Developer Builds MCP Governance Tool After AI Agent Gained Unchecked Production Access

·5 views

A developer discovered last week that an AI agent connected to three MCP servers had equal, ungoverned access to both read-only tools and production deployment capabilities. Recognizing that MCP standardizes how agents communicate with tools but provides no built-in governance, the developer found no existing tools to manage permissions, approvals, or audit trails across multiple connected servers. They began building a control plane — dubbed mcp-fabric-toolmesh — that consolidates server registration, policy enforcement, approval workflows, and audit logging into a single platform. What was planned as a phased rollout across three versions collapsed into a single release as each governance layer proved dependent on the last, tripling the original timeline. The project, published to PyPI after multiple naming conflicts, surfaced 170 type errors during development, which the author attributed to design ambiguity rather than simple coding mistakes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds 5-Game LAN Party Server Using Only Two In-Memory Maps

A developer built GameNight, a Node/Express/Socket.io server hosting five real-time party games — including a Mafia variant, UNO, trivia, Scribble, and Tic-Tac-Toe — designed to run locally without internet, accounts, or a database. The entire game state is managed using just two JavaScript Maps: one tracking rooms by code and another linking socket IDs to rooms. Rather than building a shared game engine abstraction, the developer opted for zero shared architecture, giving each game its own state shape and handler functions dispatched via a single switch statement. All timed phase transitions across games are managed through a consistent two-function timer pattern to prevent memory leaks when games end early. The project prioritizes simplicity and local usability, allowing players to join from their phones within seconds of the host running a single command.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MindStack Chrome Extension Offers Spaced-Repetition Flashcards With No Server Required

A developer has built MindStack, a Manifest V3 Chrome extension that converts saved web content into spaced-repetition flashcards without any backend infrastructure. The tool relies entirely on chrome.storage.sync and chrome.identity for cross-device sync and user identification, eliminating the need for accounts, databases, or external servers. Instead of a full SM-2 algorithm, MindStack uses a simplified scheduler that grows review intervals multiplicatively based on review count and clamps the ease factor between 1.3 and 3.4. The developer deliberately omitted per-card interval history to reduce storage overhead, arguing the approximation is sufficient for a casual browsing retention tool rather than rigorous exam preparation. The extension requires no build step or package manager and can be loaded directly as an unpacked extension in Chrome.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python library specenv makes env variable errors self-explanatory and actionable

A Python library called specenv is designed to load typed environment variables with zero runtime dependencies, covering casting, validation, and schema grouping. Its core design principle requires every error message to name the problematic variable and provide an explicit fix, with no exceptions. Rather than using a single generic error formatter, each type-specific failure builds its own inline message — for example, guiding users to valid integer or boolean formats. The library also collects all configuration errors in a single pass instead of stopping at the first failure, since misconfigured deployments typically involve multiple missing or malformed variables at once. This approach trades a small amount of code duplication for error messages that are consistently actionable rather than merely technically accurate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python library timerx records timing data even when timed code raises exceptions

A developer has released timerx, a small dependency-free Python timing utility designed to fix a common flaw in ad-hoc timing code. Standard Python timing patterns silently drop measurements when the timed function raises an exception, meaning the slowest or most problematic calls go unrecorded. timerx solves this by wrapping all three entry points — decorator, context manager, and named stopwatch — with finally blocks that guarantee timing is recorded regardless of whether an exception occurs. The library also handles re-entrant or recursive timing under the same name by storing start times as a stack rather than a single slot, preventing silent overwrites. Exceptions are never suppressed; the library only observes and records, leaving error handling entirely to the caller's code.

0 comments Read more at DEV Community