How One Developer Built a Secure, Read-Only MCP Server Before Going to Production

·2 views

A developer building Lutions, a private web app for project and ticket management, designed security constraints for its Model Context Protocol (MCP) server before any production tools were deployed. The core decision was to limit the server to six read-only tools that search and retrieve tickets, comments, and links — preventing it from acting as an open API or autonomous agent. Each tool accepts only tightly scoped inputs, such as bounded search text and capped result limits, to avoid becoming a vector for arbitrary data access. Authorisation is enforced server-side through user context and visibility rules, meaning tool schemas serve as structural guardrails rather than security substitutes. The approach reflects a broader architectural principle: narrowing the tool surface reduces misuse risk and keeps the permission model aligned with what the underlying application already enforces.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DeepSeek V4.1-Flash cuts KV cache 4x despite doubling model size, targeting AI agents

DeepSeek released its V4.1-Flash model on September 10, 2026, specifically engineered to reduce the cost of running AI agents that repeatedly read large contexts rather than generate long outputs. The model introduces a Causal Encoder-Decoder (CED) architecture that splits its 552 billion parameters into encoder and decoder halves, sharply reducing active parameters during input processing to just 8 billion. Additional techniques — including Compressed Sparse Attention 2 (CSA2) and FP4 KV caching — bring total KV cache storage down to 890 bytes per token, roughly one-quarter of its predecessor V4-Flash and 437 times smaller than the original V1. This matters economically because agentic workloads spend most compute re-reading the same context in loops, meaning KV cache — not token generation — is the dominant cost driver. Benchmark scores for agent tasks such as DeepSWE and Terminal-Bench rose substantially, from 54.4 to 74.2 and 82.7 to 90.6 respectively, compared to V4-Flash.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Coolify, Dokku, CapRover or Ownkube: Which Self-Hosted PaaS Fits Your Team in 2026?

As teams look to cut Heroku costs in 2026, four self-hosted PaaS platforms — Coolify, Dokku, CapRover, and Ownkube — have emerged as the most commonly evaluated alternatives. Dokku and CapRover are best suited for solo developers or indie projects running on a single low-cost VPS, with Dokku offering Heroku-like buildpack support and CapRover providing a click-through UI. Coolify targets solo founders and small teams seeking a polished interface with built-in support for databases, queues, and monitoring. Ownkube is positioned for teams of 5–20 engineers on AWS who want Kubernetes-grade scalability without hiring dedicated DevOps staff, operating the platform on the user's own cloud account with a managed control plane. The key tradeoff across all four is operational burden — while each delivers Heroku-style deployment primitives, only Ownkube offloads ongoing platform maintenance, whereas the others leave infrastructure operations largely to the user.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS NAT Gateway Can Cost More Than Your Entire EC2 Bill — Here's the Fix

AWS NAT gateways charge $0.045 per hour per availability zone plus $0.045 per GB of data processed, meaning a multi-AZ production workload pushing 10 TB per month can rack up over $1,400 in NAT costs alone — often exceeding the compute bill. The core problem is that traffic between private subnets and AWS services like S3, ECR, and Secrets Manager is routed through the NAT gateway by default, generating unnecessary data-processing fees. The most impactful fix is enabling VPC endpoints: gateway endpoints for S3 and DynamoDB are free, while interface endpoints for other AWS services charge $0.01 per GB instead of $0.045, breaking even at roughly 700 GB per month. For outbound IPv6 traffic, AWS's egress-only internet gateway is free and carries no data-processing or hourly fees, yet remains widely underutilized. Teams are advised to audit which traffic actually needs NAT and reroute internal AWS service calls through endpoints as a first step to significantly reducing cloud costs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Avatar v20 Adds Voxel Garden, Cursor Pop-ups, and AI Tool Notifications

AI Avatar, a free VS Code and Chrome extension that animates a VRM avatar during coding sessions, has released version 20 with several new features. The update introduces a Minecraft-style voxel flower garden that grows automatically when triggered by Claude Code or manually via clicks, complete with butterflies, rain, and rainbows. A new Cursor Avatar spin-off Electron app lets the avatar appear anywhere on the desktop outside the browser or editor side panel. The release also includes Notification Avatar, which uses hooks to alert users when AI coding tools like Claude Code or Codex stop or require approval. Additional updates include a Kaleidoscope Mode for randomized backgrounds and support for Piper TTS as a simpler text-to-speech alternative.

0 comments Read more at DEV Community