Not trusting your agent is now a product aisle.

A CLI and TypeScript SDK from OpenAI for finding, validating, and fixing security vulnerabilities: npm install @openai/codex-security, sign in with a ChatGPT plan or set an API key for CI, then npx codex-security scan .. The repo is Apache-2.0, sixteen days old, and at 3,700 stars; the npm registry shows v0.1.1 published yesterday — the auth fix the maintainer promised in the HN thread, actually shipped. Per that same thread, the architecture is candid: your code goes to OpenAI's servers, the scanner is hardcoded to GPT-5.6 Sol, and thirteen pre-built security skills ship in the box. Commenters converged on an unexpected verdict — the scanner is the demo; the workbench is the product. Deduplication across runs, false-positive tracking, --max-cost budget caps, and CI wiring are the parts nobody has when they duct-tape "act as a security reviewer" onto a general coding agent.

Vercel Labs' deepsec brought this pattern to CI on 07-20; now it comes from the model vendor itself, and the thread's sharpest finding is what that costs. OpenAI's cyber guardrails fire on the tool's own job: users reported scans that found a vulnerability and then refused to explain it, and 30-to-50-minute runs dying to refusals after burning $100 in tokens or half a weekly Pro allocation, unrefunded. The fix is applying to OpenAI's Trusted Access for Cyber program, which reduces refusals without eliminating them. The vendor that documented its own models breaking into Hugging Face's infrastructure now sells the audit — and its safety layer sometimes treats your defense as the attack.

Reach for it when agent-written diffs have outrun your security review capacity and you want scanning with dedupe, findings history, and a CI gate rather than a prompt. Delete the security-review prompt taped to your general-purpose agent. Tradeoff: hosted-only, model not swappable (the maintainer says local and OpenAI-compatible endpoints are being worked on), the refusal tax is real until your Trusted Access application clears, and v0.1.x is sixteen days old — one commenter's request for a head-to-head against Strix, our 07-27 kicker, went unanswered.

A Rust CLI that puts Claude Code, Codex, Pi, CoPilot, Hermes, OpenCode, or OpenClaw in a least-privilege sandbox with no daemon, no container, no VM, and no disk image — curl | sh or brew install nono, then run your agent under a profile. Apache-2.0, 3,268 stars, v0.69.0 shipped last week, an OpenSSF best-practices badge, and a README claiming the team behind Sigstore, the attestation standard PyPI and npm run on. Profiles are forkable, themeable, and shared through a registry (nono pull nolabs-ai/claude). Where the sandbox shelf we've covered rents the agent a machine — Superserve and box on 07-22, Clawk's VMs before that — nono makes the opposite move: no machine at all, an OS-level ceiling on the box you already have, at zero start latency. Disclosure: this crossed our pool on 06-11 under its old org name, always-further; the namespace migrated, the tool didn't.

The load-bearing feature is one layer down. Agents delegate real work to git, gh, curl, kubectl — and most sandboxes give the whole session one blanket policy, so every tool inherits every secret. nono's broker launches each controlled tool in its own child sandbox with separate filesystem grants, separate network rules, and credentials injected through a proxy, so the agent never holds the raw token. Policy goes down to L7: gh may GET /repos/you/yourrepo/issues/** and nothing else, git may call ssh under a chained policy while direct ssh from the agent stays denied, and argv allowlists pin which subcommands run at all. The README's own summary is the thesis of today's edition: the policy lives in the profile, not in the prompt.

Reach for it on the days you'd otherwise reach for --dangerously-skip-permissions. Delete the devcontainer you maintain purely as a blast shield. Tradeoff: registry-distributed policy inherits the skills supply-chain problem this newsletter flagged on 07-14 — a too-loose profile installs exactly like a tight one and nothing signs or reviews what you pull; Windows support means WSL2, not native; and "nono pioneered the zero-latency agent sandbox, copied by many" is README swagger about a shelf that was already real.

A single-binary CLI in Go that answers questions about your infrastructure: cynative "what in my cloud is publicly exposed that shouldn't be?". It reasons across GitHub, GitLab, AWS, GCP, Azure, and Kubernetes as one system, using the credentials already in your shell, and instead of issuing one tool call per action it writes code in an ephemeral sandbox that fans out API queries concurrently, then cross-checks findings and traces each back to its origin. Apache-2.0, brew-installable, bring your own model — the quickstart literally exports ANTHROPIC_API_KEY and claude-opus-5. The posture is the pick: every call is authorized against a read-only policy before a credential is attached, which is a different claim than "the prompt says don't modify anything."

The signals are early and worth stating: created 06-24, 161 stars, Show HN at 16 points — but it also crossed our pool yesterday via a ProductHunt launch, so this is a two-channel launch week, not organic traction. What earns the slot is the design family it extends: deepsec gates the PR, crabbox records the run, and Cynative makes the destructive call unexecutable — enforcement over instruction, the same lineage as pick two, applied to the scariest credential set a builder has.

Reach for it when an infrastructure question needs frontier-model reasoning and you are not willing to hand write-capable credentials to an agent to get it. Delete the pile of read-only MCP servers and the six-console click-through it replaces. Tradeoff: the read-only guarantee is their gate code, not your IAM policy — scope the credentials anyway; "verified answers" means its own cross-checking loop, not an external check; and every demo is the vendor's own.

A hosted review layer — GitHub integration, CLI, and an MCP server — that checks pull requests against your ADRs, docs, and past decisions instead of against vulnerability classes. Number one on Product Hunt today at 242 votes. The axis is what makes it interesting: every other tool in this edition asks whether the agent's code is safe; Prelint asks whether it's the product you decided to build. Agents drift in ways CI can't see — an empty state quietly redesigned, a config flag that contradicts a decision record from March — and the only reviewer for that class today is a human who remembers everything.

The MCP server is the preventive half: agents can query the decision history mid-task, before writing the drift, rather than getting flagged after. That closes a loop this newsletter has been tracking in pieces — Grepathy (07-16) extracts decision records from agent transcripts, CodeAlmanac (07-22) gives the repo a memory, and Prelint is the enforcement arm the decision log was waiting for.

Reach for it when multiple agents merge daily into a codebase that has real written decisions worth defending. It fills a gap rather than replacing an incumbent — no linter checks intent. Tradeoff: closed and hosted, so your ADRs and diffs go to their servers; the "~40% of issues fixed before merge" figure is their own; credits pricing with a launch-day coupon is early-stage economics; and it can only enforce decisions you actually wrote down — drift from undocumented intent sails through, which makes the tool exactly as good as your documentation habit.

The kicker, because every pick above still ends with a human reading a report, and this one deletes the reading. A Lean 4 implementation of 3D mesh intersection — the first formally verified one, per the author — where the human-reviewable surface is a 93-line specification. The implementation and its proofs, more than a thousand lines of code and what the author counts in the tens of thousands of lines of proof, were largely AI-generated and never reviewed: Lean's proof checker verifies at compile time that the implementation satisfies the spec, across all inputs, including the coplanar-face and edge-edge cases that fuzzing statistically never finds. MIT, three days old, 110 points on Show HN.

The boundary of the guarantee demonstrated itself in the wild, which is the honest part: an overflow bug turned up in the unverified glue code that converts exact rationals to floats for the GPU — while the verified kernel stayed sound. The bug landed precisely where the proof didn't reach. That is simultaneously the best advertisement for the method and its limit, stated in one incident.

This is a working demonstration of a workflow more than a tool you adopt: pin down a small spec, let the agent generate both implementation and proof, review neither. Reach for the pattern when correctness is worth more than speed and the domain has a spec worth writing. Tradeoff: exact rational arithmetic puts it far from production CAD performance — the thread's consensus, with a CGAL-style float fast path as the plausible fix; the proof covers the Lean code, not the compiled binary it becomes; and it's a single-author repo covering exactly one operation.

Also worth knowing. MoonshotAI/FlashKDA (MIT, 889 stars, +216 today) is Moonshot's first-party CUTLASS kernel library for Kimi Delta Attention, auto-dispatched from flash-linear-attention's chunk_kda; it needs SM90-class GPUs and CUDA 12.9. Two days after K3's weights went public, the serving substrate is arriving from the vendor piece by piece — the open question from 07-28 (what it actually costs to run K3 on owned hardware) is still open, but the kernels are no longer the excuse. It pairs with Sebastian Raschka's K3 architecture notes (434 points, dropped as analysis), which explain what KDA is and why it exists. Hubble (MIT, 1,012 stars, 119 points) is Astro core developer Ben Holmes' notepad "for you and your agents": a Notion-feel Markdown editor over a plain folder that live-reloads while your agent edits the same files, plus a companion skills repo for having agents build HTML views — tables, bookshelves, maps — over your notes. The one-artifact-both-species thread (Nobie 07-14, Tiptap 07-15) lands on plain files, which is where it probably always belonged. MemoryCustodian (97 votes, #6 on Product Hunt) keeps coding-agent memory as reviewable Markdown in the repo with a manifest that loads only task-relevant slices — CodeAlmanac's idea with a token budget. And BlackFlare (Product Hunt) keeps your Mac awake and pings you when Claude or Codex finishes — the 07-22 doorbell thread's cheapest form yet.