March 2026 Summaries

A recent security incident involved poisoned versions of the LiteLLM package (1.82.7 and 1.82.8) on PyPI, which compromised cloud credentials, SSH keys, and Kubernetes secrets from affected systems. The attack, perpetrated by a group known as TeamPCP, highlighted the importance of version pinning in protecting software repositories, as unpinned or range-based dependencies allowed the malicious versions to be installed. Using tools like Deep Search and Code Search, it was possible to identify which repositories were at risk and which had safeguards in place, such as specific version pinning to avoid compromised releases. The incident emphasizes the need for careful management of software dependencies, advocating for practices like setting upper bounds and auditing CI/CD pipelines to prevent similar supply chain attacks.

SCIP, a language-agnostic protocol for indexing source code, is transitioning to a community-driven open source project with an open governance structure, marking its fourth anniversary. Sourcegraph, which introduced SCIP, is establishing a Core Steering Committee, including engineers from Uber and Meta, to guide the project's future development while remaining an active participant. The governance model introduces a public SCIP Enhancement Proposals (SEP) process to ensure transparent and structured decision-making. The new framework is aimed at promoting innovation, predictability, and stability, inviting contributions from the broader community to make code intelligence universally accessible.

In the ongoing debate about the Model Context Protocol (MCP) versus direct API calls and CLIs, the recent decision by Perplexity to drop MCP in favor of direct APIs has reignited discussions within the tech community. While some leaders in the field criticize MCP, arguing for the simplicity of APIs, large organizations and security-focused entities emphasize the importance of MCP for maintaining security, governance, and control. Companies like Stripe have developed sophisticated internal infrastructures, such as their Toolshed layer, to manage MCPs effectively, providing a curated and secure environment for tool usage. Meanwhile, other companies are exploring different approaches, such as democratizing MCP creation internally or developing MCP routers to simplify tool accessibility. Despite differing opinions, what's evident is the lack of consensus and the potential market opportunity for structured solutions to manage MCPs and context layers at scale. As the debate continues, many enterprises remain heavily reliant on MCPs, underscoring the gap between industry practices and the views of some tech influencers.

CodeScaleBench is a new benchmark designed to evaluate coding agents against the complexities of enterprise software development, addressing the limitations of existing benchmarks which often fail to accurately assess agents' capabilities in handling large, multi-repository codebases across various programming languages. The benchmark includes 370 tasks divided into two parts: CodeScaleBench-SDLC, which assesses agents across the full software development lifecycle, and CodeScaleBench-Org, which focuses on organizational-level tasks. Initial findings indicate that agents using Sourcegraph MCP tools outperform baseline configurations in tasks requiring extensive codebase navigation and context retrieval, particularly in cross-repository scenarios. The benchmark emphasizes the importance of robust quality assurance to ensure valid and reliable results, highlighting the need for comprehensive tooling and retrieval strategies in enterprise-scale software development. Despite improvements in context retrieval metrics, challenges remain in driving agents to effectively utilize advanced search tools, as they often default to keyword searches. The ongoing development of CodeScaleBench aims to further refine the evaluation framework, expand the range of tasks, and explore different agent harnesses and MCP tool combinations to enhance the assessment of coding agents in complex environments.