← Back

Repo Pulse

Daily tracking of key repositories in agentic commerce and AI infrastructure.

💡

Weekly Insights

📋 UCP disclosure contracts and totals formalization — protocol matures for production

PR #267 extends warnings to support legal disclosure contracts, while PR #261 formalizes how order totals work. Together with last week's identity linking redesign, UCP is solidifying the boring-but-essential infrastructure for enterprise adoption. Read analysis →
🔒 OpenClaw blocks JVM, Python, and .NET environment injection vectors in exec sandbox

A critical security fix (f84a41d) blocks environment variable injection attacks that could bypass sandbox restrictions. JAVA_TOOL_OPTIONS, PYTHONSTARTUP, and DOTNET_STARTUP_HOOKS are now filtered. Read analysis →
⚡ MCP filesystem hardening continues — Windows paths, UNC handling, and root merging

A cluster of PRs (#3616, #3615, #3607) address filesystem edge cases: bare Windows drive letters, UNC path preservation, and MCP roots/CLI directory merging. Production deployments drive hardening.
📋 A2A post-1.0 spec polish — content types, enum values, and transcoding errors

The cleanup phase continues: PR #1640 fixes content type inconsistencies in examples, #1641 corrects enum values in validation errors, and #1627 addresses transcoding-related error changes. The spec is tightening.

Universal-Commerce-Protocol/ucp

⭐ 2,475 🍴 305 📋 59 open

Google's Universal Commerce Protocol — enabling AI agents to transact with businesses.

Recent Activity (Last 7 Days)

Commit

feat: extend warning to support disclosure contract (#267)

Ilya Grigorik • Merged Mar 17

Commit

feat: formalize totals contract (#261)

Ilya Grigorik • Merged Mar 17 · Analysis →

PR

feat!: redesign identity linking with mechanism registry and capability-driven scopes

amithanda • Open · Mar 15 · Analysis →

PR

feat: attestation extension for eligibility claims

douglasborthwick-crypto • Open · Mar 13

Commit

feat: eligibility claims & verification contract (#250)

Ilya Grigorik • Merged Mar 13

modelcontextprotocol/servers

⭐ 81.3k 🍴 9.9k 📋 517 open

Anthropic's Model Context Protocol server implementations.

Recent Activity (Last 7 Days)

Commit

fix(fetch): refresh uv lockfile (#3598)

Arif Celebi • Merged Mar 17

PR

fix(filesystem): merge MCP roots with CLI-provided directories instead of replacing them

flobo3 • Open · Mar 17

PR

fix(filesystem): preserve UNC paths in access validation

BillionClaw • Open · Mar 17

PR

Classify filesystem root and path validation failures

davidahmann • Open · Mar 16

Commit

fix(git): add missing argument injection guards to git_show, git_create_branch, git_log, and git_branch (#3545)

Elliot • Merged Mar 15

a2aproject/A2A

⭐ 22.6k 🍴 2.3k 📋 200 open

Google's Agent-to-Agent Protocol — enabling AI agents to communicate and collaborate.

Recent Activity (Last 7 Days)

Commit

Update CODEOWNERS (#1644)

Amye Scavarda Perrin • Merged Mar 16

Commit

docs: add WritBase to partners list (#1634)

Alex (RusDyn) • Merged Mar 16

PR

fix(spec): correct enum values in validation error example

matanweks • Open · Mar 16

PR

fix(spec): use application/json content type in Section 6 examples

matanweks • Open · Mar 16

PR

fix(spec): recent transcoding-related error changes

yarolegovich • Open · Mar 13

openclaw/openclaw

⭐ 319.6k 🍴 61.4k 📋 14,293 open

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

Recent Activity (Last 7 Days)

Commit

fix(security): block JVM, Python, and .NET env injection vectors in host exec sandbox (#49025)

Andrew Demczuk • Merged Mar 17 · Analysis →

Commit

feat(skills): preserve all skills in prompt via compact fallback before dropping (#47553)

Hung-Che Lo • Merged Mar 16

Commit

fix(hooks): pass sessionFile and sessionKey in after_compaction hook (#40781)

Jari Mustonen • Merged Mar 17

Issue

Extract GIF metadata (source URL, title) from inbound WhatsApp media

bugkill3r • Open · Mar 17

PR

fix(security): use constant-time comparison for TLS fingerprint verification

haoyu-haoyu • Open · Mar 17

Last updated: March 17, 2026 • Updated daily • View archive