AbilityGuard Plugin Brings Visibility to WordPress 6.9 Abilities API in Production

·1 views

A developer has built AbilityGuard, a WordPress plugin designed to monitor usage of the Abilities API introduced in WordPress 6.9. The API allows any plugin to register programmable actions that can be invoked by human triggers, automations, or AI agents, but currently offers site administrators no built-in visibility into what is registered or called. AbilityGuard addresses this gap by hooking into the API's native lifecycle events — registration, pre-execution, and post-execution — rather than wrapping core functions, making it non-intrusive by design. The plugin captures metadata such as ability names, caller context, arguments, execution time, and result status, then surfaces this information through a readable dashboard in the WordPress admin area. The tool is structured around three separated responsibilities — watching, logging, and displaying — so that each component performs only its own function without interfering with site behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Supply Chain Attacks: How Hackers Compromise Code Before It Reaches You

Supply chain attacks target the building blocks of software — libraries, container images, and firmware — rather than end products directly, allowing attackers to execute malicious code across millions of projects at once. A notable example involved a compromised npm package that silently exfiltrated Bitcoin wallet data from countless dependent projects after a single malicious pull request. Attackers exploit three main vectors: package repository manipulation on platforms like npm and PyPI, tampering with official container base images, and injecting malware through unsecured firmware update mechanisms. A 2023 incident involving the widely used Docker Hub image node:14-alpine saw a reverse shell script embedded that connected compromised containers to an attacker-controlled server within hours of deployment. Security experts warn that protecting only one's own codebase is no longer sufficient, as every third-party dependency and automated CI/CD pipeline integration expands the potential attack surface exponentially.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three MCP Servers That Extend Claude Desktop With Files, GitHub, and Postgres

A developer has shared three Model Context Protocol (MCP) servers they actively use with Claude Desktop to enhance productivity. The filesystem server allows Claude to read project files directly, eliminating the need to manually copy-paste code into the chat. The GitHub server enables Claude to review pull requests, check issues, and browse repositories within the same conversation. A PostgreSQL server grants Claude direct database query access, letting users retrieve data without switching tools. Each server can be installed via the mcp-hub CLI in roughly two minutes, though users are cautioned to restrict filesystem paths carefully to avoid exposing their entire disk.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bun Outperforms Node.js on High-Throughput SQLite JSON API in Real-World Test

ViralVidVault, a European viral video tracking platform, ran a week-long benchmark comparing Bun and Node.js on a batch video metadata API that processes up to 200 video IDs per request. The existing Node.js service had a p99 latency of 40ms, with profiling revealing that only 2ms was spent on SQLite reads while the remaining 38ms came from JSON serialization, HTTP framing, and garbage-collection pauses. The test used a single POST endpoint querying a 350,000-row SQLite database in WAL mode, deliberately stripped of framework overhead to isolate runtime and SQLite driver performance. Node.js relied on the better-sqlite3 driver, while Bun used its built-in bun:sqlite module, eliminating native compilation dependencies entirely. The benchmark aimed to provide measured, infrastructure-based data rather than relying on vendor launch-day performance claims.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds self-hosted MCP mail server giving each AI agent its own inbox

A developer has built openagent.email, an open-source self-hosted mail server designed to give AI agents dedicated email identities without routing sensitive messages through third-party servers. The system runs on two Docker containers — a Postfix/Dovecot catch-all mailbox and a Node/Hono API — with an MCP layer allowing compatibility with AI clients like Claude Code, Cursor, and Windsurf. Rather than provisioning a separate mailbox per agent, the architecture uses a single catch-all inbox where logical identities are filtered by exact recipient-header matching, preventing one agent from accessing another's mail. The design deliberately avoids substring matching, untrusted sender-supplied dates, and display-name spoofing to close common security gaps in multi-tenant email handling. The full stack consumes around 190 MB of RAM in production and is backed by 268 automated tests.

0 comments Read more at DEV Community