The hottest Standards Substack posts right now

And their main takeaways

MCP is a standardized way to expose capabilities using JSON-RPC, so it talks about operations (not resources) and is easier to discover and consume than vague REST APIs.
You can call MCP tools from workflows by making JSON-RPC requests, initializing a session to get the mcp-session-id, and mapping each tool's inputSchema to workflow inputs; outputs may be structured or unstructured and might need parsing.
Putting MCP tools into workflows gives predictable, traceable, and more secure execution with easier debugging and reliability, though adapting unstructured tool outputs to procedural steps has some implementation cost.

There’s no single perfect authentication solution—organizations must support multiple methods like passwords, passkeys, magic links, OTPs, and MFA to meet different user needs. Passkeys offer big security gains but still have UX and implementation friction, while magic links and OTPs face deliverability and browser issues, and shared password managers can introduce new risks.
AI agents are fast and unpredictable and become dangerous when they can access private data, read untrusted content, and communicate externally. Treat agents like users: apply least privilege, separate access for subagents and tools, and build on existing standards (like OAuth/MCP) for authentication and authorization.
A good developer environment is fast and low-latency, and many teams prefer local-first setups for quicker feedback and more direct security control. Make security part of the workflow by adding useful tests and developer-friendly security tools so they get used without slowing developers down.