Wrong API Endpoint Made MCP Tool Return Drafts Instead of Published Articles

·1 views

A developer discovered that a DEV.to MCP server tool called list_articles was silently returning unpublished drafts instead of published articles due to a wrong API endpoint. The tool's docstring promised published articles, but the underlying code called /articles/me, which returns all articles with drafts sorted first, rather than the correct /articles/me/published endpoint. Because the default page size was set to 10, any account holding 10 or more drafts would receive only drafts in the response, with no error or empty-list signal to indicate something was wrong. The bug went undetected across multiple code audits because the tool had never actually been executed in the developer's sandbox environment. The issue was confirmed through a reproducible test using a stubbed fixture, and fixed by updating the endpoint to /articles/me/published.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hardcoded API Keys in Cron Scripts Expose a Silent Config and Security Risk

A developer migrating years of automation scripts to version control discovered live API keys embedded as default fallback values in Python environment calls. Rather than acting as safety nets, the hardcoded literals were the actual working configuration, since the environment variables they were meant to back up had never been set in cron's minimal runtime. Deleting the literals without first confirming the environment carried the values would have silently broken scheduled jobs, with failures only surfacing in unmonitored log files. A subsequent secret scan flagged high-entropy strings but missed a plaintext email and password combination, highlighting that entropy-based detection cannot catch short or human-readable credentials. The incident illustrates that the correct fix requires verifying which code branch is actually running in production before removing any default, not simply treating the removal as routine hygiene.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

API Pagination Explained: Offset, Cursor, and Keyset Patterns Compared

APIs that return large datasets require thoughtful pagination strategies, as simple offset-based approaches can cause performance and consistency problems at scale. Offset pagination is easy to implement and supports direct page jumps, but slows down with deep queries and can return duplicate or missing records during concurrent writes. Cursor pagination encodes the last seen item's position, enabling fast and consistent results ideal for infinite scroll and real-time feeds, though it does not support jumping to arbitrary pages. Keyset pagination works similarly to cursor-based methods but uses raw column values instead of encoded tokens, offering transparency and efficiency with composite indexes at the cost of exposing implementation details. Developers are advised to cap page limits, include next-page links in responses, and choose the pattern based on dataset size, consistency needs, and client requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Founder Built an AI-Readable Knowledge Base Using Obsidian, Git, and VS Code

A solo founder and lead architect at NEXT4I has shared a three-layer personal knowledge management system designed to make institutional memory searchable and AI-accessible. The setup combines Obsidian for storing plain Markdown notes with wiki-style links, Git for version-controlling every change with descriptive commit messages, and a VS Code AI agent that reads the file tree as context. Because all notes are stored as standard .md files with no proprietary format, any AI coding assistant can treat the knowledge vault the same way it would treat a codebase. The folder structure is organized into categories such as Ideas, Infrastructure, Platform, Scripts, and Skills, with each folder serving as a distinct context layer for both human navigation and AI queries. The author emphasizes that the entire pattern is tool-agnostic and reusable, requiring no paid SaaS tools or custom integrations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Built 70-Tool Web Platform With Zero Backend Code and Near-Zero Server Costs

A frontend developer built BeGoodTool, a browser-based utility platform hosting over 70 tools, after growing frustrated with sign-up walls and privacy risks on existing online tools. Every tool on the platform runs entirely within the user's browser, using local CPU and RAM, meaning no user data ever reaches a server. This client-side-only architecture eliminates server compute costs, making the platform virtually free to run regardless of traffic volume. The site is hosted on Azure Static Web Apps' free tier and distributed globally through a CDN, with no backend infrastructure required. Over four years, the project grew from a simple weekend experiment into a multi-language platform generating substantial passive income for its solo developer.

0 comments Read more at DEV Community