Agentic payments: what an agent can verify before paying
What a paying agent can check about the party it pays. The AP2, ACP, UCP and x402 layers, what each refuses to do, and what the attacks break.
Blog
Scoring philosophy, MCP security, and what changed this week.
AI BOM (AIBOM) explained, and the tool gap
What an AI bill of materials records, which formats can express one today, and why no shipped format has a field for the MCP servers an agent calls.
Software supply chain security in MCP packages
SBOMs, build attestations and SLSA explained for MCP servers, plus our measurement of how many npm and OCI packages publish verified provenance.
AI agent identity: the standards that actually ship
There is no single AI agent identity standard. Four layers solve four different problems, and MCP has shipped exactly one of them. A field guide.
Best AI agents 2026: compared by what you can verify
Eleven AI agents compared on where tool calls run, what each asks before acting, and how far MCP support goes. Every figure links to its source.
MCP security scanning: what it can prove
What an automated scan of an MCP server can actually establish, what it structurally cannot, and why an inconclusive result beats a confident guess.
MCP prompt injection and tool poisoning
Tool descriptions are untrusted text the model reads on every call. How poisoning works, why the spec says to distrust descriptions, and what stops it.
MCP server hosting: self-hosted or managed
What actually changes when you host an MCP server yourself versus using a managed platform, and the deployment details that decide its trust score today.
MCP observability after logging was deprecated
The 2026-07-28 spec deprecated protocol-level logging and points at OpenTelemetry instead. What to instrument on an MCP server, and what not to log.
MCP elicitation: form mode, URL mode and the risks
How elicitation works in the 2026-07-28 spec, why sensitive data must never go through form mode, and the phishing attack URL mode has to defend against.
Best MCP servers: how to actually pick one
What separates a trustworthy MCP server from a popular one: supply-chain checks for packages, connection checks for remote endpoints, and where to look.
MCP gateway: what it solves, and what it hides
What an MCP gateway or proxy actually does, when aggregating servers behind a single endpoint is worth it, and the per-server provenance you give up.
MCP Inspector: debug and verify an MCP server
What the MCP Inspector checks, how to run its web, CLI and TUI clients, why CVE-2025-49596 made auth the default, and the supply-chain signals it misses.
MCP authorization: how OAuth 2.1 works in the 2026 spec
How MCP authorization works in the 2026-07-28 spec: OAuth 2.1, RFC 9728 discovery, resource indicators, and why dynamic client registration is deprecated.
MCP vs CLI: which should your coding agent use, and when?
Token cost, composability and blast radius. When a documented CLI beats an MCP server for coding agents, when it loses, and how to weigh the security trade.
MCP vs RAG: how retrieval fits behind the protocol
RAG is a pattern for getting relevant text into a model's context. MCP is a protocol for tools and resources. One can serve the other. Here is how to choose.
MCP vs Skills: where the trust boundary sits
Agent Skills run inside your own agent's sandbox; an MCP server is a third-party dependency on the wire. How to choose by trust boundary and blast radius.
MCP security best practices: the 2026 checklist
The MCP security considerations that matter, as two checklists covering remote endpoints and packaged servers. Every check has a command and a pass condition.
Why MCP server security is hard, and how we score it
MCP servers give agents the power to run code and call tools, which makes server trust a security problem. The threat model, and how we turn it into a number.