Popcorn
Show HN: Popcorn – An open-source browser cloud that runs inside TEEs
Hope, 1-on-1 AI Tutor for kids Grades 2-10 learning math
Hey HN! My friend and I have been working for the last 3 months on HOPE, a platform that provides students with 1 on 1 math support to improve their confidence and teach them by doing and asking questions. We would really appreciate anyone who's down to try it out with their kids and give their thoughts.
mcp-use v2 rebuilt from scratch for stateless 2026-07-28 MCP spec
Hi HN, Luigi here. We maintain mcp-use an open-source TypeScript framework for building MCP servers and MCP Apps: https://github.com/mcp-use/mcp-use MCP is now (finally) stateless so we rewrote mcp-use v2 from scratch for the 2026-07-28 MCP spec revision: https://blog.modelcontextprotocol.io/posts/2026-07-28/ Thanks to the rebuild: - Throughput: +27% → from 8,615 to 10,982 median ops/sec - Cold launch: 2.2x faster → from 151.6 ms to 68.1 ms - Clean install: 82% smaller → from 404.6 MiB to 74.4 MiB Benchmark with methodology here: https://github.com/mcp-use/mcp-use/blob/main/benchmark.md What changed in the spec: 1. No more sessions. The initialize/initialized exchange and the Mcp-Session-Id header are gone (SEP-2575, SEP-2567). Every request carries its own protocol version, client identity, and capabilities in _meta. Server discovery is an optional server/discover RPC instead of a mandatory round trip. 2. Multi round-trip requests replace server-initiated calls (SEP-2322). Now the server returns resultType: "input_required" with a requestState, and the client retries the original call with inputResponses. Mid-call user confirmations no longer need a live connection. 3. Header-based routing (SEP-2243). Mcp-Method and Mcp-Name are now required HTTP headers, so gateways, rate limiters, and WAFs can route and meter without parsing the JSON body. 4. Cacheable list results (SEP-2549). 5. Auth hardening: DCR still works but is deprecated in favor of CIMD and will be removed in a future spec revision. 6. Roots, sampling, and logging are deprecated with a 12mo window. 7. Legacy HTTP+SSE gets a one year offramp. Regarding mcp-use, we are focused on MCP apps for Claude connectors and ChatGPT plugins. MCP apps use an MCP extension called ext-apps, which allows tools to return UIs that render in chats. What we support: - Views have HMR, so they hot reload while you develop. - Standard Schema validators for tool and prompt I/O, so Zod, ArkType, Valibot all work. Or any validator library backed by standard schemas. - Drop-in OAuth integrations for Auth0, Clerk, WorkOS, Better Auth, Supabase, and Keycloak. - Server composition (proxy and mount other MCP servers). - OpenAPI import and expose your APIs as an MCP server. The HTTP layer is Hono so it mounts inside an existing app, so you can have edge deployments. If your product is in Next.js, we’ve seen a lot of developers who want to get rid of the (basically unmaintained) mcp-handler. So we have a drop-in integration for Next.js: wrap `next.config.ts` in `withMcpUse` for view compilation then `export const { GET, POST, DELETE, OPTIONS } = createNextHandler(server)` from a catch-all route. For DX: - MCP inspector built-in: `mcp-use dev` runs it at `/mcp/inspector` with hot-reload. We also have a hosted version: https://inspector.manufact.com/inspector - mcp-use CLI has a cool headless feature to debug MCP servers and the UI parts from coding agents including visual feedbacks: `mcp-use client <name> screenshot --tool <tool>` renders the View headlessly through Chrome. An agent can call a tool, read the failure, then screenshot the UI it just generated and look at what it built. Unfortunately we could not avoid some breaking changes. The good news is 90% of MCP servers built with v2 are compatible with both versions of the MCP spec. Clients negotiate the version automatically, probing with server/discover and falling back to old initialization for legacy servers. Interested in what people running MCP servers think about the stateless move, especially anyone who built their own session layer and now gets to delete it. Blog post with the details: https://manufact.com/blog/mcp-use-v2 If you want to play with mcp-use v2, it just went out of beta: https://github.com/mcp-use/mcp-use We’d love to hear what you think of it and how we can improve it! We are happy to answer any questions and look forward to your comments.
Science for Kids
There’s a really good kids’ science magazine called Oyla, but it’s aimed at kids 12+ I subscribed a couple of years ago thinking that it would be fine for my son (then 8yo, but an advanced reader) but, even now (10yo), the articles are too dense for him and don’t hold his interest. Last year, the same company launched ‘Oyla Junior’ aimed at younger kids ~8yo. But I read a couple of the articles and I think they’re too oversimplified. I wanted something in between, but didn’t find anything suitable online. So I used AI to create something, and did a bunch of iterations to tune the sentence length, the flow of the articles, how much info is introduced in each paragraph etc. I still want to make it better, but it’s already good enough for my son to read.
Silo
Show HN: Silo – S3-compatible object storage, a maintained fork of MinIO
I spent 2 years designing a mechanical Magic Keyboard
Hi HN, today I’m revealing Altar II, an ultra-low profile (4.75mm) mechanical keyboard designed to replace your Magic Keyboard. It’s the keyboard I wish Apple made. Altar II has fully mechanical switches, plus a magnetically detachable dial, haptic feedback, a red backlight, and a native macOS companion app. I’m a heavy Mac user and I feel that Apple hasn’t given its keyboards the attention they deserve, in terms of hardware, software, and features, so I set out to try and change that. It was a massive undertaking and it has taken almost 2 years to get to this stage. One of the main obstacles was fitting a reasonably sized battery into the chassis, and aggressive power profiling without messing with the user experience. Another issue was we couldn’t fit any components on the underside of the PCB because there was literally no space to do so (and there are a lot of components). Around 4 years ago I posted my first keyboard to HN (https://news.ycombinator.com/item?id=32507172). Its response blew me away and ultimately led to me quitting my job and making and selling keyboards full time. I’ve taken some of the feedback from that original post and incorporated it into Altar II (e.g. the detachable dial). I’ll be around to answer any questions. Please let me know what you think, I’d love to get some feedback.
Spltty
I built Spltty, a Ruby CLI for tracking shared expenses, custom splits, and settlements using plain Markdown files. The article explains how it evolved from a Claude-managed folder into a CLI
ClickBench Playground
I created it mostly for testing and exploration, but the main reason was that it became possible after previous work.
Hyperprobe
Hi HN, this is Shailendra and Karan here. We are building a fast and safe way for coding agents to debug issues live in production. When prod breaks, it lets Cursor, Claude, and others drop virtual breakpoints or probes safely in your running code, and extract the exact variable values that logs don’t have. All this saves time and effort for engineers who’d otherwise dig through logs and traces or redeploy with console.logs or print statements until they find the root cause. Here is the link to the video that explains this: https://www.youtube.com/watch?v=ivV7I--ta5c Agents write most of our code now. This shrinks the useful context engineers need to debug AI written code, a problem not helped by the limited telemetry added in the same code by AI. So when something breaks in prod, the first instinct for an engineer is to open logs or throw them to your agents. But if the line you are looking for is not there, agents will start guessing the root cause on non-existent data, forcing you to add a log, and redeploy. This analysis-inference loop of agents with existing data does not come cheap, burning a lot of tokens. And the add log, redeploy cycle is so slow and painful that it makes engineers hate on-call. Our approach lets agents capture telemetry on-demand at the exact moment and point of failure, killing the log-redeploy cycle and getting the most accurate RCA while burning fewer tokens. The obvious problem is making it work on a running service. You can't pause a live service the way you'd pause a debugger on your laptop. Getting the value out of a running process safely, without pausing a thread or slowing the host is the challenge.We are making this happen. Before this I ran engineering at a 100 member team. Then Karan and I spent three years on HyperTest which was a testing tool. At HyperTest, we turned production traffic into integration tests using OpenTelemetry. That was production instrumentation too. The hard parts of pulling real runtime state out of a running service without breaking it, were the hard parts we learnt to put together. We learnt some other lessons the hard way too. HyperTest tried to prevent bugs with better tests, and adoption was a fight every time. Calls kept getting cancelled because teams were firefighting production. Testing was hygiene. Broken prod was hair on fire. This made us see where priorities lie. This seeded the idea of building a truly autonomous on-call agent i.e. one that takes an alert, probes, diagnoses and fixes it in a few minutes. But this is how it works as of now: You talk to your coding agent the way you already do. Tell it what's wrong: "checkout returns 200 but some users are seeing their order fail, find out why." It locates the line in your local code, connects to us over MCP, and drops a probe on that line in the running service. The probe is read-only and sits dormant until real traffic hits. When hit, it captures the local variables at every frame of the call stack at that exact moment. It hands them to the agent, which diagnoses with real data. There are two pieces. An SDK that runs inside your service, and an MCP server your coding agent talks to. The SDK is what makes setting probes (virtual breakpoints, log or metric) possible without a redeploy. In Node and Python it hooks in-process. In Java it attaches as a JVM agent, instrumenting at the bytecode level. Either way the service keeps running and serving traffic. Nothing pauses. When your agent wants to look at a line, it calls the MCP server, which tells the SDK to place a probe there. When a request hits the line, the SDK captures what the probe asked for, sanitizes it in-process, and streams it back to the agent via the MCP. This can run inside prod, so a probe can read any value sitting in that variable. We ensure redaction happens in-process, inside your own container's memory. This is before anything goes on the wire. Keys like password, token, authorization, ssn and credit card are redacted by default and you add your own. Also the probes read but never write, and if you want no captured state to ever leave your network you can self host the server, broker, and even the database in your infra. On overhead: when idle, the SDK adds negligible memory and effectively nothing to throughput and response time. Probes only cost anything while actively capturing. Also captures are bounded. A separate monitor watches in real time and pulls every active probe if overhead ever spikes. Every log-and-trace tool hands the agent data that already exists and asks it to reason backward to what probably happened. We think it is more useful to give agents eyes and ears into the running code, so they capture what they need when they need it, right at the point of failure. This seems like the simplest and fastest way to debug prod incidents. We’d love the community to try this in any environment to debug any known or unknown issue by just chatting with your coding agent. And let us know what more features you need to make this a truly autonomous on-call agent Supported platforms: NodeJs, Java, Python.
Diffing Binary Files
My partner reviews a lot of P&IDs (piping and instrumentation diagrams) and the adjacent files involved (excel, docx, pdfs, acd/l5x, etc). In his company, these are usually done in Bluebeam. It's really hard to see the diff + keep track of all the revisions resulted by these iterations. They end up storing files like "rev3_final_redlined.pdf". We've been looking for something close to Github to do these reviews, but haven't found one easy enough for folks with no CLI experience to understand and use (happy to check out more tools if you know any). So I built withkord.com to help with revisioning and diffing binary files. Any feedback is welcome.
Modern Browsers Don't Need the Cookie Anymore
Show HN: Modern Browsers Don't Need the Cookie Anymore
AuditBadger
Hi, Wanted to share something I've been working on for over a year. AuditBadger is a compliance management platform that uses AI to write policies (there are underlying "templates" with basic requirements), rewrite controls (or trust service criterions) to match the company context, help figure out your own controls, does initial risk assessment, and business continuity planning (which at least gives you an example of how the process should look like). Fun fact - I wanted to share this a year ago, but then I spotted something similar here. The most common comment was about lacking the SOC 2 report, so I decided to pick the fight. I got SOC 2 Type I first, and then recently finished SOC 2 Type II using the tool alone. It took some time - both learning the process, the SOC 2 gotchas, and implementing automatic evidence collection. We're now adding support for the European AI Act and NIS 2; HIPAA is already there (though it requires me to explicitly enable it for customers who want to test it), and CyberEssentials and ENS are coming later this year. The platform is now complete, but my business partner (ISO 27001 Lead Auditor) and I are still dog-fooding it. Everything we build is either based on our own pain points or our customers'—most of them joined our Slack where we try to help them if they get stuck. If you have any questions, I'll be happy to answer them all.