Four hundred thousand approval clicks say the gate doesn't work.

An MIT SDK from CopilotKit (106 points on Show HN, 700 stars in three weeks) that puts an agent inside Slack, Microsoft Teams, Discord, or Telegram as a participant rather than a webhook — it reads the conversation, streams a reply, calls tools, and renders native Block Kit or Adaptive Cards from one JSX description. It speaks AG-UI, so LangGraph, CrewAI, Mastra, Pydantic AI, and Google ADK agents all plug in unchanged. npm shows 36 releases of @copilotkit/channels since July 8, with 0.8.0 landing on launch day.

The engineering worth reading is in the approval path, and the OP spelled it out in the thread: the run loop is ack-first — post the approval card, acknowledge the delivery, resume the run when the click arrives — which is why an approval survives retries and process restarts instead of stranding a half-finished run. Handler IDs are content hashes rather than per-deploy identifiers, so a button posted last week still resolves after three deploys. That is a genuinely hard problem solved well, and it is worth sitting with the fact that it was solved for the control the day's other headline just graded at 66.3%. The team's own dogfooding is the honest picture of what arrives once this is easy: a lunchbot wrapping the DoorDash CLI, a pupfood agent doing incident triage, a chadbot making marketing videos out of pull requests. One commenter's reply to all of it — "I dread the day when my employer's Slack includes chatbots rambling all over it" — is the tradeoff the README doesn't print.

Reach for it when an agent you already run needs to live where the humans are, with buttons instead of a terminal. Delete the hand-rolled Slack bolt app and the Adaptive Cards JSON you maintain twice. Tradeoffs: the repo you are starring contains no SDK — it is a README, a license, and two examples, with the actual packages over in the CopilotKit monorepo (also MIT) and the managed Slack and Teams connections handled by CopilotKit Intelligence, which is closed and license-gated; a commenter called that out and the maintainer conceded it, calling it "a maturity problem on our end right now"; WhatsApp works only on the open-source side; and putting an approval card in the channel where people are least attentive is a delivery improvement, not a security one.

An Apache-2.0 harness (npm install -g @osfactory/har) that runs a fleet of coding agents on one repository without them colliding: each agent gets its own git worktree, branch, ports, and database, launched and torn down through har env launch and har env verify. A .har/ contract in the repo replaces the knowledge currently scattered across a README, a CLAUDE.md, Cursor rules, and CI yaml, and any MCP agent — Claude Code, Cursor, Codex — reads the same file. Ships as a CLI and an MCP server, with a local dashboard called Mission Control. Nineteen stars, one fork, #10 on Product Hunt at 91 votes — and 65 npm releases since July 6, with 0.47.0 published the day before launch. The registry is where the work shows.

The reason it belongs next to today's study is reason three in its own README: trusting an agent's change currently means re-verifying it yourself, so every task instead runs the same deterministic verify step and leaves logs, artifacts, and a validated tree hash behind. The reviewer checks proof of what ran rather than the agent's self-report. That is the same substitution the study's author called for in his thread when he said the fix is making sandboxing and permission isolation easier from the tooling rather than treating a human in the loop as an acceptable alternative — and this is the pool's cleanest instance of it, shipped, installable, and grading itself. har env maintain even diffs your installed harness against current templates to catch drift before a run fails confusingly.

Reach for it when you have more than one agent working a repo and you have started losing track of which branch actually passed. Delete the shell scripts that spin up a worktree and a spare Postgres, and the habit of trusting "tests pass" from the process that wrote the tests. Tradeoffs: nineteen stars and one maintainer, so the ecosystem promised by the plugin section does not exist yet; the verify gate is only as good as the checks your project already has, and a repo with thin tests gets a tree hash attesting to very little; GitHub's API reports the license as NOASSERTION because the LICENSE file opens with a copyright line, though the file itself says Apache-2.0 plainly; and version 0.47.0 in five weeks is a compliment and a warning about interface stability.

An AGPL-3.0 MCP server (npx wigolo init, Node 20+, about 1.5 GB of disk) that gives an agent one surface for search, fetch, crawl, extract, cache, find-similar, and autonomous research — with no API key for any of those. Eighteen search-engine adapters with rank fusion, reranking and embeddings running on-device, and everything it touches living under ~/.wigolo/. Results come back as evidence rather than prose: a verbatim excerpt pinned to byte-offset source spans, a citation ID, and a score decomposition the agent can inspect. One command wires it into any of nine coding agents. 4,390 stars, up 88 today, still labeled public beta.

Scope violations were the category human reviewers missed most often in the study, at 35% — the agent reaching for a file or a credential outside what the task needed. wigolo's answer to that is not a better prompt, it is an absence: there is no Firecrawl key, no Tavily key, and no Exa key in the environment, so there is nothing in this part of the stack to exfiltrate and nothing to approve. The honesty in the output design is the other reason it's here. Failed engines are reported, stale cache is labeled, weak results are flagged as junk by its own scorer, and a bot-challenged page returns a labeled blocked_by_challenge failure rather than the challenge shell dressed up as content — which is the behavior you want from the tool feeding a machine that cannot tell the difference.

Reach for it when your agent's web habit has become a metered bill, or when you would rather your research queries not leave the box. Delete the Tavily or Exa subscription for everyday agent search, and the API keys for it. Tradeoffs: the published npm package is 0.2.1 from July 19, while the repo whose README you just read was pushed today, so npx wigolo gets you something three weeks behind the pitch; research, agent, and answer-formatted search still want an LLM key unless you point them at a local Ollama; and the benchmark is one cold query in a single Claude Fable 5 session, scored by the same agent that ran it and presented as an animated GIF — the comparison table is the vendor's, as of July, and the honest read is parity-plus-provenance rather than a measured win.

An MIT browser cloud from Reclaim Protocol that runs a live browser session inside an AMD SEV-backed confidential VM on Google Cloud, then destroys it. The browser, the desktop, the VNC viewer, the proxying, and the attestation service all live inside the enclave. A verifier sends a nonce to the attestor and gets back cryptographic fingerprints of the browser and attestor images plus the cloud's hardware attestation — evidence that the session ran on genuine confidential hardware executing approved code. Allocation takes 470 ms at the median and 889 ms at p95. The repo describes itself as self-hostable browser runtime infrastructure for agents.

This is the end of the ladder the other three picks climb. Channels SDK makes the human's yes durable, HAR replaces the human's review with a hash, wigolo removes the thing worth stealing — and Popcorn removes the person from the loop entirely, replacing "I trust the operator ran what they said" with a fingerprint you can check yourself. The numbers behind it are the most interesting thing in today's pool: 102,859 sessions in a 30-day window, averaging six minutes eleven seconds each. That is a six-figure production workload attached to a repository with one star and a Show HN that drew ten points and zero comments. The service has users; the open-source release has none yet, which is an unusual and useful inversion of the traffic we normally see.

Reach for it when an agent has to drive a browser through something you would not hand it a password for, and somebody downstream needs proof of what actually ran. Delete the headless Chrome box you cannot make any claims about, and the trust-us paragraph in your security page. Tradeoffs: pricing is not disclosed anywhere; a one-star repository means nobody outside the company has stood up the self-hosted path, so "self-hostable" is untested in public; the Show HN drew no comments at all, so there is no thread to check the design against, and the production numbers are entirely the vendor's own; and attestation proves which image ran, not that the image is good — the same boundary that bit the Lean-verified kernel we covered on 07-29, where the bug landed exactly where the proof did not reach.

Also worth knowing. Orite (#21 on Product Hunt, closed, free tier plus three months) is the layer nobody above binds: spending limits set once and enforced on every agent transaction, blocked or held above the ceiling, with an audit trail — the maker's analogy is a company card rather than a set of API credentials. It is also the one item today whose mechanism stays undisclosed even in the maker's own comments ("not by replacing how payments move, but by building the missing layer in front of it"), which is a lot of trust to ask for a product about not extending trust. Money remains the blast radius with no technical boundary around it. Soloop took the day's #2 slot with 173 votes for an "approval-first Agent OS" — three agents playing CEO, CTO and CMO that bring critical choices back to the founder for sign-off — launching within hours of the data saying founders miss a third of what they sign off on. Nobody involved did anything wrong; the collision is just the clearest picture of where the category's instincts currently sit. DataBlur (#12, 86 votes, $4.99/mo or $39 once) blurs emails, cards, passwords and API keys on screen before a recording or a demo catches them, and it earns the mention for two design decisions stated plainly by its maker: deterministic pattern matching rather than a model, and failing closed — if detection breaks it blurs everything instead of exposing everything. That sentence is the whole thesis of today's edition, shipped in a Chrome extension. formwork (Apache-2.0, Rust, one star) is cross-platform kernel-enforced agent sandboxing with an MCP gateway, and it is here because its author posted it into the study's own comment thread as the answer — the reply-guy pipeline occasionally produces the right artifact. mcp-use v2 (10,455 stars, MIT) rewrote a two-year-old framework from scratch for the stateless MCP spec revision dated 2026-07-28; the 2.0.x line shipped on August 3, three days before the Show HN that drew ten points, and npm already carries a 3.0.0 canary alongside a legacy-v1 tag pinned at 1.34.6 — the cost of building on a protocol that keeps moving, itemized in dist-tags. And VulnClaw (MIT, 2,616 stars, +64 today, on PyPI at 0.3.7) is the other side of every gate above: natural language in, then reconnaissance, vulnerability discovery, exploitation and report generation run end to end by an agent. Chinese-first documentation, an explicit authorized-scope-only badge, and a working install command — noted rather than recommended, and a useful calibration for how fast the thing on the other side of the approval prompt is moving. Reddit produced nothing for the twelfth consecutive week; the pool was 82.