标签：#mcp

Here is a number that should reframe how you think about the agent economy: in roughly one year, AI agents moved about $73M across 176 million machine-to-machine transactions on a single exchange, at an average of around $0.31 per transaction , across 100k+ registered agents . Read that again. Agents are not "coming." They are already transacting, at scale, in production, right now. The interesting question is no longer whether autonomous software moves money. It is what those transactions are trusting - and what happens the first time that trust is misplaced. Payments scaled. Settlement did not. Almost all of that volume runs on payment rails. A payment rail does one job, and does it well: it moves a unit of value in one direction. Agent pays a service. Agent tips an API. Agent settles a micro-invoice. At thirty-one cents a pop, the failure modes are invisible - if a transaction goes wrong, you are out pocket change, and you move on. The problem is that a payment and a trade are not the same operation. A payment asks one question: did the money move? A trade asks a harder one: did **both * sides happen - or neither?* When your agent pays for something, there is one transfer and one direction of risk. When your agent trades - my asset for yours, your stablecoin for my token, one chain's value for another's - there are now two transfers that must both complete, or both not. The risk lives in the gap between them. One side sends; the other side is supposed to send back. On a payment rail, "supposed to" is doing an enormous amount of load-bearing work. The hidden assumption Every one of those 176 million transactions made an assumption that nobody had to state out loud: the counterparty will deliver. Between parties who already trust each other - a company and its own agents, two services under one operator - that assumption is fine. It holds because the trust was established off-chain, by humans, before the agent ever ran. But the entire promise of the agent economy i

Web MCP, DevTools per agenti e Modern Web Guidance: meno hype, più strumenti e metodo. Negli annunci recenti di Chrome è emersa una cosa interessante: al netto delle novità “appariscenti”, ciò che resta più utile per il lavoro quotidiano è quello che migliora workflow, diagnosi e decisioni tecniche . Tre filoni, in particolare, disegnano una direzione chiara: Web MCP , DevTools per agenti e Modern Web Guidance . Di seguito una sintesi ragionata di cosa significano, perché contano per il frontend, e come prepararsi a sfruttarli. 1) Web MCP: il ponte tra agenti e Web (senza incollaggi fragili) Se stai lavorando con assistenti/agentic workflow, oggi il collo di bottiglia è quasi sempre lo stesso: far sì che un agente capisca e usi le capacità del browser e delle app web in modo affidabile. Web MCP punta a risolvere questo punto creando un linguaggio/protocollo comune per esporre “capacità” (capabilities) e strumenti (tools) che un agente può invocare in modo strutturato, invece di basarsi su prompt lunghi, scraping o integrazioni ad hoc. Perché è importante per chi fa frontend Automazioni più robuste : meno script fragili che si rompono al primo refactor del DOM. Integrazioni più standard : se più strumenti parlano lo stesso “dialetto”, il costo di collegare agenti e applicazioni scende. Esperienze utente nuove : assistenti che completano task complessi dentro l’app (es. compilazioni, ricerca guidata, operazioni amministrative) con maggiore affidabilità. Implicazione pratica Inizia a ragionare sull’app come su un insieme di azioni esplicite (es. “crea ordine”, “esporta report”, “filtra dataset”), non solo come UI. Questa mentalità ti rende pronto a esporre capacità in modo sicuro e controllato, quando lo stack lo renderà semplice. 2) DevTools per agenti: debugging e performance nell’era dell’automazione Se Web MCP è il “ponte”, DevTools per agenti è la cassetta degli attrezzi per controllare quel ponte: osservabilità, diagnosi e iterazione rapida su flussi in cui non è

I’ve been shipping code since before most people even knew what Git was. I've seen entire architectures built around point-to-point API integrations that were beautiful for a quarter, and then became unmaintainable monoliths by the second year. If you spend any time in enterprise software development—especially anything touching customer data or HR pipelines—you run into integration hell. The modern AI agent promises to be this universal connective tissue, right? It sounds simple enough: give it access, and boom, productivity magic. But let’s be real about what that means under the hood. When an LLM is given a tool schema, how does it get data from five wildly different systems—Salesforce for contacts, Workday for employees, Zendesk for tickets, Greenhouse for candidates? The naive approach, and frankly, most teams still take it this way, is to build bespoke orchestration services. You create a microservice that accepts an input query (e.g., 'What did Jane do last month?') and then contains specialized logic: if the name format looks like a CRM record, call salesforce_api ; if it sounds HR-related, hit workday_endpoint , etc. This is debt acceleration disguised as architecture. You are not building an integration layer; you are building a brittle routing table that requires human intervention every time one of the underlying APIs changes its schema or rate limit structure. It’s glue code for glue code's sake, and it has a massive maintenance overhead. The core problem is that most agents see data sources as functional silos , not integrated components of a single operational truth. Your CRM thinks about accounts; your HRIS thinks about job codes; your ATS tracks keywords. They all speak different dialects of 'person' or 'business unit.' When an agent needs to know, say, which employees (HRIS) are currently candidates in the pipeline (ATS) who also have a linked account record (CRM), you hit a wall. The solution isn't more specialized microservices. The solution is s

Why a build log (and not another tutorial) Every AI shopping tutorial shows the same thing: install the SDK, call a tool, ship. None of them show what happens when the API returns a price that is stale , the merchant is geo-blocked , or the agent has to reconcile four different currencies for a single shopper query. This is the build log of a working cross-border shopping agent — what we shipped, what broke, and the patterns we now use on every customer integration. What we are building A conversational agent that takes a product brief ("noise-cancelling headphones under SGD 400") and returns the three cheapest matching offers across SG, US, and JP retailers in real time , with currency conversion and shipping transparency. It uses BuyWhere MCP as the price-discovery layer (5M+ products, 6M+ offers, 100+ merchants, 5 currency modes). The architecture, after three iterations v1 — naive : agent calls search_products , picks top 3, returns them. Failed because the agent had no idea which offers were in stock or shippable to the user. v2 — offer-aware : agent calls search_products (with mode=offer ), then calls get_product on each to pull current price + shipping. Failed because round-trips to get_product added 8–11s of uncached latency on the first request. v3 — multi-region, currency-normalised (the one that ships): search_products with mode=offer and a regional filter Filter offers by in-stock + ships_to=user_region in the agent prompt For cross-region results, call find_similar to get the same product in the local catalog and pick the cheaper of (local offer + shipping) vs (foreign offer + conversion + shipping) Return three results with a one-line rationale per choice The result is a 1.2–2.4s response time and a 73% click-through on the top result, measured over 1,800 shopper queries last week. Three patterns we use on every integration now 1. Always pass mode=offer for shopping tasks mode=product returns the canonical product card (good for browsing and category p

I spent a week building Wingman , an open source MCP server that renders a persistent task panel inline in Claude conversations using MCP Apps (SEP-1865). The spec is solid. The SDK is solid. But I hit two bugs that cost me most of a weekend each, and neither is documented anywhere I could find. Writing them up here in case they save someone else the time. Bug 1: resourceUri has two valid-looking locations, and only one works MCP Apps needs a way to tell the host "render this resource as a UI for this tool call." That pointer lives in _meta.ui.resourceUri . The question is: meta on what? I started with a parameterized resource template, ui://wingman/panel/{plan_name} , registered per plan. That was my first mistake. Parameterized templates get listed under resources/templates/list , not resources/list , and hosts do not prefetch or render anything from the templates list. The fix was straightforward once I found it: register one static resource, ui://wingman/panel , and pass the actual plan data through structuredContent on the tool result instead of baking it into the URI. That fix surfaced the real bug. My show_plan tool was returning a plain Python dict: return { " plan " : plan_data , " _meta " : { " ui " : { " resourceUri " : " ui://wingman/panel " }} } This looks correct. It is not. FastMCP's result conversion takes a returned dict and serializes the whole thing into structuredContent , verbatim, including any _meta key the dict happens to carry. So the actual wire result looked like this: result . structuredContent [ " _meta " ][ " ui " ][ " resourceUri " ] # == "ui://wingman/panel", but wrong place result . meta # None — this is what the host actually reads MCP Apps hosts read resourceUri off the top-level _meta on the CallToolResult , not off whatever ended up inside structuredContent . With that pointer effectively missing, the host had nowhere to bind the iframe. The visible symptom was strange: actions in the UI would update on screen but nothing persist

MCP is useful, but most of the time you do not actually need it. It gives an agent a clean way to discover tools, call APIs, and work with external systems. In practice, a skill file can describe the same usage path without dragging the whole MCP surface into context. But MCP is not free; rather than MCP itself, the real issue is the habit of loading a big MCP surface into every session, no matter what the session is actually about. Once a Claude Code or Codex run pulls in a bunch of servers, the model sees those tool definitions right away, even if the job is just writing docs or fixing a small bug. That is where the waste starts. The hidden cost of always-on MCP Every MCP server brings metadata with it: tool names, descriptions, argument schemas, nested parameters, enums, examples, and sometimes prompts or resources. While useful, this is still context. If you connect a handful of lightweight tools, the overhead is annoying but manageable. If you connect a real stack of services, the cost compounds fast. In practice, you end up paying for: tool discovery before the task starts schema text the model may never use repeated loading across unrelated sessions extra context pressure that pushes out the actual work That last point matters more than people think. Context acts as the active working set the model uses to reason. The more of it you burn on static tool catalogs, the less room you have for the user request, the repo state, prior reasoning, and the actual answer. Anthropic has already written about this problem directly in the context of MCP. Their engineering post on code execution with MCP calls out tool-definition bloat and shows how direct tool calls can consume a lot of context before the model even starts doing the real job. The tool list is not just setup noise; it is part of the session cost. Why skills are cheaper Skills take a different path. A skill file keeps the always-loaded portion tiny. Usually that means just the skill name and a short descript

Why Your Agent's Search Results Look Right and Are Wrong: The Index Distribution Problem You've built an agent. It has a search tool. You query it with something reasonable — a factual question, a comparison, a technical lookup — and it returns results. The results look right. The sources are real. The snippets are plausible. The agent synthesizes them into a confident answer. And the answer is wrong. Not obviously wrong. Not hallucinated-in-a-hallucinatory-way wrong. Structurally wrong — wrong in a way that passes every surface-level check because the error is baked into the retrieval layer before the model ever sees the context. This isn't a prompt engineering problem. It isn't a context window problem. It's a distribution problem , and it has a structural ceiling that no amount of better prompting will fix. The Index Is a Frozen Decision Here's the thing most agent builders don't internalize: a search index is not a neutral representation of knowledge. It's a frozen set of decisions about what matters and what doesn't. Every index — whether it's a BM25 inverted index, a dense vector store, or a commercial web search API — encodes a distribution shaped by past relevance judgments. Someone, at some point, decided which documents were "relevant" to which queries. That could be explicit (human raters labeling search results) or implicit (click logs, dwell time, link graphs). Either way, the index now encodes a probability distribution over what the system considers a good answer to a given query. That distribution is not semantic truth. It's past relevance consensus . Consider what happens when you embed a corpus and build a vector index. Your embedding model was trained on data that reflects certain assumptions about what concepts are close to each other. Your chunking strategy encodes assumptions about what granularity of information is useful. Your ranking model — whether it's cross-encoder reranking or a learned relevance model — was trained on labeled data that

A few weeks ago I gave an AI agent access to my machine through MCP. It read files, opened PRs, queried a database. It was great — until I looked at what it could have done if a tool description had been poisoned, or a prompt injection had slipped through. The answer was: anything. ~/.ssh/id_rsa . DROP TABLE users . rm -rf / . The agent had sudo, and nobody had voted for that. So I built AgentPerms — a CLI that gives MCP agents least-privilege permissions the same way you'd lock down any other process: figure out the minimum it actually needs, pin it, prove it, and enforce it. pip install agentperms The gap nobody was filling MCP (the Model Context Protocol) is quietly becoming the USB-C of AI tooling. Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI — they all speak it. Which is wonderful, and also means your agent is one config file away from your filesystem, your repos, your inbox, and prod. The existing tools each do part of the job: Scanners tell you something looks risky. Then they leave. You still have a risky thing. Firewalls / allowlists make you hand-write YAML up front — before you have any idea what the agent will actually use. Neither closes the loop. What I wanted was the boring, proven security workflow we already use for everything else: observe real behavior → derive least privilege → enforce it → keep it honest in CI. That's the whole thesis of AgentPerms, as a pipeline: record → infer → lock → replay → enforce See it in 30 seconds (no setup, no network) AgentPerms ships with a deliberately over-privileged demo MCP server, so you can watch a real policy decision without wiring anything up: # Flag risky config: a ~/.ssh mount and an unpinned npx server agentperms scan --path examples/vulnerable-mcp-demo # Replay a pack of canned attacks against an example policy agentperms replay --policy examples/policies/example.mcp.policy.yaml Output: 8/8 attacks blocked. SSH-key exfiltration, .env reads, rm -rf / , unapproved email, force-push, repo deletio

A few weeks ago, I started exploring the Afriex MCP server. The setup was surprisingly straightforward. Connect your MCP client. Configure your API key. Verify the connection. Done. But then I ran into a different problem. Not a technical problem. A prompt problem. The Blank Prompt Problem Once everything was connected, I found myself staring at an empty prompt box. What should I ask? Sure, I could retrieve balances. I could create customers. I could generate virtual accounts. But what were the most useful workflows? What were the prompts that would actually help developers build real products? This isn't a problem unique to Afriex. It's becoming a common challenge across the entire MCP ecosystem. The infrastructure exists. The tools work. But many developers don't know where to start. MCP Changes How We Build Traditionally, integrating a payment API looked something like this: Read documentation Find the endpoint Write HTTP requests Parse responses Build business logic With MCP, the workflow looks very different. You can simply tell your AI assistant what you want to build. For example: Create a customer onboarding flow that: - Collects customer details - Generates a virtual account - Displays payment instructions Build it using Next.js and TypeScript. Instead of manually stitching everything together, the AI can interact with infrastructure through the MCP server. That's incredibly powerful. But only if you know what to ask. The Idea That's what led me to build the: Afriex MCP Prompt Cookbook A collection of practical, production-oriented prompts designed specifically for developers building with Afriex MCP. The goal is simple: Copy. Paste. Build. Instead of starting from scratch every time. The cookbook is open source and available on GitHub: https://github.com/SonOfUri/afriex-mcp-cookbook Feel free to explore the prompts, use them in your own projects, and contribute new recipes. What's Inside The cookbook is organized around real-world use cases. Not API endpoi

Most weeks in the agent economy look like a pile of unrelated announcements. This one had a theme hiding in it. Four different teams shipped progress on agent commerce, and if you line them up, they're all solving the same half of the problem — and all leaving the same half open. This is a builder's map. No leaderboard, no "who wins." Just what each thing is, what it does well, and the question none of them answer yet. The rails that shipped Mastercard Agent Pay for Machines. Mastercard's agent-payment program continues to roll, with 30+ partners spanning crypto and TradFi (Aave Labs, Alchemy, Anchorage, BVNK, Coinbase, MoonPay, OKX, Polygon, Ripple, Solana). The mechanically interesting part: agent payment authorizations get recorded to Polygon. A TradFi network is writing agent-spend permissions on-chain. That's a real signal about where this is heading. x402. Coinbase's HTTP-402 payment protocol keeps expanding its reach — it's now usable behind mainstream web infrastructure (AWS/CloudFront paths), which lowers the integration cost for ordinary web services to charge agents per request. Worth noting alongside the growth: standalone x402 transaction volume is well off its peak (OKX Ventures put the drop around 92% from the November high). The protocol is spreading even as raw volume cools — rails proliferate faster than they fill. Eco. A cross-chain stablecoin orchestration layer that abstracts routing, solving, and finality across ~15 chains. Where a payment intent can't move natively, Eco figures out the path. This is genuinely useful — it's the "make the stablecoin show up on the right chain" problem — but orchestration is routing, not atomic exchange. ERC-8004 (Trustless Agents). Not a rail at all — an identity and reputation layer for agents, with a v2 direction that leans into MCP. This is the one that actually points at the gap the others leave. More on that below. The thing they have in common Mastercard, x402, and Eco are all answers to "how does an agent

The next Model Context Protocol specification, 2026-07-28 , is the largest revision since the protocol launched. The release candidate locked on May 21, 2026, and the final spec publishes on July 28. It contains breaking changes to transport, authorization, and how tool schemas are handled. A server that is correct against 2025-11-25 today is not broken. Nothing here is a present-tense vulnerability. But several of these changes are security properties, not just compatibility ones — request routing integrity, cross-user cache scope, and schema-driven fetch behavior all move under this revision. This checklist walks the changes a server operator needs to handle before July 28, and calls out the security implication wherever there is one. Everything below describes the release candidate. Treat specifics as subject to change until the July 28 final, and validate against the official spec before shipping. Transport: the stateless core This is the headline change. MCP becomes stateless at the protocol layer, and most of the migration work lives here. The handshake and session are gone The initialize / initialized handshake is removed (SEP-2575). Protocol version, client info, and client capabilities no longer get exchanged once at connection time — they travel in _meta on every request. The same SEP adds server/discover as the new discovery anchor: servers must implement it, and clients fetch server capabilities from it when they need them up front. Once the handshake is gone, a server that can't answer server/discover can't be negotiated with. The Mcp-Session-Id header and the protocol-level session it carried are also removed (SEP-2567). Any request can now land on any server instance. The sticky routing and shared session stores that horizontal deployments relied on are no longer required at the protocol layer. If a server needs state across calls, mint an explicit handle from a tool — a basket_id , a browser_id — and have the model pass it back as an ordinary argumen

Last Tuesday at 3am, a multi-agent loop hit 12K KV writes/minute and froze. The loop was a one-line counter bug. That part was fixable. What I found while tracing it was worse. I had --dangerously-skip-permissions enabled on a Claude Code session that was running D1 migrations. I thought it was pointing at staging. It wasn't — I'd misconfigured my env file reference, loading .env.production instead of .dev.vars . Claude didn't ask. The flag told it not to. The migration was ADD COLUMN , not DROP COLUMN , so no data loss. Survivable. But only barely. The thing I got wrong: I treated --dangerously-skip-permissions as "skip the annoying confirmation popups." It's actually "remove the only moment a human sees what command is about to run." Those are very different things. Turning the flag back off helps, but it doesn't constrain what Claude attempts — it just adds a prompt you'll click through anyway at 3am. What actually worked was adding a deny rule in .claude/settings.json : { "permissions" : { "allow" : [ "Bash(wrangler d1 execute * --local*)" ], "deny" : [ "Bash(wrangler d1 execute *)" ] } } The allow rule is more specific than the deny, so --local calls go through and everything else is blocked before execution. Over 2 weeks post-fix, Claude attempted zero production DB commands. Three deny events were logged — all from ambiguous prompts I wrote during fast context-switches, not from Claude going rogue. I ended up running three layers: the settings.json allowlist, a separate git worktree for migration work that physically contains only staging credentials, and a CLAUDE.md that instructs Claude to ask before anything touching production. The CLAUDE.md approach has a real caveat though — in long sessions the instructions lose weight as context grows. Anything critical needs to be restated in the prompt itself. I wrote up the full breakdown — including the worktree setup, the exact CLAUDE.md wording, and why MCP tool permissions behave inconsistently with the deny ru

I just shipped Pro tier for Eidetic Works . Here's what's in it, who I built it for, and why I'm shipping three tiers ($29 / $99 / $299) instead of a single plan. What problem does this actually solve? You're running Claude Code. You have two or three sessions open across different parts of the codebase. Session 2 doesn't know what Session 1 decided. You end up re-explaining the same architecture decisions to the same model you already talked to yesterday. This is the context-drift problem. It doesn't come from the model being bad. It comes from each session starting with no memory of what came before. nucleus_ask — the MCP tool at the center of Pro — lets any agent call into your shared engram store and pull context that persists across sessions, across tools, and across machines. What's in Pro Managed R2 sync. Your engrams live in SQLite on your machine. Pro backs them to a Cloudflare R2 bucket with zero config. Your keys, your bucket — I'm not storing your AI history on my infrastructure. nucleus_ask recall. The MCP primitive your agents use to query the shared store. One call, structured results. Wire it into your MCP config once and every session gets recall. Customer dashboard. Sync health, engram counts, last-seen surfaces. Not glamorous. Just the visibility you need to confirm it's working. Email support. Direct line. Not a help-center chatbot. 60-second restore. New machine. One command. Full engram history back, including decisions from six months ago that your codebase assumes you remember. Three tiers Pro $29/mo — single seat. Managed sync, recall MCP, dashboard, email support. Pro+ $99/mo — 3 seats. Same features, team-shared engram store. Team $299/mo — 10 seats. Same features at team scale. Priority support. All three live at eidetic.works/pricing right now. Stripe checkout, monthly billing, cancel anytime. Who I built it for Devs running Claude Code seriously. If you use it daily, you're accumulating context that the next session can't access. That's

Uber recently described an internal architecture for propagating identity across multi-agent AI workflows. The design aims to perserve user context, agent provenance, and scoped access as agents delegate work and call internal tools. The case study aligns with Auth0’s view that AI agents need permissions based on delegated authority, scoped credentials, and explicit human approval boundaries. By Eran Stiller

A capability-compiler meets ten deliberately-broken MCP servers. The honest scorecard: it cleanly stops one class, shrinks the blast radius on several, and is useless against another. Knowing which is which is the whole point. Disclosure: I'm the author of capgate , the Apache-2.0 sandbox compiler this post puts to the test. The DVMCP project and the other tools mentioned aren't mine; the manifests and compiled output are reproducible from the repo . The setup Damn Vulnerable MCP (DVMCP) is a teaching project: ten MCP servers, each built to demonstrate one attack — prompt injection, tool poisoning, excessive permission scope, token theft, command injection, and so on. It's the closest thing the ecosystem has to a shared adversarial fixture. capgate is a compile-time tool. You write a manifest declaring what an MCP server is allowed to do — fs:read:/workspace/** , net:connect:api.github.com:443 , nothing else — and it compiles that to a concrete sandbox policy ( docker run flags, bwrap argv, or an egress-proxy config). It does not run anything, watch traffic, or inspect the server's code. It turns a declared capability set into an enforced boundary. So this is a fair, falsifiable test: for each DVMCP challenge, I wrote the honest minimum manifest, compiled it, and asked one question — does the boundary capgate emits actually stop the attack? The answer is not "yes" across the board, and the cases where it's "no" are the interesting ones. The bullseye: Challenge 3 — Excessive Permission Scope The vulnerable tool advertises "read a file from the public directory" and then does this: @mcp.tool () def read_file ( filename : str ) -> str : # VULNERABILITY: doesn't restrict file access to the public directory if os . path . exists ( filename ): # any absolute path works with open ( filename , " r " ) as f : return f . read () The private directory next door holds employee_salaries.txt , acquisition_plans.txt , and system_credentials.txt (a live DB password and cloud API ke

Hermes AI Agent handles multi-step workflows well. The planning layer holds up. Memory across sessions works. What kept breaking down was the tool layer. Once a workflow touched three or four external systems, I was spending more time on auth configs, mismatched response formats, and per-tool retry logic than on the workflows themselves. I fixed this by routing all external tool calls through a unified MCP gateway. The agent logic stayed the same. The integration complexity moved into one place I could actually manage. This post walks through how that works, how to set it up, and where it is genuinely useful. How Hermes runs tasks Hermes is an open-source, self-hosted agent runtime from Nous Research, released in February 2026 under the MIT license. It runs persistently on your own infrastructure and executes goals as structured, stateful workflows. Four layers handle execution. The planning layer breaks a goal into sequenced steps and adjusts them as intermediate results come in The execution layer runs each step and fires tool calls when external data or action is needed The memory layer stores task state and session history in SQLite with FTS5, so context carries over across restarts The skills layer captures completed workflows as reusable documents retrieved on future tasks After a task finishes, Hermes writes a skill file with the procedure and known failure points, then stores it for retrieval next time a similar task runs. Tool execution is embedded in the runtime loop. External capabilities come through MCP-based interfaces, which is where the gateway plugs in. What breaks when integrations live inside the agent In a standard MCP setup, each client connects one-to-one with a specific MCP server. That works fine with two or three tools. With ten, it becomes a maintenance problem that grows with every tool you add. A task spanning a web search, a product API, and a SERP scraper means three separate auth setups, three response formats to parse, and three diffe

Most explanations of atomic swaps stop at the spot case: two parties lock funds, one reveals a secret, both legs clear in the same short window. Clean, but it quietly assumes the trade settles right now . A lot of real agent activity isn't spot. It's a forward: two agents agree on terms today - asset pair, size, price - and settle at some future point, T+24h or T+48h. Procurement agents pre-committing to a delivery. A treasury agent locking tomorrow's FX-equivalent rate. A market-making agent quoting a forward to offload inventory risk. The economics are old; what's new is that the counterparties are anonymous software that will never meet. That raises a question spot swaps don't have to answer: what holds the trade together in the gap between agreement and settlement? In traditional markets the answer is a chain of intermediaries - a clearing house, posted margin, a credit desk that decides whether your counterparty is good for it. Strip those away, as you must in a market of anonymous agents, and the naive version of a forward collapses. If nothing binds the trade, either side can simply not show up when the price has moved against them. That's counterparty risk, and it's exactly the thing a forward is supposed to manage. This post is about how the HTLC primitive - the same hashlock plus timelock most people only associate with same-block atomic swaps - can encode a forward obligation that's binding without anyone custodying the funds in between. The timelock is doing more work than you think Recall the two parameters of a hash-time-lock contract: Hashlock: funds can only be claimed by revealing a preimage s such that hash(s) == H . The same H is used on both legs, so the act of claiming one leg reveals the secret that unlocks the other. That's what makes the swap atomic - both clear or neither does. Timelock: if the preimage isn't revealed before a deadline, the funds refund to their original owner. No third party decides this; the contract enforces it. In the sp

Giving an LLM a database connection is one of those ideas that sounds great in a demo and terrifying in production. The agent writes a slightly-wrong query, and now you're explaining to your team why orders is empty. So when I wanted an AI agent (Claude Desktop, in my case) to answer questions about a SQLite database, I didn't want to hand it a read-write connection and hope for the best. I built a small MCP server that gives the agent read-only SQL access — and I made "read-only" mean it, with two independent layers of protection. Here's how it works, and the design decisions that matter. Full source: github.com/skycandykey1/mcp-sqlite-server (MIT). A 30-second primer on MCP The Model Context Protocol (MCP) is an open standard for connecting AI apps to tools and data. An MCP client (Claude Desktop, Claude Code, Cursor, ...) connects to MCP servers that expose three kinds of capability: Tools — functions the model can call ( query , list_tables , ...) Resources — read-only data the model can pull in (a schema, a file) Prompts — reusable prompt templates The Python SDK ships a high-level helper, FastMCP , that turns this into a few decorators. The interesting part isn't the protocol — it's the safety design behind the tools. Design: keep the dangerous part away from the protocol The first decision: the read-only safety logic has zero MCP dependency. It lives in a plain module ( db.py ) that knows nothing about MCP, so I can unit-test it with nothing but the standard library. The server ( server.py ) is a thin wrapper. That separation matters: the part that must never be wrong (write protection) is testable in isolation, without spinning up an MCP client. Two layers of write protection A single guard is a single point of failure. So write protection happens twice, independently. Layer 1 — open the database read-only at the engine level: import sqlite3 def connect ( path : str ) -> sqlite3 . Connection : """ Open a SQLite database in READ-ONLY mode. Any write raises Op

Title: The agent economy added two rails and lost most of its volume this week. Nobody added settlement. Tags: mcp, ai, cryptocurrency, blockchain This is our weekly recap from building Hashlock in public. We try to read every agent-economy announcement of the week and ask one question of each: at the moment a trade actually clears, which layer finishes it? This week the answers lined up unusually neatly. The headline number: x402 is down 92% OKX Ventures published agent-payment data in June showing that x402 transaction volume has fallen roughly 92% from its November 2025 peak - from about $5.15M to $1.19M per month. Transaction count recovered (around 2.89M monthly), but the average transaction is now about $0.52. That is a category settling into micropayments, not a category absorbing real trade value. That is worth sitting with, because for most of the last year the narrative ran the other way: payment rails for agents were the story, and settlement was treated as a solved sub-problem of payment. The first hard volume number says the opposite. The rails are cooling. And yet the rails keep launching The same week, two more shipped: Mastercard Agent Pay - a way for agents to initiate card payments on a user's behalf. A Ripple XRPL agent kit - tooling for agents to move value over the XRP Ledger. Both are real, both are useful, and both do the same fundamental job: route a known asset from an agent to a seller. That is payment . It is also the layer that already has the most entrants, the most capital, and - per the x402 data - the softest demand relative to the hype. There is nothing wrong with a crowded payment layer. The point is narrower: launching more payment rails does not address the thing that is structurally missing. The map with a hole in it The most useful artifact of the week was OKX Ventures' framework for the agent economy. It describes three converging layers: Payment - x402 and similar (move value from agent to seller). Trust - ERC-8004 and agent r

HashiCorp has announced the general availability of the Terraform MCP Server, an open-source MCP server that enables agents to integrate with Terraform Registry APIs. The company says that it can improve infrastructure teams productivity by relieving engineers of rote tasks. By Sergio De Simone