Notes on AI agents and MCP
Short, plain notes about building AI agents and MCP servers that work in real businesses: what works, what breaks, and why.
June 3, 2026
Your agent trusts the tool description. That's the hole.
To a language model there's no difference between the data you gave it and an instruction — it reads everything as a possible command. That one fact is the whole of AI agent security. Here's how it turns a helpful tool into a data-exfiltration vector, why a prompt can't fix it, and the one structural rule — the lethal trifecta — that tells you when your agent is genuinely dangerous.
- agents
- security
- methodology
June 2, 2026
Cheap code is the most expensive code
The cost of changing software isn't constant — it follows a curve, and the shape of that curve is set by your architecture. Skipping SOLID, DRY, KISS, and DI doesn't save money; it moves the bill to later, with interest. Here's the economics, with the numbers.
- architecture
- methodology
- business
May 17, 2026
The spec is the artifact, not the prompt
When agent behavior lands via spec PRs instead of prompt edits, the team reasons about agents the way it reasons about code. Here's what that looks like in practice and why it works.
- agents
- methodology
- specs
May 15, 2026
Directing coding agents, not writing code
A short note on what changes when the implementation layer is an agent — what stays the same, what disappears, and where the new bottleneck lives.
- agents
- methodology
- ai-native
May 10, 2026
Evals or it didn't ship
Why I refuse to ship an agent without a held-out evaluation set, what makes one useful, and the failure mode I keep seeing when teams skip this.
- agents
- eval
- methodology