Pinned Tweet
Executor is joining the YC S26 batch!
We're building an open source MCP gateway to connect any agent to any service
Your team is constantly spinning up new agents, trying out new tools, wrangling multiple accounts. You need one place to configure everything once, and use them anywhere.
Executor gives you the ability to connect your agents to thousands of tools in a way that keeps you in control. Giving agents access to production services and data should be easy and predictable
Since launching the beta we've:
- Shipped a self-hostable Docker version
- Shipped a desktop app
- Shipped setup by chatting with your agent
- Shipped multi-account support
- Hit 2,000 GitHub stars
- Built a product loved by thousands of users
Truly appreciate all of the early support on it, has been incredible seeing all the ways people use it
There's so much to build here. The past month has been laying the foundation. Now that that's in place, next up is custom tools, generative UI, and workflows.
Setting it up is as easy as asking your agent "help use executor.sh". Incredibly excited about what's next, let me know all your feedback!
somehow signing in to chase.com on a muse browser has become 'endangering the entire global financial system'
the plot has been lost
can we move on from api keys now
the whole point of agents existing is that they make our life easier, pick a standard, adopt it - this should've been done months ago
this, at this point just use Alchemy + Cloudflare or AWS
your agent can get you the experience you're used to just defined as code
Look guys if you’re building something on a cloud platform and you don’t want to get owned at some point you have like 4 real options
AWS
Azure
Cloudflare
GCP
You should not trust key infra to a neocloud
Neoclouds may get you faster performance on something like S3 but they just can’t match the availability, durability, and security of a “real” cloud
They don’t and can’t design for as many nines
There's a new version of this post
Thankfully I think that’s about it for the security vulnerabilities and we probably won’t find any more
If you self host software, you really should put it behind either Cloudflare or Vercel’s firewall
The firewall rules & data they have on how people try to run exploits are so critical right now
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
This is cool
🔒 Prevent unauthorized data exfiltration with connection allowlists → goo.gle/4y7rYgp
Third-party scripts or AI-generated code can bypass app-level checks to send sensitive information to unauthorized servers. Connection allowlists give you explicit control over network requests by making the browser the gatekeeper of all network connections originating from your page.





















