MCP vs RAG: how retrieval fits behind the protocol
RAG is a pattern for getting relevant text into a model's context. MCP is a protocol for tools and resources. One can serve the other. Here is how to choose.
Blog
Scoring philosophy, MCP security, and what changed this week.
MCP vs Skills: where the trust boundary sits
Agent Skills run inside your own agent's sandbox; an MCP server is a third-party dependency on the wire. How to choose by trust boundary and blast radius.
MCP security best practices: the 2026 checklist
The MCP security considerations that matter, as two checklists covering remote endpoints and packaged servers. Every check has a command and a pass condition.
Why MCP server security is hard, and how we score it
MCP servers give agents the power to run code and call tools, which makes server trust a security problem. The threat model, and how we turn it into a number.