Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: Security
Cloud Browser: A Secure Remote Browser Platform for Any AI Agent
A reference design for a model-neutral remote browser service: gateway, workers, WebRTC live view, approvals, SSRF guards, replay, and every config setting.
32 min readTaking Agents to Production With Foundry Agent Service and Agent Framework
How a sales-prep agent moves from local code to a hosted, identity-scoped, sandboxed and monitored deployment, published in Microsoft 365 and grounded in business data.
11 min readMCP and OAuth2: Who Authorized the Agent's Action on Your MCP Server?
OAuth2 covers only part of agent authorization in the Model Context Protocol. How OIDC, scopes, confused-deputy rules, GNAP and capabilities fit together.
12 min readAI Agent Audit Logs Need 12 Fields: What LangChain, CrewAI and Four Others Record
A static count of six agent frameworks, from LangChain and CrewAI to the OpenAI Agents SDK, against a 12-field audit trail draft: median coverage is 5 of 12.
10 min readSeven Questions to Ask Before Running a Local MCP Server
A checklist for sandboxing local MCP servers, worked through on the GitHub server: short-lived tokens, sealed network, egress allowlist and pinned tool lists.
8 min readAntigravity CLI Migration: OWASP Scans and Auto-Fixes in the Terminal
Move a Gemini CLI security extension to Antigravity CLI, run local OWASP and dependency scans that support ISO 27001 controls, and let the agent patch an SQL injection.
6 min readScope Guards for AI Agents: Decoding Hidden IPs and Domains Before Running
Scope guards for AI agents: decode nested base64, hex and URL encoding, normalize odd IP formats and filter file names so out-of-scope targets never run.
6 min readMCP, A2A and ACP in Practice: How a Bank Wires Tools and Agents Together
How MCP, A2A and ACP divide the work of connecting models to tools and agents to each other, shown through one bank assistant handling fraud and loans.
17 min readRunning Hermes Agent Locally in Rootless Podman with Ollama on an AMD GPU
Running Hermes Agent locally and securely: rootless Podman, one mounted folder, internal networking, Ollama on an AMD GPU with ROCm, and a systemd unit.
20 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.