This is the type of security and vulnerability testing that actually matters. In a sea of security researcher noise, thank you for contributing in a meaningful way.
Just because a MCP server offers 100 MCP tools doesn't mean that they all have to be in your context. Any decent harness will let you filter out ones you don't want. And to take that concept further you really should be designing specialized subagents that only have access to a small subset of total MCP tools in the first place.
I created MCP AQL, which is an extension to the MCP spec, specifically to reduce the bloat for MCP tools.
It only has five CRUDE endpoint: Create, Read, Update, Delete, and Execute using a GraphQL-like structure for tool calling of the operations within the endpoints. It's very efficient, and robust. there's all kinds of exemplar tools and components to make adapters for any MCP server. You don't even need to rewrite your own MCP server. Just create an adapter for it.
Oh sorry I didn't explain that we are not dumping the entire endpoint list to the MCP. We have 400+ endpoints so this would be terrible.
We tag each endpoint by category in the OpenAPI spec and require the MCP to request actions by tag and optional query term. At most we return 10 endpoints at a time and the LLM can request more using pagination.
These tags also create your categories in API doc websites like swagger/mintlify so its a win win.
I get your point, but it kind of is AI related. The size of PRs since AI has made it much harder to review a diff. Stacking the PRs seems like a response to this problem.
We were benefiting from stacked pull requests in Phabricator for a decade before "AI" was a thing. Having well scoped commits that can be individually actioned by distinct sets of reviewers has always been extremely useful.
Meh. Stacked PRs (where a PR is already a stack of commits, and reviewers can perhaps communicate with each other to coordinate scope/responsibility) are a bit like tab groups in the browser when tabs, multiple windows, and workspaces already existed for maintaining organization. This new feature clearly scratches an itch for some users but creates more complexity (yes, even if you don't interact with it) for people already comfortable with the status quo.
It definitely isn't. People have wanted this for many years. It's an obvious workflow. There's been a feature request since at least 2020 and I'm sure there were earlier ones: https://github.com/cli/cli/issues/2693
The post effectively communicated what it needed to. It seemed both written and structured in a way that was optimized for human consumption.
If they used AI to write this and that gave them more time to volunteer their time towards developing this fantastic piece of open source software, then this all seems like a good thing to me.
It is clearly not effectively communicated if the tool used to write it stamps its signature in such a way that it distracts from the great work they’re doing.
Its only distracts the distractable. Does anyone ever read product announcement blog posts like they were great literature? Ive always just skimmed, theyve always been throwaway writing to me. I’d rather the humans spend more time on the actual creative challenges in a project.
All writing is open to interpretation by the reader.
Some people let punctuation or grammar mistakes ruin an entire text or post for them, because they choose to focus on those flaws, rather than looking past them and taking in the content itself.
"this was written/assisted by AI" is starting to feel like next-gen "this has spelling/grammar mistakes in it, therefore it is invalid".
First time I’ve seen this take, but man it rings true.
I remember having teachers in middle school who seemed draconic to me in their emphasis on proper grammar and punctuation, however as an adult I’m lucky to read an email that contains paragraphs, much less proper punctuation.
Times are changing, and it’s up to the individual to decide how they want to respond to it
This doesn't even account for the fact that while the tech industry's dominant language is English, lots of people in our industry count English as a second (or third/fourth/etc) language, so they might use AI to help them write in English in an effort to be better understood by others.
To arbitrarily dismiss all AI-assisted writing shows a real lack of understanding of the possible reasons one might use it beyond the "lazy author" trope that everyone likes to throw out there.
I think the problem is that too many people use AI to write bullshit. Thus AI writing becomes a cue for bullshit.
For people who have internalized AI writing as a cue for bullshit, it is very difficult to read obvious AI writing without constantly being cue-ed that the thing they're reading is bullshit. Even if it's not.
The issue is that you can't trust that every word of the message was intentional due to how much Claude will usually add various levels of nonsense, some more obvious some less to your voice or requests. Considering how much Claude alters the meaning of what I want to communicate I wouldn't trust the accuracy of that output right.
And I use Claude a lot, 24/7, but not for things like that. And I appreciate how much it elevates my productivity, but not like this. It usually prioritizes or highlights the wrong things, it overfixates on one thing I said and adds random content there out of nowhere.
So then I can't tell what part of it is slop, how slop, and it becomes impossible to trust.
LLMs literally are incapable of writing in the way humans are. Generating a string of tokens is a completely different task than composing prose be it fiction, documentation, or product releases. It would take an insane harness on the par of a complexity of a coding harness to write at the level of college graduate.
So when I see someone saying LLMs are suitable for this use I must assume that they don’t think what they are writing is worth the effort or they don’t understand how effective written communication works. Either way, I’m resentful of it in the way someone reviewing a slop PR is.
I’ve been thinking about this a lot this week after having fable try to write some design docs and it outputting 1k line docs which I had to manually rewrite to 200-300 lines. I should of just did it myself to start.
Then don't trust it. Don't read it. Don't use it. But I don't get this obsession with trying to police and control everyone's use of AI. Hint: you can't control everyone. They're going to do what they want whether you like it or not. The only thing you can do is move on.
Let me make sure I am hearing you right.
1) The person you report to asked you to accomplish a discrete task
2) of standing up one of the most common websites on the planet
3) and your response was to begin building your own custom CMS?
I know I am removing the train of thought that led you down this path, but is there anything I just said that is factually false?
I’ll try to tell the story in a more responsible way: My boss asked me to install a WordPress, to which I advised against it; while it’s easy to set up, it doesn’t align with our tech stack (his main team won’t be able to support it easily, woohoo army of juniors!), and the convenience of a quick start is outweighed by having a thing that needs CVE patching when, guess what never got hacked: pure, static HTML.
Since my wife had asked me twice the same week to set up a website with a design mock she’d sent me, I thought: what’s holding me back in both cases from giving them a Claude Design’ed Hugo theme is that they need to edit Markdown on their filesystem and run terminal commands.
So I picked an item out of my infinite backlog, which was very well-defined: a web dashboard that acts as the equivalent of the WordPress admin page that lets you manage a Hugo static site, use a rich editor on top of Markdown, and commit to git instead of a database. I spent the better part of a weekend making this, with my wife as the customer, and when it got good enough, I presented it to my boss. He was happy with the choice, but mostly because of the vibed design, he ultimately didn’t care about the technology.
When someone wants “a WordPress” they’re asking for convenience of an easily updated website.
AI has helped us all lose the plot because now we don’t just know better than everyone else, we can prove it by project managing our better versions of the same things.
What I find really great is that we’re only a prompt or two away from proper docs for these novel solutions but we still don’t make them and if we do, we definitely don’t read them first.
I’ll say “proper docs” has shifted for me for two reasons
I used to insist on commenting code richly, so I could better read it. But comments lie, while code is truth. Read the code, that’s what it does.
With AI, the cognitive overhead of getting a human-worded explanation of what’s true, is one prompt away and is never a stale leftover.
So the purpose of docs: Specs for implementing and getting an architectural overview, and API documentation for exploring the interface of something new.
What I find great is that people still don’t test their code when it became practically free to do so.
Some of the things I like about RubyLLM:
1. the DSL - You can chain methods like ActiveRecord.
2. the Structure - If gives a way to organize agents, tools & prompts
3. the Portability - The costs of AI usage, will one day be an issue for any successful product. Being able to easily test and move from Anthropic to DeepSeek cut my bill down by over 90%. Knowing how easy RubyLLM makes it, ignoring this eventuality feels reckless to me.
4. ActiveRecord Integration - With a simple `bin/rails generate ruby_llm:install
`, you can save each chat to your database.
5. Agent Training - This is a side benefit of the above, but has been a huge unlock for me. Since I have all my chats saved, I will regularly pull down that history and give it to claude code to refine my agent instructions.
Top 10% of global earners (~800M people) can afford a $2,000 device without major financial strain.
Top 25% (~2B people) could afford it with some budget adjustments.
Bottom 50% (~4B people) would find it prohibitively expensive.
So for a SV top income, maybe that might look more like the weekly pet brushing budget, but for most people out there this is not that much of a no-brainer.
The maths changes if you're working for yourself. Because I live in Europe, I've ended up working as a contractor due to the lack of a legal entity in my country. While that mostly sucked for a bunch of reasons, I was able to get a 64Gb Mac M2 a few years back with approximately a 52% discount, which was kinda nice.
If you're working for yourself paying monthly is exactly the same as amortising an asset. Personally I'd rather my business just pay $100 a month than have to deal with additional hardware and software maintenance while using a depreciating asset that is break-even after 3-5 years depending on the spec.
reply