AI Agent Supply Chain & Identity

Agents install from the same registries, read the same config files, and hold the same credentials as everything else, and the failures arrived before the controls did. Posts here follow MCP packaging and configs, the lethal trifecta with receipts, agent identity, and the review and merge handoffs where a human used to sit.

Last updated:

  1. MCP Servers Have an npm Problem
  2. Your MCP Configs Are an Attack Surface Now
  3. TanStack Did Everything Right
  4. The MCP Spec Just Did the Cleanup
  5. The Lethal Trifecta Has Receipts
  6. Google Gave AI Agents Their Own IAM Principal. That Solves Only Half the Problem. Scheduled
  7. GitHub Put Security in the Agent Handoff Scheduled