Issue #1
Mercury 3, Voxtral 3 and an Agent That Cleans Up Your TV
Inception's Mercury 3 diffusion LLM, Mistral's Voxtral 3 voice stack, a 40B open coding model using ~2.5B parameters per token, and agents that strip the ads off your TV.
Welcome to the first Toolsmith Weekly, and thanks for being here. This week: a very fast new model, real-time voice agents, side-by-side model comparisons in VS Code and a stack of small open-source finds.
In this issue
- 🚀 Big drops: Mercury 3, Voxtral 3 and Compare models in VS Code 1.143
- 🔭 Off the radar: a 40B open coding model using ~2.5B parameters per token, and a tiny model that pretends to be a terminal
- 🛠️ Vibe-coding corner: fx0 from Vercel Labs and Beam for headless Macs
- 🎮 Gaming pick: Co-op Anything
- 📰 News & alerts: PHP2Shell, a malicious LiteLLM release and the OpenCode Console breach
- 📺 Weekend project: CleanYourTV strips ads and bloat off old Android TVs
🚀 Big drops
Mercury 3 from Inception · Oct 19
A diffusion LLM that refines many tokens in parallel. Inception claims 1,068 tokens per second and a 1M-token context. OpenAI API compatible.
Good for: browser agents, voice bots and subagents where speed matters.
Price: $0.20/$0.70 per million input/output tokens, half that during launch.
Voxtral 3 from Mistral · Oct 20
New speech models plus a voice agent SDK that listens, reasons, calls tools and speaks in real time. Transcription covers 50+ languages. Use the EU-hosted API or your own servers.
Good for: phone and support agents.
Price: $0.0035/min for the 4B Mini transcription model.
VS Code 1.143: Compare models · Oct 19
A new preview sends one task to two or more models, with optional Judge and Synthesize steps to merge the best answers. Turn on sessions.chat.compareAgents.enabled.
Good for: settling "which model is better at our codebase" with your own tasks.
🔭 Off the radar
Recursive Flint · Oct 21
An open-weight (Apache-2.0) coding model with 39.8B parameters, about 2.5B active per token. Self-reported 74.2% on SWE-bench Verified.
Good for: self-hosters wanting a fast coding model. Needs one B300 or H200 GPU for now, or Kapitsa on a Mac.
WorldTUI · Oct 21
A 360M-parameter model trained to be a terminal. There's no real shell: it predicts the next screen from each keypress. It runs vim and tmux and plays snake.
Good for: a five-minute "huh." The 208 MB demo runs in the browser.
qwen3-4b-deslop · Show HN, Oct 19
Qwen3-4B fine-tuned to drop the usual AI writing tics. The author's "slop score" fell from 121 to 12.5 per 1,000 words.
Good for: local drafting through Ollama. The author admits the voice is flat and it still invents names and places.
earshot · Oct 15
Gives coding agents ears: it describes sound files, finds moments in long recordings and writes second-by-second listening reports on videos. Runs as a CLI, Python API or MCP server. MIT-licensed.
Good for: agents building demos, launch videos or game audio.
🛠️ Vibe-coding corner
fx0 · Oct 19
An open-source design agent from Vercel Labs. Describe a page and it writes the whole thing as one HTML file, starting from ten design styles or your own.
Good for: landing pages and mockups.
Price: model costs bill through your Vercel AI Gateway account.
Beam · #1 on Product Hunt, Oct 19
Keep agents running on a Mac mini or Studio; their windows appear as real windows on your other Mac. Needs two Macs on macOS Sonoma+.
Good for: anyone tired of Screen Sharing a headless Mac.
Price: 20 free minutes/day; $84/year or $199 lifetime.
🎮 Gaming pick: Co-op Anything
Co-op Anything · created Oct 16, MIT
Tell your coding agent which single-player game you want to play with friends. It fixes an existing co-op mod or builds one, tests it with bots and packages a one-click install, so friends can join over Steam.
Good for: modders. Deus Ex co-op is listed as released. Results vary a lot by game.
📰 News & alerts
Severity (0–10): 0–2 FYI · 3–4 Monitor · 5–6 Update soon · 7–8 Patch now · 9–10 Act immediately. Official CVSS where one exists; otherwise our rating.
Security alert · PHP2Shell: patch PHP now · Oct 21
CVSS 9.2/10 · Act immediately
CVSS v4.0 base score from the PHP security team for CVE-2026-109618 and CVE-2026-109619.
Two critical bugs in PHP itself allow unauthenticated remote code execution. Wiz found them with AI help, every version back to 5.4 is hit, and attacks have already started.
Who's affected: anyone running WordPress, Drupal, Joomla or another PHP app.
What to do: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today.
Read more: Wiz's write-up
Tools for this
- Snyk: Snyk Container scans container images for vulnerabilities and recommends base-image upgrades.
- Trivy: open-source (Apache-2.0) scanner for known CVEs in container images, code repos and Kubernetes clusters.
Security alert · LiteLLM 1.107.0 shipped a credential stealer · Oct 21
Our rating 9/10 · Act immediately
Not a CVSS score: a malicious release has no CVE. GitHub's advisory (GHSA-92x9-889m-jgmw) rates it Critical.
The popular LLM gateway's release pipeline was hijacked. The bad release runs every time Python starts and grabs SSH keys, cloud credentials, browser passwords, coding-agent tokens and provider keys.
Who's affected: anyone running LiteLLM unpinned or on latest.
What to do: pin 1.106.2, rebuild and rotate every key that machine could reach.
Read more: SafeDep's analysis
Tools for this
- Socket: blocks malicious packages before they reach your code; Python support covers pip, uv and Poetry.
- GitGuardian: its ggshield CLI scans files and folders for secrets with
ggshield secret scan path.
Security alert · OpenCode Console breach · Oct 17-19
Our rating 7/10 · Patch now
Not a CVSS score: a service breach has no CVE. Exposed provider keys and reported rogue charges, limited to 1.4% of Console users.
A breach of a legacy system may have exposed the OpenAI, Anthropic and Google keys that 1.4% of Console users saved there. Some users report rogue charges up to about $1,700.
Who's affected: anyone who ever saved a provider key in OpenCode Console.
What to do: revoke it at the provider. Deleting it from Console isn't enough.
Read more: BleepingComputer
Tools for this
- Infisical: MIT-licensed secrets manager; its Agent Vault lets agents, OpenCode included, call APIs without holding the keys.
📺 Weekend project: fix a bloated Android TV
CleanYourTV · 22,000+ stars
A repo with a ready-made prompt that has your coding agent clean up an old Android TV. It started when a developer showed Claude Code cleaning up his parents' TV. TV Detox is similar.
- Turn on USB debugging.
- Paste the repo's prompt into your coding agent.
- The agent disables apps over ADB, asking first.
- Turn debugging off.
Heads-up: a few TVs got stuck at the logo; keep the restore script handy.
That's it for Issue #1. Thanks for reading, and see you next Friday.
Browse every tool we've covered at toolsmithweekly.com. No sponsors this week; nothing here is paid placement.
Know someone who'd like this? Forward it along, or they can subscribe at toolsmithweekly.beehiiv.com/subscribe.
Web version: toolsmithweekly.beehiiv.com/p/mercury-3-voxtral-3-and-an-agent-that-cleans-up-your-tv