Independent reporting on artificial intelligence.


The Frontier Wire

Archive

Every article, newest first.

94 articles


Tools

AI agent security: a practical guide to securing LLM apps and agents

The model is not a security boundary. Eight concrete failures in LLM apps and agents, from provider keys in browser bundles to injected tool calls and runaway spend, each mapped to the OWASP LLM Top 10, with the code-level fix and an open-source agent skill that audits a codebase for them.

15 min read

Comparisons

Best Claude Code skills for teams shipping LLM apps and agents

A Claude Code skill is a folder of instructions the agent loads only when a task calls for it. Six MIT-licensed skills for security, observability, cost, MCP, coding-agent governance and skill management, ranked on stated criteria, installed and linted in a clean repository.

14 min read

News

Bifrost Edge brings AI gateway governance to every company laptop

Maxim AI's endpoint agent for the Bifrost gateway gained per-app capture controls, version reporting and a stateless MCP inspection path in Bifrost Enterprise v2.3.0. How Edge works, what it governs, how it rolls out through MDM, and where it sits next to CASB and DLP tooling.

14 min read

News

Bifrost reworks /v1/decisions into one OpenAI-shaped API for decision models

Decision models from TypeSafe, OpenAI, Perplexity, Cloudflare, Microsoft, Databricks and Ollama return typed answers with probabilities, in two request dialects. Bifrost v2.3.0 gives them one endpoint, stops silently answering decisions with chat models, and prices decisions on their own rates.

15 min read

Tools

LLM cost optimization: a measured playbook for cutting API spend

Every LLM bill is requests times tokens times price. A playbook for shrinking each factor without a quality regression: attribution, right-sized models, complexity routing, prompt trimming, prompt and response caching, Batch APIs, loop caps and budgets, plus the open-source llm-cost-reduction agent skill.

15 min read

Research

LLM observability: what to capture, trace and alert on in production

A practical explainer on LLM observability: the per-call record, time to first token, OpenTelemetry GenAI conventions, trace structure for agents, sampling and PII redaction, Prometheus alert thresholds, feedback joins and evals on production traffic, plus the open-source llm-observability-stack agent skill.

15 min read

Tools

MCP best practices: tool budgets, least privilege and approval gates

Connecting one MCP server takes a line of config. Running twenty safely across a team takes tool budgets, per-identity allow-lists, approval gates, sane transports, health checks and logs. The practices, checked against the 2026-07-28 MCP specification, and an open-source agent skill that audits a setup against them.

15 min read

Tools

npx skills and skills.sh: a complete guide to the skills CLI

The skills CLI installs SKILL.md folders from GitHub into 79 coding agents, and skills.sh is the directory built on its telemetry. Every command in version 1.7.4, project and global scope, the symlink layout, the lock file and its hashes, and the warning printed on every install, checked against the source.

13 min read

Comparisons

API management platforms compared: twelve options for 2026

Every major API management platform now ships some form of AI gateway. The criteria below separate the platforms built to publish and monetize APIs from the layer built to meter tokens, fail over between model providers and govern MCP tools, and compare twelve options against both.

19 min read

Research

Attribute-based access control (ABAC): a practical guide

NIST defines attribute-based access control as decisions made from attributes of the subject, the object and the environment. The architecture behind it, how it differs from RBAC and Google's Zanzibar-style ReBAC, the policy languages that implement it, and how to apply it to models, agent tools, MCP servers and RAG.

23 min read

Research

Claude usage: plan limits, how to check them and API tracking

Claude usage is measured three different ways depending on how a request signs in. Subscriptions run on five-hour and weekly windows, API keys run on rate limits and spend caps, and usage-based Enterprise seats are billed per token. Where each meter lives and what drains it, per Anthropic's pages on 21 October 2026.

21 min read