GPAI and the EU AI Act: what MCP server builders owe
What the EU AI Act reaches when you ship an MCP server: GPAI duties, Article 50 transparency, the Article 25(4) value-chain rule, and the post-Omnibus dates.
Blog
Scoring philosophy, MCP security, and what changed this week.
Agentic payments: what an agent can verify before paying
What a paying agent can check about the party it pays. The AP2, ACP, UCP and x402 layers, what each refuses to do, and what the attacks break.
AI BOM (AIBOM) explained, and the tool gap
What an AI bill of materials records, which formats can express one today, and why no shipped format has a field for the MCP servers an agent calls.
Software supply chain security in MCP packages
SBOMs, build attestations and SLSA explained for MCP servers, plus our measurement of how many npm and OCI packages publish verified provenance.
AI agent identity: the standards that actually ship
There is no single AI agent identity standard. Four layers solve four different problems, and MCP has shipped exactly one of them. A field guide.
Best AI agents 2026: compared by what you can verify
Eleven AI agents compared on where tool calls run, what each asks before acting, and how far MCP support goes. Every figure links to its source.
MCP tools vs resources: which one to expose
Tools do things, resources supply data, prompts are user-invoked templates. How the spec divides them, and the rule for deciding which one you need.
MCP client vs server: which are you building?
The roles are fixed and easy to get backwards. What a host, a client and a server each do, who initiates, and which side owns the security decisions.
MCP vs ACP: different layers, and three ACPs
ACP means at least three things. For the Agent Client Protocol the answer is that it sits above MCP, not against it. Which ACP you mean, and how they stack.
MCP vs LangChain: framework, protocol, or both?
LangChain is a framework you build with. MCP is a protocol you connect over. They compose rather than compete, through an official adapter per language.
MCP vs agents: the difference, and do you need both?
An agent is a program that decides what to do. MCP is how it reaches the things it acts on. How the two layers relate, and the real decision underneath.
MCP vs function calling: they are not rivals
Function calling is how a model asks for a tool. MCP is how that tool got there. Where the two meet, and what MCP adds once you have more than a few.
MCP security scanning: what it can prove
What an automated scan of an MCP server can actually establish, what it structurally cannot, and why an inconclusive result beats a confident guess.
MCP prompt injection and tool poisoning
Tool descriptions are untrusted text the model reads on every call. How poisoning works, why the spec says to distrust descriptions, and what stops it.
MCP server hosting: self-hosted or managed
What actually changes when you host an MCP server yourself versus using a managed platform, and the deployment details that decide its trust score today.
MCP observability after logging was deprecated
The 2026-07-28 spec deprecated protocol-level logging and points at OpenTelemetry instead. What to instrument on an MCP server, and what not to log.
MCP sampling and roots are both deprecated now
Both client features were deprecated by SEP-2577 in the 2026-07-28 spec. What each one did, why they went, and exactly what to migrate them to.
MCP elicitation: form mode, URL mode and the risks
How elicitation works in the 2026-07-28 spec, why sensitive data must never go through form mode, and the phishing attack URL mode has to defend against.
Best MCP servers: how to actually pick one
What separates a trustworthy MCP server from a popular one: supply-chain checks for packages, connection checks for remote endpoints, and where to look.
MCP gateway: what it solves, and what it hides
What an MCP gateway or proxy actually does, when aggregating servers behind a single endpoint is worth it, and the per-server provenance you give up.
MCP Inspector: debug and verify an MCP server
What the MCP Inspector checks, how to run its web, CLI and TUI clients, why CVE-2025-49596 made auth the default, and the supply-chain signals it misses.
How to test MCP servers: from local dev to production
A workflow for testing MCP servers: the Inspector, protocol smoke tests for the stateless 2026-07-28 spec, schema and auth checks, and what fails at scale.
MCP authorization: how OAuth 2.1 works in the 2026 spec
How MCP authorization works in the 2026-07-28 spec: OAuth 2.1, RFC 9728 discovery, resource indicators, and why dynamic client registration is deprecated.
MCP vs CLI: which should your coding agent use, and when?
Token cost, composability and blast radius. When a documented CLI beats an MCP server for coding agents, when it loses, and how to weigh the security trade.
MCP vs A2A: what each protocol lets you inspect
A2A vs MCP, compared by what each one lets you see. MCP connects an agent to tools through schemas you can inspect. A2A connects agents as opaque peers.
MCP vs RAG: how retrieval fits behind the protocol
RAG is a pattern for getting relevant text into a model's context. MCP is a protocol for tools and resources. One can serve the other. Here is how to choose.
MCP vs API: what changes when the caller is a model
MCP does not replace your API, it usually wraps one. What actually differs under the stateless 2026-07-28 spec, and what wrapping costs you in security.
MCP vs Skills: where the trust boundary sits
Agent Skills run inside your own agent's sandbox; an MCP server is a third-party dependency on the wire. How to choose by trust boundary and blast radius.
MCP security best practices: the 2026 checklist
The MCP security considerations that matter, as two checklists covering remote endpoints and packaged servers. Every check has a command and a pass condition.
VerifyMCP now supports MCP 2026-07-28
The 2026-07-28 revision makes MCP stateless, removing the initialize handshake and sessions. What changed, what it means for your server, and which scores move.
Why MCP server security is hard, and how we score it
MCP servers give agents the power to run code and call tools, which makes server trust a security problem. The threat model, and how we turn it into a number.