MCP Server Cards: what discovery before connection means for operators
SEP-2127 lets remote MCP servers publish a static card that clients find before connecting. What a card holds, what it leaves out, and the rules to set now.
5 min read
Blog category
AI and development
Researched articles on AI coding tools, agents, MCP, LLM cost, governance and security, and engineering practice.
Three Claude advisories in October, for fixes that shipped months earlier
Anthropic published three high-severity Claude Code and Claude Desktop advisories in October. The fixes date from May and June: how to tell if you are behind.
5 min read
MCP SDKs can now check a token's audience, but only if you turn it on
The MCP Python and TypeScript SDKs accepted tokens issued for other services. The fix is opt-in: what to upgrade, what to configure and how to test it.
Claude Code closed permission bypasses: update before relying on deny rules
Claude Code releases from 3 to 14 October 2026 fixed deny and ask rules that could be skipped. What was fixed, what deny rules never covered, and how to retest.
5 min read
Terminal-Bench 4.0 and honest comparisons of coding agents
Terminal-Bench 4.0 is a new task set, not a harder 2.1, and vendor and independent scores already differ. How to read the numbers before they reach a decision.
4 min read
Copilot computer use is in preview: setting rules for desktop-driving agents
Copilot CLI and the Copilot app can now operate desktop apps, in public preview. What the controls are, where the risks sit, and a starting policy for teams.
5 min read
Shrink a coding agent's credential blast radius with secret proxies
NCSC guidance and Copilot's sandbox proxy point the same way: agents should not hold real secrets. How credential proxies work, their limits, and a checklist.
5 min read
Sonnet 5.5's cache-read price cut: what it does to coding agent bills
Anthropic halved Sonnet 5.5 cache reads on 7 October 2026. A worked example of what that means for an agent turn, and why cache misses now matter more.
Why open-weight coding models now appear in financial-stability reports
The Bank of England's FPC tied capable open-weight models to cyber risk. What it said, what it did not, and how to adjust engineering AI policy.
5 min read
Copilot license and repository accounts can now differ: keep attribution intact
The Copilot app and VS Code now let one account hold the Copilot license and another reach the code. What that changes for identity, telemetry and audit.
5 min read
Copilot's Agents window and worktree cleanup: running many agent sessions
VS Code 1.141 adds a session grid and worktree cleanup for parallel Copilot agents. What changed, and the review and disk habits that parallel sessions need.
NCSC's sandbox maturity levels for agentic AI, explained for engineering leads
The NCSC grades agent sandboxes on two four-level ladders, network and compute. How to use them as a scorecard now that local agent sandboxes are shipping.
5 min read
Browse by tag
- #Security (55)
- #Agents (41)
- #AI coding tools (38)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #Networking (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (2)
- #Skills (1)
- #Testing (1)