Viewing profile — miguelspizza

Not sure I understand the point your are making. how is this unique for bots with their own identity? Bots hijacking a user session can also be blocked

AI Session Hijacking is such a dead end and I think this will be the thing that kills it. Just register these things in the IDP and let them sign into their own accounts. Maybe if …

I used this for a POC analytics dashboard for a client recently. Very very good, nice work. What are your plans for the library?

What’s ironic about this is they technically already shipped a looser version. The entire cf api is exposed as an MCP server which supports OAuth and dynamic client registration. N…

Happy to see WebMCP adoption and a standards first framework. The argument for react has always been dev velocity and ecosystem. But with AI the best web experiences will be as clo…

I have been working full time in the MCP (& WebMCP) space for about a year now. Half consulting half spec work. The article is semi right. Local MCPs that are made by enthusiasts w…

I’m not sure why this is getting so much hate. This is the future people, AI is a primitive of modern software, just be thankful chrome ships this locally

A lot of people are acting like code quality doesn’t matter anymore. Coding is solved, agents will write everything, and nobody will need to read code line by line etc etc. I've no…

I’ve spent the past few months working with and implementing OAuth. This might the best collection of resources: https://github.com/ryanspletzer/oidc-oauth-spec-graph

We actually have this with the permissions API. The issue is everyone just opts for longer approval times and less intrusive UX with manifest level permissions. I agree though, run…

Playwright and Chrome DevTools MCP servers are the standard for agent-driven web app testing, but their token efficiency is terrible: the screenshot-action-screenshot loop quickly …

Hate to say it but this sounds like a skill issue. The reason Typescript monorepos are gaining popularity for building with AI is because of how powerful TS's inference system is. …

Clojure is such an underrated language for vibe coding for this very reason. Makes me wonder what a theoretical “best possible language for vibe coding” would look like

Not sure where you heard this but general sentiment is the opposite. There was recently a conference which was themed around the idea that typescript monorepos are the best way to …

The agent mode is really disappointing. I thought OpenAI would try to be more innovative with how the agent interacts with webpages, but it looks like it's the same DOM parsing and…

WebMCP essentially turns your website into an MCP server. Which means it is kind of like building a UI for the LLM that lives alongside the human UI. It's also a contract for how L…

It's more providing permission granularity on the action level rather than the sandbox level. Your script might not be able to make external api calls, but there is no way to gate …

Hey glad to see Jason getting the credit he deserves! He was grokking WebMCP long before anyone else. If anyone wants to test out WebMCP, you can go to: https://webmcp.sh/ (this is…

> The other part is the cohesive interface for the agent itself to use these selectors We are incubating this over at the WebMCP web standard proposal. You can see the current draf…

I wrote #2 as a result of a web automation tool I a working on. It's easier to show than tell. This is a video of me "vibe-coding" a userscript that adds a darkmode toggle to hacke…

I left my job to work on my side project (MCP-B: https://news.ycombinator.com/item?id=44515403 ) full time. I set out with the goal of making the ability to vibecode a webMCP serve…

Hey I wrote MCP-B and am about to do another launch here in a week or so. The product is a browser agent which does browser automation sudo-deterministically over WebMCP. https://n…

Can we run it in the browser via WASM?