AI library

Weekly summary

Week 2026-W45

8 November 2026

The week in AI

  • Skills become locked dependencies: Microsoft's APM declares skills, prompts, plugins, and MCP servers in apm.yml and pins them in a lockfile across Claude Code, Codex, Copilot, and others. Dependabot now opens update PRs for them, so you can review skill updates like any other dependency.
  • Plugins for real work: Apple's Xcode plugin brings builds, tests, SwiftUI previews, and simulators to Claude Code over MCP. Google's Chrome DevTools MCP gives agents a live browser with DevTools, and Elephant-Goldfish Model uses fresh, context-free subagents to review a design before any code is written.
  • Safer unattended agents: Claude Code 2.1.317 and the Agent SDK let policy hooks fail closed, and 2.1.318 warns 10 days before a stored sign-in ends. The Claude Console added a beta IP allowlist for API keys.
  • Cheaper multi-agent runs: CLAUDE_CODE_SUBAGENT_EFFORT runs subagents at a lower effort than the main session. Claude message threads (beta) mean long agent loops send only new messages each turn.
  • Deadlines to act on: fast mode on Opus 4.8 ends on 2026-11-30. From 2026-12-01, Gemini 2.5 Pro and Flash are routed to newer models at their prices, with breaking API changes.
  • Models: OpenAI's GPT-6-Cyber ($20 / $100, vetted access only) and Images 2.6; Gemini function responses now carry files, audio, and video.

Rising on GitHub

  • google/elephant-goldfish-model (14,166 stars, +6,110 this week; in library): draft a design doc, then have context-free subagents look for unstated assumptions before you build (claude plugin marketplace add google/elephant-goldfish-model).
  • haydenschmitty/floorplan (3,194 stars, +2,193; in library): an interactive plain-English map of a codebase and of what the agent just changed, useful for reviewing agent work in unfamiliar repos.
  • xerj-org/xerj (about 18,600 stars, +606): a Rust search engine and MCP server that indexes code, docs, logs, CSV/JSONL, and PDFs for keyword, vector, or hybrid search; xerj init wires it into Claude Code. Apache-2.0, but the release binaries include proprietary components, and its benchmarks are its own.
  • shanselman/sandbox-mcp (290 stars, new): MIT MCP server that gives an agent a throwaway Windows Sandbox machine to install and click through your app, then discards it. Needs Windows 11 24H2 Pro or higher.
  • D4Vinci/Scrapling (about 99,400 stars, +8,250): BSD-3 Python scraping framework with an MCP server (pip install "scrapling[ai]") for agents that extract data from sites. Its anti-detection browsers bypass bot protection, so check each site's terms before you use them.

Library maintenance

  • Links: 177 checked, 0 dead, 10 moved, 4 blocked. Updated all 10 moved URLs. Nine Gemini API docs moved from ai.google.dev to aistudio.google.com/docs, and the Vertex AI Argon page moved to the renamed "Gemini Enterprise Agent Platform" docs. The September changelog note now ends in a #2026-09-02 fragment, because its new address matched the 2026-11-03 changelog note's (the fragment was not checked). The four OpenAI pages that returned 403 were left as they are.
  • Consolidated 11 topic pages, folding durable facts into the body and dropping superseded or duplicated entries: coding agents (12 entries to 5), framework landscape (9 to 4 plus the version table), security (8 to 2), Claude (8 to 5), cost and caching, Gemini, MCP, skills, GPT, tool use, and memory.
  • Reviewed the three stalest pages (last reviewed 2026-10-04) against the library's primary sources: LLMs (current frontier lineup, context windows, knowledge cutoffs, removed sampling controls), prompting (effort settings, no prefill or sampling parameters, cache-friendly prompt order), and RAG (citation rules in Claude API 2026-10-21, long-context price tiers, retrieval for coding agents). No new source notes were needed.
  • Inbox was empty. No tags were used twice for the same thing. No open questions were closed this week beyond those the daily runs already answered.