https://deedglass.com/blog Real runs, tested guides and incident lessons about AI agents that act on real systems. en Fri, 30 Oct 2026 00:00:00 GMT https://deedglass.com/blog/claude-code-and-cursor-database-safety-guide https://deedglass.com/blog/claude-code-and-cursor-database-safety-guide Fri, 30 Oct 2026 00:00:00 GMT How developers protect local and production databases when using Claude Code, Cursor, and Codex CLI with policy rules and WAL verification. https://deedglass.com/blog/connect-ai-agents-to-hospital-sql-server-oracle https://deedglass.com/blog/connect-ai-agents-to-hospital-sql-server-oracle Fri, 30 Oct 2026 00:00:00 GMT How hospital IT connects AI agents safely to EHR systems on SQL Server, Oracle, and MySQL using FHIR facades, integration engines, and MCP wrappers. https://deedglass.com/blog/govern-langgraph-toolnode-tools https://deedglass.com/blog/govern-langgraph-toolnode-tools Fri, 30 Oct 2026 00:00:00 GMT How to wrap standalone tools in LangGraph ToolNode using govern_tool for pre-execution policy checks, approval states, and model-readable errors. https://deedglass.com/blog/govern-medplum-fhir-agent-writes https://deedglass.com/blog/govern-medplum-fhir-agent-writes Fri, 30 Oct 2026 00:00:00 GMT How to connect AI agents to Medplum FHIR APIs via Deedglass, enforce pre-write approval rules, and verify committed resource versions in PostgreSQL. https://deedglass.com/blog/govern-nvidia-nemotron-database-agents https://deedglass.com/blog/govern-nvidia-nemotron-database-agents Fri, 30 Oct 2026 00:00:00 GMT How to connect NVIDIA Nemotron reasoning models to PostgreSQL tools via MCP, enforce SQL policies before execution, and verify row diffs with Deedglass. https://deedglass.com/blog/llamaindex-agent-database-tool-approvals https://deedglass.com/blog/llamaindex-agent-database-tool-approvals Fri, 30 Oct 2026 00:00:00 GMT How to give a LlamaIndex FunctionAgent database tools via MCP, enforce pre-write approval policies, and verify real Postgres row changes. https://deedglass.com/blog/nemotron-ultra-ai-agent-blast-radius-policy https://deedglass.com/blog/nemotron-ultra-ai-agent-blast-radius-policy Fri, 30 Oct 2026 00:00:00 GMT How we use NVIDIA Nemotron 3 Ultra to analyze agent tool calls, estimate blast radius across records, and generate CEL policies live on deedglass.com. https://deedglass.com/blog/stop-ai-agent-redis-flush https://deedglass.com/blog/stop-ai-agent-redis-flush Fri, 30 Oct 2026 00:00:00 GMT Keep an AI coding agent from wiping Redis cache, queues and sessions: ACL permissions, renaming commands, and the pre-command shell guard. https://deedglass.com/blog/why-prompt-firewalls-fail-at-the-database-layer https://deedglass.com/blog/why-prompt-firewalls-fail-at-the-database-layer Fri, 30 Oct 2026 00:00:00 GMT Prompt firewalls check text before execution, but miss cascade triggers. Here is why database-layer state checks are required for safe AI agents. https://deedglass.com/blog/ai-receptionist-dental-clinic-records https://deedglass.com/blog/ai-receptionist-dental-clinic-records Wed, 28 Oct 2026 00:00:00 GMT AI receptionists and booking bots in dental clinics: six ways they can go wrong with patient records, what US and Indian rules say, and a safer setup. https://deedglass.com/blog/dental-clinic-ai-tool-checklist https://deedglass.com/blog/dental-clinic-ai-tool-checklist Wed, 28 Oct 2026 00:00:00 GMT A plain checklist for dental clinics before an AI scribe, booking bot or assistant touches patient records: contract, access, testing, daily checks. https://deedglass.com/blog/whats-new-in-deedglass-0-15-0 https://deedglass.com/blog/whats-new-in-deedglass-0-15-0 Wed, 28 Oct 2026 00:00:00 GMT Deedglass 0.15.0 opens as an app in your browser with one command. How to open it, what each screen means, where your records stay and how to stop it. https://deedglass.com/blog/agentharm-benchmark https://deedglass.com/blog/agentharm-benchmark Tue, 27 Oct 2026 00:00:00 GMT What AgentHarm measures: 110 harmful agent tasks with benign twins, synthetic tools, rubric grading, and why agents complied more than chat models suggest. https://deedglass.com/blog/ai-agent-governance-in-hospitals https://deedglass.com/blog/ai-agent-governance-in-hospitals Tue, 27 Oct 2026 00:00:00 GMT How a hospital can govern AI tools that act, not just advise: an inventory, a review group, write tiers, monitoring and records, mapped to NIST and ICMR. https://deedglass.com/blog/ai-agent-provenance-standards https://deedglass.com/blog/ai-agent-provenance-standards Tue, 27 Oct 2026 00:00:00 GMT W3C PROV, FHIR Provenance, C2PA, SLSA and AAP-H compared for recording what an AI agent did: what each records, signs and leaves out. https://deedglass.com/blog/ai-scribe-ehr-write-who-approved https://deedglass.com/blog/ai-scribe-ehr-write-who-approved Tue, 27 Oct 2026 00:00:00 GMT What a hospital's audit trail should show for AI scribe notes and queued orders: who drafted, who edited, who signed, and what reached the EHR. https://deedglass.com/blog/ai-scribe-note-review-checklist https://deedglass.com/blog/ai-scribe-note-review-checklist Tue, 27 Oct 2026 00:00:00 GMT A review routine for AI scribe notes built on published error studies: where omissions, made-up details and negation flips hide, and how to check fast. https://deedglass.com/blog/ai-vendor-security-questionnaire-healthcare https://deedglass.com/blog/ai-vendor-security-questionnaire-healthcare Tue, 27 Oct 2026 00:00:00 GMT AI-specific questions to add to a hospital vendor security questionnaire: what the tool can write, model changes, training on your data, logs, exit. https://deedglass.com/blog/appworld-benchmark https://deedglass.com/blog/appworld-benchmark Tue, 27 Oct 2026 00:00:00 GMT What AppWorld measures: 750 tasks across 9 simulated apps and 457 APIs, graded by database diffs that fail any unexpected change, and the lessons. https://deedglass.com/blog/audit-mcp-config https://deedglass.com/blog/audit-mcp-config Tue, 27 Oct 2026 00:00:00 GMT Review .mcp.json server by server: secrets in the file, write tools, archived servers, folder scope and remote URLs, with a worked example from D to B. https://deedglass.com/blog/audit-record-fields-for-ai-actions https://deedglass.com/blog/audit-record-fields-for-ai-actions Tue, 27 Oct 2026 00:00:00 GMT The fields an audit record needs when an AI agent acts on health data: actor, approver, rule decision, claim versus outcome, versions, and a signature. https://deedglass.com/blog/claude-agent-sdk-canusetool-pretooluse https://deedglass.com/blog/claude-agent-sdk-canusetool-pretooluse Tue, 27 Oct 2026 00:00:00 GMT When the Claude Agent SDK calls canUseTool, when it skips it, and why checks that must run on every tool call belong in a PreToolUse hook. https://deedglass.com/blog/claude-code-checkpoints-rewind https://deedglass.com/blog/claude-code-checkpoints-rewind Tue, 27 Oct 2026 00:00:00 GMT Claude Code's /rewind restores files its edit tools changed. It skips files only Bash touched, most subagent edits, symlinks and anything outside the repo. https://deedglass.com/blog/claude-code-dangerously-skip-permissions https://deedglass.com/blog/claude-code-dangerously-skip-permissions Tue, 27 Oct 2026 00:00:00 GMT What Claude Code's bypassPermissions mode skips, what still stops it (deny rules, ask rules, critical rm), and how to disable it for a team. https://deedglass.com/blog/cline-auto-approve-settings https://deedglass.com/blog/cline-auto-approve-settings Tue, 27 Oct 2026 00:00:00 GMT What each Cline auto-approve toggle allows, why 'safe commands' is the model's own judgment, what YOLO mode turns off, and a setup for teams and databases. https://deedglass.com/blog/commands-that-wipe-a-database https://deedglass.com/blog/commands-that-wipe-a-database Tue, 27 Oct 2026 00:00:00 GMT Prisma, Rails, Django, Laravel, Drizzle, Alembic and more: which CLI commands drop tables or empty a database, and which forward migrations are safe. https://deedglass.com/blog/copilot-cli-allow-deny-tool https://deedglass.com/blog/copilot-cli-allow-deny-tool Tue, 27 Oct 2026 00:00:00 GMT How Copilot CLI's --allow-tool, --deny-tool and --available-tools patterns work, what deny wins over, where approvals are saved, and safe defaults. https://deedglass.com/blog/cost-of-claim-denials-and-rework https://deedglass.com/blog/cost-of-claim-denials-and-rework Tue, 27 Oct 2026 00:00:00 GMT What a denied claim costs to rework, how often claims are denied, and how to build your own estimate, using only cited studies and their limits. https://deedglass.com/blog/cursor-auto-run-allowlist https://deedglass.com/blog/cursor-auto-run-allowlist Tue, 27 Oct 2026 00:00:00 GMT How Cursor's run modes, allowlist, permissions.json and sandbox.json fit together in 2026, what each file controls, and a setup that keeps auto-run useful. https://deedglass.com/blog/cursor-checkpoints-restore https://deedglass.com/blog/cursor-checkpoints-restore Tue, 27 Oct 2026 00:00:00 GMT What Cursor checkpoints save, what Restore Checkpoint reverts, what it can't reach (shell commands, databases, deploys), and recovery paths when it fails. https://deedglass.com/blog/da-vinci-crd-dtr-pas-explained https://deedglass.com/blog/da-vinci-crd-dtr-pas-explained Tue, 27 Oct 2026 00:00:00 GMT How the HL7 Da Vinci prior authorization guides fit together: CRD finds the rules, DTR gathers documents, PAS submits and tracks the request. https://deedglass.com/blog/deedglass-protect-every-coding-agent https://deedglass.com/blog/deedglass-protect-every-coding-agent Tue, 27 Oct 2026 00:00:00 GMT npx deedglass protect adds a before-a-command hook to Claude Code, Cursor, Codex, Gemini CLI and Copilot CLI. The files it writes, and how to undo it. https://deedglass.com/blog/django-migrations-ai-agent https://deedglass.com/blog/django-migrations-ai-agent Tue, 27 Oct 2026 00:00:00 GMT Let a coding agent write Django migrations without letting it flush or unapply them: which manage.py commands to allow, review and block, tested. https://deedglass.com/blog/eu-ehds-explained https://deedglass.com/blog/eu-ehds-explained Tue, 27 Oct 2026 00:00:00 GMT EHDS basics for health IT teams: the 2029 and 2031 dates, patients' right to see who accessed their data, the EHR logging component, and secondary use. https://deedglass.com/blog/fhir-conditional-create-duplicates https://deedglass.com/blog/fhir-conditional-create-duplicates Tue, 27 Oct 2026 00:00:00 GMT A FHIR conditional create can answer 200 and store nothing, and one server stored two copies from one transaction. What R4 says and how to check. https://deedglass.com/blog/fhir-conditional-update-id-mismatch https://deedglass.com/blog/fhir-conditional-update-id-mismatch Tue, 27 Oct 2026 00:00:00 GMT R4 says a conditional update whose body id doesn't match the resource found gets 400. HAPI 8.12.0 applied it; two other setups refused. How to guard. https://deedglass.com/blog/fhir-delete-vs-expunge https://deedglass.com/blog/fhir-delete-vs-expunge Tue, 27 Oct 2026 00:00:00 GMT A FHIR DELETE hides a resource but usually keeps its history; HAPI's $expunge erases it. What each does, the defaults, and which one an agent should get. https://deedglass.com/blog/fhir-draft-orders-clinician-signoff https://deedglass.com/blog/fhir-draft-orders-clinician-signoff Tue, 27 Oct 2026 00:00:00 GMT How to model AI-drafted orders in FHIR R4 so nothing is actionable until a clinician signs: status draft, intent proposal, requester, and a record. https://deedglass.com/blog/fhir-if-match-version-conflict https://deedglass.com/blog/fhir-if-match-version-conflict Tue, 27 Oct 2026 00:00:00 GMT What a stale If-Match should return in FHIR R4, what four real server setups returned (409, not 412), and how an agent should handle the conflict. https://deedglass.com/blog/fhir-json-patch-pitfalls https://deedglass.com/blog/fhir-json-patch-pitfalls Tue, 27 Oct 2026 00:00:00 GMT JSON Patch on FHIR resources: why add can replace a whole array, how indexes shift, why test is your best friend, and what validation misses on PATCH. https://deedglass.com/blog/fhir-r4-vs-r5-vs-r6 https://deedglass.com/blog/fhir-r4-vs-r5-vs-r6 Tue, 27 Oct 2026 00:00:00 GMT FHIR R4, R4B, R5 and the R6 ballots with their dates and status, which major guides and rules use which version, and how to choose for a new system. https://deedglass.com/blog/fhir-reference-to-missing-resource https://deedglass.com/blog/fhir-reference-to-missing-resource Tue, 27 Oct 2026 00:00:00 GMT Some FHIR servers store a reference to a Patient that doesn't exist; others refuse. What R4 says, what we measured, and how to check references. https://deedglass.com/blog/gaia-benchmark-explained https://deedglass.com/blog/gaia-benchmark-explained Tue, 27 Oct 2026 00:00:00 GMT What the GAIA benchmark measures: 466 real-world questions in three levels, exact-match answers, 92% for humans vs 15% for GPT-4, and its blind spots. https://deedglass.com/blog/github-mcp-server-read-only https://deedglass.com/blog/github-mcp-server-read-only Tue, 27 Oct 2026 00:00:00 GMT Run the GitHub MCP server with read-only mode, a short toolset list, lockdown and a fine-grained token. Local flags, remote URLs and headers, side by side. https://deedglass.com/blog/hapi-fhir-update-no-new-version https://deedglass.com/blog/hapi-fhir-update-no-new-version Tue, 27 Oct 2026 00:00:00 GMT A FHIR update that changes nothing gets 200 and keeps the same version on HAPI and Firely. Why it happens, when it hides a problem, and how to check. https://deedglass.com/blog/hipaa-breach-notification-ai-vendor https://deedglass.com/blog/hipaa-breach-notification-ai-vendor Tue, 27 Oct 2026 00:00:00 GMT HIPAA breach rules for AI tools: what counts as a breach, the four-factor risk assessment, the 60-day clocks for vendors and providers, the 500 line. https://deedglass.com/blog/hipaa-business-associate-agreement-ai-tools https://deedglass.com/blog/hipaa-business-associate-agreement-ai-tools Tue, 27 Oct 2026 00:00:00 GMT When an AI vendor is a HIPAA business associate, what the BAA must say, how model providers and subcontractors fit, and AI clauses to add. https://deedglass.com/blog/hipaa-de-identification-safe-harbor-ai https://deedglass.com/blog/hipaa-de-identification-safe-harbor-ai Tue, 27 Oct 2026 00:00:00 GMT HIPAA de-identification for AI projects: the 18 safe harbor identifiers, expert determination, why free text and logs are hard, and a checklist. https://deedglass.com/blog/hipaa-minimum-necessary-ai-tools https://deedglass.com/blog/hipaa-minimum-necessary-ai-tools Tue, 27 Oct 2026 00:00:00 GMT How HIPAA's minimum necessary standard applies to AI tools and agents: when it applies, the treatment exception, and how to limit what a model sees. https://deedglass.com/blog/hipaa-risk-analysis-for-ai-tools https://deedglass.com/blog/hipaa-risk-analysis-for-ai-tools Tue, 27 Oct 2026 00:00:00 GMT How to run the HIPAA Security Rule risk analysis for an AI tool that handles ePHI: scope, data flows, AI-specific threats, a scored register, and reviews. https://deedglass.com/blog/hl7-ai-transparency-on-fhir https://deedglass.com/blog/hl7-ai-transparency-on-fhir Tue, 27 Oct 2026 00:00:00 GMT What HL7's AI Transparency on FHIR guide does: tagging AI-influenced resources, AI Provenance and AI Device profiles, model cards, and what it leaves out. https://deedglass.com/blog/hl7v2-to-fhir-pipeline-with-agents https://deedglass.com/blog/hl7v2-to-fhir-pipeline-with-agents Tue, 27 Oct 2026 00:00:00 GMT How an HL7 v2 to FHIR conversion pipeline works, what the HL7 mapping guide covers, where AI agents help, and the checks that stop silent data loss. https://deedglass.com/blog/hook-vs-sandbox-vs-database-role https://deedglass.com/blog/hook-vs-sandbox-vs-database-role Tue, 27 Oct 2026 00:00:00 GMT Four ways to stop a coding agent destroying data: a pre-command hook, an OS sandbox, a narrow credential and a gate. What each stops, and misses. https://deedglass.com/blog/incident-response-for-ai-errors-in-hospitals https://deedglass.com/blog/incident-response-for-ai-errors-in-hospitals Tue, 27 Oct 2026 00:00:00 GMT A runbook for when an AI tool writes wrong data in a hospital system: stop it, scope it, fix the record, notify on time, and learn. India and US clocks. https://deedglass.com/blog/information-blocking-rule-basics https://deedglass.com/blog/information-blocking-rule-basics Tue, 27 Oct 2026 00:00:00 GMT The US information blocking rule in plain words: who it covers, what counts, the ten exceptions in 45 CFR 171, and what it means for AI tools. https://deedglass.com/blog/injecagent-indirect-prompt-injection-benchmark https://deedglass.com/blog/injecagent-indirect-prompt-injection-benchmark Tue, 27 Oct 2026 00:00:00 GMT What InjecAgent measures: 1,054 cases where tool output carries attacker instructions, the 24% GPT-4 result, why one phrase doubled it, and what to do. https://deedglass.com/blog/insurer-pre-auth-ai-records https://deedglass.com/blog/insurer-pre-auth-ai-records Tue, 27 Oct 2026 00:00:00 GMT What insurers, TPAs and hospitals in India should record when AI helps with cashless pre-authorisation: inputs, rule decisions, approvers and times. https://deedglass.com/blog/irdai-cyber-security-guidelines-insurers https://deedglass.com/blog/irdai-cyber-security-guidelines-insurers Tue, 27 Oct 2026 00:00:00 GMT IRDAI's 2026 Information and Cyber Security Guidelines replace the 2023 set. Who they cover, the 180-day log rule, 6-hour reporting and the main changes. https://deedglass.com/blog/laravel-migrations-ai-agent https://deedglass.com/blog/laravel-migrations-ai-agent Tue, 27 Oct 2026 00:00:00 GMT Laravel asks before destructive migrations in production, and --force skips it. Use DB::prohibitDestructiveCommands, --pretend and a command check instead. https://deedglass.com/blog/linear-mcp-server-security https://deedglass.com/blog/linear-mcp-server-security Tue, 27 Oct 2026 00:00:00 GMT Linear's MCP server is read-write by default. Its /readonly endpoint, a read scope or a Read-only API key keep a coding agent to reading issues. https://deedglass.com/blog/malaffi-abu-dhabi-health-information-exchange https://deedglass.com/blog/malaffi-abu-dhabi-health-information-exchange Tue, 27 Oct 2026 00:00:00 GMT Malaffi basics from its own pages: who runs it, which facilities must connect, what onboarding needs, ADHICS, activity logs and the privacy seal. https://deedglass.com/blog/mcp-authorization-spec-explained https://deedglass.com/blog/mcp-authorization-spec-explained Tue, 27 Oct 2026 00:00:00 GMT How MCP authorization works in the 2026-07-28 spec: OAuth 2.1, resource metadata, client ID metadata documents, resource indicators, PKCE, scopes. https://deedglass.com/blog/mcp-sampling-security https://deedglass.com/blog/mcp-sampling-security Tue, 27 Oct 2026 00:00:00 GMT MCP sampling lets a server borrow your model. The attacks Unit 42 showed, why the 2026-07-28 spec deprecated it, and how to lock it down meanwhile. https://deedglass.com/blog/mcp-toolbox-for-databases-security https://deedglass.com/blog/mcp-toolbox-for-databases-security Tue, 27 Oct 2026 00:00:00 GMT Google's MCP Toolbox for Databases: custom SQL tools vs prebuilt execute_sql, its read-only mode, auth services, and what to set before an agent uses it. https://deedglass.com/blog/mongodb-read-only-user-ai-agent https://deedglass.com/blog/mongodb-read-only-user-ai-agent Tue, 27 Oct 2026 00:00:00 GMT Create a MongoDB user an AI agent can't write with, a custom role that writes without dropping, and the MongoDB MCP server's read-only mode. https://deedglass.com/blog/nabidh-dubai-health-information-exchange https://deedglass.com/blog/nabidh-dubai-health-information-exchange Tue, 27 Oct 2026 00:00:00 GMT NABIDH basics from DHA's own standards: who must connect, HL7 v2, FHIR and IHE profiles, consent and break-glass, and audit logs kept three years. https://deedglass.com/blog/naic-ai-model-bulletin-insurers https://deedglass.com/blog/naic-ai-model-bulletin-insurers Tue, 27 Oct 2026 00:00:00 GMT The NAIC model bulletin on AI in insurance, read from the text: the written AIS Program, third-party vendors, and the documents regulators may request. https://deedglass.com/blog/notion-mcp-server-security https://deedglass.com/blog/notion-mcp-server-security Tue, 27 Oct 2026 00:00:00 GMT Notion's hosted MCP server can create, move and trash pages you can access. How its delete confirmation works, what admins control, and a safer setup. https://deedglass.com/blog/nphies-saudi-health-insurance-platform https://deedglass.com/blog/nphies-saudi-health-insurance-platform Tue, 27 Oct 2026 00:00:00 GMT How NPHIES works from its own implementation guide: FHIR R4 messages, $process-message, size and time limits, duplicate rules and what errors look like. https://deedglass.com/blog/postgres-timeouts-for-ai-agent-roles https://deedglass.com/blog/postgres-timeouts-for-ai-agent-roles Tue, 27 Oct 2026 00:00:00 GMT Set statement_timeout, lock_timeout, idle and transaction timeouts on an AI agent's Postgres role, see what each one stops, and the one thing they can't. https://deedglass.com/blog/prior-authorization-burden-statistics https://deedglass.com/blog/prior-authorization-burden-statistics Tue, 27 Oct 2026 00:00:00 GMT Prior authorization burden in numbers from AMA physician surveys: requests per week, staff hours, denials, AI concerns, and what CMS changes in 2026. https://deedglass.com/blog/prisma-mcp-server https://deedglass.com/blog/prisma-mcp-server Tue, 27 Oct 2026 00:00:00 GMT What Prisma's MCP server can do, which tools delete data or change live traffic, why the CLI guardrail doesn't cover it, and how to set it up safely. https://deedglass.com/blog/rails-migrations-ai-agent https://deedglass.com/blog/rails-migrations-ai-agent Tue, 27 Oct 2026 00:00:00 GMT Rails refuses db:drop and db:reset in production until one variable is set. What that protects, what it misses, and which rails db commands to allow. https://deedglass.com/blog/saudi-pdpl-health-data https://deedglass.com/blog/saudi-pdpl-health-data Tue, 27 Oct 2026 00:00:00 GMT Saudi PDPL treats health data as sensitive. What the law and SDAIA's Implementing Regulation require: access limits, records, 72-hour breach notice. https://deedglass.com/blog/scan-mcp-config-in-ci https://deedglass.com/blog/scan-mcp-config-in-ci Tue, 27 Oct 2026 00:00:00 GMT Grade every pull request that adds an MCP server: a free GitHub Action that comments the blast-radius change, uploads SARIF and can fail the job. https://deedglass.com/blog/sentry-mcp-server-security https://deedglass.com/blog/sentry-mcp-server-security Tue, 27 Oct 2026 00:00:00 GMT Connect a coding agent to Sentry without project admin: scope the URL to one project, keep triage and project-management off, treat events as untrusted. https://deedglass.com/blog/singapore-ai-in-healthcare-guidelines https://deedglass.com/blog/singapore-ai-in-healthcare-guidelines Tue, 27 Oct 2026 00:00:00 GMT Singapore's MOH and HSA updated the AI in Healthcare Guidelines in March 2026. What AIHGle 2.0 asks of developers, deployers and users, from the text. https://deedglass.com/blog/singapore-health-information-act https://deedglass.com/blog/singapore-health-information-act Tue, 27 Oct 2026 00:00:00 GMT Singapore's Health Information Bill passed as the Health Information Act. NEHR contribution, the insurer ban, security duties and penalties. https://deedglass.com/blog/slack-mcp-server-security https://deedglass.com/blog/slack-mcp-server-security Tue, 27 Oct 2026 00:00:00 GMT Slack's official MCP server runs on user tokens and admin-approved apps. The OAuth scope each tool needs, and minimal sets for three agent jobs. https://deedglass.com/blog/smart-app-launch-ehr-vs-standalone https://deedglass.com/blog/smart-app-launch-ehr-vs-standalone Tue, 27 Oct 2026 00:00:00 GMT SMART App Launch's two flows compared: how EHR and standalone launch get context, PKCE and state rules, token lifetimes, and the AI angle. https://deedglass.com/blog/smart-backend-services-for-agents https://deedglass.com/blog/smart-backend-services-for-agents Tue, 27 Oct 2026 00:00:00 GMT How AI agents authenticate to FHIR servers with SMART Backend Services: client credentials, signed JWTs, system scopes, short tokens, and the gaps. https://deedglass.com/blog/stop-ai-agent-aws-cli-deletes https://deedglass.com/blog/stop-ai-agent-aws-cli-deletes Tue, 27 Oct 2026 00:00:00 GMT Deletion protection, S3 Versioning, an explicit IAM deny and a pre-command hook: what each stops when a coding agent runs aws rds delete-db-instance. https://deedglass.com/blog/stop-ai-agent-docker-volume-delete https://deedglass.com/blog/stop-ai-agent-docker-volume-delete Tue, 27 Oct 2026 00:00:00 GMT docker compose down -v removes the named volume holding your local database, and coding agents run it to reset. Which commands delete data, and guards. https://deedglass.com/blog/stop-ai-agent-kubectl-delete https://deedglass.com/blog/stop-ai-agent-kubectl-delete Tue, 27 Oct 2026 00:00:00 GMT Keep a coding agent from deleting a namespace or a volume claim: a view-only RBAC role, Retain on volumes, and a pre-command hook. Commands tested. https://deedglass.com/blog/stop-ai-agent-terraform-destroy https://deedglass.com/blog/stop-ai-agent-terraform-destroy Tue, 27 Oct 2026 00:00:00 GMT Four layers that keep a coding agent from destroying infrastructure: plan-only access, prevent_destroy, a pre-command hook and cloud deny rules. https://deedglass.com/blog/synthetic-data-pilot-for-hospital-ai https://deedglass.com/blog/synthetic-data-pilot-for-hospital-ai Tue, 27 Oct 2026 00:00:00 GMT A step-by-step plan for piloting an AI tool in a hospital on synthetic data first: what to measure, what not to, the IT review pack, and exit criteria. https://deedglass.com/blog/tefca-explained https://deedglass.com/blog/tefca-explained Tue, 27 Oct 2026 00:00:00 GMT TEFCA in plain words: the Common Agreement, the RCE, QHINs, the six exchange purposes, the link to information blocking, and what it means for AI. https://deedglass.com/blog/toolemu-risky-agent-actions https://deedglass.com/blog/toolemu-risky-agent-actions Tue, 27 Oct 2026 00:00:00 GMT What ToolEmu measures: an LM-emulated sandbox for finding risky agent actions, its 144 test cases, the 23.9% finding, and what it means for real tools. https://deedglass.com/blog/vs-code-windsurf-mcp-config-files https://deedglass.com/blog/vs-code-windsurf-mcp-config-files Tue, 27 Oct 2026 00:00:00 GMT The MCP config file for Claude Code, Claude Desktop, Cursor, VS Code, Copilot CLI, Windsurf, Gemini CLI and Codex: paths, keys and secrets. https://deedglass.com/blog/which-ehr-writes-need-approval https://deedglass.com/blog/which-ehr-writes-need-approval Tue, 27 Oct 2026 00:00:00 GMT A tiering method for AI writes to an EHR: which FHIR resources an agent may write alone, which need a person, which need two, and which it never touches. https://deedglass.com/blog/windsurf-cascade-auto-execution https://deedglass.com/blog/windsurf-cascade-auto-execution Tue, 27 Oct 2026 00:00:00 GMT Windsurf Cascade's four auto-execution levels, how allow and deny list entries match, what Turbo really runs, team limits, and hooks that block commands. https://deedglass.com/blog/abdm-building-blocks-explained https://deedglass.com/blog/abdm-building-blocks-explained Mon, 26 Oct 2026 00:00:00 GMT The Ayushman Bharat Digital Mission's building blocks in plain words: ABHA, the two registries, HIPs and HIUs, the consent manager, NHCX and UHI. https://deedglass.com/blog/adaptive-attacks-break-prompt-injection-defenses https://deedglass.com/blog/adaptive-attacks-break-prompt-injection-defenses Mon, 26 Oct 2026 00:00:00 GMT A 2025 study attacked 12 published prompt injection and jailbreak defenses with adaptive methods and beat most over 90% of the time. What it means. https://deedglass.com/blog/agentdojo-prompt-injection-benchmark https://deedglass.com/blog/agentdojo-prompt-injection-benchmark Mon, 26 Oct 2026 00:00:00 GMT What the AgentDojo and InjecAgent benchmarks measure about prompt injection in tool-using agents, how they score it, and how to read the numbers. https://deedglass.com/blog/agentpoison-memory-poisoning https://deedglass.com/blog/agentpoison-memory-poisoning Mon, 26 Oct 2026 00:00:00 GMT AgentPoison planted a few entries in agents' memory or knowledge base and steered them over 80% of the time. How it works and what defends against it. https://deedglass.com/blog/ai-agent-api-keys-in-env-files https://deedglass.com/blog/ai-agent-api-keys-in-env-files Mon, 26 Oct 2026 00:00:00 GMT Coding agents can read .env files and use the keys inside. What Claude Code and Cursor ignore rules cover, what they miss, and how to keep secrets away. https://deedglass.com/blog/ai-agent-framework-guardrails-compared https://deedglass.com/blog/ai-agent-framework-guardrails-compared Mon, 26 Oct 2026 00:00:00 GMT Where nine agent frameworks let you check or approve a tool call before it runs, what each hook can do, and the gaps each leaves, from their own docs. https://deedglass.com/blog/ai-agent-kill-switch https://deedglass.com/blog/ai-agent-kill-switch Mon, 26 Oct 2026 00:00:00 GMT A kill switch for AI agents is four layers: refuse new calls, end running work, revoke credentials, and hold writes until a person looks. What each stops. https://deedglass.com/blog/ai-agent-ssrf-cloud-metadata https://deedglass.com/blog/ai-agent-ssrf-cloud-metadata Mon, 26 Oct 2026 00:00:00 GMT An AI agent with a fetch tool can be steered to cloud metadata at 169.254.169.254 and leak credentials. The risk, IMDSv2, and a tested URL check. https://deedglass.com/blog/ai-agents-gaming-tests-reward-hacking https://deedglass.com/blog/ai-agents-gaming-tests-reward-hacking Mon, 26 Oct 2026 00:00:00 GMT Coding agents sometimes edit tests, patch graders or special-case inputs to pass. What METR and ImpossibleBench measured, and controls that reduce it. https://deedglass.com/blog/alert-fatigue-research-and-agent-approvals https://deedglass.com/blog/alert-fatigue-research-and-agent-approvals Mon, 26 Oct 2026 00:00:00 GMT Clinicians accept fewer alerts as they get more, especially repeats. What health IT studies of alert fatigue suggest for AI agent approval prompts. https://deedglass.com/blog/amazon-q-extension-wiper-prompt https://deedglass.com/blog/amazon-q-extension-wiper-prompt Mon, 26 Oct 2026 00:00:00 GMT In July 2025, malicious code shipped in the Amazon Q Developer VS Code extension 1.84.0. What AWS's bulletins say, how it got in, and the lesson. https://deedglass.com/blog/attack-suite-on-every-release https://deedglass.com/blog/attack-suite-on-every-release Mon, 26 Oct 2026 00:00:00 GMT How to build an attack suite for an AI agent's tool layer: assume the model is fooled, write outcomes first, test real systems. 82 cases. https://deedglass.com/blog/automation-bias-health-it-approvals https://deedglass.com/blog/automation-bias-health-it-approvals Mon, 26 Oct 2026 00:00:00 GMT Health IT research shows people over-trust decision support, especially when checking is hard. What it means for human approval of AI agent actions. https://deedglass.com/blog/ayushman-bharat-digital-mission-statistics https://deedglass.com/blog/ayushman-bharat-digital-mission-statistics Mon, 26 Oct 2026 00:00:00 GMT Ayushman Bharat Digital Mission numbers from official sources only: ABHA accounts, linked records, registered facilities and professionals, and the trend. https://deedglass.com/blog/benchmark-your-own-ai-agent-gateway https://deedglass.com/blog/benchmark-your-own-ai-agent-gateway Mon, 26 Oct 2026 00:00:00 GMT A method for testing any AI agent gateway or checker: ground truth from the database log, three separate scores, a control case, misses on purpose. https://deedglass.com/blog/berkeley-function-calling-leaderboard https://deedglass.com/blog/berkeley-function-calling-leaderboard Mon, 26 Oct 2026 00:00:00 GMT BFCL scores how accurately models call tools: AST matching of names and arguments, execution, relevance detection and multi-turn state checks. https://deedglass.com/blog/best-postgres-mcp-server https://deedglass.com/blog/best-postgres-mcp-server Mon, 26 Oct 2026 00:00:00 GMT Supabase, Neon, Prisma, Postgres MCP Pro and the archived reference server, compared on read-only mode, scoping, confirmations and production advice. https://deedglass.com/blog/cedar-opa-cel-for-agent-policies https://deedglass.com/blog/cedar-opa-cel-for-agent-policies Mon, 26 Oct 2026 00:00:00 GMT Cedar, OPA Rego and CEL compared for AI agent tool-call rules: decision model, defaults, errors. One refund rule in all three, the CEL one run. https://deedglass.com/blog/cert-in-directions-for-hospitals https://deedglass.com/blog/cert-in-directions-for-hospitals Mon, 26 Oct 2026 00:00:00 GMT What CERT-In's April 2022 directions ask of hospitals: report listed incidents in 6 hours, keep ICT logs 180 days in India, sync clocks, name a contact. https://deedglass.com/blog/claude-code-hook-block-database-commands https://deedglass.com/blog/claude-code-hook-block-database-commands Mon, 26 Oct 2026 00:00:00 GMT A tested PreToolUse hook that makes Claude Code ask before DROP TABLE, migrate reset or rm -rf, what the hook format allows, and where text matching stops. https://deedglass.com/blog/claude-code-ide-extension-websocket-cve https://deedglass.com/blog/claude-code-ide-extension-websocket-cve Mon, 26 Oct 2026 00:00:00 GMT CVE-2025-52882 let web pages connect to the Claude Code IDE extension over WebSocket. The advisory, how to check your version, and 36 advisories grouped. https://deedglass.com/blog/claude-code-managed-settings-for-teams https://deedglass.com/blog/claude-code-managed-settings-for-teams Mon, 26 Oct 2026 00:00:00 GMT Enforce Claude Code guardrails for a whole team with managed-settings.json: file paths, a starter policy, what developers can still change, how to verify. https://deedglass.com/blog/claude-code-permissions-deny-ask-allow https://deedglass.com/blog/claude-code-permissions-deny-ask-allow Mon, 26 Oct 2026 00:00:00 GMT How Claude Code's settings.json deny, ask and allow rules are evaluated, what they cover, public reports of deny rules not applying, and how to test yours. https://deedglass.com/blog/claude-code-ran-alter-table-over-ssh https://deedglass.com/blog/claude-code-ran-alter-table-over-ssh Mon, 26 Oct 2026 00:00:00 GMT A public Claude Code issue: asked to read logs over SSH, the model dropped two columns on a live database. What the report says, and what holds. https://deedglass.com/blog/claude-code-sandbox-settings https://deedglass.com/blog/claude-code-sandbox-settings Mon, 26 Oct 2026 00:00:00 GMT Claude Code's sandbox limits what shell commands can write and reach. What it covers by default, the settings that tighten it, and what runs outside it. https://deedglass.com/blog/cms-prior-authorization-api-rule https://deedglass.com/blog/cms-prior-authorization-api-rule Mon, 26 Oct 2026 00:00:00 GMT What the CMS prior authorization rule requires: decision times, denial reasons, a FHIR prior authorization API by 2027, and where AI agents fit. https://deedglass.com/blog/codex-cli-approval-and-sandbox-modes https://deedglass.com/blog/codex-cli-approval-and-sandbox-modes Mon, 26 Oct 2026 00:00:00 GMT Codex CLI sandbox modes and approval policies explained, what --full-auto and --yolo do, and what the macOS sandbox blocked when we ran it. https://deedglass.com/blog/copilot-agent-pretooluse-hooks https://deedglass.com/blog/copilot-agent-pretooluse-hooks Mon, 26 Oct 2026 00:00:00 GMT How a GitHub Copilot preToolUse hook decides a tool call: allow, deny or ask, what exit codes and timeouts do, and why ask means deny in the cloud agent. https://deedglass.com/blog/crewai-tool-call-hooks https://deedglass.com/blog/crewai-tool-call-hooks Mon, 26 Oct 2026 00:00:00 GMT How to block, edit or ask a person about a tool call in CrewAI with PRE_TOOL_CALL hooks: decorators, HookAborted, in-place edits, scope and traps. https://deedglass.com/blog/cursor-agent-deleted-my-files https://deedglass.com/blog/cursor-agent-deleted-my-files Mon, 26 Oct 2026 00:00:00 GMT Why a Cursor agent can delete files outside your project, which run modes and protections cover rm, and a tested hook that asks before any delete. https://deedglass.com/blog/cursor-security-advisories-patterns https://deedglass.com/blog/cursor-security-advisories-patterns Mon, 26 Oct 2026 00:00:00 GMT We sorted all 33 security advisories Cursor has published on GitHub into six patterns: MCP config, allowlists, sandboxes, protected files. The lessons. https://deedglass.com/blog/dpdp-breach-notification-health https://deedglass.com/blog/dpdp-breach-notification-health Mon, 26 Oct 2026 00:00:00 GMT A hospital breach in India can trigger two clocks: CERT-In's 6 hours and the DPDP Board's 72 hours, plus notices to patients. What each must contain. https://deedglass.com/blog/dpdp-data-processor-ai-vendor-logs https://deedglass.com/blog/dpdp-data-processor-ai-vendor-logs Mon, 26 Oct 2026 00:00:00 GMT Under India's DPDP Act, an AI vendor processing patient data for you is usually a Data Processor. What the Act and Rules then ask of contracts and logs. https://deedglass.com/blog/dpdp-rules-for-hospitals https://deedglass.com/blog/dpdp-rules-for-hospitals Mon, 26 Oct 2026 00:00:00 GMT What India's DPDP Rules 2025 ask of hospitals and clinics: notices, children's data, safeguards, breach reporting, logs, erasure, and the May 2027 start. https://deedglass.com/blog/drizzle-kit-push-force-data-loss https://deedglass.com/blog/drizzle-kit-push-force-data-loss Mon, 26 Oct 2026 00:00:00 GMT drizzle-kit push --force accepts every data-loss statement without asking. Why agents reach for it, what it can drop, and a safer push or migrate workflow. https://deedglass.com/blog/dry-run-an-update-before-the-agent-commits https://deedglass.com/blog/dry-run-an-update-before-the-agent-commits Mon, 26 Oct 2026 00:00:00 GMT EXPLAIN guesses how many rows an UPDATE touches; BEGIN and ROLLBACK counts them, but triggers still run and sequences move. A tested dry run. https://deedglass.com/blog/ehr-audit-logs-what-they-record https://deedglass.com/blog/ehr-audit-logs-what-they-record Mon, 26 Oct 2026 00:00:00 GMT EHR audit logs timestamp every user action in the record. What a review of 85 audit-log studies learned, their limits, and what AI agents change. https://deedglass.com/blog/enable-logical-replication-supabase-neon-rds https://deedglass.com/blog/enable-logical-replication-supabase-neon-rds Mon, 26 Oct 2026 00:00:00 GMT How to set wal_level = logical on Supabase, Neon, RDS, Cloud SQL and Azure, who needs REPLICATION, and how to stop slots filling the disk. https://deedglass.com/blog/evaluating-agent-actions-not-answers https://deedglass.com/blog/evaluating-agent-actions-not-answers Mon, 26 Oct 2026 00:00:00 GMT Trusted agent benchmarks grade agents by the state they leave behind. How τ-bench, AgentDojo, SWE-bench and OSWorld do it, and a template for yours. https://deedglass.com/blog/fhir-auditevent-vs-provenance https://deedglass.com/blog/fhir-auditevent-vs-provenance Mon, 26 Oct 2026 00:00:00 GMT FHIR AuditEvent records that something happened, for security. Provenance records how a resource version came to be. When to use each, for AI agent writes. https://deedglass.com/blog/fhir-bulk-data-export-security https://deedglass.com/blog/fhir-bulk-data-export-security Mon, 26 Oct 2026 00:00:00 GMT FHIR Bulk Data $export can copy every patient record in one request. How the flow works, what the spec requires for security, and an agent policy. https://deedglass.com/blog/fhir-consent-resource-explained https://deedglass.com/blog/fhir-consent-resource-explained Mon, 26 Oct 2026 00:00:00 GMT What FHIR R4 Consent records, how its base policy and provisions work, and the line teams miss: the resource enforces nothing. Your agent tools must. https://deedglass.com/blog/fhir-transaction-vs-batch https://deedglass.com/blog/fhir-transaction-vs-batch Mon, 26 Oct 2026 00:00:00 GMT A FHIR transaction is all-or-nothing and links its entries; a batch is independent entries answered 200 regardless. The R4 rules, explained. https://deedglass.com/blog/fhir-validator-cli-profiles https://deedglass.com/blog/fhir-validator-cli-profiles Mon, 26 Oct 2026 00:00:00 GMT Three ways to check an agent-built FHIR resource against your profiles before it is stored: the HL7 validator, the $validate operation, server rules. https://deedglass.com/blog/fhir-versioning-and-history https://deedglass.com/blog/fhir-versioning-and-history Mon, 26 Oct 2026 00:00:00 GMT How FHIR R4 versions resources: versionId, ETag, vread, _history and If-Match, what servers needn't support, and how to use them to check writes. https://deedglass.com/blog/filesystem-mcp-server-security https://deedglass.com/blog/filesystem-mcp-server-security Mon, 26 Oct 2026 00:00:00 GMT How the reference filesystem MCP server limits an agent to allowed directories, the two 2025 path-escape advisories, and a safe setup for agents. https://deedglass.com/blog/gemini-cli-deleted-files https://deedglass.com/blog/gemini-cli-deleted-files Mon, 26 Oct 2026 00:00:00 GMT The widely shared Gemini CLI lost-files report ended with the files found at the C: drive root. What issue #4586 shows and how to protect a folder. https://deedglass.com/blog/gemini-cli-trusted-folders https://deedglass.com/blog/gemini-cli-trusted-folders Mon, 26 Oct 2026 00:00:00 GMT Gemini CLI trusted folders limit what a project you have not trusted can do: settings, .env, MCP servers, auto-approval. How to turn it on and use it. https://deedglass.com/blog/gemini-cli-yolo-mode https://deedglass.com/blog/gemini-cli-yolo-mode Mon, 26 Oct 2026 00:00:00 GMT Gemini CLI yolo mode auto-approves every tool call. What the four approval modes do, how the policy engine and sandbox fit in, and a safer setup. https://deedglass.com/blog/github-mcp-prompt-injection-private-repos https://deedglass.com/blog/github-mcp-prompt-injection-private-repos Mon, 26 Oct 2026 00:00:00 GMT Invariant Labs showed a public GitHub issue steering an agent into copying private repo data into a public pull request. What happened, and the fixes. https://deedglass.com/blog/google-adk-before-tool-callback https://deedglass.com/blog/google-adk-before-tool-callback Mon, 26 Oct 2026 00:00:00 GMT How Google ADK before_tool_callback stops or changes a tool call, what returning None or a dict does, and when a plugin is the better place for guardrails. https://deedglass.com/blog/hapi-fhir-request-validation https://deedglass.com/blog/hapi-fhir-request-validation Mon, 26 Oct 2026 00:00:00 GMT HAPI FHIR can validate writes as requests arrive or just before storage. Which catches what, why PATCH results slip past request validation, and a setup. https://deedglass.com/blog/hipaa-audit-controls-ai-agents https://deedglass.com/blog/hipaa-audit-controls-ai-agents Mon, 26 Oct 2026 00:00:00 GMT What HIPAA audit controls and activity review rules say, what they leave to you, and how to record an AI agent's actions on ePHI for review. https://deedglass.com/blog/india-ai-governance-guidelines-healthcare https://deedglass.com/blog/india-ai-governance-guidelines-healthcare Mon, 26 Oct 2026 00:00:00 GMT MeitY's November 2025 AI Governance Guidelines in plain words: seven sutras, six pillars, incident reporting and liability, read for health AI teams. https://deedglass.com/blog/india-ehr-standards-log-viewing https://deedglass.com/blog/india-ehr-standards-log-viewing Mon, 26 Oct 2026 00:00:00 GMT India's EHR Standards ask that every action on health records, including viewing, be logged, that records not be overwritten, and that log edits be found. https://deedglass.com/blog/indirect-prompt-injection-research https://deedglass.com/blog/indirect-prompt-injection-research Mon, 26 Oct 2026 00:00:00 GMT The 2023 paper that named indirect prompt injection, what it predicted, and how its threat list showed up in GitHub, Supabase and MCP tool demos. https://deedglass.com/blog/insert-on-conflict-how-many-rows-updated https://deedglass.com/blog/insert-on-conflict-how-many-rows-updated Mon, 26 Oct 2026 00:00:00 GMT Postgres answers INSERT 0 12 whether an upsert inserted 12 rows or overwrote 5. Count inserts and updates with RETURNING old or MERGE, tested. https://deedglass.com/blog/langgraph-interrupt-vs-middleware-approval https://deedglass.com/blog/langgraph-interrupt-vs-middleware-approval Mon, 26 Oct 2026 00:00:00 GMT Two ways to put a person in front of agent tool calls in LangChain: HumanInTheLoopMiddleware and interrupt(). When to use each, plus a trap we tested. https://deedglass.com/blog/let-ai-agents-write-migrations-safely https://deedglass.com/blog/let-ai-agents-write-migrations-safely Mon, 26 Oct 2026 00:00:00 GMT Agents are good at writing migrations and risky at running them. A workflow: the agent writes the file, a person reviews it, CI applies it. https://deedglass.com/blog/lethal-trifecta-ai-agents https://deedglass.com/blog/lethal-trifecta-ai-agents Mon, 26 Oct 2026 00:00:00 GMT The lethal trifecta: private data, untrusted content and a way to send data out. What each leg means, two real cases, and how to remove a leg. https://deedglass.com/blog/llm-as-a-judge-for-agent-evals https://deedglass.com/blog/llm-as-a-judge-for-agent-evals Mon, 26 Oct 2026 00:00:00 GMT The MT-Bench study found GPT-4 judges agree with people over 80% of the time, with position and verbosity biases. When a model judge fits agent evals. https://deedglass.com/blog/llm-hallucination-rates-clinical-notes https://deedglass.com/blog/llm-hallucination-rates-clinical-notes Mon, 26 Oct 2026 00:00:00 GMT One study found 1.47% of sentences hallucinated in LLM clinical notes; another found 23.6 errors per case. Why both can be right, and what to record. https://deedglass.com/blog/llms-medical-coding-accuracy-study https://deedglass.com/blog/llms-medical-coding-accuracy-study Mon, 26 Oct 2026 00:00:00 GMT Three recent studies of LLMs assigning ICD and CPT codes found exact matches from 14% to 45%, and big gains with retrieval. What it means for claims. https://deedglass.com/blog/local-mcp-server-origin-check https://deedglass.com/blog/local-mcp-server-origin-check Mon, 26 Oct 2026 00:00:00 GMT A local MCP server on localhost can be reached from a web page through DNS rebinding. The checks the MCP spec asks for, a small server, our curl results. https://deedglass.com/blog/mastra-require-tool-approval https://deedglass.com/blog/mastra-require-tool-approval Mon, 26 Oct 2026 00:00:00 GMT How Mastra pauses an agent for approval before a tool runs: requireApproval and requireToolApproval, approving, declining, storage, and what fails closed. https://deedglass.com/blog/mcp-2026-07-28-spec-changes https://deedglass.com/blog/mcp-2026-07-28-spec-changes Mon, 26 Oct 2026 00:00:00 GMT What changed in MCP revision 2026-07-28: no initialize, no sessions, per-request _meta, server/discover, mirrored headers, and what a gateway must check. https://deedglass.com/blog/mcp-remote-oauth-vulnerability https://deedglass.com/blog/mcp-remote-oauth-vulnerability Mon, 26 Oct 2026 00:00:00 GMT CVE-2025-6514 let a malicious MCP server run commands through mcp-remote's OAuth flow. The advisory, who was exposed, the fix in 0.1.16 and how to check. https://deedglass.com/blog/mcp-security-research-papers https://deedglass.com/blog/mcp-security-research-papers Mon, 26 Oct 2026 00:00:00 GMT A guide to MCP security research: an audit showing tools turned against developers, a 16-scenario threat taxonomy, and public disclosures, mapped. https://deedglass.com/blog/mcp-token-passthrough-confused-deputy https://deedglass.com/blog/mcp-token-passthrough-confused-deputy Mon, 26 Oct 2026 00:00:00 GMT Why the MCP spec forbids token passthrough, how the confused deputy attack on MCP proxy servers works, and what a server must check. A review checklist. https://deedglass.com/blog/mcp-tool-poisoning https://deedglass.com/blog/mcp-tool-poisoning Mon, 26 Oct 2026 00:00:00 GMT Tool poisoning hides instructions in an MCP tool's description, where the model reads them and you don't. The attack, rug pulls, shadowing, and defences. https://deedglass.com/blog/medagentbench-fhir-agent-benchmark https://deedglass.com/blog/medagentbench-fhir-agent-benchmark Mon, 26 Oct 2026 00:00:00 GMT MedAgentBench tested LLM agents on 300 tasks in a FHIR-based virtual EHR. The best scored 85% on reads and 54% on writes. What the gap means. https://deedglass.com/blog/mysql-binlog-point-in-time-recovery https://deedglass.com/blog/mysql-binlog-point-in-time-recovery Mon, 26 Oct 2026 00:00:00 GMT Recover MySQL to just before a bad statement with the binary log: find the event position, replay up to it, skip it, and why positions beat timestamps. https://deedglass.com/blog/mysql-cascade-not-in-binlog https://deedglass.com/blog/mysql-cascade-not-in-binlog Mon, 26 Oct 2026 00:00:00 GMT MySQL's manual says InnoDB runs ON DELETE CASCADE internally and logs none of it, so binlog readers and CDC feeds miss it. What changed in 9.6. https://deedglass.com/blog/mysql-read-only-user-for-ai-agent https://deedglass.com/blog/mysql-read-only-user-for-ai-agent Mon, 26 Oct 2026 00:00:00 GMT How to give an AI agent a MySQL user that can only read: grants, no EXECUTE, column limits, timeouts and hourly caps, and why read_only isn't it. https://deedglass.com/blog/neon-branch-per-pull-request https://deedglass.com/blog/neon-branch-per-pull-request Mon, 26 Oct 2026 00:00:00 GMT Give every pull request, including an AI agent's, its own Neon database branch: the GitHub Actions, the inputs that matter, expiry, and a safe workflow. https://deedglass.com/blog/neon-mcp-server-production https://deedglass.com/blog/neon-mcp-server-production Mon, 26 Oct 2026 00:00:00 GMT Neon recommends its MCP server for development and testing only. What read-only mode and project scoping change, and a setup that keeps agents off prod. https://deedglass.com/blog/nhcx-claims-fhir-and-ai https://deedglass.com/blog/nhcx-claims-fhir-and-ai Mon, 26 Oct 2026 00:00:00 GMT India's National Health Claims Exchange explained: the cashless flows, the FHIR claim bundles in the ABDM guide, and checks for AI-built claims. https://deedglass.com/blog/nx-s1ngularity-ai-cli-supply-chain https://deedglass.com/blog/nx-s1ngularity-ai-cli-supply-chain Mon, 26 Oct 2026 00:00:00 GMT In August 2025, malicious Nx packages stole credentials and, per Nx, tried to use local AI tools. What the advisory says, and settings that limit it. https://deedglass.com/blog/openai-agents-sdk-human-approval https://deedglass.com/blog/openai-agents-sdk-human-approval Mon, 26 Oct 2026 00:00:00 GMT How to make the OpenAI Agents SDK pause for a person before a tool runs: needs_approval, interruptions, RunState, resuming later, and what guardrails skip. https://deedglass.com/blog/openai-agents-sdk-tool-guardrails https://deedglass.com/blog/openai-agents-sdk-tool-guardrails Mon, 26 Oct 2026 00:00:00 GMT How tool input and output guardrails work in the OpenAI Agents SDK, how to put them on MCP servers, and what they skip: hosted MCP, shell and handoffs. https://deedglass.com/blog/owasp-agentic-top-10-what-a-gate-covers https://deedglass.com/blog/owasp-agentic-top-10-what-a-gate-covers Mon, 26 Oct 2026 00:00:00 GMT The ten OWASP agentic risks, ASI01 to ASI10, in plain words, and which ones a tool-call gate helps with, partly helps with, or doesn't touch at all. https://deedglass.com/blog/owasp-llm06-excessive-agency https://deedglass.com/blog/owasp-llm06-excessive-agency Mon, 26 Oct 2026 00:00:00 GMT OWASP LLM06:2025 Excessive Agency in plain terms: its three causes, its eight mitigations, and a worked audit of a coding agent's MCP setup against them. https://deedglass.com/blog/postgres-18-returning-old-new https://deedglass.com/blog/postgres-18-returning-old-new Mon, 26 Oct 2026 00:00:00 GMT PostgreSQL 18 lets RETURNING show old and new values in INSERT, UPDATE, DELETE and MERGE. Tested examples, and how to record what a write changed. https://deedglass.com/blog/postgres-column-grants-hide-pii-from-agent https://deedglass.com/blog/postgres-column-grants-hide-pii-from-agent Mon, 26 Oct 2026 00:00:00 GMT Postgres column-level grants keep an AI agent away from email, phone and other personal data in a table it still needs. A tested setup and its limits. https://deedglass.com/blog/postgres-default-privileges-for-agent-roles https://deedglass.com/blog/postgres-default-privileges-for-agent-roles Mon, 26 Oct 2026 00:00:00 GMT GRANT ON ALL TABLES misses tables created later; ALTER DEFAULT PRIVILEGES covers them, sensitive ones included. A tested run, and a safer grant plan. https://deedglass.com/blog/postgres-event-trigger-block-ddl https://deedglass.com/blog/postgres-event-trigger-block-ddl Mon, 26 Oct 2026 00:00:00 GMT A Postgres event trigger can refuse DROP and ALTER TABLE from an agent role, even on tables it owns. Tested on PostgreSQL 18, plus the gap: TRUNCATE. https://deedglass.com/blog/postgres-set-role-per-user-agent https://deedglass.com/blog/postgres-set-role-per-user-agent Mon, 26 Oct 2026 00:00:00 GMT Run an AI agent's queries as each end user with SET LOCAL ROLE and a per-request setting, so row-level security applies. A tested pattern and its limit. https://deedglass.com/blog/postgres-view-bypasses-rls https://deedglass.com/blog/postgres-view-bypasses-rls Mon, 26 Oct 2026 00:00:00 GMT A Postgres view runs with its owner's rights, so it can skip row-level security. A local test, the one-line fix, and a query to find every such view. https://deedglass.com/blog/prompt-injection-design-patterns-camel https://deedglass.com/blog/prompt-injection-design-patterns-camel Mon, 26 Oct 2026 00:00:00 GMT Six agent design patterns from 2025 research that limit prompt injection by structure, plus CaMeL's two-model design, with a table of what each gives up. https://deedglass.com/blog/pydantic-ai-approval-required-toolset https://deedglass.com/blog/pydantic-ai-approval-required-toolset Mon, 26 Oct 2026 00:00:00 GMT How Pydantic AI deferred tools pause a run for approval: requires_approval, ApprovalRequired, DeferredToolRequests and results. Tested with TestModel. https://deedglass.com/blog/questions-to-ask-an-ai-scribe-vendor https://deedglass.com/blog/questions-to-ask-an-ai-scribe-vendor Mon, 26 Oct 2026 00:00:00 GMT Twenty plain questions for doctors and clinics choosing an AI scribe or assistant: data, contracts, logs, review, errors and exit, for India and the US. https://deedglass.com/blog/rds-superuser-neon-superuser-agents https://deedglass.com/blog/rds-superuser-neon-superuser-agents Mon, 26 Oct 2026 00:00:00 GMT The default admin roles on RDS, Neon and Supabase can create roles and much more. What each holds, a local SET ROLE test, and a role for agents. https://deedglass.com/blog/replication-slot-wal-disk-full https://deedglass.com/blog/replication-slot-wal-disk-full Mon, 26 Oct 2026 00:00:00 GMT An unread Postgres replication slot keeps WAL with no limit by default and can fill the disk. Spot it, cap it with max_slot_wal_keep_size, drop it. https://deedglass.com/blog/restore-neon-after-agent-delete https://deedglass.com/blog/restore-neon-after-agent-delete Mon, 26 Oct 2026 00:00:00 GMT An AI agent deleted data on Neon. How the history window, instant restore and snapshots work, and when to copy rows back instead of rolling back. https://deedglass.com/blog/restore-one-postgres-table-point-in-time https://deedglass.com/blog/restore-one-postgres-table-point-in-time Mon, 26 Oct 2026 00:00:00 GMT Postgres point-in-time recovery restores a whole cluster, not one table. How to recover a side copy, pause before the bad commit, and copy one table back. https://deedglass.com/blog/restore-supabase-after-agent-delete https://deedglass.com/blog/restore-supabase-after-agent-delete Mon, 26 Oct 2026 00:00:00 GMT An AI agent deleted rows in Supabase. Which backups your plan has, why restoring over the project costs data, and how to copy back only what was lost. https://deedglass.com/blog/semantic-kernel-function-invocation-filter https://deedglass.com/blog/semantic-kernel-function-invocation-filter Mon, 26 Oct 2026 00:00:00 GMT How Semantic Kernel function invocation filters can stop a function from running, return a result instead, and order your guardrails. Tested in 1.45. https://deedglass.com/blog/smart-on-fhir-v2-scopes https://deedglass.com/blog/smart-on-fhir-v2-scopes Mon, 26 Oct 2026 00:00:00 GMT SMART v2 scopes like patient/Observation.rs name exactly which FHIR interactions a client may use. The cruds letters, filters, and scopes for AI agents. https://deedglass.com/blog/stripe-restricted-key-ai-agent https://deedglass.com/blog/stripe-restricted-key-ai-agent Mon, 26 Oct 2026 00:00:00 GMT Give an AI agent a Stripe restricted key, tagged as an agent key, so refunds wait for a person. Permissions, default approval rules and a checklist. https://deedglass.com/blog/supabase-branching-preview-migrations https://deedglass.com/blog/supabase-branching-preview-migrations Mon, 26 Oct 2026 00:00:00 GMT Supabase preview branches give each pull request its own instance with no production data by default, and merging runs migrations on production. https://deedglass.com/blog/supabase-service-role-key-ai-agent https://deedglass.com/blog/supabase-service-role-key-ai-agent Mon, 26 Oct 2026 00:00:00 GMT Giving an AI agent the Supabase service_role or secret key turns off every RLS policy. What the key does, a local test, and a safer setup for agents. https://deedglass.com/blog/swe-bench-what-it-measures https://deedglass.com/blog/swe-bench-what-it-measures Mon, 26 Oct 2026 00:00:00 GMT SWE-bench scores a coding agent by whether its patch makes an issue's tests pass. What that measures, what Verified changed, and what it skips. https://deedglass.com/blog/tau-bench-explained https://deedglass.com/blog/tau-bench-explained Mon, 26 Oct 2026 00:00:00 GMT τ-bench scores agents by the database state a conversation leaves, and pass^k asks whether an agent succeeds every time. What it measures, and not. https://deedglass.com/blog/text-to-sql-benchmarks-bird-spider https://deedglass.com/blog/text-to-sql-benchmarks-bird-spider Mon, 26 Oct 2026 00:00:00 GMT BIRD and Spider 2.0 test whether models turn questions into correct SQL on real databases. Their scores, what execution accuracy hides, and safe setups. https://deedglass.com/blog/transfer-failed-halfway-debit-committed https://deedglass.com/blog/transfer-failed-halfway-debit-committed Mon, 26 Oct 2026 00:00:00 GMT An AI agent's transfer failed on the second statement and it reported no money moved. The debit had committed. Why, how to reproduce it, and how to fix it. https://deedglass.com/blog/vercel-ai-sdk-needsapproval-to-toolapproval https://deedglass.com/blog/vercel-ai-sdk-needsapproval-to-toolapproval Mon, 26 Oct 2026 00:00:00 GMT AI SDK 7 deprecates needsApproval in favour of toolApproval. How the statuses work, approval by amount, and a mock-model run showing what executes. https://deedglass.com/blog/vscode-copilot-agent-mode-auto-approve https://deedglass.com/blog/vscode-copilot-agent-mode-auto-approve Mon, 26 Oct 2026 00:00:00 GMT How VS Code decides when Copilot agent mode runs a terminal command without asking: autoApprove rules, the global switch, defaults, the sandbox. https://deedglass.com/blog/webarena-osworld-computer-use-benchmarks https://deedglass.com/blog/webarena-osworld-computer-use-benchmarks Mon, 26 Oct 2026 00:00:00 GMT WebArena tests agents on real websites; OSWorld on real desktops. How each checks success by the end state, the human-agent gap, and what it means. https://deedglass.com/blog/why-multi-agent-systems-fail https://deedglass.com/blog/why-multi-agent-systems-fail Mon, 26 Oct 2026 00:00:00 GMT A 2025 study annotated over 1,600 multi-agent traces and found 14 failure modes, led by repeated steps and reasoning-action mismatch. What it means. https://deedglass.com/blog/why-regex-cant-block-drop-table https://deedglass.com/blog/why-regex-cant-block-drop-table Mon, 26 Oct 2026 00:00:00 GMT We tested a DROP TABLE regex on six statements. Five dropped a table and got through; the only one it blocked was harmless. What to use instead: a parser. https://deedglass.com/blog/ai-agent-audit-logs-india-dpdp https://deedglass.com/blog/ai-agent-audit-logs-india-dpdp Sun, 25 Oct 2026 00:00:00 GMT DPDP Rule 6 asks for logs of access to personal data, kept for one year, from May 2027. What that means for AI agents, and what a log should hold. https://deedglass.com/blog/ai-agent-ran-prisma-migrate-reset-on-production https://deedglass.com/blog/ai-agent-ran-prisma-migrate-reset-on-production Sun, 25 Oct 2026 00:00:00 GMT Prisma stops detected AI agents before migrate reset and db push --force-reset. We tested where that check stops, and the role that held when it did. https://deedglass.com/blog/ai-agent-retried-and-wrote-twice https://deedglass.com/blog/ai-agent-retried-and-wrote-twice Sun, 25 Oct 2026 00:00:00 GMT A client timeout doesn't undo a write. Measured on Postgres: the first try commits, then the retry commits again. The idempotency key that stops it. https://deedglass.com/blog/ai-agent-update-without-where https://deedglass.com/blog/ai-agent-update-without-where Sun, 25 Oct 2026 00:00:00 GMT Postgres has no setting that refuses an UPDATE with no WHERE. Five guards compared on real runs, a 20-line trigger that caps agent writes, and recovery. https://deedglass.com/blog/audit-mysql-changes-made-by-ai-agent https://deedglass.com/blog/audit-mysql-changes-made-by-ai-agent Sun, 25 Oct 2026 00:00:00 GMT MySQL's general log and audit plugins record the statement. Only the row-based binlog shows the rows. A recorded run: 1 row reported, 301 committed. https://deedglass.com/blog/check-agent-records-without-our-software https://deedglass.com/blog/check-agent-records-without-our-software Sun, 25 Oct 2026 00:00:00 GMT How to check a signed, hash-chained audit log with software its vendor didn't write: what to check, in what order, and what a second verifier still misses. https://deedglass.com/blog/codex-gemini-copilot-cursor-hooks https://deedglass.com/blog/codex-gemini-copilot-cursor-hooks Sun, 25 Oct 2026 00:00:00 GMT Block dangerous shell commands in Codex CLI, Gemini CLI, GitHub Copilot and Cursor with a before-command hook: where each goes, and which can ask or deny. https://deedglass.com/blog/fhir-writes-that-said-success https://deedglass.com/blog/fhir-writes-that-said-success Sun, 25 Oct 2026 00:00:00 GMT A 200 or 201 from a FHIR server means the request was accepted, not that it stored what the agent meant. 17 synthetic cases on Medplum, misses first. https://deedglass.com/blog/is-supabase-mcp-safe https://deedglass.com/blog/is-supabase-mcp-safe Sun, 25 Oct 2026 00:00:00 GMT Supabase MCP is safe enough on a dev project with a narrow role, scoped and reviewed. A 10-point checklist, the settings, and what read-only doesn't stop. https://deedglass.com/blog/lockdown-mode-for-hospitals https://deedglass.com/blog/lockdown-mode-for-hospitals Sun, 25 Oct 2026 00:00:00 GMT How to lock down AI agent writes in a hospital: a person approves every write, risky SQL never runs, and a failed check stops the agent. https://deedglass.com/blog/on-delete-cascade-deleted-more-rows https://deedglass.com/blog/on-delete-cascade-deleted-more-rows Sun, 25 Oct 2026 00:00:00 GMT Postgres answered DELETE 1 and 49 rows were gone. Why the command tag skips cascades, how to map every chain, and how to count a delete before it commits. https://deedglass.com/blog/post-quantum-signatures-for-audit-logs https://deedglass.com/blog/post-quantum-signatures-for-audit-logs Sun, 25 Oct 2026 00:00:00 GMT Records signed today may be checked in 2046, after NIST's draft retires EdDSA. Add an ML-DSA seal without breaking old records or allowing downgrades. https://deedglass.com/blog/postgres-mcp-server-read-only-bypass https://deedglass.com/blog/postgres-mcp-server-read-only-bypass Sun, 25 Oct 2026 00:00:00 GMT A stacked COMMIT; ends the archived Postgres MCP server's read-only transaction. We reproduced it with psql and tested five fixes. Two hold. https://deedglass.com/blog/supabase-mcp-leak-what-the-demo-showed https://deedglass.com/blog/supabase-mcp-leak-what-the-demo-showed Sun, 25 Oct 2026 00:00:00 GMT General Analysis's 2025 Supabase MCP demo, read from the primary page: one support ticket, a service_role credential, dummy data, and what changed after. https://deedglass.com/blog/we-show-where-our-gate-loses https://deedglass.com/blog/we-show-where-our-gate-loses Sun, 25 Oct 2026 00:00:00 GMT Twelve cases where an AI agent's report and Postgres disagree, scored from the change log. Our gateway caught 5 of 11; the 6 misses come first. https://deedglass.com/blog/ai-agents-writing-to-patient-records https://deedglass.com/blog/ai-agents-writing-to-patient-records Mon, 19 Oct 2026 00:00:00 GMT AI now drafts orders, codes visits and handles pre-authorisations in India and abroad. What can go wrong between done and the record, and what to check. https://deedglass.com/blog/ai-agent-deleted-the-database-first-hour https://deedglass.com/blog/ai-agent-deleted-the-database-first-hour Sun, 18 Oct 2026 00:00:00 GMT An AI agent wiped your production database. A calm first-hour checklist: stop it, cut its access, keep evidence, restore beside production. https://deedglass.com/blog/pgaudit-triggers-logical-decoding-agent-audit https://deedglass.com/blog/pgaudit-triggers-logical-decoding-agent-audit Sun, 18 Oct 2026 00:00:00 GMT One agent UPDATE, a legacy trigger, 301 changed rows. What log_statement, pgAudit, an audit trigger and logical decoding each recorded on Postgres 18. https://deedglass.com/blog/require-approval-mcp-tool-calls https://deedglass.com/blog/require-approval-mcp-tool-calls Sun, 18 Oct 2026 00:00:00 GMT How to make a person approve MCP tool calls in Claude Code and Cursor: settings.json rules, hooks, Cursor's allowlist, and when to move it to a gateway. https://deedglass.com/blog/agent-said-1-row-postgres-changed-301 https://deedglass.com/blog/agent-said-1-row-postgres-changed-301 Wed, 14 Oct 2026 00:00:00 GMT A real run: an agent's one-row UPDATE fires a legacy trigger, Postgres commits 301 rows, and the tool reports 1. How to see it, and how to put it back. https://deedglass.com/blog/checklist-before-an-agent-touches-production https://deedglass.com/blog/checklist-before-an-agent-touches-production Wed, 14 Oct 2026 00:00:00 GMT Twenty checks before an AI agent gets near a production database, payments or customer data: access, limits, destructive verbs, recovery and evidence. https://deedglass.com/blog/claimed-checked-proven https://deedglass.com/blog/claimed-checked-proven Wed, 14 Oct 2026 00:00:00 GMT Three levels of evidence for what an AI agent did: the tool's word, a read-back from the target, and the database's change log. What each one catches. https://deedglass.com/blog/mcp-server-security-basics https://deedglass.com/blog/mcp-server-security-basics Wed, 14 Oct 2026 00:00:00 GMT An MCP security checklist for servers that touch real data: inventory, narrow credentials, read-only modes, local HTTP servers, injection and approvals. https://deedglass.com/blog/replit-and-pocketos-what-the-primary-sources-say https://deedglass.com/blog/replit-and-pocketos-what-the-primary-sources-say Wed, 14 Oct 2026 00:00:00 GMT Two widely shared AI agent incidents, read from the platforms' own accounts, not the headlines: what happened, how, and the fixes that need no vendor. https://deedglass.com/blog/safe-postgres-access-for-ai-agents https://deedglass.com/blog/safe-postgres-access-for-ai-agents Wed, 14 Oct 2026 00:00:00 GMT A tested setup for an AI agent's Postgres access: a narrow role, row-level security per customer, statement and lock limits, and the gap they all share. https://deedglass.com/blog/undo-for-agent-sessions https://deedglass.com/blog/undo-for-agent-sessions Wed, 14 Oct 2026 00:00:00 GMT An agent ran for an hour and something is wrong. How to put back what it changed in Postgres, without restoring a backup over everyone else's writes. https://deedglass.com/blog/why-logs-arent-evidence https://deedglass.com/blog/why-logs-arent-evidence Wed, 14 Oct 2026 00:00:00 GMT After an agent incident, the first question is what it did. A log can't answer that on its own. What signed, linked records add, with a real tamper run.