GitHub Universe sessions are live,

A2A joins the Agentic AI Foundation,

Cloudflare can spot MCP traffic,

and local.ai helps you

compare local AI setups.

All that and more,

on this episode of The Download.

Welcome back to another

episode of The Download,

the show where we cover the latest

developer news and open source projects.

Please like and subscribe!

I’m Andrea Griffiths,

Senior Developer Advocate.

Let’s get into it!

The GitHub Universe 2026 session catalog is live,

with speakers like Angie Jones,

Frank Nijhof,

Rohan Varma from OpenAI,

Sam Morrow,

Jake Albaugh,

and many, many more.

Universe runs October 28th

through the 29th in San Francisco.

You can catch Angie on how AI is

reshaping open source,

Franck on

building Home Assistant in the open,

and Rohan

on what’s next for AI-assisted development.

Sam is taking on MCP security

with real exploits and mitigations.

And Jake is showing us how

to see what an agent will build

before it builds it.

The catalog is live.

Browse it now

and build a schedule that fits

what you want to learn.

And don’t forget

the tickets are now on sale

at githubuniverse.com.

And in Changelog news,

GitHub OAuth apps can now use

eight-hour access tokens

with six-month refresh tokens.

Add the offline_access scope

while you test the refresh flow,

or configure the app to require

short-lived tokens.

OAuth apps can also register

up to ten callback URLs.

That helps with development,

staging,

and production setups.

One thing to note:

apps with one redirect URI

might have legacy wildcard matching enabled.

Disable it if you do not need it.

More about this

in the link on the show notes.

Cloudflare Gateway can now identify

MCP traffic in TLS-inspected connections.

It looks for the MCP-Protocol-Version header

and gives administrators

a policy selector named

“experimental.is_mcp”.

That gives security teams

a way to see MCP connections,

enforce approved paths,

and block direct connections

on managed networks.

Start in observe mode.

Local stdio servers and off-network

traffic are outside of this view,

so network telemetry is one part of the control set.

Agent2Agent,

or A2A,

is now a hosted project at

the Agentic AI Foundation,

defining how independent agents

find each other,

delegate work,

and exchange results

across frameworks and vendors.

The AAIF now hosts AGENTS.md,

Goose,

MCP,

agentgateway,

and A2A,

covering the stack from agent instructions

to agent-to-agent communications.

A2A is backed

by more than 150 organizations,

with AWS,

Cisco,

Google,

IBM Research,

Microsoft,

Salesforce,

SAP,

and ServiceNow

represented on its

Technical Steering Committee.

If you build multi-agent systems,

it gives cross-framework handoffs

an open-governance home.

In a project pick,

picking a local model

is still a messy decision.

Tokens per second does not really tell you

whether the model can finish

useful work on the machine

you already own.

Local.ai

compares task quality,

end-to-end task time,

hardware cost,

and electricity costs

where it can measure it.

The early-access site

can also detect your machine

and recommend a local model to try.

That is closer to

the decision

most of us need to make before

spending money on a GPU.

Check it out at local.ai.

local.ai

And an open-source

project pick for this week:

TTFX.

TTFX is an MIT-licensed Rust port

of ChrisBuild’s

TerminalTextEffects.

Pipe in a Git log,

a fortune,

a release note,

anything really,

and send it through one of

the 37 terminal animations.

You can run

git log --oneline -10 | ttfx matrix

and your commit history

gets some digital rain.

Check it out at

github.com/omacom-io/ttfx.

And that’s all for now!

Let me know in the comments

your thoughts on any of the topics

we discussed this week.

If you like this episode,

please give it a thumbs up

to serve the algorithm gods

and don’t forget to subscribe

to GitHub’s YouTube channel

for all your nerdy needs.

Keep building. See you next time!