News
Private, non-commercial open-source projects and notes about AI and agents by weisser-dev.
Why wearable interfaces could be the next home for coding agents
A personal look at smart glasses, quiet gestures and coding agents, and what it will take to make an open wearable interface trustworthy.
Planning agents for the future: what a platform needs to run them over time
Run logs, a short morning report, a supervising review agent, a release window with veto and four-eyes publishing: what a platform needs for agents, and what exists.
Does a classifier model always make sense? Deciding what an agent may do
Classifier models can route requests and judge agent actions, but they cost money and make mistakes. When rules are better, when a classifier helps, and how autonomy levels fit.
Detecting and handling model drift in agents
Agents change behaviour when models, prompts, tools or inputs change. How to notice it with golden runs and run metrics, and how to contain it with pinning, canaries and rollback.
What is a playbook for in agentic work?
A playbook makes a recurring agent task run the same way every time: fixed steps, typed handovers, checks and stop rules. How it relates to AGENTS.md, skills and runbooks.
Five open tools around Claude Code: alternatives, companions and what they really are
OpenCode, OpenRouter, Open WebUI, openagentix and Ollama sorted honestly: harness, router, chat UI, platform or runtime. Where each fits and how they combine.
Agent platform readiness: the checklist that ties the series together
AI agent production readiness checklist across architecture, skills, security, operations, cost and evaluation, each item linked to the post behind it.
Measuring whether agents help: outcomes over impressions
AI productivity measurement needs outcomes, not impressions: accepted changes, review time, rework and cost per accepted change, with a metric tree.
Ops series recap: agent platforms are not that different from classic operations
AI platform operations recap: a table of twelve disciplines showing what carries over from DevOps and SRE and what is genuinely new for agents.
An architecture review for agent systems in one page
An AI architecture review template for agents on one page: purpose, boundaries, data flow, contracts, autonomy and failure paths, with questions for each.
Building an internal skills catalog: review, ownership and discovery
Build a skills catalog for your organisation: submit, review, publish with owner and version, then deprecate. Borrows ideas from public registries.
Treat agents like insiders: what misalignment research means for operations
AI insider threat: research on agentic misalignment suggests insider-risk controls for agents, such as separation of duties, limited access and monitoring.
Ops series: capacity, rate limits and runaway agents
LLM rate limiting for agents: nested run, agent, tenant and provider limits stop one looping agent from starving the rest. With a config sketch and alerts.
Beyond tools: MCP sampling, elicitation and tasks
MCP sampling lets servers request model calls; elicitation asks users for input; tasks track long work. Each moves control and needs its own policy.
The agent security checklist: twenty questions before production
AI agent security checklist: twenty yes/no questions on identity, permissions, data flow, injection, sandboxing, supply chain and audit, each with a link.
An AI governance operating model for agents: who owns what
An AI governance operating model fails when nobody owns the agent registry, policies or budget. Roles and a RACI for platform, security, owners and reviewers.
Ops series: how to deploy AI agents with canaries and rollbacks
Deploy AI agents like any service: send a new model, prompt or skill to a small share of runs first, let evals and SLOs decide and keep a rollback ready.
Structured output for agents: schemas, contracts and ownership
Structured output agents hand over typed data, not free text. Define JSON schemas for tool results and outputs, version them and name an owner per contract.
Long-running AI agents: progress files, clean states, checkpoints
Long-running AI agents lose context between sessions. Keep state in a feature list, progress notes and git commits to make runs resumable and auditable.
MCP vs A2A: tools for agents versus agents talking to agents
MCP vs A2A: MCP connects an agent to tools and data, A2A connects agents to each other. Where each fits, what neither covers and why governance sits above both.
Prompt injection testing: check your agents against hijacking
Prompt injection testing pairs a legitimate task with an injected one and checks both outcomes. Build suites for your own tools and keep containment in place.
Code execution agents or direct tool calls? Trade-offs for builders
Code execution agents can cut token use sharply by filtering data in a sandbox, but need isolation. Compared with direct tool calls on cost, safety and audit.
Ops series: LLM FinOps for agents, attributing every token
LLM FinOps applies the cloud playbook to agents: tag every run, attribute spend per key and team, set budgets, alert early and export usage to cost reports.
Enterprise AI agent rollout: pilot, baseline, then scale
An enterprise AI agent rollout works best with a small pilot, telemetry from day one, spend limits and written exit criteria for each wider step.
Prompt hygiene: a checklist for teams drowning in prompts
Prompt management for teams: a checklist covering owner, version, eval, scope and review, plus the rule to move repeated know-how into skills.
Ops series: audit trails are not logs
An AI audit trail must be complete, attributable and tamper-evident; logs are for debugging. How to separate them on agent platforms and what goes where.
NIST AI RMF for agent teams: Govern, Map, Measure, Manage in practice
The NIST AI RMF is voluntary and has four functions. How agent registries, data-flow maps, evals, traces and policies map to Govern, Map, Measure, Manage.
Reading the OWASP Top 10 for Agentic Applications as a platform team
How a platform team can turn the OWASP agentic top 10 and related LLM Top 10 entries into controls: least privilege, sandboxing, approvals and audit.
Air-gapped agents: a checklist for running without the internet
Air-gapped AI means no downloads at run time. A checklist of what to vendor, pin and verify, and how to update agents through a reviewed import path.
Self-hosted models for agents: what changes when inference is yours
Self-hosted LLM for agents: prompts stay in house, but you own capacity, updates and evaluation. Local runtimes versus batched servers and the ops work.
BYOK for agent platforms: your keys, your providers, your bill
BYOK LLM explained: the platform calls model providers with your own keys and contracts. Gateways, catalogs, per-key spend tracking and BYOK's limits.
Ops series: turning runbooks into skills without losing control
Runbook automation AI done safely: turn a runbook into a skill plus narrowly scoped tools with approvals. A step-by-step conversion guide for ops teams.
AGENTS.md: one predictable place for project context
AGENTS.md is a Markdown file at the repository root with build steps, conventions and limits for coding agents. What belongs in it and what in skills.
LLM as a judge: a useful grader with known biases
LLM as a judge scales evaluation but has position, verbosity and self-enhancement bias. Which grader to use and how to calibrate a model grader.
LLM cost optimization for agents: caching, code execution and budgets
LLM cost optimization for agents: where prompt caching pays off, when code execution beats tool calls, and why hard per-run token budgets protect security too.
Ops series: AI supply chain security and patching for agents
AI supply chain security for agents: inventory and patch models, MCP servers, skills, SDKs and images. A checklist for pinned, reviewed artefacts.
Claude Code hooks as policy enforcement points for coding agents
Claude Code hooks run code before a tool call, so a PreToolUse hook can enforce policy locally. How to write one, where it stops and why a central gate stays.
Claude Code vs OpenCode: a governance comparison
Claude Code vs OpenCode on the controls a platform team needs: permission rules, auto modes, subagents, MCP, providers and managed config. No benchmarks.
When are multi-agent systems worth their tokens?
Multi-agent systems parallelise work but multiply token use and add hand-off failures. Single agent, orchestrator-worker and pipeline compared.
Human in the loop for AI agents that works: fewer approvals, better ones
Human in the loop for AI agents fails when every call needs approval. Reserve people for high-risk actions, show context, and let policy handle the rest.
AI agent sandboxing: filesystem and network isolation together
AI agent sandboxing works only when file access and network egress are both limited. Why one boundary is not enough and how allow-lists cut approvals.
Ops series: AI incident response when the actor is an agent
AI incident response keeps the classic phases but needs a kill switch, tool revocation and policy freeze in seconds. A playbook for agent incidents.
Workflows or agents? Choosing how much autonomy a step needs
Workflows vs agents is a per-step choice: fixed code paths are cheaper and easier to govern, loops are flexible. Pick the least autonomy that works.
Versioning agent skills like any other dependency
Skill versioning treats agent skills as dependencies: semantic versions, changelog, pinning and evals that guard upgrades. What counts as a breaking change.
Draw the data flow before you write the first prompt
An agent data flow diagram shows where untrusted data enters, where private data lives and where anything leaves. One-page template for trifecta risks.
Ops series: SLOs for agents, from task success to time to approval
Define an SLO for AI agents like for any service: task success rate, consistency over trials, latency and cost per task, plus an error budget for rollouts.
Quality gates for agent output: a checklist against slop
AI code quality gates let machines reject what humans should never read. A checklist of gates before review: tests, evals, size limits and policy checks.
MCP authorization: OAuth 2.1, audiences and why passthrough is forbidden
MCP authorization builds on OAuth 2.1, protected resource metadata and resource indicators. How the flow works and why token passthrough is forbidden.
Ops series: observability for agents with traces, not transcripts
AI agent observability works best as distributed tracing: model and tool calls become spans with tokens, cost and decisions. Use OpenTelemetry, avoid lock-in.
Design patterns against prompt injection that do not rely on the model
Prompt injection design patterns like plan-then-execute, dual LLM and capability tracking limit what an attack can change by structure, not by detection.
Tool poisoning: when the tool description is the attack
MCP tool poisoning hides instructions in tool descriptions that the model reads and users rarely see. How the attack works and how pinning and review limit it.
Third-party skills are supply chain: an agent skill security checklist
Agent skill security starts with treating third-party skills as dependencies. A checklist for provenance, pinning, full review and least privilege.
Ops series: change management and prompt versioning for agents
Prompt versioning and change management for AI agents: apply semantic versioning, review and rollback to prompts, skills and policies like code.
Handovers are contracts: designing the seams between agents
An agent handover is where multi-agent systems break. Treat each one as a typed contract with an owner, a schema and an acceptance check, not a prompt.
One MCP server per system: MCP server design you can govern
MCP server design rules for governable agents. One small server per system, namespaced tools, and read/write separation instead of one giant gateway.
Small verified steps beat one big prompt: incremental agent workflows
Incremental agent workflows break work into small steps with acceptance checks, progress notes and a clean state after each one. Here is the pattern.
Agent evals 101: tasks, graders and transcripts
AI agent evaluation checks the outcome in the environment, not just the final message. Learn tasks, trials, graders, transcripts and pass@k vs pass^k.
Context engineering: the smallest set of tokens that does the job
Context engineering treats the context window as a finite budget. Practical ways to keep it small: compaction, sub-tasks with own context, notes.
Ops series: secrets for agents never belong in the context window
Secrets management for AI agents in practice: keep credentials on the tool side, give the model only handles, and never pass user tokens through to downstream APIs.
Indirect prompt injection: when the data gives the orders
Indirect prompt injection hides instructions in tickets, pages and tool results. Why filters fail and how to limit the blast radius by design.
Anatomy of an agent skill: SKILL.md, progressive disclosure and scope
SKILL.md is the entry point of an agent skill: its short description decides when the rest loads. Progressive disclosure, a minimal skill and scoping rules.
Ops series: identity for agents, or who is acting on whose behalf
AI agent identity: each agent needs its own identity plus a record of whom it acts for. Delegation vs impersonation, audience-bound tokens, no shared API keys.
Writing tools agents can actually use: names, schemas and errors
Tool design for AI agents is interface design for a model reader. A checklist for names, namespaces, narrow schemas and errors, and how small tools ease policy.
Architecture before prompts: why the foundation decides everything
AI agent architecture sets boundaries, contracts, handovers and data flows before any prompt runs. Why most production failures trace to a missing boundary.
The lethal trifecta: private data, untrusted content and a way out
The lethal trifecta in AI agents: private data, untrusted content and external communication together. How to break the triangle per agent, not trust the model.
Too many prompts: how prompt sprawl turns into AI slop
AI slop is output that grows faster than anyone can review it. How prompt sprawl lowers quality, and why fewer, smaller, verified steps beat more prompts.
What is the Model Context Protocol? A plain explanation for platform teams
What is MCP? The Model Context Protocol standardises how an agent host finds and calls tools, resources and prompts on servers. Plain guide for platform teams
Running agents is operations: the old disciplines still apply
AI agent operations is not a new field: identity, least privilege, change management, SLOs, cost and audit all still apply. The opening of an operations series.
Tool, skill or prompt? Three ways to give an agent what it needs
Agent skills vs tools vs prompts: a tool acts, a skill packages know-how loaded on demand, a prompt is standing text. Includes a decision table.
Agent architecture is not application architecture: the agentix pattern
Application architecture structures code. Agent architecture decides who may do what at run time. The agentix pattern - one MCP server per system, one agent per step - is our answer.
What is an agent harness, and why do harnesses keep shrinking?
An agent harness is the loop and scaffolding around a model. As models improve, much of it moves into the model or the API. What stays is governance, and that is why open-agentix treats the harness as replaceable.
Dark software factory: only for MVPs and PoCs
Letting agents build software with minimal human touch can be a fast way to a prototype. open-agentix offers it as an opt-in mode with a fixed notice, and keeps approval gates for production.
Cost is a platform concern: budgets, per-agent and per-tenant attribution, export
Agent systems can fail financially while working technically. open-agentix prices every step, attributes it to tenant, agent and use case, stops runs at their budget and exports the lines.
A model may ask, the policy decides: deterministic gates and tamper-evident audit
In open-agentix a model can request a tool call but never authorises it. A deterministic policy gate decides before each call, and a hash-chained audit trail records what it decided.
Least privilege for agents: decomposition instead of one all-powerful agent
One agent with read and write access to everything is a large blast radius. open-agentix splits a process into small agents that each hold only the tools one step needs.
Why I share my AI projects as OpenAgentix
OpenAgentix is my personal, non-commercial collection of open-source AI projects, experiments and notes. Here is what belongs here and why I share it.