Co-Founder @aurapathai_ | @claude Community Ambassador New York
NYC
Joined August 2012
- Tweets8.1K
- Following1.6K
- Followers428
- Likes41.6K
The "Read-only" preset includes secrets like API keys. That is why the coding agent token starts at No access, then you toggle Database to read.
Supabase Personal Access Tokens now scope to chosen organizations, projects, and permissions, with an expiry up to a year out. The review screen names the exact Management API endpoints and Model Context Protocol tools you are authorizing before you create it.
And a token never has more access than you do. Leave the org, and the agent loses that access with you.
xitter.cf/supabase/status/211481…
You can now scope your Personal Access Tokens to the organizations, projects, and permissions the job needs. Give a CI pipeline or coding agent access to one project instead of your whole account.
Learn more
supabase.com/blog/scope-your…
The steps nobody ever built an API for are the ones that get cheaper now.
GPT-6.1 Terra reads what is on screen and takes action across apps, at 50% lower standard API prices. Usage allowances in ChatGPT Work and Codex go further on it too.
On Agents' Last Exam, a test of how well agents use software at work, it matches GPT-6 Astra at one-tenth the price per token and finishes tasks over 3x faster on average.
So the screen-driven work in your process is worth a fresh look: the forms, the portals, the internal tools with no integration.
Rolling out now to Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, and in the API as gpt-6.1-terra.
xitter.cf/OpenAI/status/21147807…
Ask Claude where your records actually live before you ask it for a single draft.
That is the map step in the new Claude for Nonprofits plugin: donor data, grant files, finances, policies. With memory on it saves that map per person, and every other skill reads it first, so you stop pointing at the same source for every task.
Then put the policy check in front of staff: "Can I use Claude for this?" answered from your organization's own AI policy.
Then run a real request for proposal through the fundraising skills.
Built with around 30 nonprofits in Anthropic's Design Partner Circle. Context first, output second.
xitter.cf/claudeai/status/211478…
More than 25,000 nonprofits now use Claude. Most are small, local teams.
We’re expanding Claude for Nonprofits with a plugin built with around 30 of them, adding skills for fundraising, marketing, and hiring grounded in each team’s context and AI policy: claude.com/resources/article…
Regex still does the finding. The model only decides whether the thing it found is real.
That split is the whole design in GitHub's new secret scanner. Patterns cast a wide net, then a fine-tuned ModernBERT classifier reads each candidate with its file path, variable names, and surrounding code, and filters the placeholders and test fixtures before anyone sees an alert.
11.5% higher owner-weighted acceptance, 86% lower median post-push scan time, more than 98% lower serving cost. Fast enough that generic secret detection now runs in push protection, before the commit lands.
Model size and model usefulness are different things.
xitter.cf/github/status/21144796…
Faster secret scanning. Less noise. GitHub's classifier raised acceptance by 11.5% and cut median scan time by 86%.
github.blog/ai-and-ml/github…
Identity is what makes this one work. Every tool call runs as the signed-in user, so your row level security policies decide what the agent can reach.
Supabase's Model Context Protocol server block copies an Edge Function into your project: handler, authentication middleware, and a whoami tool. Supabase Auth runs the OAuth flow, and helpers hand each tool a client for the signed-in user, so a tool can be a plain query with no service role key. You own that code.
Model Context Protocol Apps go further. In ChatGPT and other clients that support it, a tool can render part of your app's interface in the conversation.
Your customers show up with the account they already have.
xitter.cf/supabase/status/211331…
Give your Supabase app its own MCP server. Your customers can use your app from ChatGPT or Claude with the account they already have.
Try it → supabase.com/blog/give-your-…
Brandon Slicklein retweeted
We’re opening a research preview of Claude Duet, a new app where Claude works as a proactive agent.
It comes to you with what needs your attention, completes tasks you ask of it, keeps working when you step away, and checks with you before it acts on your behalf.
Checking which PHP version your site is serving, without sending a single exploit request at it, is now a one-line ask to Codex.
OpenAI's php2shell-checker repo ships two skills: phpcheck-url when you only have a URL, phpcheck-server when you have server access. Node.js, nothing to install. It reads X-Powered-By and Server, sends HEAD, falls back to GET only on a 405 or 501.
Results are OK, VULNERABLE, UNKNOWN, and UNKNOWN is the useful one. Missing version, unrecognized branch, or prerelease build, all named as what they are. Use --json for machine-readable output.
A checker that names what it cannot see is a checker you can report from.
xitter.cf/OpenAI/status/21129458…
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
A teammate who can read the full conversation can pick up the work without you narrating it.
Replit now lets you share a conversation, an individual asset, or your chat's devURLs with people in your workspace. Viewers get read-only access, and recipients have to sign in and belong to the workspace.
So the findings arrive with the decisions and the next steps sitting right underneath them. That is a handoff with the work attached.
xitter.cf/Replit/status/21129434…
Every tool you hand an agent gets a replay policy. A lookup marked 'safe' runs again after a crash. A refund marked 'never' comes back to the model as possibly run, so it can check before trying again.
That is the detail I keep coming back to in durable-harness, Vercel's new package wrapping Pi, OpenCode, Codex, and Claude Code. Each step of a turn writes to a durable log before and after it runs, so a turn that loses its function continues on a new one. Finished model calls are read from the log, so you are never billed twice for a finished call's tokens.
Crash recovery becomes a property of the harness, so you stop rebuilding it project by project.
xitter.cf/vercel/status/21126538…
Introducing 𝚍𝚞𝚛𝚊𝚋𝚕𝚎-𝚑𝚊𝚛𝚗𝚎𝚜𝚜. Run Pi, OpenCode, Codex, Claude Code, eve, fx, or your own harness durably on Vercel.
With 𝚍𝚞𝚛𝚊𝚋𝚕𝚎-𝚑𝚊𝚛𝚗𝚎𝚜𝚜, agents automatically resume work after failures and run for hours, days, or months. vercel.com/blog/making-every…
Someone on every engineering team spends Friday afternoon assembling what shipped and what is blocked. Team tasks in ChatGPT put that on a schedule.
In an eligible Enterprise workspace, create a team in Settings > Teams, invite teammates, and choose its connections. Then Scheduled > New Task, select the team, and describe the work and when it should run.
The part worth reading twice: teammates can review the results and change what the next update covers. A standing report is a schedule plus a definition of what counts, and that definition drifts as the work changes. Letting the people reading it adjust the scope is how it still earns attention in month three.
xitter.cf/OpenAIDevs/status/2112…
Diligence work usually means the data room sits in one place, the firm's own deal history in another, and market data somewhere else again.
Hebbia and Datasite are bringing live data room content into Hebbia, where customers can analyze it alongside their firm's internal deal context and market data. Every answer comes cited to its source.
Citations are what make an answer reviewable. On document work, that is the floor.
xitter.cf/hebbia/status/21125426…
This quoted post is unavailable.
One product URL, two readers. Vercel Shop serves the same page as a visual storefront for people and as machine-readable content, price, availability, and options, for agents.
That takes the guessing out of it. An agent stops inferring stock from layout.
Model Context Protocol sits at the merchant's own domain, so catalog search and cart building happen without navigating the site at all. Template is open source Next.js, built on Shopify's rebuilt Hydrogen software development kit, which also became generally available today.
Storefront and shopping assistant share one codebase and one cart, so a shopper keeps what they added moving between the two.
xitter.cf/vercel/status/21122040…
Vercel and @Shopify are making agents first-class shoppers. Vercel Shop, our Next.js storefront template for Shopify, is GA.
• Built on Shopify's rebuilt Hydrogen SDK
• Agents can read product pages directly
• MCP for product search and carts vercel.com/blog/vercel-and-s…
A repeated prompt mapped to a physical key keeps your hands in the work.
GitHub has been working with Logitech on their MX Keypad for 18 months, and the Copilot app is now integrated directly.
Three questions to get more out of it:
1. Which interruption repeats every day?
2. Which steps does that key actually remove?
3. What context lives in that prompt so it runs clean every time?
You still decide which actions earn a key, and when the keyboard or command palette is better.
Write the prompt down first. Then map it.
xitter.cf/github/status/21115151…
Your workflows have changed with AI. How about your setup?
Physical controls are back. Take the new Logitech MX Keypad, now directly integrated with the GitHub Copilot app.
This experience allows you to run agentic workflows with control, map a repeated prompt, start or resume a session, and help you stay in flow.
github.blog/news-insights/co…
Builders still just hit Publish. What changes is where the app lands.
Replit shipped Bring Your Own Cloud across Azure, Google Cloud, and Amazon Web Services in three levels. Full BYOC puts the platform and the agent harness in your own tenant, in private preview. BYOC for Published Apps hosts published projects in your cloud while Replit runs the platform. Image Exports hand you a Docker image, a Terraform file, and a software bill of materials. Both are in early access.
Three questions:
1. Which data cannot leave your premises?
2. How much deployment work do you want to own?
3. Who reviews an app before it goes live?
Admins set the destination per workspace. Map that first.
xitter.cf/Replit/status/21112190…
We’re introducing Bring Your Own Cloud (BYOC) for Replit, with options for development and production in your cloud, whether you use @Azure, @GoogleCloud, or @AWScloud.
Our approach gives security and platform teams greater isolation and control while preserving the familiar Replit experience.
Explore BYOC: replit.com/blog/bring-your-o…
Per-request logic gets rewritten every time you move runtimes. Supabase Middleware closes that.
Free and MIT-licensed.
What this means for you:
1. Bridges for Hono, H3, Elysia, NestJS, and TanStack Start are a file you copy, so the only install is the package.
2. withOAuthProtectedResource makes Model Context Protocol authorization one entry, and your row level security policies apply to an agent like they do a browser session.
Take the logic in one handler and make it an entry this week.
xitter.cf/supabase/status/211119…
Introducing Supabase Middleware.
Write per-request logic once, like checking who's calling, and run it on any runtime that has fetch. The same middleware also works inside Hono, H3, Elysia, NestJS, and TanStack Start with a bridge you copy.
Learn More ↓
supabase.com/blog/supabase-m…
The shareable link is the part that changes who gets to see the work.
Cursor cloud agents can now build interactive canvases. You ask for a dashboard or a report while the agent is still working, then you share the finished canvas with your team as a link.
Three questions before you use it:
1. Who on your team currently waits on a screenshot of agent output?
2. What belongs on that canvas every single run, so the next one starts from a baseline?
3. Where does the report end and the decision begin?
Asking for the view while the work happens is the habit worth building.
Pick one task you already run in the cloud and ask for the canvas with it.
xitter.cf/cursor_ai/status/21111…
Voice is a product decision, and you now have two paths to it.
GPT-Live-1 apps can shape a voice from a prompt, or use nine new presets created with native-speaking actors in French, German, Hindi, Japanese, and Korean.
Three questions before you pick:
1. Who is listening, and in which language do they want to be met?
2. Where in the product does this voice show up?
3. Who signs off on how it sounds?
Write those answers down first. That is your spec.
Read the custom voices guide, then run your real script through both paths and listen.
xitter.cf/OpenAIDevs/status/2111…
Brandon Slicklein retweeted
literally no one can shift the entire world's mood like elon
self-driving cars, flying cars, skyscrapers thrown into the sky and then caught by giant chopsticks, people controlling computers with their minds
every few months this madman comes out with something straight out of sci-fi and gets everyone excited about the future
a generational vibe shifter making the future look like the future
Brandon Slicklein retweeted
So in fact we actually can get robots, flying cars, superintelligence, fast internet on planes, space travel, space colonies, orbital data centers, unlimited energy, likely cures for nearly every disease, and more all in our life times. Pretty great.
