Brief

Snyk's agent-scan tool for MCP servers operates by executing them to retrieve tool descriptions, a process that raises security concerns when scanning untrusted configurations or in CI/CD pipelines. This method involves connecting to the server and transmitting data to Invariant Labs' API, which could be problematic for data residency and compliance. An alternative, Bawbel, offers static analysis by reading configuration files and manifests without executing any code, making it suitable for pre-deployment checks and air-gapped environments, though it cannot detect runtime-specific behaviors. AI

Cursor has launched new features for its AI-powered integrated development environment (IDE). Customers can now run cloud agents within fully configured development environments, which can be set up with cloned repositories, dependencies, and credentials. These environments now include version history with rollback capabilities and an audit log for all changes, with egress and secrets scoped per environment for enhanced security. AI