Feed

If you think that you can achieve security through offering guidance to the LLM through cursor rules, then you are misguided. Cursor rules or any of those types of rules (i.e AGENTS.md) that are attached to your agentic coding harness are mere suggestions to the LLM. They are suggestions.

Right now, AIs own no responsibilities. If they get things wrong, they don’t guarantee to fix it. They take no responsibility for the trouble they may cause with their errors. In fact, this difference is currently the key difference between human employees and AI workers. The buck stops with the humans. They take responsibility for their work; you hire humans because you trust them to get the job done right. If it isn’t, they redo it, and they learn how to not make that mistake again. Not so with current AIs. This makes them hard to trust.

Every company, and probably every person, will have an AI agent that represents them inside the AI system to other AI agents. Making sure your personal rep agent has a high trust score will be part of your responsibility. It is a little bit like a credit score for AI agents. You will want a high TQ for yours. Because some AI agents won’t engage with other agents having low TQs. This is not the same thing as having a personal social score (like the Chinese are reputed to have). This is not your score, but the TQ score of your agent, which represents you to other agents. You could have a robust social score reputation, but your agent could be lousy. And vice versa.

AI seems to be accelerating this feeling, at least with many of my friends. There is a sense of malaise and frustration at what appears to be the slow erosion of intentional care and effort in our industry. Just let the AI do it, while you ... do other stuff.

I'm not quite there yet. I believe you can use AI as a virtual assistant that does the stuff that actually causes burnout in the first place. Creating and updating READMEs, ensuring the code on your docs is correct, writing a script that compiles markdown to a PDF - things like that.

I had not thought of it this way but I love the idea and it is very true and feels right. I often create posts that are just links to stuff I read on the internet. Typically I don't write any comment at all. I simply quote the relevant part of the link.

Here's how to leave a comment on this web site:

1. Read a post
2. Think, "I want to comment on this"
3. Draft a post on your blog
4. Add a hyperlink to my post
5. Paste an excerpt to which you want to respond
6. Write your comment
7. Hit publish

Many people have found the intelligence of AIs to be shocking. This will seem quaint compared to a far bigger shock coming: highly emotional AIs. The arrival of synthetic emotions will unleash disruption, outrage, disturbance, confusion, and cultural shock in human society that will dwarf the fuss over synthetic intelligence. In the coming years the story headlines will shift from “everyone will lose their job” (they won’t) to “AI partners are the end of civilization as we know it.”

If something is common enough to require a trustworthy NPM package, then it is also well-represented in the training set, and you can generate it yourself.

The core principle is simple: reduce the need for external context and assumptions. An AI agent is at its best when the next step is obvious and the tools are intuitive. This framework builds from the most immediate agent interaction all the way up to the complete system architecture. This isn’t to say today's agents can’t reason or do complex things. But to unlock the full potential of today’s models—to not just solve problems, but do so consistently—these are your levers.

My takeaway? Maybe instead of arguing about MCP vs CLI, we should start building better tools. The protocol is just plumbing. What matters is whether your tool helps or hinders the agent's ability to complete tasks.

That said, if you're building a tool from scratch and your users already have a shell tool available, just make a good CLI. It's simpler and more portable. Plus, the output of your CLI can be further filtered and massaged just by piping it into another CLI tool, which can increase token efficiency at the cost of additional instructions. That's not possible with MCPs.

Once you have a well-designed, token-efficient CLI tool, adding an MCP server on top of it is very straightforward.