News
Release /
Aroha 2.0
Mandate tokens that carry their whole signed chain, one call that enforces spending limits on a plain HTTP API, rotatable identities, and a remote MCP connector. Published on npm and PyPI under Apache-2.0.
Read the release
Archive
Written before Aroha 2.0 and the move to Apache-2.0. Each one carries a dated note about what has changed.
- Your agent's permission logic lives in 2,267 filesOne safety rule, traced through a production agent harness, turned up in 2,267 files. Two honest answers: better maps of the scatter, or moving the rule somewhere the scatter cannot reach.
- Your AI agent's tools need a firewallAn assistant's GitHub server exposes delete_repository, and only the model's judgement stands in the way. mcp-guard wraps any MCP server with block rules, approval gates and session limits.
- Five packages that changed how I build AI agentsA working tour of the toolkit in Python and TypeScript, bugs included.
- Why AI agents need a permission layerWhy API keys and rate limits cannot bound an agent that spawns more agents, and what a permission layer needs.
- Spending mandates and OAuth scopesOAuth was designed for people granting access to apps. When agents delegate to agents, three problems appear that OAuth never had to solve: narrowing, chain depth and spend limits.
- Five reasons your AI agent should never hold an API keyAPI keys are all-or-nothing, long-lived and silent about what they were used for.
- How we built a reputation engineScoring agents with a Bayesian Beta distribution instead of star ratings.
- Deploying an Aroha agent on Fly.ioScaffolding an agent, issuing a spending mandate and deploying it to Fly.io.