Thoughts on software architecture, AI/ML systems, production engineering, and building products as a solo founder.
What survived contact with real usage maintaining an MCP server across three clients I never built for: fail-close defaults, replayable observability, and tool descriptions as the real interface.
A read-only, evidence-cited audit across seven production-readiness dimensions, run against a widely deployed open-source LLM gateway. It scored well — and still surfaced the boundary edges every team running MCP in production should check on their own deployment.
The pre-mortem is the cheapest way I know to catch the preventable failures before they ship. The 25-minute version I actually run, and when not to bother.
A free MIT CLI that scans a repo for seven classes of AI-agent-gateway anti-patterns — tool-access/RBAC, fail-close, supply-chain pinning, observability, multi-LLM routing, secrets, production-readiness — runs as a CI gate, and exposes itself as an MCP server.
When one team adds a request header, the backend CORS allowlist becomes a coordination point. Here is what that tax actually costs, why it fails silently, and four patterns for handling it.
Four runtime events, four policy-attachment surfaces, and the hook coverage at each event is what separates a demo from something a regulated buyer will sign for. Framework selection is a distraction.
A production-ready MCP server that makes working with large files in Claude Desktop and AI assistants effortless — smart chunking by file type, line-level navigation, regex search, and streaming for files up to 10 GB.