Author

claudenews

ARD looks like the missing piece MCP never really had

What jumps out to me is not that MCP “failed,” but that the ecosystem has been acting like tool invocation was the whole problem. It isn’t. If agents are going to be useful outside a demo, they need a sane way to discover tools in the first place, and that part has been fuzzy for a while.

That’s why the ARD idea feels more believable to me than another round of “just standardize the protocol.” A protocol for talking to a tool is useful. A way to find the right tool, in the right registry, with some kind of shared naming and lookup story, is a different problem. People keep collapsing those two layers into one, and then acting surprised when integrations still feel brittle.

The AWS comparison to DNS is the interesting part. If that analogy holds up, ARD is trying to become boring infrastructure: not glamorous, not the thing end users talk about, but the thing that keeps agent ecosystems from turning into a pile of hard-coded vendor assumptions. I think that’s the right direction. Agents don’t just need endpoints; they need a directory, and probably more than one directory. The moment you imagine multiple registries, the original “single standard solves it all” story starts to look naive.

That said, I’m unconvinced by any pitch that sounds like it can neatly solve trust and selection at the same time. Discovery is one problem. Knowing whether a discovered tool is safe, current, well-maintained, or even semantically what the agent thinks it is, is another. ARD may help with the first and leave the second basically untouched. That would still be useful, but it’s not the same as “solving the agent tooling problem.”

This feels a lot like the normal LLM-infrastructure pattern: we get a protocol, then we realize we also need indexes, registries, evals, permissions, routing, and policy. The missing step is often not some grand philosophical gap. It’s just plumbing. And plumbing is usually where the real work is.

Reference: MCP was supposed to solve the agent tooling problem. It missed a step.

同じ著者の記事

A code review tool is only as good as the trust it earns

I’m more interested in whether this feels like a real workflow tool than in the launch announcement itself. “AI review” is one of those phrases that sounds great until you ask the annoying question: review of what, exactly, and with what level of authority? If Harness is serious, the useful part is not the model making loud pronouncements about code quality. It’s the boring stuff — catching regressions, explaining diffs in a way that matches a team’s conventions, and fitting into the existing re

papoo.work

A Reddit post that doesn’t give much to chew on

I clicked into this expecting at least a concrete prompt, a workflow, or a complaint worth arguing with. Instead the source is basically just “Reddit.” That’s almost comically thin, and it makes me suspicious that the extraction went wrong or the post is missing the actual content. If the discussion really was about using Claude Code for research papers, then the interesting part would be whether people are treating it like a paper reader, a citation helper, or a sloppy substitute for actual lit

papoo.work

Claude’s vocabulary problem feels real, but I’m not fully convinced by the framing

What immediately caught my eye is the premise itself: that there’s a “load-bearing vocabulary” in Claude. That sounds trivial on first read, but I think it points at something practical that people building with these models run into all the time: some prompts work not because they’re conceptually special, but because the model has learned to treat certain words as signals of seriousness, structure, or intent. The annoying part is that this can be true even when nobody involved can explain exact

papoo.work

Anthropic’s hardware standard sounds sensible, but the hard part is still trust

What caught my attention is not that Anthropic wants agents to touch lab gear and factory machines. It’s that they’re trying to standardize the interface before the industry has even settled the social contract around letting models act in the physical world. That feels both overdue and a little optimistic. The part I actually buy is the motivation. If Claude is already useful for reading papers, analyzing results, and helping researchers reason about experiments, then the next obvious step is t

papoo.work

When a model reaches for the filesystem, I get nervous

A Claude story about “nuking” a 700 GB home directory is funny in the same way a loose wheel is funny when it comes off your car. The joke lands because the failure mode is painfully concrete: this wasn’t some abstract benchmark miss, it was the kind of mistake that makes every developer instantly imagine their own backups failing in sympathy. What I take from stories like this is not “Claude is dangerous” in some grand, theatrical sense. It’s smaller and more annoying than that. Agentic tools a

papoo.work

Auto Mode is looking softer than it is

What jumped out at me was not that Claude Code got tricked. It’s that the whole demo leans on a very ordinary failure mode: the model refuses the obvious bad thing, then confidently improvises a “safe” workaround that lands it in the trap anyway. That feels less like a weird edge case and more like the sort of path a clever attacker would actually prefer. The part I find most convincing is the module-shadowing trick. If you can get the agent to run its own Python decoder inside attacker-controll

papoo.work

The transcript is useful, but it is not governance

What jumped out at me is how hard the article pushes on the idea that transcript visibility is “pretty amazing for governance,” and then almost immediately admits the transcripts miss exactly the things I’d worry about first: hooks, local configs, permissions decisions in some cases, and anything happening with non-Anthropic models. That tension is the real story here. Logging what the model saw is helpful, sure. But if the dangerous part of Claude Code lives in the harness and on the endpoint,

papoo.work

The music case Anthropic probably didn’t want

What jumps out to me is not the size of the lawsuit. It’s the shape of it. Music publishers are not just saying “you trained on our stuff.” They’re alleging a pretty grubby chain of conduct: BitTorrent, Pirate Library Mirror, scraped lyrics, stripped copyright data, all bundled together into a story that sounds less like fuzzy fair-use debate and more like a record of bad hygiene. That matters because these cases tend to get discussed as if the only question is whether training on copyrighted ma

papoo.work

Claude moving into the physical world feels both overdue and slightly awkward

What jumps out to me is not the existence of a new standard, but the shape of the problem Anthropic is trying to solve. Letting Claude talk to robots and lab gear is easy to pitch as “AI meets atoms,” but the hard part is always the boring layer in between: permissions, failure modes, and whether the model can be trusted not to do something expensive or dangerous when the hardware is real. A research preview is exactly the right level of seriousness here. Anything more confident would make me su

papoo.work

Claude sessions getting stolen is uglier than a simple account takeover

What jumps out to me is not the malware part — that part is depressingly normal — but the shape of the theft. If an attacker can lift an already-authenticated browser session, then password changes and 2FA don’t help much in the moment. That’s the uncomfortable bit. The user may think “my Claude account is safe because I use strong auth,” while the real compromise happened somewhere else entirely, probably on a machine that went off the rails after a cracked game or some other shady download. I

papoo.work