Engineering deep dives, industry perspective, implementation notes, and practical recipes.
Search covers titles, summaries, tags and full article text.
An agent loop can choose a next action. It cannot, by itself, bind a user identity, serialize concurrent messages, preserve files, restore a conversation on another worker, enforce a grant, account for a model call, or isolate generated code. KDCube supplies that operating layer around the agent — without requiring the agent's reasoning core to become a K...
The builder-facing half of authenticated MCP. A service that re-exposes a third-party API resolves the approving user's credential through the Connection Hub broker - per call, at the trusted boundary. Every argument traces to a config key; the connector app is resolved, not hardcoded.
My agents act on users' Gmail and Slack every day - external agents like Claude Code included - and none has ever held a provider token. Every access is something the user granted, granular and on demand, and it takes two acts they control: connect the account, and permit the agent. Here is the whole machine, fence by fence.
One chain of configuration, written once. An app declares a protected MCP door; Connection Hub declares what may be delegated there and to whom; the provider behind the door declares which user accounts back its work; and every call crosses two gates before a real credential resolves at the trusted boundary.
Switch a tool off and every trace of it leaves the agent's instruction — teaching blocks, protocol channels, catalog sections. One authority decides: the effective tool roster.
How a KDCube app verifies Telegram webhooks, admits updates to its event lane, runs its configured agent, and delivers results back.
Route every caller — a resident agent, an external app, an unattended automation — through one registry, each a small revocable grant bound to specific accounts and permissions.
One KDCube app exposes its functionality over a governed MCP door; its tools act on a user's accounts and your own OAuth-protected server, while Connection Hub authorizes every call and your code never touches a token.
The KDCube ReAct agent's full instruction body is ~24,800 tokens of battle-proven prose. It now has two distilled siblings — a moderate set at 40% and an extra-lite set at 30% — built by one discipline: enumerate every hard signal, then cut only the prose around it. The signal table is executable: it lives in tests that fail if a distillation loses a sing...
KDCube is a self-hosted application runtime built from explicit boundaries: trusted apps, scoped data, guarded authority, and split execution for untrusted generated code.
How KDCube loads, reloads, predeploys authorized widget assets, and cuts over app generations without rewriting in-flight work.
How KDCube apps provide and consume API, MCP, named-service, connected-account, Telegram, UI, event, and job surfaces.