News and Tech Update

Posts

From API Integration to Agent Governance: What Backend Teams Need to Know About MCP

Many MCP projects begin with an existing API and a simple request: expose one backend capability to an LLM client. The quickest route is to wrap an endpoint as a tool and connect it to Claude or another MCP host. Users can then ask for data in natural language instead of navigating a fixed interface. This creates a production boundary because the model, rather than application code, chooses which operation to call. At Fullinfo, more than 1 million company profiles are served through a GraphQL backend on AWS AppSync. Users previously searched a portal and worked with the results using deterministic flows. With MCP, a user can ask, “Find SaaS companies in Germany with 50-200 employees,” and receive structured records in the conversation. The wrapper was straightforward in TypeScript and Go, but defining the model’s authority required more work. What Changes With MCP Governance? Existing API controls still apply, but they no longer cover the full decision path. A chang...

Shift Left Security: 4 Automated Security Gates in GitHub Actions

A security researcher filed a report against our Node.js API two years ago. The vulnerability was prototype pollution in an npm package we had been shipping for eight months. The fix took about 20 minutes. The internal review to figure out how it got through took two days. The package had a known CVE. It had been sitting in the NVD for months before we found it. Our CI never checked. Code review didn’t catch it. The researcher did. There’s a stat from IBM’s Cost of a Data Breach 2024 report that I keep referencing when this comes up: The average breach costs $4.88 million. Teams running DevSecOps practices save $1.68 million from that cost on average. The number I actually find more useful is smaller. A vulnerability caught in CI costs about $80 to fix. Caught in production, the same costs $7,600. That gap is why this article exists. Four automated security gates wired into GitHub Actions, running on every push and pull request — none of them require an enterprise license: Gate 1:...

N. Korea Group Behind Multiple Open Source Supply-Chain Attacks: Amazon

Amazon’s recent report attributing a series of compromises of open source software libraries to a North Korea-backed threat group encapsulates many of the expanding cyber risks increasingly facing developers, from the growing use of generative AI by bad actors and targeting of code repositories to financially focused attacks by nation-state hackers and the abuse of trust by development teams. It also is the latest report to point to the group – known by such names as Sapphire Sleet, Stardust Chollima, BlueNoroff, CageyChameleon, and Alluring Pisces – linked to the Democratic People’s Republic of Korea (DPRK) to supply chain attacks over the past couple of years that involve placing malicious code into packages in the npm repository. “When an attacker compromises a widely used open source package, every organization that depends on that package is potentially affected,” CJ Moses, CISO of Amazon Integrated Security, wrote in the report , adding that they have “observed the volume and s...

Common Risks of Outsourcing Software Development, and How to Tackle Them

Both SMBs and large enterprises often choose software development outsourcing over developing software in-house. It is no surprise, as partnering with external developers enables companies to bridge IT talent gaps that cannot be filled internally, avoid time-consuming recruiting and training processes, and eliminate expenses associated with salaries and benefits, eventually accelerating software delivery and reducing development costs. While software development outsourcing can be highly advantageous from the business perspective, it also introduces various risks, ranging from diminished project control to provider lock-in and security-related issues. Managing these risks proactively is critical to preventing them from escalating, minimizing their impact on the project timeline, budget, and software quality, and ensuring smoother project execution. In this article, experts from Itransition, an outsourcing partner with over 25 years of experience, outline common risks of outsourcing ...

Ten Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Dice Booz Allen Hamilton McLean, VA DevOps Engineer $77,600 to $176,000 Alarm.com Centennial, CO DevOps Engineer $120,000 to $130,000 HarbourVest Partners Boston, MA DevOps Engineer $135,00...

Microsoft Confirms Copilot ‘Super App’ Is Coming This Year — and It’s About More Than Convenience

Microsoft is finally admitting what many IT teams already knew: It has too many Copilots. CEO Satya Nadella confirmed on the company’s fiscal Q4 2026 earnings call, held July 29, that Microsoft is folding its scattered Copilot experiences into a single app. The move will merge chat, coding, the Cowork research tool, and Microsoft’s autonomous agents, called Autopilots, into one place, spanning both consumer and business use. “Copilot is evolving rapidly from chat to Cowork to Autopilots,” Nadella said. “This quarter, we are bringing these Copilot experiences together, including code, in one super app. This is a major step forward, and I look forward to sharing more soon.” That’s a real commitment, not a rumor. Nadella attached a timeframe, not a date. He named the four pieces going into the merged app but did not say whether it replaces Microsoft’s existing standalone Copilot apps or runs alongside them. Pricing, feature scope and rollou...