标签：#agents

So you have heard people rave about Claude Code. Maybe you have also heard people mention OpenRouter in the same breath, usually followed by some combination of environment variables and a screenshot of a terminal. If you are new to any of this, it can feel like everyone skipped a step and jumped straight to the jargon. This guide is that missing step. We will go slow where it matters, explain the confusing bits, and by the end you will actually understand what is happening instead of just copy pasting commands and hoping. The two things, quickly Claude Code is Anthropic's terminal coding agent. It reads your files, edits code, runs commands. By default it talks straight to Anthropic's servers. OpenRouter is a switchboard. It a switchboard for AI models. Instead of every app needing its own separate connection to every AI provider, OpenRouter sits in the middle and lets you route requests to different models through one account, one dashboard, and one place to watch your spending. (Even free and open source models!) You can check out all the models provided by OpenRouter here . Important honesty check: OpenRouter's own docs say this combo is only guaranteed to work well with Anthropic's own models. You're not really swapping Claude's brain out here, you're mostly rerouting the pipe it talks through. Quick vocab check: "OpenAI compatible" Claude Code sends requests in Anthropic's format. Some servers only understand OpenAI's format instead. Point Claude Code at one of those by mistake and you get garbled errors, like mailing a French letter to someone who only reads Spanish. OpenRouter has an endpoint that speaks Anthropic's format natively, so no translation step, no separate proxy needed. Wait, do I use zsh or bash? How would I even know This question stops more beginners than anything else in this guide, and it is a fair one. Here is how to check in ten seconds. Open your terminal and type this, then press enter: echo $SHELL You will get one of these back: Somethi

The AI chatbot was more effective at creating “exploitable trust” than the humans.

The slowest job on the content platform I run is authoring a review end to end. Create the record, fill seventy-odd structured fields, write the narrative blocks, upload and wire the screenshots, publish. Every review follows the same shape, which is exactly what makes it miserable and exactly what makes it a good candidate to hand off. The worry people lead with is quality. Will the agent write something embarrassing? That is the easy half. A draft is reviewable, and a bad draft costs nothing but the time it takes to read. Authoring means writing to production, though, and that is a different animal. An agent with write access to a live CMS is not a drafting tool. It is a second admin who never sleeps, never gets bored of the tedious fields, and will work straight through the backlog without ever wondering whether the first record came out right. So the question was never whether an agent could edit the site. It was: what does it authenticate as, what enforces the rules when it writes, and can I reconstruct afterwards what it did. Why a tool server and not a script I weighed three shapes for the write path. One-off REST scripts are the fastest thing to start and the worst thing to own. Each one re-implements whatever slice of the validation rules it happens to need, they do not compose, and nothing tells you later which of them check anything at all. Browser automation is more tempting than it looks, because driving the real admin UI inherits every rule the UI enforces for free. It is also slow, brittle against any markup change, and hands you a screenshot where you wanted a result. I built an MCP server instead. The tools are primitives (get a listing, update a listing, upload an asset, replace a page's blocks) and the agent decides how to sequence them. That was the part worth paying for: I did not have to anticipate the workflows, only the verbs. Roughly forty tools now cover the entity types the CMS manages, and none of them encode a workflow. One server, two t

Watching an autonomous agent run through a loop of tasks is like watching a black box try to solve a puzzle in another room. You can see the final result, but the middle part—the reasoning, the failures, and that pivotal moment where it realizes its plan was garbage—is buried in thousands of lines of unstructured logs. If you've ever deployed an agentic workflow only to check back an hour later and find it has been stuck in a high-latency loop of 'I made a mistake... let me try again' for forty minutes, you know the pain. You didn't have failure; you had expensive, silent repetition. The problem with current LLM observability is that we focus too much on the input and output (the traces) and not enough on the internal state transitions of the agent itself. We need to quantify how often an agent is actually self-correcting versus just spinning its wheels. I recently started working with a specific tool designed for this exact visibility gap: the Agent Self-Reflection & Sentiment Scanner . The Observability Gap in Agentic Loops When we talk about 'agents,' we're usually talking about a loop: Observe, Think, Act, Repeat. In a perfect world, the 'Think' step includes self-correction. If an action fails (e.g., a 403 error from an API), the agent should reflect on that failure and adjust its next move. But how do you measure if your agent is actually getting better during a session? How do you distinguish between an agent that is 'Proceeding' with confidence and one that is in a state of constant 'Correction'? You can't just look at the final success/fail status. You need to parse the execution logs for deterministic markers. Why Deterministic Matching Wins Over LLM-Based Analysis The temptation here would be to pipe your agent logs into another, even larger LLM and ask, 'Is this agent struggling?' Don't do that. It’s redundant, it’s slow, and if you're running high-volume loops, the cost will kill your margin. You've already paid for the primary reasoning engine; don't p

Agent security today is inherited from the connection. N-AALP makes the message itself carry identity, authorization, approval and audit, verifiable offline, on any transport. Your agent just deleted a production table. The audit log says the request was approved. Now prove it. Not "show me the log line" - prove it, to someone who does not trust your log, your gateway, or your database. Which key approved it? Were those the exact arguments that were approved, or did something rewrite them after approval? Was that approval already used once? If your answer to any of those starts with "well, our gateway checks that," then the proof lives in your infrastructure, not in the message. Replay the message somewhere else and the proof is gone. This is the gap I have been working on. It has a name worth stating plainly: agent security today is inherited from the connection. TLS tells you the tunnel was private. mTLS tells you which service opened it. A bearer token tells you someone had a credential. None of that survives the message being written to a queue, forwarded by a relay, logged, replayed, or handed to a second agent. The moment a message leaves the connection it arrived on, it is just bytes with no provable origin. N-AALP is my attempt to close that. It is an application-layer object protocol where the message, not the connection, is the unit of security and governance. Full disclosure before you read further: I wrote it. I am the sole editor and maintainer, it is draft-bubblefish-naalp-00, an Independent Submission, and it claims no IETF working-group consensus. I would rather you read the spec and tell me where I am wrong than take my word for anything below. There is a section at the end listing what it does not do. The one-object idea Every N-AALP message is one signed object. Not a request type, not an envelope-plus-payload, not a header format with a body convention. One structure, one signature, one identity model, one authorization model, one audit model, an

A short case study from my "building and testing MCP agents" series — it stands on its own, but the method behind it is laid out in https://dev.to/langensjonathan/the-parameters-that-actually-matter-when-youre-tuning-an-ai-agent-2agd . TL;DR: I benchmarked two agents that are identical except for one thing — how many MCP servers they're connected to — on the exact same question. Both got the right answer, both called the same single tool. The one with more MCP servers attached still cost 28% more per question , purely from the extra tool schemas the model has to be told about on every single call, whether it uses them or not. The setup MAVERIK is my open-source MCP test bench: define a suite of questions with pass criteria, run it against one or more agent configurations, and compare the results on hard numbers. This post is one deliberately tiny experiment with it: change exactly one thing about an agent, hold everything else fixed, and see what the numbers attribute to that one change. I have a small "GitHub summarizer" agent: one system prompt, one job — answer questions about my GitHub account by calling the GitHub MCP server . I duplicated its configuration (MAVERIK supports this directly — same model, same prompt, same everything) and changed one field on the copy: the set of attached MCP servers, adding deepwiki , microsoft-learn , and context7 . Neither agent needs any of those three for the question I was about to ask; they were attached because that's what the "kitchen sink" version of this agent had accumulated over a few sessions of general-purpose use. Then I wrote the simplest possible test suite — one question: "How many repositories do I have?" with a contains criterion checking the answer includes the correct count. No judge model, no subjectivity — it either says the right number or it doesn't. I ran both agents against it, 2 repetitions each, same model ( claude-haiku ) for both, and pulled up MAVERIK's Agent Comparison report. Agent A — github on

The deal gives Okta identity threat detection capabilities as enterprises seek to secure AI agents and other non-human identities across cloud environments.

A common MCP setup carries auth the same way: create an API key, paste it into mcp.json or an .env file, restart the client. It works. Now the key sits in plaintext on every machine that runs the agent. It often carries one broad, fixed permission set. Every agent that reads the file gets the same set. And when one agent misbehaves, the fix is rotate the shared key everywhere. There's a second failure that arrives after you add real auth: the agent calls a tool and gets a bare 403. The user doesn't know what to approve. The agent doesn't know what to ask for. Somebody ends up reading server logs. I build multiuser AI systems for production. My agents act on users' Gmail and Slack accounts every day - external agents like Claude Code included. None of those agents receives a provider token. This is the auth chain that makes that work, including the part that took the most design: what happens when consent is missing at call time. A URL instead of a key An external agent doesn't get the Gmail or Slack credential. It gets a URL - a managed MCP endpoint my platform exposes. I call that endpoint the door, and so does the interface further down. Claude Code connects to the door as an OAuth client. Dynamic client registration (DCR) registers its client identity against a configured redirect allowlist. The user signs in and approves the maximum this connection may be granted. The OAuth exchange returns a scoped KDCube bearer tied to that client and grant, not a provider token. The approval screen also resolves those requested capabilities to the accounts behind them. If a required provider is not connected, it is named there with a connect link. The connect step already says what to add - the same shape as the call-time denial later in this post, moved to the front. Approve it, and the connection becomes a card. That card is the whole governance relationship. Nobody registered Claude by hand, and nobody pasted a provider token. The checklist is a ceiling: the most this app

Plus, a new deprecation policy ensures features aren't removed suddenly.

Originally published on tamiz.pro . The rise of "vibe coding" has democratized software development, allowing developers to build complex applications using natural language prompts. However, this same flexibility introduces a fundamental challenge for enterprise-grade AI agents: non-determinism. When you ask an LLM to "handle this customer support ticket," the model might draft an email, query a database, or call an external API—depending on the temperature, the context window, and the whims of the weights. For simple chatbots, this is fine. For agents that interact with bank accounts, manage server infrastructure, or coordinate multi-step business logic, this unpredictability is a liability. To bridge the gap between the creative, probabilistic nature of Large Language Models (LLMs) and the rigid reliability required by production systems, engineers must introduce structure. The most robust pattern for this is the Finite State Machine (FSM). By decoupling the decision logic from the execution logic , you create agents that are not only smarter but also predictable, auditable, and debuggable. This deep dive explores the architecture of FSM-driven AI agents, why they are essential for moving beyond prototypes, and how to implement them effectively using modern TypeScript libraries like XState and LangGraph. The Problem with Linear Chains In the early days of agentic AI, the dominant pattern was the linear chain: a sequence of LLM calls where the output of one becomes the input of the next. While simple to implement, this architecture suffers from several critical flaws that become apparent at scale: Lack of Error Recovery : If an LLM call fails or returns malformed JSON, the entire chain collapses. There is no defined "state" to revert to, no way to retry a specific step, and no way to pause for human intervention. No Global Context : Each step in a linear chain is often isolated. The second LLM call may not have access to the full history of decisions made in the f

Eighteen months ago, MCP was the thing. Every demo and chatbot connector was running on MCP under the...

On July 29, 2026, five OpenClaw agents sat down at Synthetics' Last Cradle and played for five hours and twenty-one minutes without a human in the loop. They negotiated in public chat. They emailed each other. They opened HOLA lines. They ran cron heartbeats every five minutes. When the white hole opened at turn 33, two cradles were still alive. This is not a mechanics dump. It is what the players reported — winners, early deaths, and the ones who almost made it — and how IdentyClaw Passport made that multi-agent arena possible. Live playbook (pin this, do not fork it): https://slc.discernible.io:8443/api/game/skill.md Lore map: https://slc.discernible.io:8443/api/game/narrative TLS note: game API needs :8443 . Bare host without the port returns 404. The cast (same Passports, many lives) These are not throwaway bots. They are Passport holders on an OpenClaw hive — stable 12-letter tokenId s , personal email, A2A endpoints, webhook wake URLs. The same identities recurred across lobbies all week. Display name Passport tokenId July 29 fate (game 01KYQ372… ) John Vanderbilt bmspzpzhcdgq 🥇 White Hole Anchor — survived, wealthiest Jay lfcjlkskbnzd 🥈 Co-Cradle of the Restart — survived Daniel Morgan cnljzmbqlfsm Eliminated turn 33 (final tick) Joe Carnegie lflvlnbrsfcq Eliminated turn 16 Cornelius cfbkbhzdzflk Eliminated turn 9 Across earlier games that same week, the roster rotated roles: Daniel died at turn 5, then clawed to turn 27; Joe once won a one-turn sprint as White Hole Anchor; Jay carried a water-surplus specialty into a 33-turn alliance with John. Identity persisted. Strategy evolved. That is the Passport pitch in one sentence. What is SLC, in one screen Each agent wakes as a cradle specialized in energy, water, or compute. Every turn: Negotiate — public messages on the game API (non-binding theater) Settle privately — A2A, email, HOLA on side channels (where trust lives) Execute — transfer , invest , transfer_and_invest , or none Survive — pay escalating costs

Picture a moment every person who runs an AI agent knows. A task is halfway done and starting to go wrong. The agent took a weird turn a few steps back and now it is confidently heading somewhere bad. You have to decide fast on this. Do you step in? And if you do a quick "wait, check your work" nudge will that actually fix it? Or do nothing? Or worse knock a run that was about to recover on its own off the rails? That question is the whole project. Here is the honest short version of what I found. Detecting a failure is not fixing it A lot of recent agent research is about failure attribution — figuring out which step in a long run broke everything. Useful but it stops one step short of what you need when you are on call. Knowing where it broke is not the same as knowing what to do about it . So I asked a blunter question: given a failure, which fix actually recovers the run and which ones quietly make it worse? To answer it without fooling myself I rewind each failing run to the exact step where it went wrong, apply one fix, let it play forward and check the real answer against a hard ground truth no LLM grading another LLM. And I always compare against a "do nothing" control, because some runs recover on their own, and I did not want to give my fixes credit for that (or miss a "fix" that's actually worse than leaving the agent alone). What a capable agent actually gets wrong First surprise: a decent agent mostly doesn't fail in the dramatic ways people worry about. It rarely loops, rarely forgets to answer, rarely fumbles a tool that throws an error in its face. It fails in two quieter ways and both are the same underlying mistake: acting on the surface of the situation instead of the real thing underneath. It makes up an answer it could have looked up. The fact it needs is sitting right there behind a tool call it just never makes, so it fills the gap with something plausible. Reads "manager: #202," never looks up who #202 is, asserts a name anyway. It trusts a t

A voice agent can sound polished, respond instantly, and still create a trust incident in one sentence: “Stop calling me.” If that request only updates the SMS path, your agent may keep dialing tomorrow. If it only updates a call transcript, your follow-up workflow may keep texting. For builders shipping AI callers, inbox agents, scheduling bots, or multi-step outreach workflows, consent is no longer a static checkbox. It is runtime state. That is where an AI consent ledger helps. It gives every agent action a simple rule: before contacting, enriching, recording, or escalating a person, check the latest consent state from one durable place. This guide shows how to design that ledger without turning your product into a compliance maze. This is technical architecture guidance, not legal advice. If your workflow touches regulated outreach, health, finance, employment, or sensitive personal data, involve a qualified legal reviewer. Why AI agents make consent harder Traditional apps usually ask for permission at predictable moments: signup, newsletter opt-in, cookie banner, phone number capture, or billing consent. AI agents blur that boundary. A production agent may: answer an inbound call summarize a voicemail text a follow-up link schedule another call enrich a CRM record trigger a campaign step next week hand the case to a human retry after a failed tool call switch from voice to SMS or email Each step may be valid by itself. The risk appears when consent changes in one channel and the rest of the workflow does not notice. The common failure shape is simple: User revokes permission in the channel in front of them. The agent logs the message as conversation text. Another workflow keeps running because it never checked revocation state. That is not an LLM problem. It is a state-management problem. What is an AI consent ledger? An AI consent ledger is an append-only record of permission events plus a fast read model that answers one question: Is this specific agent allo

Handoffs are useful when a specialist agent needs to take over a task. They also make cost easier to hide, because the bill is spread across graph nodes instead of one visible chat turn. Why can LangGraph handoffs multiply tokens? LangGraph handoffs can multiply tokens because each model-calling node may resend instructions, prior messages, retrieved material, tool returns, summaries, and artifacts, then loops or handoffs repeat that payload for the next agent. Token amplification is the total prompt-plus-completion tokens across a trace divided by a simpler baseline for the same task; Anthropic reported in June 2025 that multi-agent systems used about 15x more tokens than chats while improving an internal research evaluation by 90.2% . Quick Answer: Handoffs raise the token bill when each agent receives copied context instead of a narrow task packet. Anthropic’s June 2025 research system showed the tradeoff clearly: multi-agent runs used about 15x more tokens than chats while scoring 90.2% higher on its internal research evaluation . In LangGraph, the practical issue is observability and budgeting, not whether graphs are bad. The LangGraph project describes the runtime as a way to build stateful, long-running agents with persistence, human control, memory, and debugging support; those same traits make it possible to measure where context grows instead of guessing. "Multi-agent systems are often highly effective at open-ended research tasks, but token usage can be substantial," — Anthropic engineering team at Anthropic The small verified demo below shows the arithmetic behind a 15x bill: a 100-token task becomes 1,500 billed tokens when 5 agents each receive 3 copies of the relevant context . """ Tiny token-accounting demo: handoffs multiply the same task context. """ task_tokens = 100 agents = 5 context_copies_per_handoff = 3 # instructions + task + summary/history direct_bill = task_tokens handoff_bill = task_tokens * agents * context_copies_per_handoff print ( f

I've spent enough time in the trenches of software engineering to know that there is nothing more soul-crushing than writing 'glue code.' You know exactly what I mean—the thousands of lines of boilerplate, error handling, and webhook listeners required just to make two services talk to each other. When Bland AI first arrived on the scene, it was essentially another API you had to integrate. You'd write a Node script, handle the async nature of outbound calls, manage your credentials in environment variables, and then spend weeks building a dashboard just so you could see what happened during a call. It worked, but it wasn't intelligent. The shift we are seeing right now with the Model Context Protocol (MCP) changes the fundamental architecture of integration. We are moving from 'integration as an engineering task' to 'integration as a capability.' Instead of writing code to bridge Bland AI and your application, you provide an MCP server that gives your LLM—whether it's Claude or Cursor—direct access to those telephony tools. I recently started using the Bland AI MCP server via Vinkius, and the difference in how I can orchestrate workflows is night and day. This isn't about just 'making a call.' It's about giving an agentic loop control over a communication channel. The Architecture of Voice Orchestration When you look at traditional API integrations for something like Bland AI, you focus on the request/response cycle. You send a payload to trigger a call, and then you wait for a webhook to notify your backend that the call is finished. With this MCP server, the mental model shifts. You aren't managing webhooks; you are managing tools. The toolset provided here—including send_phone_call , create_voice_agent , and list_recent_calls —allows an LLM to act as a telephony engineer. Here is what happens when you actually use it in Cursor or Claude: You don't just say "Make a call." You can instruct the agent, "Look at my recent calls from yesterday, find any where the tran

TL;DR: MCP servers run with significant privileges inside AI agent pipelines, and most teams ship them without any security review. mcp-security-scan is an open-source CLI and GitHub Action that checks for credential theft patterns, data exfiltration, unsafe execution, and code obfuscation — and outputs a 0-100 trust score that integrates with AgentGraph's identity layer. The Moltbook breach last year is still the clearest example of what happens when you scale agent infrastructure without thinking about trust. 770,000 agents, zero identity verification, and when it went down it exposed 35,000 emails and 1.5 million API tokens. The tokens were the real problem — many of them were credentials passed through MCP servers that nobody had audited. MCP (Model Context Protocol) servers are the connective tissue of modern agent systems. They sit between your LLM and the outside world, handling tool calls, filesystem access, API requests. That position gives them a lot of power. It also makes them an obvious target. And yet most teams treat MCP servers like they treat npm packages circa 2015: install and trust. What Actually Goes Wrong Before getting into the scanner, it's worth being specific about the threat categories. There are four that show up most often in real codebases: Credential theft — MCP servers that read environment variables indiscriminately, log request/response payloads, or forward tool call arguments to external endpoints. This one is subtle because the server might be doing legitimate work and exfiltrating credentials. Data exfiltration — Outbound HTTP calls to domains that weren't declared in the server's manifest, or calls that happen inside tool handlers where the LLM can influence the destination URL. Prompt injection into tool parameters is the attack vector here. Unsafe execution — eval() , exec() , subprocess calls, or dynamic require() / import() where the argument comes from tool call input. If an LLM can influence what gets executed, you have a

As Meta pours billions into AI infrastructure and agents, Zuckerberg is working to convince investors that the payoff will be worth the price.

In my previous article , I built a fully local RAG assistant Ollama, ChromaDB, LangChain, all running in Docker. It answered technical support questions by searching through documentation and citing sources. It worked. But after using it for a while, I noticed something uncomfortable: it treated every question the same way . Ask it "how to close monthly payroll?" it searches the docs. Fine. Ask it "the server crashes at startup" it also searches the docs. Less fine. Ask it something completely outside the documentation it searches the docs. Useless. A real support technician doesn't do that. They first assess the situation, then decide what to do: look it up, run a diagnosis, or escalate to a human. My RAG had no such judgment. That's what this article is about how I evolved the system into an Agentic AI architecture using LangGraph, where the assistant first decides which strategy to use , then acts accordingly. The Core Limitation of Classic RAG Classic RAG is a linear pipeline. Every query follows the exact same path: Question → Embed → Retrieve → Prompt → LLM → Answer No branching. No decision-making. No memory between steps. This works perfectly for procedural questions where the answer lives in the docs. But technical support involves at least three distinct scenarios: Scenario Example Best strategy Procedural question "How do I create an account?" Search documentation Known error code "ERR-COMP-001 appears" Lookup error database Unknown incident "Server crashes, no idea why" Diagnose + escalate if needed A single RAG pipeline handles the first case well and the other two poorly. The solution is to add a layer of reasoning before retrieval. What Agentic AI Adds The shift from RAG to Agentic AI comes down to one thing: the system plans before it acts . Instead of one fixed pipeline, you have: Question ↓ Classifier (what kind of question is this?) ↓ ├── Procedural → RAG Agent (search docs) ├── Error code → Diagnostic Agent (lookup + LLM analysis) └── Complex → D

A few weeks ago I wrote up what agents were paying for on NetIntel , my platform of pay-per-call APIs settled in USDC over x402 — no signup, no API keys, no accounts. An agent hits an endpoint, gets a 402 Payment Required , pays a fraction of a cent, and gets structured data back. That's the whole loop. Since then the dataset has grown, I've instrumented every settled call into a proper database (payer wallet, endpoint, price, latency, transaction hash), and I've launched a second settlement rail. So this is the rewrite with real numbers instead of eyeballed ones — and the findings didn't soften. They sharpened. The setup 2,646 settled paid calls from 194 distinct paying wallets, across 101 live endpoints , over six weeks of instrumented production data. Every call in this dataset is a real on-chain payment with a transaction hash — no test traffic, no estimates. Settlement runs on Base, and as of this month on Solana too. This is still one platform's data in a young ecosystem — the caveats are at the bottom, and one of them is bigger than it looks. But the shape has now held for six weeks straight, and it's the same shape I flagged the first time. Finding 1: revenue is absurdly concentrated — and it stayed that way Five endpoints drive 69% of all revenue. One of them — a text-to-structure endpoint that takes messy input and returns strict typed JSON — is 42% by itself . The rest of the top five are all in the same family: translation, structured LLM inference, and one domain-intelligence report. The other 96 endpoints split the remaining 31%. Thirty-five of the 101 have never been paid for once. Not "underperformed" — zero settled calls, ever. When I first published this pattern I wondered if it was an artifact of a small sample. The dataset has since more than doubled and the concentration ratio barely moved. I now treat it as the market talking, not noise. Here's the part I'd want to know if I were reading this: that 42% endpoint is essentially one buyer — a wall