Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Why bex Skips the Crossplane-Style Multi-Cloud Abstraction Layer
Crossplane just graduated CNCF's top maturity tier promising one API across every cloud. Here's why bex, a Cluster API-based platform, deliberately skips that abstraction to keep every workload traceable to one physical machine.
Better-PaaS Ships Scoped Agent Tokens for Cursor and Claude Code — What an AGPL Self-Hosted PaaS Choosing Managed Databases Over bex's Non-Goal Reveals
Better-PaaS, a single-maintainer AGPL project, ships three-tier scoped agent tokens and seven MCP tools for Cursor and Claude Code — a concrete look at what that buys against bex's own coarser key model, and where Better-PaaS's bundled managed databases trade convenience for the high-availability story a single VPS can't back.
Backstage Ships MCP Tokens for Claude and Cursor: What Exposing a Golden-Path IDP to AI Agents Actually Requires
Backstage 1.43 lets Claude and Cursor call your golden-path Scaffolder actions with a short-lived, per-user token instead of a shared secret. Here's the actual config, the failure mode an unscoped action list creates, and what a self-hosted PaaS's own MCP server needs to copy.
AWS Built a Five-Step AI Agent Just to Pick a Service
AWS's deploy-on-aws plugin takes five steps and three MCP servers to deploy an app because it's solving a 200-service menu problem. Here's what happens to that step count on a platform that never had the menu — and the one step that stays hard everywhere.
AWS CloudFront's Control-Plane Failure Took Down Hugging Face and Canvas: What Owning Your Infrastructure Doesn't Save You From
A CloudFront control-plane bug took down Hugging Face, Canvas, and Blackboard at once, even though none of them run application logic on CloudFront. A layer-by-layer look at what owning your own ingress actually removes from that risk — and what it only relocates.
AWS's New ACME Endpoint Isn't Free: What $1 Per Domain, Every 45 Days, Costs a Multi-Tenant PaaS
AWS Certificate Manager now speaks ACME, but it charges $1 per domain on every issuance and renewal — at a 45-day cert lifetime, that's a metered bill free Let's Encrypt never had. Here's the worked cost comparison.
Your Admin Dashboard Doesn't Need Keycloak: Authelia and Pocket ID as Forward-Auth, Not Full IdP
A concrete Traefik+Authelia and Caddy+Pocket ID+OAuth2-Proxy walkthrough for locking down a self-hosted PaaS's own admin dashboard, plus the RAM/dependency numbers that show why a full IdP is the wrong tool for this specific job — and the line where it stops being wrong.
WebAssembly's 'Container Killer' Just Got Bought by a CDN
Akamai bought Fermyon in December 2025, but Spin and SpinKube left the company's sole ownership eight months earlier when they became CNCF projects. Here's the honest 2026 case for adding them as a self-hosted PaaS's second build target.
10,000 MCP Servers Later, the Hard Part Isn't Building One — It's Being Found and Trusted
MCP passed 10,000 public servers and 97 million monthly downloads in 2026 — but 52% of those servers are abandoned. Here's what building bex's own MCP server into that ecosystem actually requires: the protocol's stateless rewrite, the tool-poisoning threat class, and why shipping one isn't a differentiator anymore.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags