In Praise of "Normal" Engineers
28 by zdw | 11 comments on Hacker News.
Thursday, June 19, 2025
New top story on Hacker News: Show HN: EnrichMCP – A Python ORM for Agents
Show HN: EnrichMCP – A Python ORM for Agents
21 by bloppe | 0 comments on Hacker News.
I've been working with the Featureform team on their new open-source project, [EnrichMCP][1], a Python ORM framework that helps AI agents understand and interact with your data in a structured, semantic way. EnrichMCP is built on top of [MCP][2] and acts like an ORM, but for agents instead of humans. You define your data model using SQLAlchemy, APIs, or custom logic, and EnrichMCP turns it into a type-safe, introspectable interface that agents can discover, traverse, and invoke. It auto-generates tools from your models, validates all I/O with Pydantic, handles relationships, and supports schema discovery. Agents can go from user → orders → product naturally, just like a developer navigating an ORM. We use this internally to let agents query production systems, call APIs, apply business logic, and even integrate ML models. It works out of the box with SQLAlchemy and is easy to extend to any data source. If you're building agentic systems or anything AI-native, I'd love your feedback. Code and docs are here: https://ift.tt/krfJAq4 . Happy to answer any questions. [1]: https://ift.tt/krfJAq4 [2]: https://ift.tt/DNv3enU
21 by bloppe | 0 comments on Hacker News.
I've been working with the Featureform team on their new open-source project, [EnrichMCP][1], a Python ORM framework that helps AI agents understand and interact with your data in a structured, semantic way. EnrichMCP is built on top of [MCP][2] and acts like an ORM, but for agents instead of humans. You define your data model using SQLAlchemy, APIs, or custom logic, and EnrichMCP turns it into a type-safe, introspectable interface that agents can discover, traverse, and invoke. It auto-generates tools from your models, validates all I/O with Pydantic, handles relationships, and supports schema discovery. Agents can go from user → orders → product naturally, just like a developer navigating an ORM. We use this internally to let agents query production systems, call APIs, apply business logic, and even integrate ML models. It works out of the box with SQLAlchemy and is easy to extend to any data source. If you're building agentic systems or anything AI-native, I'd love your feedback. Code and docs are here: https://ift.tt/krfJAq4 . Happy to answer any questions. [1]: https://ift.tt/krfJAq4 [2]: https://ift.tt/DNv3enU
Wednesday, June 18, 2025
New top story on Hacker News: Show HN: Free local security checks for AI coding in VSCode, Cursor and Windsurf
Show HN: Free local security checks for AI coding in VSCode, Cursor and Windsurf
11 by jaimefjorge | 5 comments on Hacker News.
Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40% of Copilot’s outputs were buggy or exploitable [1]. Other surveys mention that people are spending more time debugging AI-generated code [2]. That's why we created “guardrails” to catch security problems early. Codacy Guardrails uses a collection of open-source static analyzers (like Semgrep and Trivy) to scan the AI’s output against 2000+ rules. We currently support JavaScript/TypeScript, Python, and Java, focusing on things like OWASP Top 10 vulns, hardcoded secrets, dependency checks, code complexity and styling violations, and you can customize the rules to match your project’s needs. We're not using any AI models, it's “classic” static code analysis working alongside your AI assistant. Here’s a quick demo: https://youtu.be/pB02u0ntQpM The extension is free for all developers. (We do have paid plans for teams to apply rules centrally, but that’s not needed to use the extension and local code analysis with agents.) Setup is pretty straightforward: Install the extension and enable Codacy’s CLI and MCP Server from the sidebar. We’re eager to hear what the HN community thinks! Does this approach sound useful in your AI coding workflow? Have you encountered security issues from AI-generated code? We hope Codacy Guardrails can make AI-assisted development a bit safer and more trustworthy. Thanks for reading! Get extension: https://ift.tt/9NPSfF5 Docs: https://ift.tt/pFMPGSg... Sources [1]: NYU Research: https://ift.tt/x0bYnVw... [2]: https://ift.tt/a8k3Fs0...
11 by jaimefjorge | 5 comments on Hacker News.
Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40% of Copilot’s outputs were buggy or exploitable [1]. Other surveys mention that people are spending more time debugging AI-generated code [2]. That's why we created “guardrails” to catch security problems early. Codacy Guardrails uses a collection of open-source static analyzers (like Semgrep and Trivy) to scan the AI’s output against 2000+ rules. We currently support JavaScript/TypeScript, Python, and Java, focusing on things like OWASP Top 10 vulns, hardcoded secrets, dependency checks, code complexity and styling violations, and you can customize the rules to match your project’s needs. We're not using any AI models, it's “classic” static code analysis working alongside your AI assistant. Here’s a quick demo: https://youtu.be/pB02u0ntQpM The extension is free for all developers. (We do have paid plans for teams to apply rules centrally, but that’s not needed to use the extension and local code analysis with agents.) Setup is pretty straightforward: Install the extension and enable Codacy’s CLI and MCP Server from the sidebar. We’re eager to hear what the HN community thinks! Does this approach sound useful in your AI coding workflow? Have you encountered security issues from AI-generated code? We hope Codacy Guardrails can make AI-assisted development a bit safer and more trustworthy. Thanks for reading! Get extension: https://ift.tt/9NPSfF5 Docs: https://ift.tt/pFMPGSg... Sources [1]: NYU Research: https://ift.tt/x0bYnVw... [2]: https://ift.tt/a8k3Fs0...
Tuesday, June 17, 2025
Monday, June 16, 2025
New top story on Hacker News: Show HN: Trieve CLI – Terminal-Based LLM Agent Loop with Search Tool for PDFs
Show HN: Trieve CLI – Terminal-Based LLM Agent Loop with Search Tool for PDFs
16 by skeptrune | 0 comments on Hacker News.
Hi HN, I built a CLI for uploading documents and querying them with an LLM agent that uses search tools rather than stuffing everything into the context window. I recorded a demo using the CrossFit 2025 rulebook that shows how this approach compares to traditional RAG and direct context injection[1]. The core insight is that LLMs running in loops with tool access are unreasonably effective at this kind of knowledge retrieval task[2]. Instead of hoping the right chunks make it into your context, the agent can iteratively search, refine queries, and reason about what it finds. The CLI handles the full workflow: ```bash trieve upload ./document.pdf trieve ask "What are the key findings?" ``` You can customize the RAG behavior, check upload status, and the responses stream back with expandable source references. I really enjoy having this workflow available in the terminal and I'm curious if others find this paradigm as compelling as I do. Considering adding more commands and customization options if there's interest. The tool is free for up to 1k document chunks. Source code is on GitHub[3] and available via npm[4]. Would love any feedback on the approach or CLI design! [1]: https://www.youtube.com/watch?v=SAV-esDsRUk [2]: https://ift.tt/ZKCFfyY [3]: https://ift.tt/uUJ4k0M... [4]: https://ift.tt/jYIOsxL
16 by skeptrune | 0 comments on Hacker News.
Hi HN, I built a CLI for uploading documents and querying them with an LLM agent that uses search tools rather than stuffing everything into the context window. I recorded a demo using the CrossFit 2025 rulebook that shows how this approach compares to traditional RAG and direct context injection[1]. The core insight is that LLMs running in loops with tool access are unreasonably effective at this kind of knowledge retrieval task[2]. Instead of hoping the right chunks make it into your context, the agent can iteratively search, refine queries, and reason about what it finds. The CLI handles the full workflow: ```bash trieve upload ./document.pdf trieve ask "What are the key findings?" ``` You can customize the RAG behavior, check upload status, and the responses stream back with expandable source references. I really enjoy having this workflow available in the terminal and I'm curious if others find this paradigm as compelling as I do. Considering adding more commands and customization options if there's interest. The tool is free for up to 1k document chunks. Source code is on GitHub[3] and available via npm[4]. Would love any feedback on the approach or CLI design! [1]: https://www.youtube.com/watch?v=SAV-esDsRUk [2]: https://ift.tt/ZKCFfyY [3]: https://ift.tt/uUJ4k0M... [4]: https://ift.tt/jYIOsxL