Field notes on AI-native SaaS.
How to ship MCP servers, embed in-product AI assistants, and monetize AI usage — written by the team building the platform.
- MCP education
We tested 25 "official" MCP servers for one-click OAuth. Ten failed.
A registration_endpoint in a provider's OAuth metadata isn't proof it accepts self-registration. Real testing against Intercom, Calendly, PostHog, Freshdesk and 21 other MCP servers found a charset bug and ten false positives — here's what broke and how we fixed the marketplace around it.
Sep 13, 2026 · 6 min - MCP education
The MCP connect page is your new signup form — design it like one
How MCP clients discover auth (the four-RFC handshake: 9728, 8414, 7591, PKCE) and what belongs on the hosted connect screen your customers see: branding, minimal credential ask, live validation, privacy copy.
Jul 11, 2026 · 5 min - MCP education
The three bugs that break real MCP clients (found with Claude in production)
A 405-vs-401 handshake detail, a missing CORS header, and Cloudflare's AI-bot blocking: three production bugs that pass spec review but break Claude, Cursor and ChatGPT — with symptoms and fixes.
Jul 11, 2026 · 6 min - MCP education
OAuth for MCP servers: the 2025-06 spec, explained
OAuth 2.1 with PKCE is how the MCP spec authorizes remote servers. Here's the flow, the spec requirements, and the pitfalls to avoid when shipping a hosted MCP server.
Jun 23, 2026 · 5 min - MCP education
MCP server security: a production checklist
Production security checklist for MCP servers: short-lived per-user JWTs, tool-level authorization, gateway rate limits and cost caps, confirmation for destructive writes, prompt-injection handling, and append-only audit logs.
Jun 21, 2026 · 7 min