10 min readmcpgovernancesecurityasync
There Was No Tenant
The tenant check passed. There was no tenant — or it was someone else's. Why async tasks are where per-request governance dies, silently and by default.
§ archive
All Posts
Every article from the archive, newest first.
- 8 min readmcpgovernancesecurityoauth
Off By Default
MCP's biggest revision made the governance layer opt-in and off by default. Everything that keeps an agent honest is now yours to turn on.
- 8 min readmcpgovernancesecurityobservability
The Advisory List: Why MCP Governance Lives at the Call Path
You withdrew the tool. The agent is still holding last week's menu. Why MCP governance can only live where the call is mediated.
- 13 min readobservabilityai-agentsmcpeu-ai-act
The Agent With No Flight Recorder
OpenClaw got patched twice and still couldn't tell you what it did. That's not a security gap — it's a missing flight recorder. And the EU just gave everyone sixteen more months to pretend that's fine.
- 9 min readgovernanceeu-ai-actobservabilityaudit
Sixteen Months
Sixteen months of relief — except the two soonest obligations are still seven months out, and Article 12's logging requirement is an architecture decision you can't defer. Brussels blinked. You can't.
- 27 min readai-agentsmcpgovernancepost-mortem
Nine Seconds
Nine seconds. One curl. A startup's production data and all its backups, gone. The agent wrote a confession afterward — and the confession was the least useful part. Same architecture failure, third time this year.
- 23 min readmcpgovernancesecuritysupply-chain
The MCP Trust Deficit
Twenty-two thousand MCP servers. Zero mandatory security checks. The protocol won — the trust layer never shipped. An audit of what's actually exposed.
Three Ways Your API Lies: Lessons from GitHub's Rough Week
Four GitHub incidents in five days. Three are the same failure wearing different masks — stale caches, ghost state, retry storms. That pattern is probably in your stack too.
- 17 min readobservabilityllmpost-mortemmcp
LLM-Assisted Post-Mortems: The Streetlight Effect, Industrialized
You pasted logs into ChatGPT and got a plausible RCA. It's wrong. What changes when your LLM can query the observability stack directly — and what new failure modes that creates.
- 9 min readmcpbenchmarksperformancemcp-hangar
Benchmarking MCP Tool Calls: Three Findings That Aren't 'Parallel Is Faster'
5,300 measurements, 6 scenarios. The headline is 19.6× speedup — the real findings are that stdio isn't serial, framework overhead is zero, and a hardcoded constant was capping your throughput.
- 8 min readmcpgovernancesecurityllm
The MCP Governance Problem Nobody's Talking About
Everyone's plugging unvetted MCP servers into production LLMs. Nobody's asking who's liable when they leak credentials or delete data. The governance gap enterprises are ignoring.
- 7 min readobservabilitylogscost-optimizationvector
The Log Alerting Trap: Why Grepping Text is Not an Observability Strategy
Log-based alerting seems free until the bill arrives. Why grepping text is the observability equivalent of payday loans — and what to build instead.