Developer builds zero-dependency MCP client in Python, shares lessons from six weeks of work

·3 views

A developer spent six weeks building mcptoon, a CLI tool that sits between AI agents like Claude Code and Cursor and MCP servers, reducing token usage by keeping tool schemas out of the context window. The project was built with zero third-party dependencies, using only Python's standard library, a decision prompted by a supply chain vulnerability discovered in a popular Python tool. Avoiding packages like requests, click, and pydantic meant hand-writing HTTP clients, CLI parsers, and validation logic, adding hundreds of extra lines of code compared to using those libraries. The final result weighs 250KB and is covered by 486 tests, reflecting the significant engineering overhead that the zero-dependency constraint introduced. The developer concludes that while the approach offered security and auditability benefits, some of the added complexity was not always worth the trade-off.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Key HTML, CSS and Bootstrap Concepts Every Web Developer Should Know

A comprehensive guide covering fundamental HTML, CSS, and Bootstrap interview topics has been published on DEV Community for aspiring web developers. The guide explains core HTML concepts such as semantic tags, the box model, and the difference between block-level and inline elements like div and span. It also covers essential CSS topics including specificity, Flexbox layout properties, and the distinction between relative and absolute positioning. Media queries and responsive web design techniques are highlighted as critical skills for building websites that adapt across mobile, tablet, and desktop screens. The resource is aimed at helping developers prepare for technical interviews by reinforcing foundational front-end development knowledge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Creates RydenScript, a Lightweight Tag-Based Declarative Programming Language

A developer has built a new declarative programming language called RydenScript, designed to simplify complex systems such as games and peer-to-peer applications using minimal lines of code. The language uses a single-letter tag-based syntax and weighs approximately 567 kilobytes, making it notably lightweight. RydenScript is open source and has been actively evolving from version 1.0.0 to version 4.0.0. The creator describes its compatibility as moderate and its maturity as still developing, with community feedback being sought to help shape its future. Official documentation has been published online as the project aims to establish itself among recognized programming languages.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DIY Method to Evaluate AI Code Review Tools Beyond Vendor Benchmarks

A software developer has outlined a practical, self-run evaluation method for AI code review tools after finding vendor-published benchmarks unreliable on real repositories. The approach involves running a candidate tool against 20 previously merged pull requests and classifying every flag it raises as real, noise, or actively wrong advice. Two key metrics guide the assessment: the bad-advice rate, which flags dangerous recommendations, and the triage burden, which measures how much time engineers waste sorting unhelpful output. The developer found that most tool failures stemmed from misconfiguration or missing context rather than underlying model quality, and that default settings are typically optimised for demos rather than real team workflows. Running the evaluation twice — once with defaults and once tuned to the team's actual CI setup — is recommended for meaningful results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds his own security test passed while the prompt injection attack still worked

On 26 July, software developer Karim Hamidou discovered a prompt-injection vulnerability in his open-source CLI tool llm-council, which chains multiple AI models to rank and synthesise answers. The tool used fixed, publicly visible delimiter strings to fence untrusted model output, meaning any model that had seen the repository could write the closing marker mid-response and escape the sandboxed block. More troublingly, a unit test already existed that claimed to verify this boundary could not be forged, yet the test only checked string positions and occurrence counts — never whether a downstream model could actually be deceived. The test passed consistently and contributed to 100% code coverage, masking the unfixed vulnerability entirely. The developer resolved the flaw by replacing the static delimiters with a per-run random nonce, making the closing marker unguessable to any voter model.

0 comments Read more at DEV Community