coles.codes

I left cmux for herdr at the start of June because its remote support did not fit how I work. Maybe I should have waited a little longer! cmux shipped a daemon that keeps SSH terminals alive across reconnects on 1 June, then added SSH agent forwarding on 4 June. I stayed on herdr anyway. I’ve now spent about two months with each, moving between Linux boxes and my Mac while running several coding agents at once.

I use Pi and Claude Code day to day, and I run them in two places. On my Mac, Claude Code’s permissions stay on because the box holds personal credentials and uncommitted work. On a pair of second-hand Dell micros, both agents run unattended with scoped project access and no irreplaceable local state. I assume an unattended agent will eventually do something I didn’t mean, so the useful safety question is what that mistake can reach. Hooks and instruction files still help inside the session, but the machine and its credentials decide how much damage is possible.

TL;DR Each MCP tool puts a contract in the model’s context. I keep related typed filters together and let the agent shape authorised results in code. Server-side scoping stays where access requires it. Progressive discovery stops a large catalog from using too much context. The tempting way to build a data MCP server is one query_data(dataset, filters) tool. Every new slice adds another branch to its filter grammar. The agent clients I use give the model a code execution environment, so I first ask whether the server needs to shape the result. If the caller may see the full dataset, the tool can return the rows and let the agent work with them in Python or DuckDB. A small skill can explain the dataset’s conventions.

From schema-guaranteed structured outputs on Bedrock to Pydantic Evals: how I get LLM output I can actually gate a merge on.

The argument I keep hearing is that skills have made MCP servers redundant. A skill can drive any CLI, so point the agent at aws or psql and it can do anything a server can. For one person working on their own machine, that’s mostly true. Calling a CLI doesn’t make a skill a good way to authenticate or retrieve governed data. The skill uses whatever credentials happen to be on your laptop, which means the caller is whoever you last logged in as. It can do anything those credentials allow. There is no central place deciding which tools finance can see or recording who touched a customer’s data. The skill may also give the agent more access than the task needs.