The Hidden Cost of Validating AI-Generated Code
For a 50-developer team operating at agentic pace, validation-related delivery costs can approach $900K a year.
Operations | Monitoring | ITSM | DevOps | Cloud
The Place Where Modern Operations & Technology Come Together
The latest News and Information on Continuous Integration and Development, and related technologies.
What is a remote MCP server?
As development shifts toward agentic workflows, an AI agent is only as capable as the systems it can reach. Local MCP servers allow desktop CLI and IDE agents to execute multi-step tasks on your machine. But remote MCP servers (also called hosted MCP servers) extend that reach to cloud-based and background agents, allowing an agent running in a web browser, a CI runner, or a backend service to access external tools over HTTP without needing a developer’s machine running local child processes.
A Step-by-Step Guide to Feature Flag Implementation in CI/CD Pipelines | Harness Blog
Engineering teams often deploy code much faster than they can safely release new features to users. This gap can create risks if releases skip testing, approvals, or gradual rollouts. Feature flags help by separating deployment from release, so you can ship code continuously and control which features users see through configuration.
Why Model Routing Backfires and How to Build Agents That Don't Burn Your Budget
Model routing promises to cut your AI agent spend by offloading routine tasks to cheaper models like Claude Haiku while reserving frontier models like Claude Sonnet for complex reasoning. In the right configuration, routing strategies can reduce inference costs by 40–85%. But if you implement routing incorrectly in a multi-turn agent, you can end up paying more than if you’d never routed at all. Here’s why and how to fix it.
Guardrails for shipping with AI agents, feat. Luca Rossi of Refactoring.fm
Code review has always been a time sink. AI just makes the dysfunction undeniable. Luca Rossi, founder of Refactoring.fm and builder of the open source tool Tolaria, has been running one of engineering's most-read newsletters for five years, with over 170,000 subscribers. He's also been doing what a lot of engineering leaders talk about but rarely do: building a real product with AI agents to pressure-test what's actually possible today.
The secure path should be the default path - nothing more
Asking developers to take extra steps to pull securely is a policy that won't hold. The only approach that scales is making the private registry the default – a buffer between the developer and public registries that applies policy automatically at the global level. No extra steps, no security theater, no cognitive overhead at the point of pull. Automation and global policy configuration are what turn good intentions into a default secure posture.
CRA turns software trust from assumed to legally required
For years, buying software meant trusting the vendor. The Cyber Resilience Act changes that relationship by codifying what vendors must do – auditing dependencies, confirming exploitable vulnerabilities, and enforcing security best practices – as legal obligations, not internal choices. For customers, that means software safety is no longer a matter of brand reputation. For vendors, it means governance gaps that were once internal concerns are now deal blockers.
Bitbucket Tests now supports tracking tests from multiple branches
Tracking tests on non-default branches was one of the most requested capabilities during the Bitbucket Tests (beta). We heard you, and today, we’re shipping it. Most teams don’t ship from main. Integration happens on develop, stabilisation on staging, releases cut from release. Until now, Bitbucket Tests only tracked the tests from default(main) branch, leaving the branches that actually matter invisible. Multiple branch tracking in Tests changes that.
Feature Flag Security in your CI/CD Pipeline | Harness Blog
Incorporating robust security measures into feature flag management is critical to protecting sensitive data and maintaining compliance. Harness FME security features, like remote evaluations in Thin SDKs and governed AI flag cleanup, let you practice security by design and standardize solid security practices across your teams.
How to Use JFrog CLI Without Editing Your CI Scripts
Using JFrog CLI used to come with a catch. To run a build through it, you had to put it in front of the command. For example, jf npm install instead of npm install or jf mvn package instead of mvn package per the example below: npm install → jf npm install mvn package → jf mvn package Doing that once is easy enough.