buildOne report1 publisher MPS 2026.2 release candidate adds Linux ARM64 builds, including standalone RCPs
JetBrains' MPS 2026.2 release candidate adds Linux ARM64 support, with a matching bundled JetBrains Java Runtime and standalone RCP builds. Teams that package MPS-based tools can test ARM64 distributions before the final release.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher Cloudflare's web_fetch tool takes six request limits that the app sets at creation
Cloudflare's Agents SDK documents a paired web_search and web_fetch workflow with six request limits the app sets when it creates the tool. A dev.to write-up says the wrappers do not guarantee fetched content is safe or true.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher Laravel AI SDK 1.1 added Cohere, Agent Skills and approval gates for built-in tools
Laravel's official AI SDK went from 1.0 in September 2026 to 1.2 in early October, according to a dev.to walkthrough. The same post places Agent Skills, Cohere and built-in tool approvals in 1.1, so teams should check the changelog for what 1.2 itself added.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence55
buildConfirmed2 publishers Lightpanda shipped 1.0 of its open-source browser on October 2nd, passing 1,739,845 web-platform subtests without rendering pages. One encoding suite makes up about two-thirds of that count, so teams should judge it by whether their jobs need to see the page.
Reality
- Evidence55
- Adoption35
- Hype gap+25
- Incentives70
- Confidence60
buildOne report1 publisher MCP's 2026-07-28 revision makes every request carry what the server needs to answer it
MCP's 2026-07-28 revision deletes the initialize handshake and Mcp-Session-Id, so a server must answer each request from what arrives with it. A developer who rebuilt the spec against 708 tests wrote one test whose only job is proving no state leaks between server instances.
Reality
- Evidence62
- Adoption18
- Hype gap+5
- Incentives35
- Confidence64
buildOne report1 publisher Live MCP servers trail the stateless 2026-07-28 revision that clients already ship
Pennyforge found 7 of 72 responding MCP registry endpoints on the stateless 2026-07-28 revision that clients already ship. Servers answer with whatever in-range version a client offers, so a client learns what one supports only by offering the newest revision and reading the reply.
Reality
- Evidence55
- Adoption9
- Hype gap+15
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher Compromised MemOS packages scan for developer tokens the moment Python imports them
Semgrep found sckit hidden in the genuine MemOS npm and PyPI packages, where it fires on Python import to scan for npm, GitHub, cloud and Slack tokens. It runs on import, not on install, so install-time scanning misses it, and anyone who imported an affected version should rotate those tokens.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher rocminfo reports one MI300X framebuffer three times, once per global memory pool
A single AMD Developer Cloud droplet at $1.99 an hour was inventoried entirely over twelve tag-scoped MCP tools, and two of the readings came back wrong until the output was parsed instead of a status code.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence55
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence64
buildOne report1 publisher Five of eight DuckDuckGo MCP servers failed calls on the same twelve back-to-back queries
One machine sent the same twelve research questions through eight free servers, three times about an hour apart on 2026-09-15. The rule that caught most of the failures was the one for empty bodies.
Reality
- Evidence62
- Adoption52
- Hype gap+10
- Incentives65
- Confidence58
buildOne report1 publisher Putting the Telegram MCP server behind launchd leaves one process holding the session lock
A dev.to harness guide puts numbers on two ways MCP breaks at scale, 8,000 to 15,000 tokens of tool schema on every prompt and a SQLite session lock duplicate stdio processes cannot share. Its fix moves stateful tools onto a supervised loopback daemon.
Reality
- Evidence25
- Adoption8
- Hype gap+45
- Incentives25
- Confidence40
buildOne report1 publisher A 60-case benchmark puts Jev's usable confidence threshold at exactly 1.000
TypeSafe AI launched Jev with 193.6x and 444.6x multipliers and nothing to re-run. An independent harness measured something else, whether the confidence score is calibrated well enough to route escalations on.
Reality
- Evidence66
- Adoption14
- Hype gap+38
- Incentives48
- Confidence58
buildOne report1 publisher Foundry's Toolbox pins the MCP allow-list that a server can otherwise redefine at any time
MCP's discoverability puts the tool schema and the description text on the server side of the connection, so Foundry's Toolbox holds the credentials and the allow-list that decide what an agent accepts.
Reality
- Evidence32
- Adoption38
- Hype gap+14
- Incentives62
- Confidence44
buildOne report1 publisher Mapbox's Agent Toolkit lets a model add a stop to a route the driver is already driving
Mapbox's September 17 release turns live traffic and a 250-million-place index into function calls an agent invokes for itself. Who is allowed to invoke them is still the integrator's problem.
Reality
- Evidence38
- Adoption30
- Hype gap+28
- Incentives76
- Confidence55
buildOne report1 publisher An out-of-scope delete_repository call dies at check six of capbroker's seven
capbroker hands the agent a signed, expiring ticket and evaluates every call in deterministic code. In the second run the injected instruction stayed inside the granted scope, and a human at the terminal was what stopped it.
Reality
- Evidence45
- Adoption10
- Hype gap−12
- Incentives60
- Confidence45
buildOne report1 publisher Bundling Node left 24 dylib references pointing at /opt/homebrew
The installer launched fine on the build machine and quit in about a second on a Mac that had never run Homebrew. Getting it to start took 26 dylibs copied into the bundle, every path rewritten to @loader_path, and an ad hoc re-sign.
Reality
- Evidence55
- Adoption8
- Hype gap+12
- Incentives45
- Confidence55
buildOne report1 publisher A hundred realistic MCP tools cost 11,132 tokens on every model call
A dev.to measurement harness counts cl100k tokens over serialized MCP tool definitions and finds the standing cost grows by roughly 111 tokens for each tool described realistically, and every model call pays it again.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence58
buildOne report1 publisher Reading plannedFor instead of the queue let a 3-day freshness check pass six-day-old links
The check compared each source's date against the slot's planning label, so three swapped Bluesky posts cleared a 72-hour window and then sat in a queue that would not reach them for four to six days.
Reality
- Evidence58
- Adoption14
- Hype gap−8
- Incentives32
- Confidence55
buildOne report1 publisher MCP's Python SDK 2.0 yields two values where wrapper libraries still unpack three
The official mcp package hit 2.0.0 on 28 July with renamed imports and a shorter context-manager yield, so wrappers that declared no upper bound now fail at runtime on a fresh install of code nobody touched.
Reality
- Evidence62
- Adoption45
- Hype gap+6
- Incentives30
- Confidence58
buildOne report1 publisher A Safari MCP server minted capability tokens its own cold start would throw away
One cached identifier was enough to retire a browser tab permanently, because every recovery path in the ownership model also demanded the proof of ownership that had just gone missing.
Reality
- Evidence62
- Adoption10
- Hype gap+8
- Incentives32
- Confidence58