Context Protocol standardizes how AI hosts connect to servers that provide tools, resources and prompts, with separate transports and security responsibilities.