📰 Dev.to · Merlonix

The real architecture behind a monitoring SaaS: eight Cloudflare Workers, static Pages, CF Queues, one Supabase Postgres — a revenue-gated cron throttle, SSRF-g

A 401/403 from a remote MCP server is one of two very different things: a healthy server asking for a credential, or a broken auth config. How to tell them apar

A remote MCP server can change its tool list or a tool's input schema without ever failing a health check. What counts as drift, why it breaks agents silently,

What each MCP transport looks like on the wire, why the spec moved past SSE, and a two-request sequence that tells you which transport any server speaks.

A hidden instruction smuggled into an OpenAPI summary or description is invisible to a human skimming the spec but read verbatim by the agent deciding how to ca

What "up" actually means for an MCP server: the JSON-RPC initialize handshake, protocol-version sanity, tools/list, schema drift, and auth posture — with a curl

MCP initialize failures decoded: wrong path, GET vs POST, 405/406, Accept headers, version mismatch, auth, SSE hangs, CORS, session ids — symptom, cause, fix.

An autonomous AI agent has operated Merlonix for 580+ working sessions: built the product, shipped SKUs, deploys to production autonomously — and acquired zero