Agents now write more code than most people can read. That has shifted the bottleneck, and this week's launches are almost entirely about the moment after the agent finishes. Some make the change legible, some verify it, some test the tools the agent depends on, and two of them deal with what the agent is allowed to touch in the first place.
Making a diff legible before you read it
PR Lens draws animated architecture and data-flow walkthroughs inside the pull request itself. The claim is that you can understand a change and catch what could break before reading a single line: one view shows services, data stores and endpoints marked changed, new or removed, and a second traces the data flow with per-file additions and deletions beside a written description. It ships four ways - a GitHub App, a GitHub Action, a CLI, or a skill you add to your coding agent - and the core is open source and works locally.
EditUI closes a smaller gap that costs real time. It is a Chrome extension for reviewing your running app: click an element, describe the change you want, keep collecting, then copy the whole review and paste it into Claude Code or Cursor. The point is not the edit, it is never again writing a paragraph to explain which element you meant.
Two very different review bots
Baloo is an open source GitHub App for AI pull request review, built for teams that want self-hosting rather than another SaaS reviewer. It reads PR diffs and project context, and posts inline comments with severity labels. Two details stand out: it reads AGENTS.md and CONTRIBUTING.md from the repository and enforces them, and it honours a per-PR review brief, verifying the falsifiable checks you wrote and citing them in its findings. It reviews every push automatically, tracks discussion threads across iterations, and never blocks a merge.
Wy starts from the opposite problem. You handed an agent a task you could not solve yourself, it changed forty files, and the consequential choices were made without you. Wy turns the uncommitted diff into the questions you would need to answer to accept it, and then shows which of them the agent own record actually answers. The Plan screen has four boxes - what changed, what to worry about, whether it was tested, and progress - and every row opens its evidence: what the agent chose, what it said as an exact quote or an honest unknown, and where to look yourself. A second screen shows the session as intent-sized steps, each with why, check and gap. The discipline here is the selling point: attribution is a textual match between a hunk and a captured edit or nothing at all, and a nearby message is never treated as a proven reason. Nothing calls a model until you open the question row.
Hearing the plan instead of reading it
DiffGuardian gives you a spoken walkthrough of a pull request or a codebase, highlighting code and building live visuals as it answers. It is aimed at the specific problem of agent-written plans: it reads Spec Kit, OpenSpec, Kiro and plain PLAN.md files and turns them into a summary, an architecture diagram, a data model and API tables, so you can ask questions by voice instead of scrolling through hundreds of lines of markdown. Your code never touches their servers - you use your own keys or fully local models, and voice runs on OpenAI, ElevenLabs or the system voice.
Treating an MCP server like any other dependency
Mcpward does for MCP what contract testing did for HTTP APIs. It snapshots a server contract and fails the build when the contract changes underneath you, catching schema drift, silently changed tool descriptions, protocol violations, error-contract mistakes and tool-poisoning patterns. Because it is black-box it works against servers you did not write, over stdio or Streamable HTTP, and it runs entirely on your machine with no account, no API calls and no telemetry. The project is blunt about the failure mode: commit the lock file and refresh it only deliberately, because a CI job that re-baselines automatically would accept a rug-pull as the new contract.
Senro covers the other side of WebMCP, and is an evaluation and observability platform for sites that expose tools to agents. Before production it runs smoke testing, goal evaluation, trajectory evaluation, page checks, simulated users and multi-model comparison. In production it watches tool activity, inputs, results and errors, session timelines and usage metrics, so you can see how agents actually use what you shipped rather than how you hoped they would.
Long investigations, and the permissions behind them
Vigil is an AI harness for code audits, web pentests and bug bounty hunting, built around how real investigations fail: anchored hypotheses, false negatives and unreproducible reports. It coordinates Claude Code or Codex through broad review, focused rereads, authenticated testing and runtime reproduction, and it keeps promising leads on the books when runtime proof is still missing so a plausible source bug does not become an unsupported impact claim. Findings, evidence, coverage and handoffs carry across sessions. It is Apache-2.0 and you stay the operator, but it drives offensive tooling against live systems and is explicitly for authorized use only.
Personal Agent Proxy attacks the permission problem at the source. Every new agent asks you to connect your email, your calendar and your notes again, and to trust one more company with all of them. This is an open-source, self-hostable access layer where you connect services once and give each agent its own login: it reads your inbox or writes a draft within what you allowed, and every request is checked against your permissions and written to a log, allowed or denied. Nothing from your services is copied into its database, which is a stronger guarantee than most agent integrations offer.
Rutter applies the same logic to memory. It keeps a record of what you decided, which notes the session cited, and how your thinking changed - a stance you formed or changed is called a position - stored as plain Markdown in a folder you own. Once registered in each client and pointed at the same notes folder, each client can recall the same records, and any MCP client can recall. Six harnesses have a working capture hook today.
Closing the loop on the web itself
Usermods is the odd one out and the most fun: an open-source browser extension that customises any website by chatting with the LLM of your choice. It inspects the page - pruned DOM, element lists, computed styles, screenshots - writes a userscript, tests it live, and hands it over with Try and Save buttons. Saved mods run on every matching page load, export as standard user.js files, and you can migrate a whole Tampermonkey library in one file. It works with Anthropic, OpenAI, OpenRouter or anything OpenAI-compatible including Ollama and LM Studio.
The pattern
Every one of these launches assumes the agent already wrote the code. The question they answer is whether you can trust it, understand it, or bound it - and the best of them, Wy and Mcpward especially, are honest about what they cannot prove.