Topic
We hand-maintained a tools.json that matched our OpenAPI doc for about three weeks. Then someone renamed a parameter and the agent started sending the old name to an endpoint that no longer accepted it. The fix was not better discipline. It was letting the spec be the source of truth.
Read articlePasting a production bearer token into ~/.cursor/mcp.json means every engineer's laptop holds a credential that can call your billing API directly. The gateway should inject it; the agent client should never see it.
Read articleWhen you convert an entire OpenAPI doc into MCP tools, the agent sees 87 endpoints including the one that deletes a tenant. Per-operation exposure is the blast-radius control you actually want.
Read articleConverting an OpenAPI doc into an MCP server is easy. Keeping that Node process alive, rotated, and reachable from every engineer's laptop is the part that quietly becomes a second job.
Read articleBruno solved the cloud-lock-in problem. It didn't solve the drift problem — and once an AI agent starts treating your request collection as truth, that drift stops being annoying and starts being expensive.
Read articleWhen your assistant guesses from memory instead of reading a live spec, you get code that compiles, passes unit tests, and 404s in production. The fix isn't a better prompt.
Read articleA create-read-check scenario connects an API contract, MCP tools, and observable outcomes. Here is how to make completion something you can verify.
Read articleHand-writing OpenAPI drifts, regex mistakes cache.get() for a route, and asking an LLM to summarize a repo hallucinates endpoints. Here is the deterministic way to scan real codebases into OpenAPI 3.2: prove the contract, flag every gap, and let AI fill only what it cannot invent.
Read articleYour favorite saved request probably exercises the easiest path. Change one input at a time to find the assumptions hiding behind a green Send button.
Read articleA working request is a great starting point. Before handing it to another developer, answer the questions a cURL command cannot: what is required, what can vary, and what happens when it fails?
Read articleA demo shows that the new path works. A contract diff shows what existing callers now have to survive. Here is a focused way to review an API change without turning it into a committee meeting.
Read articleAn AI-generated schema can be valid, detailed, and wrong. A delegated handler shows why more context is not enough—and what an evidence-based review should check.
Read article