Guides
Written from shipping the work, not from the docs. If a guide answers your question completely, take the answer and go. There is no gate and no email wall. If it tells you that your problem is bigger than an afternoon, that’s what I’m for.
Safari & iOS extensions
Getting your Chrome extension onto Safari and iPhone: the complete guideWhat the converter does, what breaks, DNR, signing, and App Review.
Safari has no blocking webRequest. Here's what to do instead.The declarativeNetRequest migration: what survives, what needs redesign.
The converter ran fine. So why is your extension broken?Six silent failure modes of converted extensions and how to diagnose each.
Safari extension rejected? The usual reasons, and the fixes.App Review rejections translated into fixes, plus review notes that pass.
When your dynamic rules stop installing, collide, or change meaning in SafariThe shared rule budget, encoding provenance in rule IDs, and teardown that does not break other features.
The site never reloads, and your extension can't tell where it isWhy server-rendered metadata goes stale after client navigation, and how to keep a content script current.
When your content script can't see the page's JavaScriptMAIN vs isolated world, registration order, and passing state between halves that cannot message each other.
MCP development
Your MCP server is stateful. Your load balancer doesn't know that.Sessions, sticky routing, proxy timeouts, and what breaks at two replicas.
MCP went stateless. Here's how to migrate a session-era server.The 2026-07-28 spec removes sessions. The handle pattern, elicitation changes, and the order to migrate in.
How to pause an MCP tool call, ask the user, and resumeMCP elicitation end to end: suspend and resume, timeouts that ignore human thinking time, and the race everyone hits.
Why models ignore your MCP tools, and the design that fixes itServer instructions, filtering server-side, error results over exceptions, and tool output as prompt surface.
You have to run untrusted JavaScript. A VM sandbox isn't enough.A VM context isolates scope, not capability: SSRF and rebinding defenses, log exfiltration, and the execution contract.
AI-agent engineering
How to tell humans, AI crawlers, and AI agents apart in your trafficWhy analytics tags and origin logs both miss it, which signals to trust, and the two rules that make the numbers usable.
OAuth assumes your user already has an accountToken strategies, pooled accounts, deferred ownership, and the OAuth mechanics that bite in agent flows.
Fifty integrations are coming. Config, DSL, or code?Three architectures I tried and abandoned, and the split between declarative auth and executable setup that held up.
Reading because something's broken?
Tell me what you're building and where it's stuck. Every engagement starts with a fixed-price assessment, and the guides above are a fair preview of how I think.
Book a free intro callEmail me insteadI personally reply within one business day. · Taking new projects now.