The Powerduck Blog
Product updates, engineering notes, and guides for designing, debugging, testing, mocking, and serving MCP tools from one OpenAPI spec.
Browse the guidesThe agent solved a small data-munging task by writing a 40-line Python script. Two months later, nobody on the team remembers how to run it, and it is the only thing that produces that CSV.
Read articlestdio means every engineer, every CI run, and every teammate's laptop spawns a Node process. A hosted HTTPS MCP URL means one config block, one process, one place to debug.
Read articlePasting a production bearer token into ~/.cursor/mcp.json means every engineer's laptop holds a credential that can call your billing API directly. The gateway should inject it; the agent client should never see it.
Read articleWhen you convert an entire OpenAPI doc into MCP tools, the agent sees 87 endpoints including the one that deletes a tenant. Per-operation exposure is the blast-radius control you actually want.
Read articleConverting an OpenAPI doc into an MCP server is easy. Keeping that Node process alive, rotated, and reachable from every engineer's laptop is the part that quietly becomes a second job.
Read articleAn agent wraps a flaky HTTP call in a retry loop. It retries on every non-2xx. The auth token expired on day two, and the loop retried 30 times per request for the next three weeks.
Read articleAn agent converts an if/else chain to a lookup map for cleanliness. TypeScript is green, tests pass, but one branch's logging and metrics call quietly disappears.
Read articleAn agent 'modernized' a sync function by marking it async. TypeScript was happy. The production caller that destructured the return value synchronously started crashing at runtime.
Read articleA shell script that exits on first failure gets ported to Python line by line. The happy path runs identically. The bad path silently succeeds.
Read articleThe function looked ugly on purpose. The comment said why. The agent "cleaned it up" and now the next engineer has to rediscover the workaround the hard way.
Read articleThe test file passed. The function it was supposed to cover was broken. The mock was the giveaway.
Read articleA clean-looking diff passed every test. The function was called 40k times per request. We didn't notice until p95 spiked.
Read article