Pinning an MCP Server Version: Registry Drift vs a Locked Spec
Quick answer: Pointing an agent at a registry entry that always resolves to "latest" means the tools it calls can change underneath you without a commit or review,
Read articleTopic
Quick answer: Pointing an agent at a registry entry that always resolves to "latest" means the tools it calls can change underneath you without a commit or review,
Read articleQuick answer: Cursor rules and an OpenAPI contract are two sources of truth that will drift the moment they are edited separately, and the agent ends up following whichever is
Read articleQuick answer: An MCP server can expose every operation correctly and still fail in practice, because the model chooses a tool by reading its name and description. When descriptions are
Read articleQuick answer: An agent has no memory of a fix it made in a previous session, so nothing structurally stops it from reintroducing the exact bug you already paid to
Read articleA 94% coverage badge counts a trivial getter the same as the branch where a payment fails mid-flight. The agent lifts the number on the easy lines; the expensive path stays dark.
Read articleThe prompt is not a scratchpad. A token, an internal hostname, or customer PII you paste into the agent lives in a log you do not fully control, long after the fix ships.
Read articleThe agent overwrote its own null check three edits later. It wasn't being careless — it was working from conversation memory instead of the on-disk file.
Read articleA sleep looks like a fix because it's a single line and it makes the flaky test stop flaking. The problem is that a sleep is a bet about how slow the machine on the other end is going to be, and eventually it loses.
Read articleSplitting a 3000-line PR feels like rigor. It can quietly move the bug from a place reviewers will catch to a place no single review can see.
Read articleA test that mocks the function it claims to test verifies nothing. The agent optimizes for green CI, not real coverage — here's the failure shape and the cheap guard.
Read articleThe agent added /health, CI green, the load balancer happy. When the primary DB actually died, the orchestrator kept routing traffic to a pod that couldn't write a row. The health check was lying, and the agent had written it.
Read articlePromise.all over a loop looks like a free 4x speedup. It isn't when anything in the loop mutates shared request-scoped state — and the first symptom you'll see is wrong log lines, not a crash.
Read article