Hacker Newsnew | past | comments | ask | show | jobs | submit | jedisct1's commentslogin

When agents don’t encrypt secrets, MCP servers help prevent users from handing their API tokens to AI providers or intermediaries such as Cloudflare and Akamai.

It's probably good, and the best for Deepseek models, but do we really need one harness per model?

You can get a taste of this today yourself with Swival /audit command and the security scanner is going to get even closer soon: https://medium.com/@swival/ai-vulnerability-scanning-needs-a...

Have you tried Swival /audit? https://swival.dev/pages/audit.html

Microsoft’s GitHub was compromised when a Microsoft developer using Microsoft VSCode installed a rogue extension from Microsoft’s VSCode extension library, which is moderated and hosted by Microsoft.

Underrated reply

Interesting!

The https://swival.dev harness already has retry nudges, step enforcement, error recovery, context awareness, etc. to try to support small models as much as possible.

Curious to see how it compares with forge, and if both could be combined.


Oh interesting - I hadn't come across that!

I'd assume they could be combined. A coding harness would own the agentic workflow by nature, forge guardrails would help tool calling.

I haven't given it a thorough read yet but I think their guardrails might be more focused on the workflow level. They are doing error capture at tool level with warnings to the model, but I'd need to dig deeper. On the surface definitely the same design philosophy! Maybe Forge makes error nudges more of a first-class citizen?

Our compaction strategies might be the most similar of all the pieces. Cool find!


How does swival.dev compare to a diy agent harness like pi.dev or do they serve different purposes, since swival ships with the "extensions" by default?

Depends on the language and harness, I guess.

It works really well for me, at least for Python and JavaScript, with swival.dev as a harness.


You should probably disclaimer that you're the author of swival.dev, but nice project :)


Swival found many more vulnerabilities without Mythos https://github.com/swival/security-audits


Finding vulnerabilities everywhere doesn't need any skills and more, nor Mythos.

See https://github.com/Swival/security-audits/ for examples, which are automated security audits just made with swival.dev /audit command, and includes audits of large code bases such as the entire OpenBSD base system.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: