Rafael Sales

Software Creator

Welcome to my yard. I planted seeds a long time ago, and they've grown into beautiful trees.

I write about software, from idea to production. Strong opinions, critically formed.
No human BS, no AI slop.

Subscribe via RSS

My gut flagged MCP's Dynamic Client Registration before the RFC did

I'm building my first MCP server and AI told me to use the standard Dynamic Client Registration: expose a public endpoint, let any client POST its own metadata, hand back a client identity the server then trusts. No gate. I had not read RFC 7591, and I had never cleaned up after a registration incident. It still smelled wrong in about ten seconds. An open endpoint that mints trusted identities from self-asserted metadata is a bad default, and my gut flagged it long before I could cite a reason.

Read more →

Why I write here

Way too many opinions about software stay invisible inside private Slack threads and code review comments. They deserve a public, permanent address. This blog is that address: my opinions on building software, running it in production, and the trade-offs I stand behind.

Read more →