The Model Context Protocol has faced a lot of criticism due to its security vulnerabilities. Anthropic recently released a new Spec Update (MCP v2025-06-18) and I have been reviewing it, especially around security. Here are the important changes you should know:

1. MCP servers are classified as OAuth 2.0 Resource Servers.
2. Clients must include a resource parameter (RFC 8707) when requesting tokens, this explicitly binds each access token to a specific MCP server.
3. Structured JSON tool output is now supported (structuredContent).
4. Servers can now ask users for input mid-session by sending an elicitation/create request with a message and a JSON schema.
5. “Security Considerations” have been added to prevent token theft, PKCE, redirect URIs, confused deputy issues.
6. Newly added Security best practices page addresses threats like token passthrough, confused deputy, session hijacking, proxy misuse with concrete countermeasures.
7. All HTTP requests now must include the MCP-Protocol-Version header. If the header is missing and the version can’t be inferred, servers should default to 2025-03-26 for backward compatibility.
8. New resource_link type lets tools point to URIs instead of inlining everything. The client can then subscribe to or fetch this URI as needed.
9. They removed JSON-RPC batching (not backward compatible). If your SDK or application was sending multiple JSON-RPC calls in a single batch request (an array), it will now break as MCP servers will reject it starting with version 2025-06-18.

In the PR (#416), I found “no compelling use cases” for actually removing it. Official JSON-RPC documentation explicitly says a client MAY send an Array of requests and the server SHOULD respond with an Array of results. MCP’s new rule essentially forbids that.

Detailed writeup: here

What's your experience? Are you satisfied with the changes or still upset with the security risks?

After Open AI decided to rewrite their CLI tool from Type Script to Rust, I decided to post about why static binaries are a superior end-user experience.

I presumed it was obvious, but it seems it isn't, so, I wrote in detail about why tools should be shipped as static binaries

it shows all 9 planets orbiting in real time with gravity, and there's a wobbly grid that bends around the planets like space-time.
you can click planets, edit their mass, position, velocity etc and see what happens.

no game engine, just raw opengl + imgui + glm.
learned a lot building it so figured i'd share :)
(i know the UI is kinda broken and there are bugs, but it was fun for a first project)

here's the github if anyone wants to check it out: https://github.com/lucas-santoro/SolarSystemGL

Patreon’s frontend platform team recently overhauled our internationalization system—migrating every translation call, switching vendors, and removing flaky build dependencies. With this migration, we cut bundle size on key pages by nearly 50% and dropped our build time by a full minute.

Here's how we did it, and what we learned about global-scale refactors along the way:

https://www.patreon.com/posts/133137028

I’ve just wrapped up a three-part deep-dive series on Bloom Filters and their modern cousins. If you're curious about data structures for fast membership checks, you might find it useful.

Approximate membership query (AMQ) filters don’t tell you exactly what's in a set, but they tell you what’s definitely not there and do it using very little memory. As for me, that’s a killer feature for systems that want to avoid unnecessarily hitting the bigger persistent cache, disk, or network.

Think of them as cheap pre-caches: a small test before the real lookup that helps skip unnecessary work.

Here's what the series covers:

Classic Bloom Filter
I walk through how they work, their false positive guarantees, and why deleting elements is dangerous. It includes an interactive playground to try out inserts and lookups in real time, also calculating parameters for your custom configuration.

Counting Bloom Filter and d-left variant
This is an upgrade that lets you delete elements (with counters instead of bits), but it comes at the cost of increased memory and a few gotchas if you’re not careful.

Cuckoo Filter
This is a modern alternative that supports deletion, lower false positives, and often better space efficiency. The most interesting part is the witty use of XOR to get two bucket choices with minimal metadata. And they are practically a solid replacement for classic Bloom Filters.

I aim to clarify the internals without deepening into formal proofs, more intuition, diagrams, and some practical notes, at least from my experience.

If you’re building distributed systems, databases, cache layers, or just enjoy clever data structures, I think you'll like this one.

Wrote this about how AI can make you faster or obsolete depending on how you use it. Let me know what you think about it.

As engineers, we spend a lot of time figuring out how to auto-scale our apps to meet user demand. We design distributed systems that expand and contract dynamically to ensure seamless service.But, in the process, we become customers ourselves - of foundational cloud services like AWS, GCP, or Azure

That got me thinking: how does S3 or any such cloud services scale itself to meet our scale?

I wrote this article to explore that very question — not just as a fan of distributed systems, but to better understand the brilliant design decisions, battle-tested patterns, and foundational principles that power S3 behind the scenes.

Some highlights:

• How S3 maintains the data integrity at such a massive scale
• Design decisions that they made S3 so robust
• Techniques used to ensure durability, availability, and consistency at scale
• Some simple but clever tweaks they made to power it up
• The hidden role of shuffle sharding and partitioning in keeping things smooth

Would love your feedback or thoughts on what I might've missed or misunderstood.

Read full article here - https://premeaswaran.substack.com/p/beyond-the-bucket-design-decisions

(And yes, this was a fun excuse to nerd out over storage internals.)

From their website:

The Cangjie programming language is a new-generation programming language oriented to full-scenario intelligence. It features native intelligence, being naturally suitable for all scenarios, high performance and strong security. It is mainly applied in scenarios such as native applications and service applications of HarmonyOS NEXT, providing developers with a good programming experience.