Blog

What we learn connecting agents to apps

Notes on agents, integrations, auth, MCP and workflows, from the team building the integration layer for AI agents.

MCP Grows Up: What the 2026-07-28 Spec Changes for Agent Builders

The MCP 2026-07-28 spec drops sessions, hardens OAuth and adds enterprise auth. Here is what to change in your servers and clients, plus a migration checklist.

15 Sept 202614 min read

Security

AI Agent Auth in 2026: Why Per-User Delegated Access Is the Hard Part

Agent auth is harder than human SSO. Learn PKCE, token exchange, scope attenuation, delegation chains and token refresh at scale, plus a reference architecture.

10 Sept 202614 min read

Security

MCP Tool Poisoning: Securing AI Agents That Act

Agents now write, send and deploy, so injected text in tool metadata and results is a real threat. How tool poisoning works and a layered playbook to stop it.

5 Sept 202613 min read

Strategy

Build vs Buy for Agent Integrations in 2026: A Scorecard

The integration layer for AI agents is consolidating fast. Here is what the Workday and Pipedream deal signals, what the long tail costs and how to decide.

28 Aug 202611 min read

Engineering

Reliable AI Agent Tool Calls: Retries, Idempotency and Approval Gates

Agents now write to real systems. Learn how idempotency keys, backoff, rate limits, webhook dedupe and approval gates make every tool call safe to retry.

21 Aug 202612 min read