Compile-time vs runtime: where MCP security actually lives

<p>Most API documentation is written for humans.</p> <p>MCP tool descriptions are different.</p> <p>They are read by the model that decides what to call next.</p> <p>That means

<h2> The Setup </h2> <p>MCP (Model Context Protocol) lets AI agents call external tools. Instead of just reading files and running bash, the agent gets structured access to APIs,

<p>The AI world has a plumbing problem. We have incredible language models, but connecting them to real tools — databases, APIs, file systems, other agents — still feels like

<h1>MCP Protocol Deep-Dive: How Tool Discovery Actually Works</h1> <p>Unlock the mechanics of the Model Context Protocol. We dissect the JSON-RPC handshake that enables dynamic

<h1> MCP Trust Pack: a security layer for MCP tool calls </h1> <p>MCP makes it easy for agents to call tools. Too easy.</p> <p>When your agent calls <code>fs_write</code> or

<h2> TL;DR </h2> <ul> <li>AI assistants trained on public repos reproduce hardcoded secrets because that's what they learned</li> <li>A pushed API key is effectively public even

<p>Two architectures keep showing up in AI agent runtime security in 2026. Both promise to stop bad agent actions before they complete. Underneath they work differently, and the

<p><a class="article-body-image-wrapper"