Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

protocols, harnesses, ledgers

MCP tightened the tool-call envelope, Poolside and Paseo made coding agents portable across harnesses, and Tines plus Magpie put ledgers and permissions around sensitive agent work.

Published Updated Read 5 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-07-29

agent work is getting pulled into adapter layers now: protocol rules, harness switches, and back-office write controls.

read the day through three doors. MCP tightened the shape of tool calls. Poolside and Paseo made coding agents look more like portable harnesses than apps you marry. Tines and Magpie put the boring adult furniture around sensitive agent work: permissions, branches, ledgers, invariants. rude, necessary furniture.

1. MCP made the tool call more stateless

sources:

what happened: MCP published a 2026-07-28 specification page with a colder base protocol: JSON-RPC messages, stateless self-contained requests, and per-request capability negotiation. the same page puts elicitation on the client side and lists opt-in extensions for long-running Tasks, Skills over MCP, and MCP Apps. its security section is unusually blunt for protocol docs: tools are arbitrary code execution paths, tool-behavior annotations are untrusted unless they come from a trusted server, and hosts need explicit consent before invoking tools.

Coding Tools MCP shows why that matters in practice. it packages file reads, search, structured multi-file patches, command execution, interactive sessions, and git as one model-neutral coding runtime, with 20 tools, one-workspace confinement, permission modes, Streamable HTTP, OAuth 2.1 + PKCE, and a disposable sandbox path.

why this matters: the useful boundary is moving out of the model prompt and into the request envelope. if a tool can patch files and run commands, the receipt needs to live in the protocol, not in a nice sentence about safety.

2. coding agents got a harness layer

sources:

what happened: Poolside launched a macOS Desktop Assistant plus VS Code and Visual Studio extensions for running multiple coding agents across projects and repositories. the important bit is not the app chrome; Poolside says it is built on Agent Client Protocol, so compatible agents can run alongside pool while users bring Claude Code, Codex, Gemini, an OpenAI-compatible endpoint, or a local open-weight model. Poolside also says ACP connects the interface to the harness and model without routing model calls through Poolside or changing the agent’s existing configuration.

Paseo is hitting the same nerve from the open-source side. it runs Claude Code, Codex, OpenCode, Pi, Cursor, and dozens more from desktop, web, mobile, or CLI while keeping each provider’s native harness, subscriptions, skills, config, and MCP servers intact.

why this matters: the coding-agent market is quietly splitting into model, harness, and control surface. that is good news for operators: the front-end can finally change without making every subscription, skill file, MCP server, and local runtime wear a fake mustache.

3. back-office agents met the ledger

sources:

what happened: Tines 3B is selling a controlled environment for teams that are already building agents, apps, and automation with AI. its page names the control pieces directly: spaces with connectors, skills, and permissions; branches that track changes; Claude Code and Codex connections; dummy-data runs; and prompts before live data or live apps are touched. that is the enterprise version of “please stop shipping weird little side-effect machines in the corner.”

Magpie is smaller and sharper: an accounting CLI for humans and AI agents. it gives agents guarded paths for chart-of-accounts work, double-entry journals, customers, invoices, payouts, notes, snapshots, and audit reads, then checks RBAC and accounting invariants before appending an encrypted immutable event to Jaybase.

why this matters: yesterday’s agent-money story was about payment rails. this one is about the paperwork around sensitive writes: who changed the books, which invariant held, which branch tracked the workflow, and whether the agent ever got raw database access in the first place.

  • OpenViking — a context database for agents where sessions become memory and integrations already name Claude Code, Codex, OpenClaw, Hermes, and MCP clients.
  • CogniKernel — cross-session project memory for Claude Code and Codex, built from decisions, constraints, and abandoned approaches rather than a generic vector bucket.
  • OpenBiliClaw — a local-private content discovery agent with a SQLite profile, browser sources across social/video platforms, and enough memory machinery to make recommendation feel like personal infrastructure.
  • emem — signed, shared fact memory for multi-agent systems; useful as a counterweight because it explicitly says it is the wrong tool for preference memory.

left on the table

  • bun init creating CLAUDE.md stayed out because instruction files were already the main object on July 19 and part of the Claude 5 context lane on July 25; one HN thread was not enough to reopen it.
  • BEAM memory benchmark claims were interesting, but the cache surfaced them through HN rather than a primary report, and memory benchmarks were too close to yesterday’s trace/skill lane.
  • Microsoft agent-governance-toolkit was rejected as an exact recent project family from July 27’s gateway-policy signal.
  • OpenBiliClaw had the biggest repo energy, but making another local personal assistant the lead would have made the week feel like it was chewing the same sock.
  • Tines 3B and Magpie were allowed despite yesterday’s payment rail because the object changed: not agent spending, but audited sensitive writes.
agent-protocols coding-agents agent-governance workflow-automation