Loading…
Topic
167 posts about MCP. Every summary links to the original.
See the idea
An agentic ad stack wires governed customer signals to campaign execution through a shared tool interface and server-side guardrails. The diagram shows each layer, the direction of a tool call, and where control stays human.
A four-stage flow showing how a coding agent moves from a task to a reviewed change by grounding on verified skills, live system state, and code-first config before it acts.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Notion used the Model Context Protocol (MCP), an open standard for connecting AI tools to other apps, to expand its AI integrations. Previously, each new MCP connection required hours of manual setup, including creating accounts, navigating developer settings, and testing, so only 25 apps were connected. In three weeks, Notion grew that number to 185 by building a Notion agent that automates the pipeline from setup to production. The agent handles sign-ups, browser clicks, and tests, while humans still review code changes, design assets, and partner with vendors. A key lesson was that private developer apps could pass internal tests but fail for customers, so the agent now tests from a second account simulating real users.
A joint open-source release from NVIDIA and IIT Madras’s AI4Bharat introduces Nemotron-pretraining-Indic-v1, a corpus of approximately 2.8 trillion tokens across all 22 Indian languages listed in India’s Constitution. The corpus includes native-script data for all languages and romanized text for twelve, spanning 34 language-script configurations, built from 15 curated English source subsets covering mathematics, code, and question-answer content. A GPU-accelerated pipeline using NeMo Data Designer and Gemma-4-31B-it translates documents, assesses quality with a Multidimensional Quality Metrics rubric, repairs low-scoring outputs, and converts a subset to romanized text. For ten additional languages, translation uses Indic Translate from Bodhan AI with adapted document-windowing for longer texts. Every record retains a source identifier for provenance, and the full generation recipe including prompts and quality checks is released openly so developers can adapt it to their own source material.
MCP standardized how AI models connect to tools, with clients like Claude Code and Cursor adopting it and SDK downloads approaching half a billion monthly. However, production use reveals that the protocol solves only the interface problem, not the operational concerns around authentication, rate limiting, idempotency, and observability. Teams repeatedly build duplicate infrastructure for deployment, secret handling, health checks, and access control because the protocol does not address these. Context efficiency also remains a challenge: a benchmark showed reducing context from 220,393 to 27,352 tokens (87.6%) while maintaining test pass rates, highlighting the need for deliberate context selection. The author argues that MCP’s success forces the question of building a production-grade infrastructure layer, similar to how HTTP led to CDNs and API gateways.
Many engineering teams mistakenly think building an internal AI knowledge context layer is as simple as standing up a vector database and wiring a RAG pipeline to documentation. In reality, a production-grade pipeline requires five continuously maintained stages—capture, deliver, govern, organize, and validate—where each stage’s long-term cost compounds as vendor APIs change and content ages. The critical innovation is the knowledge node, a living record carrying source, ownership, and an automatically computed trust score based on authorship, usage, recency, and conflicts. Trust decays over time, prompting owners for lightweight revalidation when confidence drops, and knowledge is automatically scoped to the correct audience without manual filing. For product companies not in the knowledge-infrastructure business, the compounding maintenance burden makes building this pipeline a distraction compared to leveraging existing platforms like Stack Internal.
Google announced DPoP (RFC 9449) support for its OAuth platform, specifically binding refresh tokens to a client-generated asymmetric keypair to neutralize token theft and replay attacks from Infostealer malware and AiTM threats. Access tokens remain standard bearer tokens to avoid the per-request asymmetric cryptographic verification overhead on high-QPS APIs like Gmail and Drive, delivering a pragmatic tradeoff between security and performance. The implementation follows RFC 9700 best practices for sender-constrained refresh tokens and is recommended for Backend-for-Frontend (BFF) and Token-Mediating Backend architectures. DPoP operates at the HTTP header level, making it resilient in multi-hop environments such as Model Context Protocol (MCP) agent chains, though multi-agent delegation requires Google Cloud Secure Token Service (STS) to preserve key isolation. Complementary protections against cookie theft are offered by Device Bound Session Credentials (DBSC), which cryptographically binds browser session cookies to device hardware for a defense-in-depth strategy.
AI agents in chip design often produce plausible but incorrect artifacts, making reliability a key barrier to production adoption. NVIDIA NeMo Gym, an open library for evaluating models and agents using environments, solves this by diagnosing failure modes in multistage workflows through verification of final outputs against reference artifacts. Applied to the Siemens Fuse EDA AI Agent for standard-cell characterization, NeMo Gym uses a verifier that checks coverage, validity, relative validation, integrity, and accuracy of generated Liberty files against known references. After refining the agent’s skills and MCP tool descriptions based on trajectory analysis of failures, the composite benchmark score improved from approximately 55% to 95%, while agent turns fell from 155 to 53 and output tokens dropped from ~81K to 29K. This method generalizes to other engineering domains by emphasizing evaluation of final artifacts and domain-specific verifiers.
The post presents a tutorial for building a TypeScript Model Context Protocol (MCP) client that uses Cross App Access (XAA) to securely bridge enterprise apps across trust domains. The sample app is an employee onboarding dashboard that signs in through an identity provider, exchanges identity for an Identity Assertion JWT Authorization Grant (ID-JAG), trades it for an access token, and fetches data from a protected MCP server. The tutorial uses the MCP TypeScript SDK’s CrossAppAccessProvider to automate the four-step XAA flow, including token exchange and retry on 401 responses. Developers test against xaa.dev, a free playground that hosts the IdP, authorization server, and a todo MCP server. The post explains key concepts like ID-JAG claims, separate client credentials per trust domain, and how XAA enables AI agents and enterprise apps to act on behalf of users without OAuth consent screens.
Notion built Data Scout, an internal data agent connecting Snowflake and Notion, letting employees query governed data in plain language and cutting request turnaround from days to minutes. Within two months, weekly data team requests fell by about 80 percent, and roughly half of all employees now use it. The agent enforces Snowflake permissions per user and uses Notion business context, enabling teams such as Sales, Engineering, and Customer Experience to ask questions about account adoption, onboarding drop-off, or support volume using shared definitions. Using MCP, teams built Data Scout Reporter for scheduled reports and domain-specific agents that reuse the same context. Notion learned correct SQL could still answer the wrong question due to four failure modes, so they built governed access, curated context, instructions, query tracing, and a review process where change evidence is not approval.
The post details a hands-on lab from Red Hat Summit 2026 that demonstrated managing Red Hat Enterprise Linux using three Model Context Protocol (MCP) servers connected to a single goose client. The MCP servers for Red Hat Lightspeed, Red Hat Satellite, and RHEL each require different authentication: a Hybrid Cloud Console service account, a registry.redhat.io login with a CA bundle and personal access token, and pre-configured SSH keys respectively. Installation is straightforward using Podman containers for Lightspeed and Satellite, and uv for the RHEL server. The author tested about a dozen models and found MiniMax M2 effective, but had to switch to Claude Opus 4.6 when a shared Vertex AI token limit was exceeded during the lab. Key takeaways include that authentication is the most complex part, model choice significantly impacts behavior and cost, and capacity limits must be considered for multi-user environments.
The Kotlin Toolchain 0.13 provides a unified CLI entry point for building JVM, Android, iOS, multiplatform, and server-side applications with declarative configuration. It introduces the kotlin new command for interactive project creation, improved iOS onboarding with automatic simulator setup, and Android SDK auto-provisioning on IDE import. New features include Swift Package Manager dependency support for Apple platforms, multiplatform library publication with Compose Resources and SwiftPM metadata, and Kotlin/Native compiler caching for faster rebuilds. The toolchain is designed for both developers and AI agents, with a Hot Reload MCP server and dedicated AI agent skills included in official Kotlin agent skills. The team recommends the toolchain for new KMP projects and plans future milestones like brew installation, out-of-the-box AI skills, and streamlined app store publishing.
The Developer Knowledge API is Google’s official, programmatic source for developer documentation across Google Cloud, Firebase, and Android. It replaces web-scraping with a structured API serving fresh Markdown-formatted documentation, offering semantic and keyword search, intelligent document chunking, and grounded Q&A. The ecosystem includes a gcloud CLI surface that integrates search and grounded Q&A into terminal environments without extra plugins. An agent skill uses the standard MCP integration to connect AI assistants such as Claude Code, Cursor, and GitHub Copilot to up-to-date documentation. Multi-language client libraries enable programmatic access with features like BatchGetDocuments for retrieving up to 20 documents in one call.
Meta’s ads MCP server, now in Databricks Marketplace, connects Meta Ads Manager tools with enterprise data through Genie for natural language campaign management. The server uses the open MCP standard to expose over 25 tools across the campaign lifecycle including creating campaigns, adjusting budgets, defining audiences, and pulling performance data. Marketers can prompt Genie One to use business data like churn scores and gross margins, for example identifying high-value customers at risk of leaving and launching a retention campaign with an $8,000 daily budget. Governance is enforced server-side: Databricks administrators control access via Unity Catalog while Meta advertisers set rules in Business Settings that block actions like budget increases over 20%, with every tool call checked before execution. The integration builds on the Meta Conversions API partnership, letting agents combine signal diagnostics with Databricks models to put customer intelligence directly into campaign operations and execution.
Unreal Engine 5.8 introduces Unreal MCP, an experimental feature that runs a first-party MCP server inside the editor, allowing coding agents to drive the editor directly. The Sentry plugin registers tools and skills that agents can use to set up crash reporting, including DSN configuration, symbol upload, instrumentation, and crash debugging. Agents can discover and use these tools through the editor’s MCP interface, with skills that follow ground rules like asking before changing settings and never exposing secrets. The integration also supports connecting to Sentry MCP for server-side operations like fetching DSNs and looking up events. In a test with the Sentry Tower demo, an agent configured Sentry from scratch, enabled symbol upload, packaged a build, captured a crash, and identified the root cause as an empty projectile class in a level-up button.
Supabase announced a code-first approach at its Select 2026 event, enabling developers to store schema and configuration in code so coding agents can set up and modify projects end to end. Local Supabase now runs as native processes without Docker, allowing multiple instances per directory and compatibility with sandboxes like Claude Code. A new MCP server lets application users connect their own agents, authenticating through existing Auth flows and enforcing row-level security on every tool call. Operational tools include Health Check Advisors for error rates, Database Connections for session management, Explorer notebooks for unified SQL and log queries, and query_logs for agent monitoring. Scaling features encompass Multigres for multi-node Postgres high availability, OrioleDB to avoid table bloat and VACUUM, Supabase Pipelines for near real-time data streaming to analytics platforms, and dbarena for transparent benchmarks.
At Supabase Select, Supabase announced tools that let coding agents find production problems, test fixes, and report back, with controls for access and permission. A new MCP tool gives agents raw SQL access to project logs, advisor checks now include health signals for error rates across Data API, Auth, Storage, and Edge Functions, and the database connections view shows sessions, long queries, idle-in-transaction, blocked, and lock holders. Notebooks combine saved database or log queries with markdown notes, can be created in the dashboard via the Assistant, pulled locally with supabase notebooks pull, and pushed with supabase notebooks push, and are found in the new Explorer rolling out through October 12. Updated Skills provide a living document of common health, security, performance, and resource signals for agents to watch for and how to monitor them. Supabase Pipelines, available on paid plans, allow replicating data to BigQuery, ClickHouse, DuckLake, or Snowflake.
Supabase announced tools at Supabase Select that let coding agents manage backend configuration and deployment from code, eliminating the need for dashboard-only changes. Declarative Schemas 2.0 allows agents to edit SQL files as the source of truth, with pg-delta generating migrations, while config.toml holds settings like auth providers that can be pulled back from the dashboard. Local development now runs as native processes without Docker, supporting multiple instances per directory and working in environments like Claude Code’s sandbox, currently in alpha off by default. Supabase Compute provides long-running services in any language alongside the database, with configurable memory and CPU, public or private HTTP endpoints, and deployment via CLI or Management API. The new MCP server lets user agents interact with an app as the signed-in user, respecting existing RLS policies, built on @supabase/server and Supabase Middleware, with a headless app template available.
Seer is Sentry’s agent debugger that reasons across errors, traces, logs, profiles, and linked repositories to identify root causes, not just surface-level stack traces. The Sentry MCP, set up via the agent plugin with a single command, bridges Sentry’s data into coding agents like Claude Code and Cursor, enabling them to invoke Seer’s full analysis. The new Sentry CLI provides natural-language access to Seer’s diagnosis and issue management directly from the terminal, using selectors like @latest and @most_frequent. These tools are complementary: Seer provides deep diagnosis, while the MCP and CLI deliver that context into the environments developers already use. Teams can automate the entire workflow so Seer diagnoses, an agent fixes, and a draft PR awaits review without human involvement until approval, with Seer triggering on issues meeting event count and fixability thresholds.
Notion built a Custom Agent workflow in Notion to keep Academy content current as product changes ship. The system uses two databases: an Academy library mapping the curriculum and a maintenance-tasks database tracking work from each product change. Two Custom Agents handle the work: the Academy Drift Agent compares launch docs against the library and flags affected lessons, while the Academy Drafting Agent drafts approved updates using editorial guidance. MCP connects the workflow to Parta, the e-learning platform, so approved content moves into final QA without manual hand-off. The loop includes human review checkpoints before scope approval and before content moves into Parta, reducing content drift and giving the team hours back each week.
MCP agents can produce claims that are factually true but attributed to the wrong source, a failure known as cross-source conflation that source-blind checkers miss. ProvenanceGuard preserves source identity by decomposing answers into claims, routing each to its relevant tool output, and checking support and attribution separately, using local models like MiniLM and DeBERTa. On medical agent traces with 281 interactions, it caught 138 of 139 claims experts flagged, scoring 0.802 F1 on blocking decisions and correct source 86% of the time. It flagged 67 supported claims for review under a cautious policy and added roughly half a second per answer in local tests. Blocked answers can be fixed through a repair loop for rewriting or fallback, avoiding unverifiable responses while keeping sensitive traces in a controlled environment.
This tutorial explains how to integrate Claude Code with Auth0’s Management API using the Auth0 MCP Server, enabling AI-driven authentication configuration management from the terminal. The setup uses the OAuth 2.0 Device Authorization Flow to obtain scoped access tokens stored in the OS keychain, avoiding static secrets that risk exposure in source control. Developers initialize the MCP server with explicit scopes like read:clients or update:actions, then register it with Claude Code via the claude mcp add command, with credentials never stored in plain text. A CLAUDE.md file provides project context and constraints, guiding the agent to respect environment-specific configurations and security policies such as never modifying production callback URLs without confirmation. The tutorial demonstrates refactoring JWT validation code in a single terminal session, with human-in-the-loop confirmation ensuring safe agentic changes and all auth-critical paths undergoing manual PR review.
The best engineering reads, once a week.
