0xMarioNawfal - The Roundtable Show

The Roundtable Show’s Official Account

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Alibaba open-sourced the AI code reviewer its own engineers have used for two years.

Open Code Review served tens of thousands of Alibaba developers and caught millions of code defects before it went public. 48K stars.
→ reads your changes, then the full files and the rest of the codebase for context
→ puts each comment on the exact line
→ "ocr scan" audits whole folders, even code with no git history
→ works with your own model and API key

In Alibaba's test on 200 real pull requests, it beat Claude Code on precision with the same model, using about 1/9 of the tokens. It flags fewer issues overall, by design, so you get fewer false alarms.

Install:
npm install -g @alibaba-group/open-code-review
ocr config provider
cd your-project && ocr review

Apache-2.0.
https://t.co/q5Bu1oWR9s

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Papertrade's revenue has cooled fast

→ Launch day: $25.24M
→ 24h revenue: $1.45M down to $183K in one day
→ TVL: ~$102M peak, ~$46M now (DefiLlama)

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

geo-sleuth is an open-source agent skill that estimates where a photo was taken and shows its reasoning.

→ It uses OpenStreetMap geometry, elevation-based skyline matching, sun and shadow angles, satellite tiles and street view
→ It outputs coordinates with an error radius, camera heading and an evidence image
→ The author says its examples are not accuracy on unseen photos; a blind-test set is planned
→ It works with Claude Code, Codex and Cursor; MIT licensed

Repo: https://t.co/XPd7Ntus4i

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

ECC (Everything Claude Code) is a free, MIT-licensed pack: 70+ subagents, 300+ skills and about 95 commands.

The workflow it pushes:

→ Plan first, and approve it before code
→ Failing test before the fix
→ Separate reviewers per language
→ A security scanner for your agent config (prompts, hooks, MCP, permissions)

Don't install everything. Start with the planning agent and the rules pack for your main language, try it on a small repo, then add more.

Install only from the official repo or npm packages. The repo warns that re-uploads may contain malware. Some tiers are paid.

Repo: https://t.co/xPk3fV9mGb

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Palantir-style world map. Open source.

OSIRIS is a free dashboard that puts a dozen public data feeds on one map:

→ Live flights and ships
→ Satellites and undersea cables
→ Earthquakes, wildfires and cyber-threat feeds
→ 6,000+ public traffic and open-webcam cameras
→ Optional AI analyst and 20 recon tools

Caveats: data quality varies by source, some feeds go stale, and camera coverage differs by country. The README says it's for research and education.

MIT licensed. Run it yourself.

https://t.co/b3AqsfGe4y

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

A GitHub repo maps 300+ AI agent projects across 36 categories and saves developers from spending weekends building memory, browsers and agent loops that five open source projects already did better, covering DSPy for code-based prompting, Serena for meaning-based code editing, Stagehand for web interaction, Steel Browser for sandboxed browsing, Cognee for persistent memory and Opik for agent tracing.

→ DSPy from Stanford lets you write agents as code instead of prompts
→ Screenpipe records your computer activity so agents have real context
→ Google’s ADK for building and testing full agent teams with evaluation built in
→ Free, MIT licensed, available as JSON and YAML to plug into your own tools

Repo: https://t.co/Oh1sboEUEe

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

The same Opus 5.5 prompt run 20 days apart produced noticeably different results, raising questions about whether the model has been quietly downgraded between runs.

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

GM CT ☀️

HOW IS YOUR WEEK GOING SO FAR? ☕

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

AI shopping agents just got a front door at Walmart.

While Amazon blocks agents, Walmart announced an MCP server called Agent Gateway:

→ Approved agents can search Walmart and Sam's Club inventory and buy for you
→ You don't have to share personal info or purchase history with the agent
→ Next month: a separate profile per agent in your account
→ Require approval per purchase, or pre-approve up to a spending limit

The rules: agents can't see payment details, can't act beyond what you asked, and get blocked if they break the terms.

Walmart's returns policy still applies if an agent gets it wrong.

It already works with Meta's Muse, ChatGPT and Gemini.

https://t.co/DAaJEy2Ytz

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Someone built a live 3D airport viewer for pilot students using Claude Code.

→ It shows real flights at Delhi airport, with Mumbai, Bengaluru and Hyderabad also live
→ You can follow any aircraft or sit in the cockpit
→ He says he has no CS background and describes changes to Claude in plain English
→ The site is free with no sign-up; flight data sources are listed as licensed, self-hosted and public

Site: https://t.co/ILApXmTCgp

Reddit: https://t.co/TLnNBDG8cO

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Which AI models can your computer actually run? One command tells you.

llmfit checks your CPU, RAM, GPU and memory, then ranks hundreds of open-source models by how well they'll run on your machine. 38.2K stars.
→ scores every model for fit, speed, quality and context length
→ estimates tokens per second before you download anything
→ works with Ollama, llama.cpp, MLX, LM Studio and Docker Model Runner
→ benchmark a model to get real numbers from your own machine
→ Mac, Windows and Linux

Install:
brew install llmfit
(Windows: winget install --exact --id AlexsJones.llmfit)

Then run:
llmfit

No more downloading a 20 GB model just to find out it doesn't fit.

MIT.
https://t.co/3pW73qiJlS

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Before you install that AI skill someone shared on X, scan it.

In an analysis of 31,132 AI agent skills, 26.1% contained vulnerabilities and 5.2% looked malicious.

NVIDIA open-sourced SkillSpector, the scanner it uses before publishing skills to its own catalog. 20.8K stars.
→ checks 71 attack patterns across 17 categories: prompt injection, data theft, privilege escalation, poisoned MCP tools and more
→ scans a GitHub repo, a URL, a zip or a folder
→ gives each skill a 0 to 100 risk score with a clear recommendation
→ fast scan with no AI, plus an optional deeper AI review
→ works for Claude Code, Codex and Gemini CLI skills

Install:
uv tool install git+https://t.co/qDedfYSV9B

Scan a skill:
skillspector scan ./the-skill/ --no-llm

Apache-2.0.

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Want your AI to build a page that looks like Stripe, Apple or Linear? Give it their DESIGN.md.

awesome-design-md has ready-made design files for 83 brands. Each one captures the colors, type, spacing and layout rules of a real website. 122K stars.

→ Apple, Stripe, Linear, Notion, Vercel, Airbnb, Spotify
→ Tesla, Ferrari, Nike, SpaceX, PlayStation
→ Coinbase, Binance, Kraken, Revolut, Wise
→ Claude, Mistral, ElevenLabs, Cursor, Raycast

How to use it:
1. Pick a brand at getdesign.md
2. Drop its DESIGN.md into your project folder
3. Tell your coding agent: "build me a page that looks like this"

DESIGN.md is the plain-text design format introduced by Google Stitch, and it works with any AI coding agent.

Use it for the look and feel. Don't copy anyone's logo or brand name.

MIT.
https://t.co/DItnXsq7Ps

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

If your website runs on PHP (WordPress, Laravel, most shared hosting), check it today.

Two critical PHP flaws, called PHP2Shell, let attackers take over a web server without logging in. They were found by researchers at Calif, Wiz and OpenAI, and Cloudflare says it's already seeing early attacks.

OpenAI released a free checker that tells you if your site is exposed:

git clone https://t.co/FcvOzddvuW
cd php2shell-checker
node phpcheck.js "https://t.co/LUF9HiCbac"

Or check the PHP on your own server:
node phpcheck.js --local

You get OK, VULNERABLE or UNKNOWN. UNKNOWN does not mean you're safe. It means your server hides its PHP version.

The fix is to update PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer get official patches.

Over 5 million PHP servers are exposed online right now.

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Shinhan Card and SBI are exploring yen stablecoin payments for Japanese visitors in South Korea.

It's early stage, with no stablecoin named and no timeline, according to CoinDesk.

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

stalemap is an open-source tool that tells coding agents which dependencies changed after their training cutoff.

→ It compares your pinned versions with those from before the model's cutoff, for JS and TS projects
→ It writes notes into AGENTS.md or CLAUDE.md and adds an MCP search tool
→ It checks edits with the project's type-check and flags stale API use
→ In the author's own test, 89% of sessions passed with it versus 68% without

Repo: https://t.co/9W8XM2Ao9r

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

SAVE THIS: vibe-coded an app? Run these 3 free scans before you push it.

1. TruffleHog (28.6K stars)
Finds leaked API keys, passwords and tokens. It knows 800+ secret types, from AWS and Stripe keys to database passwords, and can show only the keys that still work.
brew install trufflehog
trufflehog git file://./your-app --results=verified

2. Gitleaks (30.2K stars)
Scans every commit in your history, so it catches the key you "deleted" three commits ago that's still sitting in git.
brew install gitleaks
gitleaks git -v

3. OSV-Scanner by Google (11.2K stars)
Checks every package your app depends on against Google's vulnerability database, and can tell you whether the vulnerable code is actually used.
brew install osv-scanner
osv-scanner scan source -r .

Two minutes, three commands, and you'll know what you're about to ship.

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Claude Opus 5.5 built a live fleet dashboard tracking 26 loads, 5 stops, 5 trucks and every axle check after every drop, giving visibility into the inside of a truck most people never see before it leaves.

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Grok Bot can find a niche, build a directory site on its own computer, ship one useful page every night, negotiate affiliate deals by email in your name and send money reports to Telegram, with the whole setup costing nothing on top of the subscription and the laptop staying shut.

→ Bot reads X and Reddit complaints in real time to find niches people search every day
→ Publishes on a routine with no manual input
→ Month one is traffic, month three is the first $217, it never stops after that
→ Every page is a tiny employee that works forever and compounds like rent

[0xMarioNawfal - The Roundtable Show @RoundtableSpace]

Local LLMs on a Mac, wired straight into your coding tools.

Kapitsa is a new open-source inference engine for Apple Silicon:

→ OpenAI- and Anthropic-compatible APIs on localhost
→ Qwen and Nemotron models, some with image input
→ Launchers: kapitsa claude, codex, opencode, pi
→ Install with Homebrew

Caveats: the speed tables in the README are the project's own measurements, not independent benchmarks. Big models need serious RAM (up to 128GB for the largest).

Apache-2.0, M1 or newer.

https://t.co/3itb020obL