LoginSign Up
← Back to DevOps
Weekly · DevOps · Week of May 18, 2026

The development stack is bolting non-human identity, agent runtimes, and BaaS for agents into the platform layer.

non-human-identityagent-runtimesmcp-platform-tierbaas-maturationpost-quantum-prepai-ml-scheduling
Y
By Yahya Tür
LinkedIn ↗
Generated 3h agoDrawn from 10 products

The week in development

This week's dominant motion in the development stack was infrastructure preparing itself for non-human callers. HashiCorp, Auth0, and Okta all moved on identity primitives for agents — Vault and Boundary as the control plane for agentic workloads, MCP authentication going GA at Auth0, Cross App Access at Okta. Vercel turned AI Gateway into a tunable model marketplace while OIDC-based Trusted Sources became the new platform trust model. Speakeasy quietly outgrew its SDK-generation roots into a full assistant runtime — identity via WorkOS, OTEL observability, per-assistant Fly isolation, memory, self-wake. The recurring shape is the same: pieces of the stack that used to assume a human caller are being rebuilt around agents.

The other thread is platform maturation in adjacent layers. Kubernetes v1.36 finally shipped first-class AI/ML scheduling (Workload API, gang scheduling) after years of CRD workarounds. Appwrite closed BaaS feature gaps while shipping a Codex plugin that bundles CLI/SDK skills with an MCP docs server. Artifactory is repositioning as a generic ML model registry. The infra layer is converging on "the thing agents call into."

Leaders

GitHub (v10.0) anchors the developer-tooling story — Copilot rebuilt as a multi-surface agentic platform with its own CLI and cloud runtime. The model layer is now GitHub's job, not the user's.

Vercel (v10.0) hardened the security perimeter (Trusted Sources via OIDC, WAF expansions) while turning AI Gateway into a tunable model marketplace. The platform is shifting from "deploy frontends fast" to "operational layer for the AI application stack."

Speakeasy (v10.0) made the most under-noticed move of the week: Gram graduated from an SDK-generation product to an agent runtime — identity, observability, isolation, persistence, multi-MCP composition. The pivot is clean.

Appwrite (v8.8) is stamping its flag in the agentic dev-tools layer with a Codex plugin while graduating product features out of beta. Two motions running in parallel: BaaS maturation and agent-tools positioning.

HashiCorp (v8.8) is racing to make Vault and Boundary the control plane for agentic workloads. IBM branding is now showing up on Vault Enterprise 2.0 — the post-acquisition integration is becoming visible, with non-human identity as the wedge.

Auth0 (v8.8) shipped MCP authentication GA and rebuilt refresh-token primitives for SPAs. Both moves track the same shift: opaque long-lived tokens no longer fit how applications run.

Kubernetes (v7.5) shipped v1.36 with first-class AI/ML scheduling — the Workload API and gang scheduling end years of treating GPU and batch as second-class citizens.

Wildcards

WeWeb (v5.0) is the directional outlier — pivoting from a front-end no-code builder to a full-stack AI app generator with backend launch, editor redesign, and multi-page AI generation. It is directly competing with Bolt, Lovable, and Cursor's app-builder products in the same week those players are moving up-stack.

Artifactory (v2.5) is shedding legacy indexing on a clear deprecation arc to mid-2026 while quietly renaming Hugging Face support to a generic Machine Learning layout. The bet is that the model registry tier is up for grabs and Artifactory has the package-management muscle to claim it.

Themes that compounded

  • Non-human identity is the new perimeter — HashiCorp Vault/Boundary, Auth0 MCP-auth GA, Okta XAA, and Vercel Trusted Sources all shipped identity primitives explicitly designed around agents and machine callers.
  • Agent runtimes converged in shape — Speakeasy's Gram, Vercel's AI Gateway, and Cursor's cloud agents (from devtools) are all packaging the same combination: identity + observability + isolation + persistence.
  • MCP servers shipped at the platform tier — Appwrite, Auth0, Vercel, and Okta all surfaced MCP integrations, treating it as standard plumbing rather than a novelty.
  • Post-quantum crypto groundwork moved behind feature flags — Bitwarden's PQC-ready keypair primitives and the broader Threema/Auth0 post-quantum prep suggest the migration plumbing is being staged before the algorithms become mandates.
  • Backend platforms are bundling agent-tooling as a default — Appwrite Codex plugin, Speakeasy Gram, Vercel AI Gateway, and the K8s Workload API all assume agent workloads are first-class.

Watch this week

The near-term test is whether HashiCorp's non-human identity pitch resonates as procurement language — Vault Enterprise 2.0 and Boundary now compete directly with the agent-identity stories from Auth0 and Okta, and the IBM brand inflection will sharpen the contrast over the next month. On the BaaS side, watch whether WeWeb's full-stack pivot draws a feature response from Bolt or Lovable — both have the AI-generation chops but not yet the BaaS depth. And keep an eye on Kubernetes 1.36 uptake — if the new Workload API gets quick adoption, expect Slurm and Ray to reposition.