Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: ai-security
Safe Tool Discovery for Enterprise AI Agents: Registry, Gateway and Policy
A design for financial-services agents: a Tool Registry, filtered discovery, a deterministic Tool Gateway, intent-level authorization and durable side effects.
7 min readThe Two Ways MCP Servers Fail and a Guardrail Layer to Stop Them
MCP servers fail through over-broad tokens and task-blind tools. Scoped tokens, audience checks, sanitized errors and tool caps make a guardrail layer.
8 min readHow a One-Character Bearer Token Opened LiteLLM's MCP Gateway
Honeypots caught attackers abusing a LiteLLM MCP auth bypass and a guardrails code-execution flaw. Here is the attack chain and a six-step checklist to harden it.
5 min readThe Runtime Graph, Not the Model, Is the Security Boundary for Agents
A late-August 2026 reading of the Hugging Face incident, the cyber defense letter, MCP's missing authentication and TRACE attestation: why agent containment lives in the runtime.
11 min readZero Findings Across How Much Code? Auditing 300 MCP npm Packages
A tarball audit of 300 MCP server packages on npm found 217 with runtime code the scanner never read. Why a clean result needs a coverage receipt attached.
8 min readHyperbrowser MCP in Production: Escalation Ladders, Transports and Guardrails
What Hyperbrowser MCP gives browser agents, where its HTTP and SSE defaults fall short, and the policy gateway, approvals and profile controls you still need.
7 min readThree LangChain Middleware Guards That Keep Agents From Leaking Secrets
Stop an agent from sending API keys to the model or deleting files unasked: PIIMiddleware, HumanInTheLoopMiddleware, call limits and why middleware order decides safety.
10 min readAI Security for Developers: Prompt Injection and Layered Defenses
Why LLM apps break classic AppSec rules, the three vulnerabilities to know, a Python guardrail and tool executor example, and lessons on least privilege.
7 min readGoverned Agent Memory in .NET 10: Quarantine, TTLs and Right-to-Forget
Design persistent agent memory with provenance, quarantine, optimistic concurrency, supersession, expiry, scoped retrieval and event-sourced replay in ASP.NET Core.
10 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.