Field notes
Notes from the workbench.
Engineering notes from building and running hardened tools — the patterns that hold up, the ones that quietly fail, and how to tell them apart. No hype, no doom.
-
- #security
- #architecture
Your agent's tools need a default-deny egress wall
The strongest single control in agent infrastructure isn't auth or sandboxing — it's refusing to let a tool talk to any host you didn't explicitly allow. Here's why, and how to verify it's real.
read → -
- #security
- #mcp
Auth belongs in the MCP server, not bolted on in front
Putting OAuth at the edge feels tidy until the same tool needs to run locally, in the cloud, and across three Claude apps. Auth that travels with the image is simpler and fails safer.
read → -
- #architecture
- #mcp
One tool per container: cheap isolation beats clever isolation
The temptation is one big MCP server with twenty tools. The discipline that pays is one tool per container, cooperating through artifacts — never through calls, networks, or shared credentials.
read →