MCP Tool Sprawl, a Claude-Targeting NPM Supply-Chain Attack, and Local Model Speedups

Today's findings

1. #1 MCP tool-selection accuracy craters past ~20 tools — and retrieval only fixes 23% of itpaper

   Agent tool-selection accuracy visibly degrades once an MCP server exposes more than ~20 tools, and RAG-style retrieval filtering caps out fixing only about 23% of those failures.

   MCP Tool Selection

   23% Fix Ceiling

   23%

   of tool-selection failures fixed by retrieval

   ~20 tools

   Accuracy craters beyond this threshold

   77%

   of failures remain unfixed

   Keep active MCP tool counts low; retrieval has a hard ceiling.

   Why it matters: If you're wiring multiple MCP servers into Claude Code or a custom agent, this explains silent tool-call misfires and shows the common fix (retrieval over the tool catalog) has a hard ceiling.

   How to apply: Read RAG-MCP (arXiv:2505.03275) and the newer attention-segment failure analysis (arXiv:2606.16364); keep active MCP tool counts per agent low and scope tools per task rather than relying solely on retrieval filtering.

   mcpagentstool-use

   Read more: Where MCP tool-selection actually breaks: retrieval-based fixes cap at ~23% of failures

2. #2 NPM supply-chain attack harvested Claude Desktop and Cursor credentialstip

   Compromised Jscrambler NPM packages (8.14.0–8.20.0) used an undocumented preinstall hook to run a Rust infostealer that specifically hunts for Cursor and Claude Desktop API keys.

   Supply-Chain Attack

   high

   Jscrambler NPM packages 8.14.0–8.20.0 deploy Rust infostealer targeting AI-tool keys

   8.14.0–8.20.0

   Affected version range

   Rust infostealer

   Undocumented preinstall hook

   Cursor & Claude Desktop

   Targeted API keys

   affected scopeDevelopers using Jscrambler in affected range

   high severity — badge colour grades the risk

   Upgrade to 8.22.0+ and audit npm install history.

   Why it matters: npm lifecycle scripts execute with full local developer permissions — this is a documented, live case of malware targeting AI-tool credentials specifically.

   How to apply: Upgrade any Jscrambler dependency to 8.22.0+, audit `npm install` history for the affected version range, and consider `--ignore-scripts` policies for dev/CI environments.

   securitysupply-chainclaude

   Read more: The AI Workspace Hijack: Anatomy of the Jscrambler NPM Attack

3. #3 Burn-rate circuit breaker catches silently degrading agentstechnique

   An open-source, zero-dependency circuit breaker auto-demotes an agent to propose-only mode when its failure rate burns past 2x its own historical baseline.

   TECHNIQUE

   Burn-Rate Circuit Breaker

   bounded capability

   Autonomous Agent Actions

   monitor Trailing failure rate

   limit 2x historical baseline

   revoke Demote to propose-only

   Auto-demotes agent when current failure rate exceeds 2x its own baseline.

   Why it matters: Per-call guardrails catch obviously bad outputs but miss an agent whose judgment is slowly drifting while every individual output still passes checks.

   How to apply: Track each agent's trailing failure-rate baseline; when the current window's ratio exceeds 2x that baseline, gate the agent to human-approved proposals instead of autonomous actions.

   agentsreliabilityobservability

   Read more: I built a burn-rate circuit breaker for LLM agent fleets: each agent judged against its own baseline, auto-demoted to propose-only on drift (zero-dep OSS + interactive demo)

4. #4 A parenthesis in your folder path silently breaks Claude Cowork's Write/Edit toolstip

   A single `(` or `)` anywhere in a connected folder's full path makes Cowork's Write/Edit tools fail with a "protected location" error while Read/Glob/Grep keep working fine.

   Claude Cowork Bug

   A single `(` or `)` in folder path breaks Write/Edit but not Read/Glob/Grep

   Write / Edit

   • Fails with 'protected location' error
   • Silent failure — no warning before use

   vs

   Read / Glob / Grep

   • Works normally
   • No error, no interruption

   One parenthesis in any path segment causes asymmetric failure — writes break, reads don't.

   Check every segment of the connected folder's full path for parentheses if Write/Edit tools are blocked.

   Why it matters: The failure mode is misleading — file access appears to work, only writes silently fail — and can cost real work before the cause is found.

   How to apply: If Cowork blocks Write/Edit with a protected-location error, check every segment of the connected folder's full path for parentheses and rename/move it to remove them.

   claudedebugging

   Read more: A single parenthesis in your folder path can silently break Claude Cowork's Write/Edit tools — here's the fix

5. #5 "Verbalized sampling" prompt trick cuts LLM mode collapse (ICML 2026)paper

   Rephrasing prompts using a "verbalized sampling" pattern measurably increases output diversity and reduces mode collapse, no fine-tuning required.

   Why it matters: Repetitive, samey completions are a common pain point for brainstorming, synthetic data, and creative generation tasks — this is a prompt-only fix.

   How to apply: Read arXiv:2510.01171 and try their verbalized-sampling prompt pattern whenever you need more varied outputs from a single model.

   prompt-engineeringtechnique

   Read more: Prompt-engineering paper accepted to ICML [R]

6. #6 Colibri streaming port lets you run Hy3 on 10GB of (V)RAMrepo

   A community port of Colibri streaming brings large local models like Hy3 down to as little as 10GB of VRAM/RAM.

   Local LLM Tool

   Colibri streaming port lets you run Hy3 on 10GB of (V)RAM

   Colibri-Hy3

   tool Community port

   Based on Colibri streamingRecent

   GitHub

   runRun Hy3 on as little as 10GB VRAM/RAM

   Dramatically cuts hardware requirements for large local models, putting them within reach of modest single-GPU setups.

   Why it matters: Cuts hardware requirements for running larger local models dramatically, putting them within reach of modest single-GPU setups.

   How to apply: Clone github.com/ErikTromp/colibri-hy3 and follow the setup; the author recommends using system RAM over VRAM unless you have plenty of it.

   local-llmopen-sourcevram-optimization

   Read more: Colibri streaming for Hy3 (Run Hy3 on 10GB (V)RAM) · Colibri streaming for Hy3 (Run Hy3 on 10GB (V)RAM) · Colibri streaming for Hy3 (Run Hy3 on 10GB (V)RAM)

7. #7 SPEED node port gives Krea-2 a free 1.25–1.33x speeduptool

   A ported "SPEED" sampling node brings meaningfully faster generation and fewer artifacts to Forge Neo and SwarmUI users running Krea-2.

   Krea-2 Speed Optimization

   SPEED node: half-res early, full-res late

   Standard

   • All steps at full resolution

   → 1.25–1.33× faster

   SPEED

   • Early steps at half-res, then full-res

   No retraining or new models needed; install from aoleg/ComfyUI-SPEED

   Why it matters: Free speed and quality gains for existing image-gen pipelines, no retraining or new models needed.

   How to apply: Install from github.com/aoleg/ComfyUI-SPEED (SwarmNeo branch) or the original ComfyUI node; it runs early denoising steps at half-res then finishes at full-res.

   image-generationoptimizationopen-source

   Read more: SPEED node port for Forge Neo and SwarmUI speeds up Krea-2

8. #8 New GGUF inference engine brings llama.cpp-style quantization to diffusion modelstool

   An open-source command-line/Python inference engine runs quantized GGUF diffusion models (Flux 2, Klein) with as little as 8GB VRAM.

   Why it matters: Fills a real gap — there wasn't a llama.cpp equivalent for quantized image models until now.

   How to apply: Get it at github.com/Mann-E/gguf_inference; best current results are Flux Klein 4B at Q4_K_M quantization.

   ggufquantizationimage-generation

   Read more: Mann-E's Inferece Engine for GGUF models is here!

9. #9 OvisOCR2: a 0.8B local document-parsing modelrepo

   OvisOCR2 is a new sub-1B end-to-end OCR/document parser built on Qwen3.5-0.8B, small enough to run fully offline.

   Why it matters: Local document extraction without API costs or sending sensitive documents to a cloud provider.

   How to apply: Download from huggingface.co/ATH-MaaS/OvisOCR2 and drop it into existing invoice/receipt/document-parsing pipelines.

   ocrlocal-llmopen-weights

   Read more: OvisOCR2: a promising 0.8B local document parser

10. #10 GUI control panel for llama.cpp configtool

    A new open-source GUI wraps llama.cpp's llama-server flags and models.ini so you can manage local models without hand-editing config files.

    Why it matters: Lowers the friction of standing up and tuning internal local-inference boxes.

    How to apply: Check the repo linked from the r/ollama post if your team runs llama.cpp directly and wants a config UI over manual flag/ini editing.

    llama.cpplocal-llmopen-source

    Read more: I built a GUI control panel for llama.cpp so I'd stop hand-editing models.ini and llama-server flags

11. #11 Internal "workspace entropy" as a hallucination signal, tested on Qwen3-4Bpaper

    A community replication of Anthropic's Jacobian Lens work finds entropy in a model's internal verbalizable workspace can flag confidently-wrong answers better than output confidence alone, across 7 QA/reasoning datasets.

    Why it matters: Gives an open, reproducible signal for building better error-routing in eval pipelines beyond simple output-probability thresholds.

    How to apply: Review the methodology and consider adding workspace-entropy scoring as a secondary signal when routing low-confidence model answers to human review.

    interpretabilityevalshallucination

    Read more: Evaluating J-space entropy as an error predictor across 7 datasets on Qwen3-4B [R]

12. #12 Self-hosted tool trains a LoRA from a single reference photorepo

    An MIT-licensed self-hosted tool automatically curates, captions, and trains a LoRA from one reference image.

    Self-hosted LoRA tool

    From One Photo to a Trained LoRA

    1

    Input

    Single reference image

    2

    Curate

    Auto-generate dataset

    Auto-curation saves manual work

    3

    Caption

    Auto-caption images

    4

    Train

    LoRA training

    MIT-licensed, self-hosted tool automates dataset prep and training from one image.

    Why it matters: Automates the tedious dataset-curation and captioning steps of LoRA training for character/product-consistency image-gen work.

    How to apply: Check the linked repo from the comfyui post; point it at one reference image to get a trained LoRA without manual dataset prep.

    lorafine-tuningopen-source

    Read more: I built a self-hosted tool that turns one reference photo into a curated, captioned, trained LoRA — open source, MIT