Analysis of 27,000 MCP Connections Reveals OAuth Refreshes, Not Servers, Cause Slowdowns

·1 views

A developer analyzed 35 days of Claude Code MCP connection logs from their own machine, covering over 27,000 connection pairs across 22 servers and nearly 2,900 sessions. While the median connection time was a fast 582ms, the 90th percentile per session stretched to 35.5 seconds, with one-third of sessions spending over 10 seconds just establishing connections. The data showed that connections involving an OAuth token refresh were 5.8 times slower than those without, revealing that auth round-trips — not server code — are the primary source of latency. The analysis also found that stdio transport is three times faster at the median but less predictable in the tail, while HTTP servers are slower on average but more consistent. The key insight is that running multiple MCP servers per session compounds these delays through fan-out, making total session startup time the more meaningful metric to track.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tool Turns GitHub Activity into Roast-Worthy RPG Character Cards

A developer built a weekend side project that converts any public GitHub profile into a role-playing game character, complete with a class, level, and letter grades across skills like Backend, DevOps, and Machine Learning. The grades are derived from real account data, including repositories, programming languages, topics, stars, and account age, making the results surprisingly accurate. As a demonstration, Linus Torvalds was rendered as a Mythic Level 99 'Linux Kernel Architect' with a failing Frontend grade and a jab about never centering a div. The tool requires no login, runs on Next.js with Vercel, and uses Claude AI for structured output alongside the GitHub REST API and Upstash Redis for caching. Each skill card includes a 'Prove us wrong' button, with the creator hoping the roasts motivate users to actually improve their weakest areas.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Stateful vs. Stateless Frontend Design Explained Through a Food Delivery App

A technical explainer on DEV Community uses a Snappfood-like food delivery app as a model to illustrate the difference between stateful and stateless frontend architecture. Stateless systems process each input independently without retaining memory of prior interactions, while stateful systems depend on accumulated history to determine current behavior. The article clarifies that a stateless API does not imply a stateless business domain, since data like baskets and orders is stored durably in databases rather than in server memory. As frontend applications grow beyond a few pages, decisions about who owns each piece of state, how long it persists, and what serves as the source of truth become critical architectural choices. The piece is intended as an educational model and does not reflect Snappfood's actual internal implementation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Password Strength Estimator Tool Shows How Character Choices Affect Crack Time

A browser-based password strength calculator has been developed to help users understand how password length and character variety affect resistance to brute-force attacks. The tool analyzes factors such as character pool size, estimated entropy, and hypothetical attacker hardware scenarios to illustrate how small password changes can dramatically alter theoretical crack times. Designed purely for education, it advises users to test fictional passwords rather than real ones to protect their privacy. The tool acknowledges its limitations, noting it cannot account for real-world factors like breached credential databases, weak hashing algorithms, or pattern-based guessing. Its guidance aligns with recommendations from security bodies like NIST and OWASP, which emphasize rate limiting, salted adaptive hashing, and multi-factor authentication over simple password composition rules.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mislabeled debug pod silently routed live checkout traffic to staging DB for 19 days

A production incident at a software team went undetected for 19 days after an engineer copied a checkout deployment manifest into the production namespace to reproduce a bug, inadvertently retaining the same pod labels used by the production Kubernetes Service selector. Because Kubernetes Services route traffic based solely on label queries, the three debug pods matched the selector alongside six production pods and received roughly one-third of real customer checkout writes — all directed at the staging database. No alerts fired because the debug pods returned HTTP 200 responses, reported metrics under the same service label, and even showed marginally better latency, masking the misdirection entirely. The issue was discovered only when a colleague noticed a real customer order, complete with a live card reference, inside the staging admin tool. In response, the team introduced unique per-deployment instance labels, a policy rule blocking config-to-namespace environment mismatches, and a nightly audit report flagging Services backed by more than one workload.

0 comments Read more at DEV Community