§ archive

All Posts

Every article from the archive, newest first.

Aug 31, 202612 min readsupply-chain openssf governance observability
Reviewed-by: Nobody
A High-weight Scorecard check gives 10/10 to a repo nobody reviewed. Four of five paths never look at who approved anything.
Jul 31, 20267 min readmcp sdk protocol governance
The Fossil Record
A dead protocol revision, fossilised in a stable SDK's type system. Why hasattr is not feature detection, and the ninety-second habit that catches the whole class.
Jul 28, 202611 min readmcp governance security llm
The Bill Came Due Early
I predicted eighteen months of governance debt. It was called in one quarter. Six January claims, graded without mercy, against February's malware, April's RCE, and today's spec.
Jul 02, 202610 min readmcp governance security async
There Was No Tenant
The tenant check passed. There was no tenant — or it was someone else's. Why async tasks are where per-request governance dies, silently and by default.
Jun 30, 20268 min readmcp governance security oauth
Off By Default
MCP's biggest revision made the governance layer opt-in and off by default. Everything that keeps an agent honest is now yours to turn on.
Jun 23, 20268 min readmcp governance security observability
The Advisory List: Why MCP Governance Lives at the Call Path
You withdrew the tool. The agent is still holding last week's menu. Why MCP governance can only live where the call is mediated.
Jun 18, 202613 min readobservability ai-agents mcp eu-ai-act
The Agent With No Flight Recorder
OpenClaw got patched twice and still couldn't tell you what it did. That's not a security gap — it's a missing flight recorder. And the EU just gave everyone sixteen more months to pretend that's fine.
May 24, 20269 min readgovernance eu-ai-act observability audit
Sixteen Months
Sixteen months of relief — except the two soonest obligations are still seven months out, and Article 12's logging requirement is an architecture decision you can't defer. Brussels blinked. You can't.
May 04, 202627 min readai-agents mcp governance post-mortem
Nine Seconds
Nine seconds. One curl. A startup's production data and all its backups, gone. The agent wrote a confession afterward — and the confession was the least useful part. Same architecture failure, third time this year.
Apr 27, 202623 min readmcp governance security supply-chain
The MCP Trust Deficit
Twenty-two thousand MCP servers. Zero mandatory security checks. The protocol won — the trust layer never shipped. An audit of what's actually exposed.
Apr 19, 20267 min readobservability incidents governance post-mortem
Three Ways Your API Lies: Lessons from GitHub's Rough Week
Four GitHub incidents in five days. Three are the same failure wearing different masks — stale caches, ghost state, retry storms. That pattern is probably in your stack too.
Apr 16, 202617 min readobservability llm post-mortem mcp
LLM-Assisted Post-Mortems: The Streetlight Effect, Industrialized
You pasted logs into ChatGPT and got a plausible RCA. It's wrong. What changes when your LLM can query the observability stack directly — and what new failure modes that creates.
Feb 09, 20269 min readmcp benchmarks performance mcp-hangar
Benchmarking MCP Tool Calls: Three Findings That Aren't 'Parallel Is Faster'
5,300 measurements, 6 scenarios. The headline is 19.6× speedup — the real findings are that stdio isn't serial, framework overhead is zero, and a hardcoded constant was capping your throughput.
Jan 15, 20269 min readmcp governance security llm
The MCP Governance Problem Nobody's Talking About
Everyone's plugging unvetted MCP servers into production LLMs. Nobody's asking who's liable when they leak credentials or delete data. The governance gap enterprises are ignoring.
Nov 23, 20257 min readobservability logs cost-optimization vector
The Log Alerting Trap: Why Grepping Text is Not an Observability Strategy
Log-based alerting seems free until the bill arrives. Why grepping text is the observability equivalent of payday loans — and what to build instead.