Hacker Newsnew | past | comments | ask | show | jobs | submit | insin's commentslogin

As the CEO of Terrible Ideas, I approve this take.

Writing CSS in a way that will scale up with the size of your project and team is just as hard as it's ever been, you still have to come up with a convention for doing that, including taking into account what newer features bring to the table. Having to manually edit it was never the pain point.


I work on an F100's internal, vendor/model-independent LLM chat app whose agent runs in your browser, so CLI isn't an option, direct API is out as the agent deliberately doesn't have any tools for hitting arbitrary URLs and it can't access the network via its iframe-sandboxed code execution tool, so we use MCP in the harness to let it do third-party things, with e.g. Atlassian and GitHub MCP servers pre-configured and support for BYO MCP if there are compatible third-party servers you want to use, or are running your own locally to provide tools to let it do things on your machine (it can already be given R/W access to your local filesystem via showDirectoryPicker()).

The biggest issues are usually that a third-party MCP server you're trying to use either has misconfigured CORS so the browser can't hit it, has a bespoke OAuth setup which doesn't work with @modelcontextprotocol/client, or they don't support Dynamic Client Registration (DCR) so you can't just point at it and use it. It's nice when none of these apply and it Just Works, the user can auth easily with the third-party and refresh tokens automatically handled in the background by the client.

That's the advantage, really - you didn't have to define the tools yourself, auth is handled for you, and the agent doesn't need to (and can't) access credentials or tokens as it knows nothing about MCP.


It looks like Google constantly pushing "MV3 is more secure" messaging worked at the intended high level.


Now they are doing it to Android with mandatory developer identity verification and Play Integrity. I wonder how those engineers sleep at night.


Given that YouTube already has a suite of anti-adblocking checks in their UI code [1] (e.g. submit a fake request to the /player endpoint and see if anything removed the ads from it - which also tells you exactly which fields you need to remove from which request, lol), I don't know why they don't have someone looking at the latest filters and reacting to them.

Twitch did that a while back and uBlock Origin was ineffective against their video ads within a few months.

[1] https://bsky.app/profile/soitis.dev/post/3lvk7przgus2u


YouTube could also only let you download the main video after you downloaded the ads AND waited however long the minimum ad time is. They don't really need to play games with ad blockers if they want to get serious.


I have default "AI" keyword and domain filters as a separate toggleable option (so you can keep your personal filters separate) in my HN extension (which I really need to add recent model names to):

https://soitis.dev/comments-owl-for-hacker-news


I thought this was funny because they've rewritten it seemingly with the primary goal of trying to get you to not use it.

TL;DR: open app, use the app, install the app, have you opened the app yet?


I'm using this API in the internal [1] model-independent LLM chat app I work on at an F100, and it ruined using the Claude and ChatGPT web interfaces for me outside of work [2] because I'm used to being able to point the model at a folder so it can be directed to find and pull in relevant context itself, being able to add folder mid-chat and saying "you do it", and being able to have the model run code to work with local files of any size your browser can handle (every time we released a new version people would drag in their huge Excel files and go "still doesn't work" as we used to extract and context stuff the contents, but now it can poke around in them directly to find sheets/headers/structure and write code to do whatever they wanted).

Claude Opus on its own with filesystem tools built around the FileSystemDirectoryHandle API [3] makes for a pretty decent coding agent - I've been using the app to write itself live on its own development server ever since it got the ability to edit its own files, which is some of the most fun development I've done recently. I think writing your own harness is probably the most fun thing you can do with an LLM, which is why so many people do it - getting the model to add and then start using a new tool you had an idea for in the same chat is always fun.

[1] which seems like the best scenario for it in terms of the security/privacy issues it poses

[2] I ended up creating an MCP server rooted to a specific local directory - which I can expose to them via Cloudflare Tunnel - and a browser extension which adds a folder picker button to their chat interfaces, so I can get an almost-equivalent experience. This is really ugly in ChatGPT but works as well as I'm used to in Claude.

[3] as a bonus, the tools you write against this API will also be compatible with the Origin private file system (OPFS) API if you want to give your chats a virtual filesystem for the model to write to, or to copy user-attached files into


Cool use-case!


> Let's say you have a jq MCP. How do you pass data in and out to/from it without the data also being processed as tokens?

Provide a meta-tool which handles piping data in and out of any other tool, and make specific tools which can read/write data sources directly, bypassing context. Or you could go full code mode, but I'm not sure it's worth the lift unless you have Cloudflare numbers of APIs which would need tools.

I work on an internal model/vendor-independent chat app where the agent runs in the browser - every chat gets its own virtual origin private filesystem (OPFS) [1] directory where user attachments get written to and tools can read from/write to, and users can also provide read/write access to a real directory with window.showDirectoryPicker() [2] (both use the same API, so tools can route to/from either).

It can push and pull MBs of data through tools, e.g. pulling huge spreadsheets directly from SharePoint in 50,000 row chunks using a tool which calls the Excel Services REST API, passing those all into a code execution tool to join them together and process them, which generates an Excel output file using SheetJS, none of which goes into context.

People used to drag their multi-MB documents in and complain either it didn't work or the agent couldn't do anything useful with it. Now it just works.

[1] https://developer.mozilla.org/en-US/docs/Web/API/File_System...

[2] https://developer.mozilla.org/en-US/docs/Web/API/Window/show...


So are you using MCP to do this?

I'm not saying MCP or the ways we use it cannot be extended to cover this use case, but my understanding is that nobody does it. But shell/code does, and more.


Nice try at trying to get me to read the friendly articles ;)


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: