Outside checker finds silent truncation bug in MCP server's list answers, fixed within an hour

·1 views

An external agent named neo tested the read-only tools of the Agent Commons MCP server by comparing their answers against the REST API as an independent source. The check found that list responses for entries, jobs, and agents stopped at 25 items without indicating that more results existed. The flaw produced no error, since every returned row was correct. The developers, who build the platform, responded by adding returned and has_more fields and a next hint to these list tools, and neo confirmed the fix. The team argues that answer-correctness checks catch bugs that liveness monitors miss, and they have offered their server as a test subject.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Azure AI Foundry Adds Model Marketplace and Governance Tools for Developers

Microsoft's Azure AI Foundry has introduced a dedicated marketplace where developers can find and integrate third-party AI models, aiming to cut development time. The platform also added an AI Governance Dashboard to help teams monitor compliance and security as AI regulations evolve. Separately, GitHub Copilot Studio now offers AI-driven code refactoring suggestions intended to improve performance and readability. Azure has further upgraded Container Apps and AKS with enhanced autoscaling and security features, and Azure AI Foundry now supports custom model training with distributed training and automated hyperparameter tuning. The roundup, compiled from community sources, provides step-by-step guidance for trying each tool.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Public-Sector Logins Secured via Low-Cost SMS OTP API in Node.js 2FA Setup

A developer guide describes using a dedicated SMS one-time-password API for two-factor login in a Node.js public-sector appointment application, keeping the provider from storing or matching codes. The application still handles expiry, resend timers, attempt lockouts, consent, and monitoring. The article argues that SMS costs scale with message sends, so reducing unnecessary resends and abuse matters more than the per-message rate. It recommends keeping a separate append-only audit record of each access decision, without storing codes, message bodies, or bearer tokens. A Go example shows how to check the provider's live API schema while handling rate limits with backoff.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three single-file HTML tools replace IT spreadsheets for racks, IPs and inventory

A developer built three IT documentation tools to replace the spreadsheets small teams typically use for server racks, IP addresses and equipment inventory. Each tool is a single index.html file that runs in any browser without a server, database or account. The rack tool maps devices and ports with cable details, the IP tool tracks address states, VLANs and subnets, and the inventory tool flags expiring warranties and support contracts. Data is stored in a user-controlled JSON file that can sit on a network share, and the tools are open source under AGPL-3.0 with English and Spanish support.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Staged Retrieval Design for Privacy-Focused Logistics Knowledge Search at Scale

A logistics knowledge manager can keep near-duplicate detection explainable and index costs under control by adopting a staged retrieval design with explicit collections, bounded queries, and traceable source context. The approach begins by defining the retrieval unit, mandatory metadata filters, and freshness requirements before choosing any endpoint. The article compares FAISS, pgvector, Qdrant, Pinecone, and managed REST vector APIs, noting that each trades off operational responsibility, database coupling, and data residency concerns. Evaluation relies on small, hand-inspectable test sets with failure cases, such as a delayed-delivery note that gets re-entered with a changed tracking number. Because cross-owner matches are treated as more serious than slightly lower top-k scores, the guidance favors a two-pass query that applies owner and document-type filters before scoring candidates.

0 comments Read more at DEV Community