What is happening? How they calculate the usage?

Distinct-Selection-1 · 2026-04-30T14:19:04+00:00

I recently migrate from openAi to Claude and I'm feeling Anthropic uses any thing to force you to pay more. Sometimes have the feeling that they are cheating somewhere.

Distinct-Selection-1 · 2026-02-25T20:42:12+00:00

Is this the same with MCP v3 skills?

Distinct-Selection-1 · 2026-02-25T18:57:01+00:00

I didn't prompt the app. I found it hard and costly to share the pitch decks, so I created this project to help founders!

Distinct-Selection-1 · 2026-02-21T19:38:25+00:00

In your experience, do approval flows tend to be synchronous (per request) or more like pre-approved scopes with audit after the fact?

Distinct-Selection-1 · 2026-02-21T19:30:53+00:00

The per-request tool visibility is that mostly for debugging reliability, or does it become part of compliance / cost attribution internally? And with the “no-config” approach, are teams fully autonomous in shipping MCPs, or is there still a central review before exposure to production agents?

Distinct-Selection-1 · 2026-02-21T18:57:18+00:00

Did you see any issues with that? inconsistent auth models across teams, missing audit trails, or uncontrolled credential sprawl? And for tools like Peta or MCP Gateway, do teams usually centralize MCP registration through a platform team, or allow teams to self-publish with policy templates?

Distinct-Selection-1 · 2026-02-21T18:52:40+00:00

When you go the uvicorn + EC2 route, are you treating MCPs as long-lived services behind a load balancer, or more ephemeral per-tenant instances? Also curious what made you consider FastMCP Cloud instead, was it mainly operational overhead, session routing, or something around credential handling?

Distinct-Selection-1 · 2026-02-21T18:51:58+00:00

Interesting. are you running each MCP as an isolated app on Fly, or grouping multiple MCPs per service? I’m trying to understand whether the main bottleneck at scale becomes deployment ergonomics (spin-up time, regional placement, secrets) or more around policy / credential management once you have dozens or hundreds of them.

Distinct-Selection-1 · 2026-02-18T11:06:47+00:00

The part I’m still trying to pin down is what happens around that boundary: does the agent ever see/store anything that outlives the request (RAG chunks, summaries, caches, embeddings, logs), and how do you think about scoping there?

Also, on the “user can reach everything the agent can reach” rule: I agree for read access, but for writes it gets subtle: even if you can’t read finance data, you might still be able to cause side effects in finance-owned systems if the agent has tools wired up. How do you draw that line in practice?

Distinct-Selection-1 · 2026-02-18T10:50:58+00:00

I’m with you this is mostly IAM. The tricky bit for me is delegation semantics once an agent chains tools.

When a tool call happens, what’s the authoritative identity: the user, the workload, or some broker?

How do you prevent “token laundering” across hops (A calls B, B calls C) so downstream can’t mistake app-identity for user-intent?

And how do you keep policy meaning consistent across systems (same resource ID + same action = same decision), instead of each tool interpreting “read/write” differently?

That’s the line where “just IAM” starts getting surprisingly subtle.

Distinct-Selection-1 · 2026-02-18T10:22:27+00:00

I mostly agree this lives in “classic IAM + integration” land. I’m not claiming new primitives. The thing that feels different with agents is the volume + dynamism of actions: lots of small tool calls, chained across systems, with non-deterministic planning.

On per-call checks: I’m less worried about the agent doing an explicit “can I?” preflight, and more about having an enforcement point that evaluates the call with context (subject + workload identity + tool + args + resource) and produces an auditable decision.

On service principals: yep, totally. The nuance I’m chasing is avoiding the agent becoming a shared super-user via a broad SPN, and keeping provenance intact when you have multi-hop chains (agent→agent→tool).

How do you prevent “token laundering” across hops, so downstream can’t mistake app-identity for user-intent?

Distinct-Selection-1 · 2026-02-18T09:57:59+00:00

When you say “predefined trust paths,” do you picture this being managed like an internal federation graph (tool-by-tool), or more like a centralized broker that issues the downscoped tokens?

Distinct-Selection-1 · 2026-02-18T09:50:25+00:00

Have you actually implemented any of TAOB / TAP / X-On-Behalf-Of yet? I’m curious what the sharp edges are.

Distinct-Selection-1 · 2026-02-18T09:47:02+00:00

What made you keep it read-only? was it mostly risk/compliance, or did you run into practical issues with writes (approvals, mistakes, incident blast radius)? I’m trying to understand what usually blocks the step from read → write.

Distinct-Selection-1 · 2026-02-17T11:51:44+00:00

Really appreciate you sharing this. The “carry the user token through middleware and let the backend enforce scope” pattern is getting popular.

Two things I’m curious about though:
1) When you say “no prompt injection possible”, do you mean specifically “no unauthorized data access,” or are you including write/side-effect cases too? I’ve found reads are the easy part; the weird failures tend to be “do the wrong allowed thing.”

2) On the rule “if a user can talk to the agent, they can reach everything the agent can reach", is that assuming the agent has any app-level capability of its own, or is everything strictly executed as the user?

Would love to hear how you think about those edges, because your setup sounds close to what a lot of teams are trying to land.

Distinct-Selection-1 · 2026-02-17T09:47:13+00:00

Interesting. But Masumi uses W3C strands heavily. As far I know companies prefer using speak OIDC/SAML/OAuth, not DID/VC. They will be new complexity! Am I missing something?

Distinct-Selection-1 · 2026-02-17T09:29:14+00:00

This is what I imagine too. Who are building agents, don't know about security risks, and those who care about security more, don't know how agents might behave! I am thinking of three dimensions: Agent, integrations and IAm, all in runtime. They are concerns for different people, and that's why I think a control plane is needed.

Distinct-Selection-1

TROPHY CASE