MCP vs RAG: how retrieval fits behind the protocol
RAG is a pattern for getting relevant text into a model's context. MCP is a protocol for tools and resources. One can serve the other. Here is how to choose.
Blog
Scoring philosophy, MCP security, and what changed this week.
MCP vs API: what changes when the caller is a model
MCP does not replace your API, it usually wraps one. What actually differs under the stateless 2026-07-28 spec, and what wrapping costs you in security.
MCP vs Skills: where the trust boundary sits
Agent Skills run inside your own agent's sandbox; an MCP server is a third-party dependency on the wire. How to choose by trust boundary and blast radius.
MCP security best practices: the 2026 checklist
The MCP security considerations that matter, as two checklists covering remote endpoints and packaged servers. Every check has a command and a pass condition.
VerifyMCP now supports MCP 2026-07-28
The 2026-07-28 revision makes MCP stateless, removing the initialize handshake and sessions. What changed, what it means for your server, and which scores move.
Why MCP server security is hard, and how we score it
MCP servers give agents the power to run code and call tools, which makes server trust a security problem. The threat model, and how we turn it into a number.