# Newsletter October 26, 2026: Security update for MCP and tooling for Claude Code

[← All newsletters](/en/nieuwsbrieven)

# Newsletter Monday, October 26, 2026

By Ivo Donker · 26 October 2026 — written with AI assistance
Daily update on the AI tools we follow. Headlines come from public sources (X, GitHub, Hacker News); the English explanations and summaries are machine-generated. Each headline links to our own news page on that topic; the source link is next to it.

## In short

Within the agent ecosystem, a security update for @modelcontextprotocol/server was released to version 2.3.0, amid warnings about unvalidated startup of MCP servers via .mcp.json in Claude Code. In addition, the tooling ecosystem expands with the aidevkit package manager, a plugin marketplace, and the /stack mod for Claude Code environments. On the infrastructural front, the self-hosted media cloud Shotstash was released under an MIT license, while Cloudflare OS allows agents to connect to live ClickHouse data. Finally, the subreddit r/opensource banned AI-related contributions, and indie developers are experimenting with AI routers and caching to lower API costs.

## Codex, Cursor, OpenCode & Hermes

- [Stop wasting tokens with Codex. Why use expensive AI models for every task? Learn how AI routers, smart model selection, caching, and contex](/codex-nieuws#i-9f2c69e841) · [source: X](https://x.com/edinsoncode/status/2113658305793143018) · 2026-10-23This item covers cost savings in AI through smart model selection and caching, which helps lower API costs as an indie developer.

- [Building a game with Claude Code or Codex? save this. 74 open-source game dev skills for AI coding agents: → Godot, Unity, Unreal, Phaser, T](/claude-code-nieuws#i-9448aea82a) · [source: X](https://x.com/RoundtableSpace/status/2114352528783540367) · 2026-10-25This item showcases open-source game development skills for AI coding agents, relevant for indie developers building games with AI.

- [Codex and Claude Code are the Ronaldo and Messi of AI Coding agents.](/claude-code-nieuws#i-123eb7bc51) · [source: X](https://x.com/IamAroke/status/2113980326083203383) · 2026-10-24This item compares Codex and Claude Code to top athletes, useful for indie developers to know which AI agents are popular.

- [My Agentic Coding Workflow: Claude Code, Codex, and Pi](/claude-code-nieuws#i-8fff3da2e8) · [source: Hacker News](https://www.damiangalarza.com/posts/2026-10-21-agentic-coding-workflow/) · 2026-10-21This item describes an agentic coding workflow using Claude Code, Codex, and Pi, providing insight into modern development methods for indie developers.

## Claude Code & agents

- [Give your Claude Code agent an official plugin marketplace and extend it with verified skills, subagents, and MCP servers in one command. Cl](/claude-code-nieuws#i-c7c26afbcb) · [source: X](https://x.com/entropyweights/status/2113359740613115947) · 2026-10-22This item showcases a plugin marketplace for Claude Code to extend the agent, relevant for indie developers looking to expand their toolset.

- [I moved a Claude Code setup into Hermes in 1.7 seconds. 🪽 hermes plugins install agent-importers --enable hermes import-agent claude-code --](/claude-code-nieuws#i-cd2cf95154) · [source: X](https://x.com/BkashJosi/status/2114385693220954198) · 2026-10-25This item explains how to migrate a Claude Code setup to Hermes, handy for indie developers who want to switch flexibly between tools.

- [Every Claude Code user NEEDS to install /stack... Seriously! Save this post and try it later The /stack mod shows you EVERYTHING installed a](/claude-code-nieuws#i-9f50e85a48) · [source: X](https://x.com/dani_avila7/status/2113026278504755415) · 2026-10-21This item highlights the /stack mod for Claude Code to show installed components, useful for indie developers to keep track of everything.

- [THIS IS F*CKING SCARY clone a repo, run claude -p inside it, and every MCP server in its .mcp.json starts without asking you Anthropic's doc](/nieuws-claude-agents#i-983978d99e) · [source: X](https://x.com/madaearly/status/2114373593886761026) · 2026-10-25This item warns about automatically starting MCP servers in Claude Code, important for the security of indie developers.

## Cloudflare OS & self-hosted

- [Show HN: Shotstash – Self-hosted media cloud for creators (MIT, BYO-AI)](/nieuws-self-hosted#i-c80e311e6c) · [source: Hacker News](https://github.com/Aldyernesto/shotstash) · 2026-10-24This item introduces Shotstash as a self-hosted media cloud for creators, relevant for indie developers managing their own infrastructures.

- [AI agents connect to live ClickHouse data through @Cloudflare OS, with governed access and a trust layer built into the platform. Learn more](/cloudflare-os-nieuws#i-2856e01c72) · [source: X](https://x.com/ClickHouseDB/status/2113676631302967551) · 2026-10-23This item discusses connections between AI agents and live ClickHouse data via Cloudflare, interesting for indie developers building data-driven apps.

- [I've been curious about self-hosted dashboards that tie all your services together, so I had my AI agent install and run a bunch of them on](/nieuws-self-hosted#i-4ed2fdb06b) · [source: X](https://x.com/tranngocthuycom/status/2114179201356230893) · 2026-10-25This item covers self-hosted dashboards installed by AI agents, handy for indie developers looking to centralize services.

- [ive finally found flow state with @t3dotcodes on mac/iphone and beaming it up to scotty, my cloud agent platform that runs on @Cloudflare -](/nieuws-self-hosted#i-b5c3b65a86) · [source: X](https://x.com/yesh/status/2111987801101332698) · 2026-10-19This item describes a mobile and cloud-based development workflow via t3dotcodes and Cloudflare, relevant for mobile indie developers.

## Agent-tooling & MCP

- [fix(deps): update dependency @modelcontextprotocol/server to v2.3.0 [security]](/nieuws-mcp-agent-tooling#i-fed42aee0c) · [source: GitHub](https://github.com/MooseGooseConsulting/context7-key-rotator-mcp/pull/15) · 2026-10-23This item shows a security update for the dependency @modelcontextprotocol/server, important for indie developers using MCP.

- [I built a package manager for AI agents, skills and MCP servers. aidevkit install github-mcp-server shows what the server can reach before y](/nieuws-mcp-agent-tooling#i-67aba9d923) · [source: X](https://x.com/jatinsj710/status/2114363853358407879) · 2026-10-25This item introduces a package manager for AI agents, skills, and MCP servers, useful for indie developers to manage components.

## Models & pricing

- [Are traditional app subscription models breaking down in the AI era? How are you handling pricing as an indie dev?](/nieuws-modellen-prijzen#i-18cb452fef) · [source: Reddit](https://www.reddit.com/r/AppBusiness/comments/1xei2h6/are_traditional_app_subscription_models_breaking/) · 2026-10-24This item discusses changes in app subscriptions in the AI era, relevant for indie developers wanting to price their software.

- [Same price per token, 2.7x the bill: what I learned trying to forecast my LLM API costs](/nieuws-modellen-prijzen#i-4feb24dc77) · [source: Reddit](https://www.reddit.com/r/LocalLLM/comments/1xcdmc5/same_price_per_token_27x_the_bill_what_i_learned/) · 2026-10-22This item covers unexpectedly high LLM API costs despite identical token prices, important for indie developer budgets.

- [I built a site to compare LLM benchmarks, token pricing, and VRAM requirements in one place](/nieuws-modellen-prijzen#i-db698fecd0) · [source: Reddit](https://www.reddit.com/r/AIToolsPerformance/comments/1xejtfu/i_built_a_site_to_compare_llm_benchmarks_token/) · 2026-10-24This item introduces a comparison site for LLM benchmarks and token prices, handy for indie developers looking to choose the right models.

- [I built a site to compare LLM benchmarks, token pricing, and VRAM requirements in one place](/nieuws-modellen-prijzen#i-22e11e742f) · [source: Reddit](https://www.reddit.com/r/OpenAI/comments/1xejs8i/i_built_a_site_to_compare_llm_benchmarks_token/) · 2026-10-24This item introduces a comparison site for LLM benchmarks and token prices, handy for indie developers looking to choose the right models.

## Repos, releases & updates

- [Thought for Bridgeplay](/nieuws-repos-releases#i-31292b75c1) · [source: GitHub](https://github.com/raymondchins/Bridgeplay/issues/727) · 2026-10-24This item refers to 'Thought for Bridgeplay', relevant for indie developers exploring specific technical integrations.

- [r/open source just banned AI, non-English speakers and more](/nieuws-repos-releases#i-b366ba776f) · [source: Hacker News](https://www.theverge.com/ai-artificial-intelligence/1018217/reddit-opensource-ai-ban) · 2026-10-25This item reports that r/open source has banned AI and non-English speakers, which is relevant for indie developers using open-source platforms.

- [CowAgent – Open-Source Super AI Assistant](/nieuws-repos-releases#i-f85cc39c3d) · [source: Hacker News](https://cowagent.ai/en/) · 2026-10-24This item introduces CowAgent as an open-source super AI assistant, useful for indie developers looking for open-source tools.

- [the fastest growing GitHub repos in finance + AI this week: 1. Kronos (+2,653 ★) open source foundation model for candlestick charts, traine](/nieuws-repos-releases#i-f6f9a150f8) · [source: X](https://x.com/gusik4ever/status/2114001885413716163) · 2026-10-24This item showcases fast-growing open-source AI repos in finance, interesting for indie developers building financial applications.

## Funding & market

- [AI startup raises $1B in Series A, accelerating growth A one-year-old AI company reportedly raised $1 billion in Series A funding. https://a](/nieuws-financiering-markt#i-6ae789f3ca) · [source: X](https://x.com/ainews_page/status/2114176876784537770) · 2026-10-25This item mentions an AI startup raising $1 billion in a Series A, providing insight into market funding for indie developers.

- [The startup playbook is changing. Earlier: Hire 20 people. Raise funding. Build for 12 months. Now: Build with AI Launch in weeks Find payin](/nieuws-financiering-markt#i-d787262bfd) · [source: X](https://x.com/Neelshah317/status/2114441459642638719) · 2026-10-25This item describes a new startup strategy involving faster building with AI, relevant for indie developers looking to launch quickly.

- [SWEDISH AI startup Legora valued at $8.8 billion in new $550 million funding round | Reuters](/nieuws-financiering-markt#i-d613a8bf84) · [source: Reddit](https://www.reddit.com/r/EU_Economics/comments/1xc11bs/swedish_ai_startup_legora_valued_at_88_billion_in/) · 2026-10-21This item reports an $8.8 billion valuation for a Swedish AI startup, relevant for indie developers to track market trends.

- [⚠️ warning: global venture funding hit $159B in q3 2026 and ai took about 64% of it (tech startups, oct 23). almost two of every three start](/nieuws-financiering-markt#i-7cdb761829) · [source: X](https://x.com/nayankmishra/status/2114009203413000399) · 2026-10-24This item shows that AI receives a large share of global venture capital funding, useful for indie developers to understand the investment market.

[← October 25, 2026](/en/nieuwsbrief-2026-10-25) · [Archive](/en/nieuwsbrieven)