GPAI and the EU AI Act: what MCP server builders owe
What the EU AI Act reaches when you ship an MCP server: GPAI duties, Article 50 transparency, the Article 25(4) value-chain rule, and the post-Omnibus dates.
Blog
Scoring philosophy, MCP security, and what changed this week.
Software supply chain security in MCP packages
SBOMs, build attestations and SLSA explained for MCP servers, plus our measurement of how many npm and OCI packages publish verified provenance.
MCP tools vs resources: which one to expose
Tools do things, resources supply data, prompts are user-invoked templates. How the spec divides them, and the rule for deciding which one you need.
MCP client vs server: which are you building?
The roles are fixed and easy to get backwards. What a host, a client and a server each do, who initiates, and which side owns the security decisions.
MCP server hosting: self-hosted or managed
What actually changes when you host an MCP server yourself versus using a managed platform, and the deployment details that decide its trust score today.
Best MCP servers: how to actually pick one
What separates a trustworthy MCP server from a popular one: supply-chain checks for packages, connection checks for remote endpoints, and where to look.
MCP security best practices: the 2026 checklist
The MCP security considerations that matter, as two checklists covering remote endpoints and packaged servers. Every check has a command and a pass condition.