Selected

How AI agents actually use your MCP server: five failure modes you won't see in logs

The author instrumented a demo ticket-booking MCP server with a self-built tool called mcpspan and identified five kinds of agent invocation problems that never show up in logs: agents guessing tool names that don't exist; parameters that don't match the schema and get rejected by the SDK before the handler runs; parameter types misunderstood because of how the tool description is worded; retry loops that keep hitting the same parameter; and responses so large they eat into the context window.

Prompt injection is a data-plane problem: move the boundary from the model to the tool call.

The author argues that prompt injection shouldn't be solved by making models smarter; instead, just as SQL injection is handled with parameterized queries, the boundary should be drawn where the agent executes actions.

Skills Are Not Tools: Why I Gave My Coding Agent 11 MCP Servers and It Fell Apart

In February I hooked up 11 MCP Servers to my coding agent. Just the tool list in an empty session ate up 34,000 tokens, with Datadog alone contributing over two hundred tools. The agent got slower and kept picking the wrong tools.

Anonymous health checks on 78 registry MCP servers: 51.3% complete the full call sequence

Pennyforge ran anonymous health checks on the 78 servers that responded to initialize out of 186 endpoints in the a–b slice of a public MCP registry. Only 40 of them (51.3%) made it through the full flow of initialize → tools/list → one safe tools/call.

FP8 pitfall: GPU bill dropped 47%, but the model outputs “!!!!!!”

The author ran Qwen2.5 7B/32B/72B on a single AMD MI300X with vLLM ROCm, priced at $2.99/GPU-hr. The BF16 baseline was 7B at $0.227/M, 32B at $0.77/M, and 72B at $1.67/M output tokens.

A local proxy spreads Claude Code requests across multiple Max accounts and switches before the quota runs out.

The author open-sourced claudemanager, a local daemon that Claude Code points to via ANTHROPIC_BASE_URL. It only changes the request's Authorization header to route sessions to the Max account with the most remaining capacity in its 5-hour, weekly, and per-model windows, switching at custom thresholds before those windows fill up.

Flash-Agents: an MCP plugin that hands Claude Code's coding tasks to a DeepSeek Flash worker

Flash-Agents is a Claude Code plugin that delegates bounded coding work—implementing slices, porting tests, reviewing diffs, mapping out a codebase—to a DeepSeek V4.1 Flash worker, while Claude keeps architecture, acceptance criteria, and final review.

Spill：把超大的 MCP 返回结果移出上下文，存入本地 DuckDB

Spill 是一个 Apache-2.0 开源工具，通过 Hook 拦截超过 32 KiB 的 MCP 工具返回，将其存为本地 DuckDB 表（~/.spill/spill.duckdb），智能体只拿到一个紧凑描述符，再用 SQL 查询而不是读入 5 万 token 的原始 JSON。

Awaiting translation

I tested ten Claude Code mods: when a guard crashes, the command still runs — only three held up

I tested ten Claude Code mods on Claude Code 2.1.288 across 85 sessions, 882 prompts, and 5993 tool calls, and found that a guard Hook without a .catch gets skipped when it throws, so the command runs anyway. Only by adding a catch that returns deny does it fail closed.

GitHub 发布 AI 代码评审开放基准 ReviewBench

GitHub 发布代码评审离线基准 ReviewBench，基于 1.039 亿个 GitHub PR 的分布特征，构建了覆盖 19 种语言、219 个公开 PR 的评测集，并公开数据集、评分规则与 LLM 评审模型配置。

Awaiting translation

When Automated Checks Lie: Five Cases from a Project Where an AI Agent Writes the Code

In a product project where an AI agent writes the code and the author doesn't read it, automated checks repeatedly reached the wrong conclusion. The author found 86 checks that no workflow had ever triggered, a secret scan that missed 438 of 1413 files because Git escapes Russian filenames by default, a new check that mistook WHERE for a table alias and let an injection slip through, and three false alarms from the test dashboard and the agent's replica.

How I Used Git Checkpoints to Undo Any Change Made by a Coding Agent

For coding agents running unattended, the author built a checkpoint mechanism based on hidden git refs. Before each task starts, it snapshots the entire working tree—including untracked files—and rolls back automatically when validation fails. The restore operation itself can also be undone.

Use CLAUDE.md plus a local MCP memory architecture to stop Claude Code from constantly needing corrections and burning through quota

The author has open-sourced the Project Athena v9.9.9 kernel (MIT License), a local-first memory and governance framework built to solve the problems of Claude Code needing repeated corrections, sub-agents overstepping their bounds and modifying files, and losing state when it hits the quota limit mid-task.

AI Hero Skills v1.3 released: new /implement-spec, /pr, and /retro skills, and CONTEXT.md renamed to GLOSSARY.md

AI Hero Skills v1.3 is out, adding three skills—/implement-spec, /pr, and /retro—and extending the main flow from /grill-with-docs → /to-spec → /to-tickets into implementation, PRs, and retros.

我连续 37 天夜间测量 MCP 注册表：19.2% 的服务器 24 小时内改动了工具面

作者搭建 mcp-transparency-log，按计划爬取官方 MCP 注册表中所有公开可达的服务器，记录其工具名、描述、JSON schema 和四个 annotation 提示，写入带签名树头的 append-only 日志。

Awaiting translation

Why Claude Code’s Read(.env) Deny Rule Doesn’t Stop Bash from Reading It

The author added a Read(./.env) deny rule to Claude Code, but after Read was blocked, Claude switched to running `grep DATABASE_URL .env` via Bash, printing the production connection string into the conversation.

How I Stopped Codex from Burning Through My Usage Quota

The author found that two Codex browser automation tasks consumed 170,123 and 110,180 tokens respectively, so they set out to control usage through model selection, configuration files, and task splitting.

How to Stop an AI Coding Agent from Declaring a Task Done Too Early

The author runs a fully autonomous implementation system where an orchestrator hands out tasks to parallel implementation agents (built on Claude Code). At first, agents could mark their own tasks as complete, which led to problems like tests never being run, acceptance criteria not being met, assertions loosened to make tests pass, and hardcoded return values.

Cursor ships Composer 2, and the API response strings give away its undisclosed Kimi K2.5 base

On March 20, 2026, developer Fynn was debugging Cursor's OpenAI-compatible endpoint when the returned model ID came back as accounts/anysphere/models/kimi-k2p5-rl-0317-s515-fast — evidence that Composer 2 was post-trained with reinforcement learning on top of Moonshot AI's Kimi K2.5. The tweet hit 44.4 views within a day.

宝玉@doteySelectedAI score8282

Drawing on a podcast episode, Baoyu walks through how Lauren Tan, who works on Grok Bot at SpaceXAI, merged 2500 PRs in a single month: at night she lets the AI check and merge on its own, then spot-checks the next morning instead of reviewing each one.