Blog

Deep-dive guides on AI agents, agent orchestration, MCP, and developer tooling.

9 posts found

MCP

MCP Resources: The Primitive Almost No Server Implements

MCP defines three primitives (tools, resources, and prompts), but nearly every server in the wild only implements the first. Here's what resources actually do, why client support lagged, and where skipping them leaves your agent acting on stale context.

October 12, 2026 · 9 min read
MCP

MCP Elicitation: Form Mode, URL Mode, and the Phishing Attack Built Into Its Design

MCP's elicitation feature lets a server pause a tool call to ask the human for more input. The protocol splits it into two modes with very different trust models, one of which exists specifically to stop an account-takeover attack.

October 3, 2026 · 11 min read
MCP

MCP Sampling: How a Server Asks the Client's Model to Think for It

Sampling is the MCP primitive that inverts the relationship, letting a server without its own model borrow the client's LLM through a two-gate approval flow. Here is how it works, and why the 2026-07-28 spec revision deprecated it.

September 11, 2026 · 9 min read
LLM Engineering

How Constrained Decoding Actually Forces an LLM to Emit Valid JSON

Structured outputs and strict tool use aren't prompting tricks. They mask invalid tokens at the decoding layer so malformed JSON becomes mechanically impossible, not just less likely.

August 24, 2026 · 10 min read
AI Agents

Most Tool-Calling Failures Are Schema Failures, Not Model Failures

When an LLM agent calls the wrong tool or sends malformed arguments, the postmortem usually blames the model. The actual defect is almost always in the JSON Schema the tool was registered with.

August 19, 2026 · 9 min read
AI Agents

How AI Coding Assistants Actually Work: Context, Diffs, and Permission Boundaries

AI coding assistants aren't one architecture. They're three separable design decisions (how context gets assembled, how edits get applied, how execution gets contained) that every tool from Claude Code to Cursor answers differently.

July 11, 2026 · 8 min read
LLM Engineering

Prompt Engineering for Agents Is a Different Discipline Than Prompt Engineering for Chat

In agent systems, instructions live across four surfaces (system prompt, tool schemas, tool results, and few-shot text), not one. Most prompt debugging still only looks at the first.

July 7, 2026 · 7 min read
Security

The Trust Boundary Problem: Why Tool-Calling Agents Need to Treat Tool Output as Untrusted Input

Most agent security advice targets prompt injection at the wrong layer. The real fix is architectural: separate untrusted tool output from privileged context, scope tool capabilities narrowly, and gate side-effecting actions behind confirmation.

July 2, 2026 · 8 min read
MCP

What Actually Happens Inside an MCP Tool Call

A wire-level look at the Model Context Protocol: capability negotiation, tool discovery, transport tradeoffs, and the context-budget mistakes that quietly degrade agent reliability.

June 29, 2026 · 8 min read

New posts by email

One email when a new post goes up. No other mail; unsubscribe in one click.

We store your email only to send new posts. See the privacy policy.