Topic
Shared stdio MCP configs look convenient until someone on the team leaves. The right model is per-teammate credentials, not one shared URL everyone pastes into Cursor.
Read articlePasting a production bearer token into ~/.cursor/mcp.json means every engineer's laptop holds a credential that can call your billing API directly. The gateway should inject it; the agent client should never see it.
Read articleWhen you convert an entire OpenAPI doc into MCP tools, the agent sees 87 endpoints including the one that deletes a tenant. Per-operation exposure is the blast-radius control you actually want.
Read articleThe security array means OR, any one listed scheme is enough; combining schemes inside one requirement object means AND, all are required. Get this backwards and an endpoint that needs both an API key and a bearer token accepts just one, or a public endpoint demands credentials. Here is how to...
Read articleMost OpenAPI auth docs are subtly wrong: a scheme is defined but never applied, a token is modeled as a plain header, or OAuth scopes do not match the server. Here is how to document each mechanism correctly, combine them with AND/OR semantics, and mark public endpoints.
Read articleAn Agent Card is the public resume of an A2A agent: where it lives, which bindings it speaks, and what skills it offers. Fetching it is easy; trusting it is the part teams get wrong. Here is how discovery and signature verification actually work.
Read articleMCP turns external content into actions: a tool description or API response is text the model reads and trusts, which makes indirect prompt injection a real attack path. Here is a practical threat model and the controls that actually work, from scoped tokens to human-in-the-loop and audit logs.
Read articleLocal stdio MCP servers inherit your CLI credentials, so nobody notices auth until they host one. Remote MCP servers require OAuth 2.1 with PKCE, metadata discovery, and short-lived tokens. Here is the full flow and the mistakes that get servers rejected by clients.
Read articleA concrete audit of where requests, model calls, database queries, mock traffic and license checks run in the Powerduck desktop app, and what the network can and cannot see.
Read article