> Technical articles by Balázs Csorba, AI engineer in Austria: agent loops, MCP servers, LLM evals, prompt injection, the EU AI Act and Nuxt. > > Web page: https://balazscsorba.com/blog · Language: English · Also available in: [Deutsch](https://balazscsorba.com/de/blog.md) · [Magyar](https://balazscsorba.com/hu/blog.md) Blog # AI agents, MCP & web engineering: notes from the workshop Engineering notes on AI agents, MCP, LLM evals and AI security – and the web apps around them. Sourced, with diagrams, written for people who ship. - ![Claude in OpenCode: a hand plugs one of two adapters into a laptop that shows a terminal window.](https://balazscsorba.com/images/blog/claude-in-opencode/cover.webp?v=872e84955c) AI agents October 30, 2026·12 min read ## [Claude in OpenCode: the Claude Agent provider, API keys and the other routes](https://balazscsorba.com/blog/claude-in-opencode) How to use Claude in OpenCode: the new Claude Agent provider on your Claude plan, API keys, Console, Copilot and OpenRouter, with costs and limits. - OpenCode - [Claude Code](https://balazscsorba.com/blog/tag/claude-code) - Claude Agent SDK - ![Claude Code Review: three magnifying glasses examine a sheet of lines, and one line is circled and checked.](https://balazscsorba.com/images/blog/claude-code-review/cover.webp?v=c6821efd26) AI agents October 21, 2026·11 min read ## [Claude Code Review is generally available: how the multi-agent review works and costs](https://balazscsorba.com/blog/claude-code-review) Claude Code Review, now GA for Team and Enterprise: how agents verify findings, set review levels, cap spend, and compare with the GitHub Action. - [Claude Code](https://balazscsorba.com/blog/tag/claude-code) - Code review - GitHub - ![Claude pricing and usage limits: three jars of growing size filled with tokens, next to a clock and an hourglass.](https://balazscsorba.com/images/blog/claude-plans-pricing-usage-limits/cover.webp?v=665e9fa21d) LLMOps & evals October 21, 2026·11 min read ## [Claude pricing explained: Free, Pro, Max, Team and the API, and how usage limits work](https://balazscsorba.com/blog/claude-plans-pricing-usage-limits) Claude plan prices as of October 2026, how the five-hour and weekly usage limits work, Team seats, API token prices and how to pick a plan. - Claude - Pricing - Usage limits - ![Claude skills and SKILL.md: an open toolbox holds upright folders, and one folder is pulled out with a single sheet.](https://balazscsorba.com/images/blog/claude-skills-guide/cover.webp?v=28589f7ab8) AI agents October 20, 2026·12 min read ## [Claude skills: how to write a SKILL.md that loads at the right moment](https://balazscsorba.com/blog/claude-skills-guide) How to write a Claude skill: directory layout, frontmatter fields and limits, progressive disclosure, descriptions that trigger, scripts and testing. - Claude skills - SKILL.md - [Claude Code](https://balazscsorba.com/blog/tag/claude-code) - ![Claude Haiku 5.5: a light paper airplane carrying a small coin flies quickly past a large, heavy jar.](https://balazscsorba.com/images/blog/claude-haiku-5-5/cover.webp?v=61b7ee7e7e) LLMOps & evals October 19, 2026·15 min read ## [Claude Haiku 5.5: pricing, effort levels and the jobs it takes over from Sonnet](https://balazscsorba.com/blog/claude-haiku-5-5) Claude Haiku 5.5 pricing by tier, benchmarks against Haiku 4.5 and Sonnet 5.5, effort levels, and which Sonnet 5.5 jobs can move to it. - Claude Haiku 5.5 - LLM pricing - Reasoning effort - ![DeepSeek V4.1 Flash 1017: a robot with a tiny backpack sets off on a long path next to a huge suitcase.](https://balazscsorba.com/images/blog/deepseek-v4-1-flash-1017/cover.webp?v=ba175864fa) LLMOps & evals October 17, 2026·15 min read ## [DeepSeek V4.1 Flash 1017: 890 bytes of KV cache per token, and what that buys an agent](https://balazscsorba.com/blog/deepseek-v4-1-flash-1017) DeepSeek V4.1 Flash 1017 deep dive: the encoder-decoder split, CSA2 cache sharing, FP4 KV cache, benchmarks, and the real cost per agent task. - DeepSeek - Open-weight models - KV cache - ![LLM rate limits and fallbacks: a van waits at a closed barrier with an hourglass, a side road leading to an open gate.](https://balazscsorba.com/images/blog/llm-rate-limits-retries-provider-fallback/cover.webp?v=395b9ac7f1) LLMOps & evals October 17, 2026·10 min read ## [LLM rate limits in production: retries, backoff and provider fallback](https://balazscsorba.com/blog/llm-rate-limits-retries-provider-fallback) How LLM rate limits work, which errors to retry, backoff with jitter, retrying in one layer only, and fallback chains that do not break your output. - Rate limits - Retries - Fallback - ![Prompt versioning in production: a hand pulls an older jar with a scroll forward from a labelled row on a shelf.](https://balazscsorba.com/images/blog/prompt-versioning-management/cover.webp?v=36c9042a97) LLMOps & evals October 17, 2026·8 min read ## [Prompt versioning in production: git, registries, labels and rollbacks](https://balazscsorba.com/blog/prompt-versioning-management) Prompt versioning in production: what belongs in a version, git vs a prompt registry, labels and rollbacks, eval gates in CI, and cache side effects. - Prompt management - Versioning - LLMOps - ![LLM batch APIs: a tray of envelopes waits overnight beside a laptop and a half-coin price tag.](https://balazscsorba.com/images/blog/llm-batch-api-offline-workloads/cover.webp?v=ceb3ca397e) LLMOps & evals October 17, 2026·9 min read ## [LLM batch APIs: half-price inference for work that can wait](https://balazscsorba.com/blog/llm-batch-api-offline-workloads) When to use the Anthropic, OpenAI and Gemini batch APIs, how limits, result matching and failures work, and how batch discounts stack with prompt caching. - Batch API - Cost - LLMOps - ![Tool design for AI agents: a robot hand reaches for a screwdriver on a pegboard where every tool has its outline.](https://balazscsorba.com/images/blog/agent-tool-design-descriptions-errors/cover.webp?v=68ee1d3e17) AI agents October 17, 2026·11 min read ## [Designing tools for AI agents: names, descriptions, schemas and error messages](https://balazscsorba.com/blog/agent-tool-design-descriptions-errors) How to design agent tools that get picked and called correctly: task-shaped tools, descriptions, schemas, compact responses and errors a model can act on. - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - Tool use - Function calling - ![Embedding model selection: three cakes from three moulds cool on a rack while a fork is about to taste one.](https://balazscsorba.com/images/blog/embedding-model-selection-2026/cover.webp?v=6f5695ca0d) Retrieval & search October 17, 2026·9 min read ## [Choosing an embedding model in 2026: leaderboards, costs and a bake-off on your own data](https://balazscsorba.com/blog/embedding-model-selection-2026) How to pick an embedding model for RAG in 2026: what MTEB and RTEB tell you, hosted vs open weights, prices, dimensions, and a one-week bake-off. - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - [RAG](https://balazscsorba.com/blog/tag/rag) - MTEB - ![Contextual retrieval and late chunking: a hand holds a tagged puzzle piece above its gap in a jigsaw on a table.](https://balazscsorba.com/images/blog/contextual-retrieval-late-chunking/cover.webp?v=fc63e98aaa) Retrieval & search October 17, 2026·10 min read ## [Contextual retrieval and late chunking: giving RAG chunks back their context](https://balazscsorba.com/blog/contextual-retrieval-late-chunking) Chunks lose their document. How contextual retrieval, late chunking and contextualized embedding models fix that, what each costs, and when to skip it. - [RAG](https://balazscsorba.com/blog/tag/rag) - Chunking - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - ![Access control for RAG: a person with an ID card takes a book while other books stay behind a locked glass door.](https://balazscsorba.com/images/blog/rag-access-control-permissions/cover.webp?v=291c7870e1) Retrieval & search October 17, 2026·9 min read ## [Access control for RAG: permission-aware retrieval without leaking documents](https://balazscsorba.com/blog/rag-access-control-permissions) How RAG assistants leak documents and how to stop it: ACLs on every chunk, pre-filtering, row-level security in pgvector, permission sync and leak tests. - [RAG](https://balazscsorba.com/blog/tag/rag) - Access control - Security - ![LLM output guardrails: water from a tap runs through a filter jug into a clean glass, pebbles caught at the top.](https://balazscsorba.com/images/blog/llm-output-guardrails-moderation/cover.webp?v=fcee1e80ca) Security & compliance October 17, 2026·13 min read ## [LLM output guardrails: moderation, safe rendering and validation before anything acts](https://balazscsorba.com/blog/llm-output-guardrails-moderation) What to check after the model answers: safe Markdown rendering, schema checks before actions, moderation classifiers, streaming rails and groundedness. - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - [Guardrails](https://balazscsorba.com/blog/tag/guardrails) - Content moderation - ![Schema.org for B2B shops: a robot reads a product tag on a shop shelf, one box behind a locked glass door.](https://balazscsorba.com/images/blog/schema-org-structured-data-b2b-shop/cover.webp?v=354f4069b5) Web engineering October 17, 2026·10 min read ## [Schema.org structured data for B2B shops: prices behind logins, units and variants](https://balazscsorba.com/blog/schema-org-structured-data-b2b-shop) Product markup for B2B shops: snippet or merchant listing, which price to publish, part numbers, unit pricing, variants, Organization and SSR in Nuxt. - Schema.org - Structured data - [B2B e-commerce](https://balazscsorba.com/blog/tag/b2b-e-commerce) - ![AI assistant for B2B shop support: a robot with a headset at a help desk hands a ticket card to a human hand.](https://balazscsorba.com/images/blog/ai-assistant-b2b-shop-customer-support/cover.webp?v=ff63c50fbe) Web engineering October 17, 2026·9 min read ## [An AI assistant for B2B shop support: tools, permissions and the human handoff](https://balazscsorba.com/blog/ai-assistant-b2b-shop-customer-support) How to build an AI support assistant for a B2B shop: which requests to automate, tools that run in the customer context, handoff, AI Act and metrics. - [B2B e-commerce](https://balazscsorba.com/blog/tag/b2b-e-commerce) - AI assistant - Customer support - ![Small language models: a hand picks a pocket knife over a large toolbox to cut a parcel string.](https://balazscsorba.com/images/blog/small-language-models-when-enough/cover.webp?v=b3a5b9f241) LLMOps & evals October 17, 2026·11 min read ## [Small language models: when a 4B model is enough](https://balazscsorba.com/blog/small-language-models-when-enough) When a small model beats a frontier API: cost per resolved case, latency, privacy, distillation, quantization, routing and an eval plan for your traffic. - Small language models - Distillation - Quantization - ![Thinking budgets and effort: a robot thinks under a thought bubble beside a large hourglass and a three-step dial.](https://balazscsorba.com/images/blog/reasoning-models-effort-thinking-budget/cover.webp?v=18f926faea) LLMOps & evals October 17, 2026·10 min read ## [Reasoning effort and thinking budgets: how much should a model think?](https://balazscsorba.com/blog/reasoning-models-effort-thinking-budget) Reasoning effort on Claude, OpenAI and Gemini: adaptive thinking, what thinking tokens cost, and how to pick a level with an effort sweep. - Reasoning models - Effort - LLMOps - ![Legacy migration with coding agents: a robot carries a brick from an old vine-covered house to a new one being built.](https://balazscsorba.com/images/blog/coding-agents-legacy-codebase-migration/cover.webp?v=085337c62c) AI agents October 17, 2026·11 min read ## [Migrating a legacy codebase with coding agents: a strangler fig playbook](https://balazscsorba.com/blog/coding-agents-legacy-codebase-migration) How to use coding agents on a legacy migration: characterization tests first, one seam per task, review gates and differential verification. - Legacy migration - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Strangler fig - ![Background coding agents: a person dozes in an armchair while a robot in the background posts an envelope.](https://balazscsorba.com/images/blog/background-agents-async-pr-workflow/cover.webp?v=1b7a4947cf) AI agents October 17, 2026·12 min read ## [Background coding agents that open PRs: a practical async workflow](https://balazscsorba.com/blog/background-agents-async-pr-workflow) How async coding agents queue tasks, run in sandboxes, open draft PRs and pass CI. Provider limits, cost controls, review design and failure modes. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Pull requests - CI - ![RAG over product catalogues: a speech bubble with a product card rises from an open product catalogue.](https://balazscsorba.com/images/blog/rag-product-catalog-pim-data/cover.webp?v=947dc56b80) Retrieval & search October 17, 2026·10 min read ## [RAG over product catalogues: turning PIM data into answers that hold](https://balazscsorba.com/blog/rag-product-catalog-pim-data) Product data is structured, so chunking it like PDFs fails. How to serialize PIM attributes, route spec questions to filters and keep answers exact. - [RAG](https://balazscsorba.com/blog/tag/rag) - [PIM](https://balazscsorba.com/blog/tag/pim) - Product data - ![Conversational query rewriting: a speech bubble goes through a sewing machine and comes out as a neat note with a magnifier.](https://balazscsorba.com/images/blog/conversational-search-query-rewriting/cover.webp?v=288066b04e) Retrieval & search October 17, 2026·12 min read ## [Query rewriting for conversational search: context, HyDE and filters](https://balazscsorba.com/blog/conversational-search-query-rewriting) How to rewrite follow-up questions in a B2B shop assistant: coreference, HyDE, multi-query expansion, filter extraction, latency and evaluation. - Conversational search - Query rewriting - [RAG](https://balazscsorba.com/blog/tag/rag) - ![Synthetic test data for RAG evals: a robot runs a machine that turns a book into a stack of question cards.](https://balazscsorba.com/images/blog/synthetic-test-data-rag-evals/cover.webp?v=d3da5c60f0) Retrieval & search October 17, 2026·10 min read ## [Generating synthetic test data for RAG evaluations](https://balazscsorba.com/blog/synthetic-test-data-rag-evals) Question generation from chunks, hard negatives, answerability labels, German and Hungarian coverage, contamination and human spot checks. - [RAG](https://balazscsorba.com/blog/tag/rag) - [Evaluation](https://balazscsorba.com/blog/tag/evaluation) - Synthetic data - ![LLM app red teaming: a person in a helmet with a checklist stands before a castle gate, a battering ram nearby.](https://balazscsorba.com/images/blog/ai-red-teaming-checklist-llm-apps/cover.webp?v=87e6ce2c9e) Security & compliance October 17, 2026·12 min read ## [AI red teaming checklist for LLM apps: what to attack before your users do](https://balazscsorba.com/blog/ai-red-teaming-checklist-llm-apps) A practical red teaming checklist for LLM features: scope, OWASP 2025 test cases, promptfoo, garak and PyRIT, human testers and regression tests. - AI red teaming - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - OWASP - ![Streaming AI chat in Vue and Nuxt: chat bubbles appear one by one in a window, headphones and a keyboard key in front.](https://balazscsorba.com/images/blog/vue-ai-chat-ui-streaming-accessibility/cover.webp?v=44f4957ff6) Web engineering October 17, 2026·11 min read ## [Streaming AI chat in Vue and Nuxt: accessible by design](https://balazscsorba.com/blog/vue-ai-chat-ui-streaming-accessibility) Streaming AI chat UI in Vue and Nuxt: fetch streams, abort and retry, safe markdown, aria-live announcements, keyboard support and reduced motion. - Vue - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - Accessibility - ![LLM translation pipeline for i18n: three speech bubbles linked by a ribbon above an open dictionary and a pencil.](https://balazscsorba.com/images/blog/llm-translation-pipeline-i18n/cover.webp?v=8fa4c64b0a) Web engineering October 17, 2026·9 min read ## [An LLM translation pipeline for i18n: glossary, placeholders and review](https://balazscsorba.com/blog/llm-translation-pipeline-i18n) How to translate product and website strings with LLMs without breaking placeholders, plurals or tone: glossary, ICU messages, QA checks and review gates. - Translation - i18n - LLM - ![Structured outputs with JSON Schema: a cookie cutter makes a perfect shape, one cookie beside it shaped right but cracked.](https://balazscsorba.com/images/blog/structured-outputs-json-schema-llm/cover.webp?v=b118d67cea) LLMOps & evals October 16, 2026·9 min read ## [Structured outputs with JSON Schema: what the guarantee covers, and what it does not](https://balazscsorba.com/blog/structured-outputs-json-schema-llm) How structured outputs and constrained decoding work on OpenAI, Claude, Gemini and vLLM, which schema rules matter, and what you still validate. - Structured outputs - JSON Schema - Constrained decoding - ![Evaluating AI agents: a robot's footprint trail through a maze is checked by a large pencil, a flag at the exit.](https://balazscsorba.com/images/blog/evaluating-ai-agents-trajectories/cover.webp?v=353322b3f3) LLMOps & evals October 16, 2026·9 min read ## [Evaluating AI agents: grading trajectories, outcomes and reliability](https://balazscsorba.com/blog/evaluating-ai-agents-trajectories) How to evaluate AI agents: outcome vs trajectory graders, trajectory match modes, pass^k, isolated environments and LLM judges that hold up. - Agent evals - Trajectories - Tool calling - ![LLM model migrations: moving boxes on a hand truck travel from an old house to a new one, a tape measure between them.](https://balazscsorba.com/images/blog/llm-model-migration-regression-testing/cover.webp?v=8a8d63025f) LLMOps & evals October 16, 2026·10 min read ## [LLM model migrations without regressions: deprecations, evals, shadow traffic](https://balazscsorba.com/blog/llm-model-migration-regression-testing) A playbook for switching LLM models: deprecation timelines, contract fixes, a regression suite, prompt re-tuning, shadow traffic and canary rollout. - Model migration - Regression testing - Deprecations - ![Context rot in long-running agents: a robot sits under a pile of papers while a press squeezes a stack into one sheet.](https://balazscsorba.com/images/blog/context-rot-compaction-long-running-agents/cover.webp?v=c613d02995) AI agents October 16, 2026·10 min read ## [Context rot in long-running agents: clearing, compaction, memory and sub-agents](https://balazscsorba.com/blog/context-rot-compaction-long-running-agents) Why LLM accuracy drops as context grows, and how clearing tool results, compaction, notes and sub-agents keep long-running agents on track. - Context rot - Compaction - [Context engineering](https://balazscsorba.com/blog/tag/context-engineering) - ![PDF parsing for RAG: a document goes through a roller machine and comes out as separate table, picture and text cards.](https://balazscsorba.com/images/blog/pdf-document-parsing-for-rag/cover.webp?v=e2830872bc) Retrieval & search October 16, 2026·9 min read ## [PDF parsing for RAG: layout pipelines, OCR and vision models compared](https://balazscsorba.com/blog/pdf-document-parsing-for-rag) Why PDF parsing decides RAG quality, how Docling, Marker, MinerU and VLM OCR differ, and how to test a parser on your own documents. - [RAG](https://balazscsorba.com/blog/tag/rag) - PDF parsing - OCR - ![Multilingual RAG for German and Hungarian: a person carries a book across a small bridge between two bookshelves.](https://balazscsorba.com/images/blog/multilingual-rag-german-hungarian/cover.webp?v=9929935ec2) Retrieval & search October 16, 2026·7 min read ## [Multilingual RAG for German and Hungarian: embeddings, compounds and cross-lingual search](https://balazscsorba.com/blog/multilingual-rag-german-hungarian) How to build RAG over German and Hungarian content: multilingual embeddings, compound words, stemming, accents and per-language evals. - [RAG](https://balazscsorba.com/blog/tag/rag) - Multilingual - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - ![Text-to-SQL guardrails: a speech bubble enters a database cylinder through a barred window, a padlock on the door.](https://balazscsorba.com/images/blog/text-to-sql-llm-guardrails/cover.webp?v=f8c4d00741) Retrieval & search October 16, 2026·8 min read ## [Text-to-SQL with LLMs: schema context, read-only roles and validation that holds](https://balazscsorba.com/blog/text-to-sql-llm-guardrails) How accurate text-to-SQL really is, how to give the model schema context, and the database and code guardrails that keep generated SQL safe. - Text-to-SQL - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - PostgreSQL - ![Slopsquatting: a robot reaches for a hollow parcel with a hook, a real parcel on the shelf behind.](https://balazscsorba.com/images/blog/slopsquatting-ai-package-hallucinations/cover.webp?v=cb12a1c4b2) Security & compliance October 16, 2026·6 min read ## [Slopsquatting: when coding agents install packages that do not exist](https://balazscsorba.com/blog/slopsquatting-ai-package-hallucinations) How LLMs hallucinate package names, how attackers register them, and the registry, lockfile and agent-harness controls that stop the install. - Supply chain security - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - npm - ![Multilingual SEO with Nuxt i18n: a signpost with three arrows points to three houses, a globe at its foot.](https://balazscsorba.com/images/blog/nuxt-i18n-multilingual-seo-hreflang/cover.webp?v=dd59702ee2) Web engineering October 16, 2026·8 min read ## [Multilingual SEO with Nuxt i18n: URL strategy, hreflang, canonicals and sitemaps](https://balazscsorba.com/blog/nuxt-i18n-multilingual-seo-hreflang) How to set up Nuxt i18n so search engines index every language: routing strategy, useLocaleHead, hreflang rules, partial translations and sitemaps. - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - i18n - SEO - ![Browser agents for E2E testing: a robot writes with a pencil in front of a browser window with a theatre mask.](https://balazscsorba.com/images/blog/browser-agents-e2e-testing-playwright/cover.webp?v=fe25fda57c) AI agents October 16, 2026·7 min read ## [Browser agents for E2E testing: let agents write Playwright tests, not run them](https://balazscsorba.com/blog/browser-agents-e2e-testing-playwright) Where AI agents help with end-to-end tests: Playwright planner, generator and healer, MCP or CLI, and the guardrails that keep healed tests honest. - Playwright - E2E testing - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - ![Semantic caching for LLM apps: a hand hands in a ticket at a coat check and gets back a coat from the hooks.](https://balazscsorba.com/images/blog/semantic-caching-llm-responses/cover.webp?v=ed3e4749c2) LLMOps & evals October 16, 2026·6 min read ## [Semantic caching for LLM apps: when reusing answers is safe, and when it is not](https://balazscsorba.com/blog/semantic-caching-llm-responses) How semantic caches reuse LLM answers for similar questions, how they differ from prompt caching, and how to avoid wrong hits, leaks and stale answers. - Semantic cache - LLM cost - Latency - ![Embedding quantization and Matryoshka: nesting dolls stand in a row from large to small, the smallest on a scale.](https://balazscsorba.com/images/blog/embedding-quantization-binary-matryoshka/cover.webp?v=a3e9b69426) Retrieval & search October 16, 2026·5 min read ## [Embedding quantization: binary, int8 and Matryoshka vectors without losing retrieval quality](https://balazscsorba.com/blog/embedding-quantization-binary-matryoshka) How binary and int8 quantization and Matryoshka truncation shrink vector indexes 4 to 32 times, what they cost in recall, and how rescoring wins it back. - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - Quantization - ![RAG knowledge base poisoning: a hand covers a well while a small bottle drips toward it.](https://balazscsorba.com/images/blog/rag-poisoning-knowledge-base-attacks/cover.webp?v=489c0e8685) Security & compliance October 16, 2026·6 min read ## [RAG poisoning: how a few documents can steer your assistant, and how to defend the knowledge base](https://balazscsorba.com/blog/rag-poisoning-knowledge-base-attacks) How attackers plant documents that RAG systems retrieve, what PoisonedRAG and OWASP show, and the ingestion, retrieval and answer controls that limit it. - RAG security - Data poisoning - Prompt injection - ![Denial of wallet on LLM endpoints: a turnstile slows a queue of tiny robots heading for an open wallet.](https://balazscsorba.com/images/blog/llm-endpoint-abuse-denial-of-wallet/cover.webp?v=0e7196785e) Web engineering October 16, 2026·14 min read ## [Denial of wallet: protecting public LLM endpoints in a Nuxt app](https://balazscsorba.com/blog/llm-endpoint-abuse-denial-of-wallet) How to stop abuse and runaway cost on a public LLM route in Nuxt: auth, per-user rate limits, prompt caps, token budgets, Turnstile and spend limits. - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - Rate limiting - ![A2A protocol: two robots shake hands across a table, each holding up an identity card.](https://balazscsorba.com/images/blog/a2a-protocol-agent-interoperability/cover.webp?v=801b7c5573) AI agents October 16, 2026·12 min read ## [The A2A protocol explained: agent cards, tasks, and where it fits next to MCP](https://balazscsorba.com/blog/a2a-protocol-agent-interoperability) What the Agent2Agent protocol standardizes in v1.0: agent cards, tasks, bindings, security, how it differs from MCP, and when it is worth using. - A2A - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - [MCP](https://balazscsorba.com/blog/tag/mcp) - ![AI copilot for B2B sales reps: a tall card with a small helper panel floating at its shoulder, a headset on the left.](https://balazscsorba.com/images/blog/sales-rep-ai-copilot-b2b/cover.webp?v=c72f10132b) AI agents October 15, 2026·10 min read ## [An AI copilot for B2B sales reps: account context, quotes and approvals](https://balazscsorba.com/blog/sales-rep-ai-copilot-b2b) How to build an internal AI copilot for B2B sales reps: the account data it needs, per-rep permissions, approval gates, KPIs and the works council. - AI copilot - B2B sales - Quotes - ![Buyer-side procurement agents: three cards slide toward a basket, a gate with a check lets one through.](https://balazscsorba.com/images/blog/procurement-agent-buyer-side/cover.webp?v=8d8d5bcb87) Web engineering October 15, 2026·9 min read ## [Agentic commerce readiness: what buyer-side procurement agents need from your B2B shop](https://balazscsorba.com/blog/procurement-agent-buyer-side) What a B2B shop must expose so buyer-side procurement agents can find, compare and order: product data, price truth, quotes, identity and protocols. - Agentic commerce - Procurement - B2B shop - ![RFQ automation with LLMs: a sheet leaves an envelope and becomes a sealed document via a small gear.](https://balazscsorba.com/images/blog/llm-rfq-quote-automation/cover.webp?v=6b2d457fcb) Web engineering October 14, 2026·8 min read ## [RFQ automation with LLMs: parsing, part matching and human review](https://balazscsorba.com/blog/llm-rfq-quote-automation) How to automate RFQ handling with LLMs: document intake, line extraction, part-number matching, contract pricing and a review queue that stays fast. - RFQ - Quote automation - [Document AI](https://balazscsorba.com/blog/tag/document-ai) - ![Email order entry automation: envelopes unfold into tidy rows on a clipboard that point to a box.](https://balazscsorba.com/images/blog/b2b-email-order-entry-llm/cover.webp?v=ca0b45ff5b) Web engineering October 14, 2026·9 min read ## [Email order entry automation: turning emailed orders into ERP orders](https://balazscsorba.com/blog/b2b-email-order-entry-llm) How to automate B2B order entry from email with LLMs: reliable mailbox intake, line extraction, validation rules as code, idempotency and GDPR. - Order entry - ERP - [Document AI](https://balazscsorba.com/blog/tag/document-ai) - ![After-sales agent for RMA and spare parts: a spare part rises from an open box, with a return arrow from a parcel.](https://balazscsorba.com/images/blog/aftersales-agent-rma-spare-parts/cover.webp?v=ad1c4b877a) AI agents October 13, 2026·8 min read ## [AI agent for after-sales service: RMA, spare parts and exact-match rules](https://balazscsorba.com/blog/aftersales-agent-rma-spare-parts) AI agent for after-sales service: serial number to spare part, RMA drafting, manual RAG, and the rule that identifiers only come from tools. - After-sales - Spare parts - RMA - ![AI in the B2B customer portal: a portal window with three tiles and a small speech bubble over one of them.](https://balazscsorba.com/images/blog/b2b-customer-portal-ai/cover.webp?v=0b114e19db) Web engineering October 13, 2026·8 min read ## [AI in the B2B customer portal: orders, invoices and reorders](https://balazscsorba.com/blog/b2b-customer-portal-ai) AI agent for a B2B customer portal: live order, invoice and reorder data, per-user permissions, the cache boundary and honest deflection metrics. - Customer portal - Self-service - Permissions - ![PIM data quality with LLMs: a table of rows with a magnifying glass over the one incomplete row.](https://balazscsorba.com/images/blog/pim-data-quality-llm/cover.webp?v=a259cbf833) Web engineering October 12, 2026·8 min read ## [PIM data quality with LLMs: ETIM classification, normalization and dedup](https://balazscsorba.com/blog/pim-data-quality-llm) How to raise PIM data quality with LLMs: ETIM and ECLASS classification, unit and language normalization, duplicate detection and a stewardship queue. - [PIM](https://balazscsorba.com/blog/tag/pim) - Data quality - ETIM - ![Supplier data onboarding with LLMs: mixed sheets pass through a funnel and come out as identical cards.](https://balazscsorba.com/images/blog/supplier-data-onboarding-llm/cover.webp?v=593e5aacb2) Web engineering October 12, 2026·9 min read ## [Supplier data onboarding with LLMs: price lists, PDFs and certificates](https://balazscsorba.com/blog/supplier-data-onboarding-llm) How to onboard supplier product data with LLMs: deterministic BMEcat and Excel imports, PDF price list extraction, GTIN validation and supplier scorecards. - Supplier onboarding - [PIM](https://balazscsorba.com/blog/tag/pim) - BMEcat - ![Self-hosted LLMs under GDPR: a server rack inside a locked house next to a piggy bank and coins.](https://balazscsorba.com/images/blog/self-hosted-llm-gdpr-cost/cover.webp?v=3d02df3933) LLMOps & evals October 9, 2026·10 min read ## [Self-hosting LLMs for GDPR: when it is required and what it costs](https://balazscsorba.com/blog/self-hosted-llm-gdpr-cost) Self-hosting an LLM for GDPR: when it is required, GPU memory for open-weight models, EU prices as of October 2026 and break-even per million tokens. - [Self-hosting](https://balazscsorba.com/blog/tag/self-hosting) - [GDPR](https://balazscsorba.com/blog/tag/gdpr) - vLLM - ![OpenCode review: an open toolbox beside a terminal window, a row of different batteries next to it.](https://balazscsorba.com/images/blog/opencode/cover.webp?v=f6b2dabb93) AI agents October 9, 2026·8 min read ## [OpenCode review: the open-source coding agent for any model](https://balazscsorba.com/blog/opencode) OpenCode is an MIT-licensed terminal coding agent for any model, hosted or local. Agents, permissions, MCP and LSP, plus the data-protection trade-offs. - AI coding agent - Terminal - [Open source](https://balazscsorba.com/blog/tag/open-source) - ![Digital Product Passports with LLMs: a product box with a code tag next to an open passport booklet.](https://balazscsorba.com/images/blog/digital-product-passport-llm/cover.webp?v=da895cd1b4) Web engineering October 9, 2026·9 min read ## [Digital Product Passports with LLMs: extracting and assembling ESPR data](https://balazscsorba.com/blog/digital-product-passport-llm) Where the Digital Product Passport stands in October 2026, which data a DPP record needs, and how LLMs extract supplier evidence without inventing values. - Digital Product Passport - ESPR - Compliance data - ![ERP integration error triage agent: a pipe with a warning at one joint, cards sorted into a tray below.](https://balazscsorba.com/images/blog/erp-integration-error-agent/cover.webp?v=9ef6cd8855) AI agents October 9, 2026·8 min read ## [An agent that triages ERP integration errors: taxonomy, runbooks and safe retries](https://balazscsorba.com/blog/erp-integration-error-agent) How to build an agent for ERP integration error handling: an error taxonomy from IDoc and OData contracts, allowlisted runbooks, safe retries and dedup. - ERP integration - SAP - Error handling - ![Secrets handling for coding agents: a robot types at a laptop next to a key locked in a glass box.](https://balazscsorba.com/images/blog/coding-agent-secrets-hygiene/cover.webp?v=1b6d517d7e) Security & compliance October 8, 2026·11 min read ## [Coding agents and secrets: keep keys out of context, logs and commits](https://balazscsorba.com/blog/coding-agent-secrets-hygiene) How secrets leak through coding agents, and the controls that stop them: deny reads, a sandbox, pre-commit scans, push protection, OIDC and rotation. - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - Secrets management - [Claude Code](https://balazscsorba.com/blog/tag/claude-code) - ![Pydantic AI review: a robot drops shaped blocks into a shape sorter with a small snake curled around it.](https://balazscsorba.com/images/blog/pydantic-ai/cover.webp?v=c21330dd81) AI agents October 8, 2026·8 min read ## [Pydantic AI review: typed Python agents with validated output](https://balazscsorba.com/blog/pydantic-ai) Pydantic AI 2.55: typed dependencies, validated output and OpenTelemetry tracing for Python agents. What 2.0 changed, Logfire costs, who should pick it. - Agent framework - Typed Python - Structured output - ![Punchout catalogs (cXML, OCI): a cart travels from one building to another and returns filled.](https://balazscsorba.com/images/blog/b2b-punchout-cxml-oci/cover.webp?v=4efd40a332) Web engineering October 8, 2026·8 min read ## [Punchout catalogs explained: cXML, SAP OCI and the round trip to the buyer’s ERP](https://balazscsorba.com/blog/b2b-punchout-cxml-oci) How punchout catalogs work: the cXML PunchOut and SAP OCI round trips, Secure OCI, what a supplier shop must implement, and when to buy a gateway. - Punchout - cXML - SAP OCI - ![Order sync between shop and ERP: two boxes joined by a loop of arrows carrying an envelope and a receipt.](https://balazscsorba.com/images/blog/b2b-order-sync-erp/cover.webp?v=189dd9c716) Web engineering October 8, 2026·8 min read ## [Order sync between shop and ERP: SAP APIs, idempotency and reconciliation](https://balazscsorba.com/blog/b2b-order-sync-erp) How to sync orders between a B2B shop and the ERP: SAP OData, IDoc and BAPI options, the outbox pattern, idempotency keys and routine reconciliation. - ERP integration - SAP - Idempotency - ![llms.txt vs Markdown content negotiation: a robot at a counter reaches past a short menu card for a full page.](https://balazscsorba.com/images/blog/llms-txt-vs-markdown-content-negotiation/cover.webp?v=fcca157595) Web engineering October 7, 2026·9 min read ## [llms.txt vs Markdown content negotiation: what agents actually fetch](https://balazscsorba.com/blog/llms-txt-vs-markdown-content-negotiation) llms.txt is a proposal, Markdown content negotiation is a header. What AI agents fetch, what the logs show, and how to serve both from Nuxt and nginx. - llms.txt - Content negotiation - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - ![Gemini CLI review: twin robots stand at a terminal next to a coin slot box.](https://balazscsorba.com/images/blog/gemini-cli/cover.webp?v=d0b176e9ff) AI agents October 7, 2026·9 min read ## [Gemini CLI review: open source, but no longer free for individuals](https://balazscsorba.com/blog/gemini-cli) Gemini CLI review: Apache-2.0 and still releasing, but the free individual route closed on 18 June 2026. Left: Code Assist, billed API keys and Vertex AI. - Terminal agent - Gemini - [MCP](https://balazscsorba.com/blog/tag/mcp) - ![Temporal review: a robot holds a bookmark in an open book beside a grandfather clock.](https://balazscsorba.com/images/blog/temporal/cover.webp?v=a74a60158b) AI agents October 7, 2026·8 min read ## [Temporal review: durable agents that survive crashes and wait for people](https://balazscsorba.com/blog/temporal) Temporal: agent loops as durable workflows, so retries, approvals and timers survive crashes. Costs, data residency, determinism, when to skip it. - Durable execution - Workflow orchestration - Human in the loop - ![B2B pricing engines: four price tags in a descending staircase, the first one highlighted.](https://balazscsorba.com/images/blog/b2b-pricing-engine/cover.webp?v=54c520d58e) Web engineering October 7, 2026·12 min read ## [B2B pricing engines: customer-specific prices, caching and audits](https://balazscsorba.com/blog/b2b-pricing-engine) How B2B platforms resolve customer-specific prices, how to cache them without leaks, explain them in a dispute, test them and round VAT. - Pricing - Spryker - SAP - ![RFQ and quote management in B2B: three document versions in a row with a clock above the last.](https://balazscsorba.com/images/blog/b2b-rfq-quote-management/cover.webp?v=64a6dc0c5f) Web engineering October 7, 2026·12 min read ## [RFQ and quote management in B2B: workflow, versioning and order conversion](https://balazscsorba.com/blog/b2b-rfq-quote-management) How to design RFQ and quote management in B2B: states, versioned quotes, price overrides, expiry rules, order conversion and a build checklist. - B2B quotes - RFQ workflow - Quote versioning - ![Zep review: a robot studies a wall chart of linked cards, each card with a tiny clock.](https://balazscsorba.com/images/blog/zep/cover.webp?v=0e30ba74e9) Retrieval & search October 6, 2026·11 min read ## [Zep review: agent memory on a temporal graph](https://balazscsorba.com/blog/zep) Zep: a hosted agent-memory API on a temporal knowledge graph. Credits on writes, free retrieval, Flex from $125/month, Graphiti as the self-hostable part. - Agent memory - Knowledge graph - Temporal graph - ![DeepEval review: a judge's gavel beside a rack of test tubes and an open coin purse.](https://balazscsorba.com/images/blog/deepeval/cover.webp?v=c2bb047fd3) LLMOps & evals October 6, 2026·8 min read ## [DeepEval review: pytest for LLM outputs, and the judge bill](https://balazscsorba.com/blog/deepeval) DeepEval: LLM checks as pytest-style tests with built-in judge metrics. The library is free and Apache-2.0; judge calls and data flow are the real cost. - LLM evaluation - pytest - LLM-as-a-judge - ![DSPy review: a robot cranks a machine that smooths a crumpled page, a target board above it.](https://balazscsorba.com/images/blog/dspy/cover.webp?v=d641e4605d) LLMOps & evals October 6, 2026·8 min read ## [DSPy review: compile your prompts against a metric, not by hand](https://balazscsorba.com/blog/dspy) DSPy compiles prompts from signatures, a metric and examples: what its optimisers cost in model calls, and when a hand-written prompt still wins. - Prompt optimisation - LLM programs - MIPROv2 - ![LLM product data enrichment: a plain product card becomes a filled card with tags.](https://balazscsorba.com/images/blog/llm-product-data-enrichment/cover.webp?v=e92590a777) Web engineering October 6, 2026·12 min read ## [LLM product data enrichment: attributes, evidence and review](https://balazscsorba.com/blog/llm-product-data-enrichment) Grounded LLM enrichment for PIM attributes and copy: source spans, schema-checked output, confidence routing, provenance and cost per 1,000 SKUs. - Product data enrichment - [PIM](https://balazscsorba.com/blog/tag/pim) - Structured outputs - ![Shop search analytics: a magnifying glass beside a bar chart with one empty bar.](https://balazscsorba.com/images/blog/shop-search-analytics/cover.webp?v=99a845a050) Web engineering October 6, 2026·10 min read ## [Shop search analytics: what to log, and the zero-result fixes to ship first](https://balazscsorba.com/blog/shop-search-analytics) Instrument on-site search with one event schema, five metrics with targets, position-bias-aware reading, a weekly zero-result review and GDPR limits. - Search analytics - Zero-result search - Position bias - ![Multiplayer sailing game in three.js: two matching wavy rails parallel across the frame, a half-divided circle above them.](https://balazscsorba.com/images/blog/multiplayer-sailing-game-threejs/dusk.webp?v=08d19ae5fb) Web engineering October 5, 2026·8 min read ## [Building a multiplayer 3D sailing game with plain three.js](https://balazscsorba.com/blog/multiplayer-sailing-game-threejs) Multiplayer 3D sailing in plain three.js: Gerstner waves shared by GPU and CPU, one sky function for sky, water and fog, and a tiny WebSocket relay. - three.js - WebGL - GLSL - ![llama.cpp review: a llama with a cog stands on a desk beside a computer tower.](https://balazscsorba.com/images/blog/llama-cpp/cover.webp?v=9a63fbfcd0) LLMOps & evals October 5, 2026·8 min read ## [llama.cpp review: the local engine under Ollama and LM Studio](https://balazscsorba.com/blog/llama-cpp) llama.cpp runs open models in plain C and C++ on Metal, CUDA, Vulkan or the CPU. I cover GGUF quants, llama-server and where it falls short. - llama.cpp - GGUF - Quantisation - ![Opik review: binoculars on a stack of notebooks, a cloud above a flag in the background.](https://balazscsorba.com/images/blog/opik/cover.webp?v=0a42152dac) LLMOps & evals October 5, 2026·7 min read ## [Opik review: open-source tracing and evals, with a US-hosted cloud](https://balazscsorba.com/blog/opik) Opik: traces, LLM-as-a-judge metrics, prompt versions and an optimiser on one Apache 2.0 platform. Free to self-host, Pro cloud $19/month, US-hosted. - [LLM observability](https://balazscsorba.com/blog/tag/llm-observability) - [Tracing](https://balazscsorba.com/blog/tag/tracing) - [Evaluation](https://balazscsorba.com/blog/tag/evaluation) - ![Visual search for B2B shops: a camera photographs a part and finds the matching tile in a grid.](https://balazscsorba.com/images/blog/visual-search-shop/cover.webp?v=82e461e217) Web engineering October 5, 2026·11 min read ## [Visual search for B2B shops: image embeddings, part numbers and honest limits](https://balazscsorba.com/blog/visual-search-shop) Visual search for a B2B shop: image embeddings, OCR of part numbers, image-to-text lookups, hybrid filters, cost and evaluation on your own photos. - Visual search - Image embeddings - OCR - ![Nuxt caching for headless commerce: a page slides out of stacked cache trays, with a clock at the side.](https://balazscsorba.com/images/blog/nuxt-caching-isr-commerce/cover.webp?v=ac033b020d) Web engineering October 5, 2026·11 min read ## [Caching a headless commerce front end in Nuxt: route rules, ISR and purge](https://balazscsorba.com/blog/nuxt-caching-isr-commerce) Caching a headless commerce front end in Nuxt: route rules, Nitro and CDN keys, ISR limits, tag purge, and keeping customer prices out of shared caches. - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - Caching - ISR - ![Knowledge-graph RAG: a magnifier over a road junction on a town map, a loose paper pile to the side.](https://balazscsorba.com/images/blog/graphrag-knowledge-graph-rag/cover.webp?v=fa0a23a3d5) Retrieval & search October 2, 2026·13 min read ## [GraphRAG and knowledge-graph RAG: when a graph beats vector search](https://balazscsorba.com/blog/graphrag-knowledge-graph-rag) Microsoft GraphRAG and LightRAG: what indexing costs, and when a knowledge graph beats vector RAG for multi-hop, global questions and product catalogues. - GraphRAG - Knowledge graphs - LightRAG - ![AI coding tools and the works council: a meeting table with a laptop below a wall camera covered by a cloth.](https://balazscsorba.com/images/blog/works-council-ai-tools-austria-germany/cover.webp?v=32dc4c118d) Security & compliance October 2, 2026·11 min read ## [AI coding tools and the works council: when usage logs count as monitoring](https://balazscsorba.com/blog/works-council-ai-tools-austria-germany) Usage logs can make an AI coding tool a monitoring system. What Austria (§ 96 ArbVG) and Germany (§ 87 BetrVG) require, and what to agree before rollout. - Works council - AI coding tools - Employee monitoring - ![E2B review: a robot builds with blocks inside a glass cube, a stopwatch on the outside.](https://balazscsorba.com/images/blog/e2b/cover.webp?v=358cc8fb38) AI agents October 2, 2026·12 min read ## [E2B review: Firecracker sandboxes for agent code, billed per second](https://balazscsorba.com/blog/e2b) E2B gives each agent run its own Firecracker microVM, billed per second. Where it fits, what the EU option costs, and where self-hosting stops. - Code sandbox - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - Firecracker - ![Nuxt Security module: a shield with three locks guards a browser window.](https://balazscsorba.com/images/blog/nuxt-security-module/cover.webp?v=e2f8a194e0) Web engineering October 2, 2026·11 min read ## [Locking down a Nuxt app: CSP, headers and rate limits with Nuxt Security](https://balazscsorba.com/blog/nuxt-security-module) How the Nuxt Security module behaves in practice: safe defaults, strict mode trade-offs, nonce CSP in SSR and SSG, route rules and limits. - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - Content Security Policy - HTTP security headers - ![Accessible Vue components: a dialog with a focus ring on one button, a tab key and a speaker beside it.](https://balazscsorba.com/images/blog/vue-accessible-components/cover.webp?v=39acedf83b) Web engineering October 2, 2026·12 min read ## [Accessible Vue components: the WCAG 2.2 patterns automated tests miss](https://balazscsorba.com/blog/vue-accessible-components) Component-level WCAG 2.2 patterns for Vue and Nuxt: focus in modals and Teleport, live regions, comboboxes, what axe-core misses, and a test ladder. - Vue accessibility - WCAG 2.2 - Focus management - ![EU AI Act deadlines: a robot walks along a timeline rope with three tags above a warning sign.](https://balazscsorba.com/images/blog/eu-ai-act-gpai-high-risk-2026/cover.webp?v=535372d06f) Security & compliance October 2, 2026·12 min read ## [EU AI Act beyond Article 50: GPAI, high-risk dates and what to do now](https://balazscsorba.com/blog/eu-ai-act-gpai-high-risk-2026) EU AI Act after the Digital Omnibus: GPAI duties, high-risk dates of 2 Dec 2027 and 2 Aug 2028, provider vs deployer on OpenAI and Anthropic, AI literacy. - EU AI Act - GPAI - High-risk AI - ![Local text-to-speech at scale: a stack of books beside a small computer with a row of headphones on hooks.](https://balazscsorba.com/images/blog/local-text-to-speech-pipeline/cover.webp?v=340fe92a97) LLMOps & evals October 1, 2026·11 min read ## [Local text-to-speech at scale: narrating 96 articles with open models](https://balazscsorba.com/blog/local-text-to-speech-pipeline) Three open TTS models on one laptop: 96 articles became 1,512 minutes of narration, via chunked synthesis and AAC at 192 kbit/s. - Text-to-speech - Audio - Kokoro - ![AI-assisted development economics: a balance scale weighs one person with two robots against a group of four people.](https://balazscsorba.com/images/blog/ai-assisted-development-economics/cover.webp?v=625f306904) AI agents October 1, 2026·11 min read ## [One senior with coding agents versus a team: what the evidence says](https://balazscsorba.com/blog/ai-assisted-development-economics) AI coding economics: what the METR, DORA, Microsoft and GitHub studies show, what they do not prove, and a break-even model for one senior vs a team. - AI coding agents - Developer productivity - Engineering economics - ![DPIA for an LLM support assistant: a clipboard form next to a robot with a speech bubble, a magnifier and a stamp.](https://balazscsorba.com/images/blog/dpia-llm-feature-worked-example/cover.webp?v=fc85bddcc1) Security & compliance October 1, 2026·12 min read ## [DPIA for an LLM support assistant: a worked example under GDPR Art. 35](https://balazscsorba.com/blog/dpia-llm-feature-worked-example) A worked DPIA under GDPR Art. 35 for an AI assistant that drafts customer email replies from order data: when it is needed, the risks and owners. - DPIA - [GDPR](https://balazscsorba.com/blog/tag/gdpr) - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - ![Multimodal RAG with ColPali: a page split into small patches, a few linked to a magnifying glass.](https://balazscsorba.com/images/blog/multimodal-rag-colpali/cover.webp?v=daa8781cdf) Retrieval & search October 1, 2026·10 min read ## [Multimodal RAG with ColPali: page images, multi-vector costs, and when they win](https://balazscsorba.com/blog/multimodal-rag-colpali) Multimodal RAG with ColPali: page-image embeddings, MaxSim scoring, multi-vector storage costs, compression options and when they beat parsed text. - ColPali - Multimodal RAG - Late interaction - ![RAG over code repositories: a branching code tree feeds a row of index cards.](https://balazscsorba.com/images/blog/code-rag-repository-indexing/cover.webp?v=ba771e90f4) Retrieval & search October 1, 2026·8 min read ## [RAG over code: AST chunking, repo maps and code embeddings that fit an agent](https://balazscsorba.com/blog/code-rag-repository-indexing) How coding agents find code: AST chunking with tree-sitter, repo maps, Merkle-tree index sync, code embedding models in 2026, and when grep beats an index. - [RAG](https://balazscsorba.com/blog/tag/rag) - Code search - Tree-sitter - ![Spec-driven development: a person and a robot shake hands over a blueprint, building blocks waiting nearby.](https://balazscsorba.com/images/blog/spec-driven-development-coding-agents/cover.webp?v=2be9ec0ee6) AI agents September 30, 2026·11 min read ## [Spec-driven development for coding agents: agree the plan before the code](https://balazscsorba.com/blog/spec-driven-development-coding-agents) Vibe coding breaks on real codebases. Write a spec with acceptance criteria, a plan and tasks, let the agent tick them off, and agree it before any code. - Spec-driven development - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Acceptance criteria - ![Browserbase and Stagehand: a robot holding a key tag stands on a theatre stage in front of a browser window.](https://balazscsorba.com/images/blog/browserbase-stagehand/cover.webp?v=e9aebfac58) Web engineering September 30, 2026·10 min read ## [Browserbase and Stagehand reviewed: rented Chrome for AI agents](https://balazscsorba.com/blog/browserbase-stagehand) Browserbase rents managed Chrome per minute and Stagehand adds natural-language steps. What it costs, where the meters run and when plain Playwright wins. - Browser automation - Web agents - Headless browsers - ![WebMCP: a hand passes a toolbox out of a browser window to a waiting robot.](https://balazscsorba.com/images/blog/webmcp/cover.webp?v=69bb046b85) Web engineering September 30, 2026·11 min read ## [WebMCP: publishing tools instead of pixels](https://balazscsorba.com/blog/webmcp) WebMCP lets a page publish typed, callable tools to an in-browser agent. What the standard does, how much ships today, and when a plain MCP server wins. - WebMCP - Agent tools - JSON Schema - ![Cross-encoder rerankers compared: a funnel narrows many cards to five, and one card is lifted to the front.](https://balazscsorba.com/images/blog/reranking-models-compared/cover.webp?v=6c51704102) Retrieval & search September 30, 2026·8 min read ## [Cross-encoder rerankers compared: Cohere, bge, Voyage, Jina and late interaction (2026)](https://balazscsorba.com/blog/reranking-models-compared) Rerankers in October 2026: pointwise, listwise and late interaction, Cohere, Voyage, bge, Qwen3, Jina and mxbai, prices, self-hosting and choosing k. - Reranking - [RAG](https://balazscsorba.com/blog/tag/rag) - Search - ![Elasticsearch and OpenSearch kNN: a cabinet with a text drawer and a vector drawer, searched by one magnifying glass.](https://balazscsorba.com/images/blog/elasticsearch-opensearch-vector-search/cover.webp?v=eefa64abde) Retrieval & search September 30, 2026·8 min read ## [Vector search in Elasticsearch and OpenSearch: kNN, hybrid search and the license story](https://balazscsorba.com/blog/elasticsearch-opensearch-vector-search) Vector search in Elasticsearch and OpenSearch: kNN and filters, BBQ and binary quantization, RRF hybrid search, GPU builds, and AGPL vs Apache licensing. - Elasticsearch - OpenSearch - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - ![OpenAI dots and always-on agents: a lighthouse glows steadily over a calm sea under both sun and moon.](https://balazscsorba.com/images/blog/openai-dots-always-on-agents-impact/cover.webp?v=870760656a) AI agents September 30, 2026·14 min read ## [OpenAI dots: what always-on agents will change, and what they will not](https://balazscsorba.com/blog/openai-dots-always-on-agents-impact) OpenAI dots: always-on GPT-6 Astra agents with their own computer. What launched, how the safeguards work, and what changes for work, IT, SaaS and Europe. - OpenAI dots - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - GPT-6 Astra - ![Ollama review: a llama sits on a sofa in a cosy living room with a laptop.](https://balazscsorba.com/images/blog/ollama/cover.webp?v=5b5f97148e) LLMOps & evals September 29, 2026·11 min read ## [Ollama review: the friendly way to run open models](https://balazscsorba.com/blog/ollama) Ollama serves open models over one HTTP API on your own hardware. What it does well, where throughput falls short, and what the MIT licence does not cover. - Local inference - Open models - llama.cpp - ![Guardrails AI: a small car drives along a winding mountain road protected by a guardrail.](https://balazscsorba.com/images/blog/guardrails-ai/cover.webp?v=edea60ca90) Security & compliance September 29, 2026·10 min read ## [Guardrails AI: validating what the model returns](https://balazscsorba.com/blog/guardrails-ai) A review of Guardrails AI: 65 hub validators, eight on-fail actions, the August 2026 shutdown of hosted inferencing, and when NeMo Guardrails fits better. - [Guardrails](https://balazscsorba.com/blog/tag/guardrails) - Output validation - LLM reliability - ![turbopuffer review: a large storage bucket below and a small cache tray above that pulls up a few cards.](https://balazscsorba.com/images/blog/turbopuffer/cover.webp?v=e4fb597603) Retrieval & search September 29, 2026·8 min read ## [turbopuffer review: vector search built on object storage, and what it costs per query](https://balazscsorba.com/blog/turbopuffer) turbopuffer reviewed: object storage as the source of truth, SPFresh and RaBitQ, hybrid search, per-GB pricing against Pinecone, and when it wins. - turbopuffer - Vector database - Object storage - ![Table extraction for RAG: a table on a page becomes separate row strips that each keep a header tab.](https://balazscsorba.com/images/blog/table-extraction-rag/cover.webp?v=f01f64155f) Retrieval & search September 29, 2026·8 min read ## [Table extraction for RAG: extraction layers, serialization and queries that hold](https://balazscsorba.com/blog/table-extraction-rag) Tables in RAG: why chunking breaks them, pdfplumber, Camelot, Docling and cloud extractors, what TEDS misses, serialization, and routing questions to SQL. - [RAG](https://balazscsorba.com/blog/tag/rag) - Tables - Document parsing - ![Home Assistant EV charging on EPEX: an electric car charges at night in a carport, a piggy bank beside the charger.](https://balazscsorba.com/images/blog/home-assistant-ev-charging-energy-manager/cover.webp?v=685500f745) Web engineering September 29, 2026·9 min read ## [Charging on EPEX Austria prices: what my Home Assistant app saves](https://balazscsorba.com/blog/home-assistant-ev-charging-energy-manager) Home Assistant on EPEX Austria prices, replayed hourly for a Tesla and a boiler: cheapest-hour charging at 6.5 vs 18.9 ct/kWh, saving about €590 a year. - Home Assistant - EPEX Spot - Energy prices - ![Portkey LLM gateway: a harbour gate with a lighthouse guides small boats into different channels.](https://balazscsorba.com/images/blog/portkey/cover.webp?v=72e0af9243) LLMOps & evals September 28, 2026·11 min read ## [Portkey: a production LLM gateway, reviewed for routing, guardrails and cost](https://balazscsorba.com/blog/portkey) Portkey: an OpenAI-compatible gateway for retries, fallbacks, caching, guardrails and cost tracking. Its config, latency cost and when to self-host. - LLM gateway - [Guardrails](https://balazscsorba.com/blog/tag/guardrails) - Routing - ![Fine-tuning embedding models: loose dots on the left become tight clusters on the right after training.](https://balazscsorba.com/images/blog/embedding-fine-tuning-domain/cover.webp?v=57878bf388) Retrieval & search September 28, 2026·8 min read ## [Fine-tuning embedding models for your domain: hard negatives, losses and evals](https://balazscsorba.com/blog/embedding-fine-tuning-domain) Fine-tuning embedding models for your domain: when it beats a reranker, hard negatives, sentence-transformers v6 losses, Matryoshka, evals and cost. - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - Fine-tuning - [RAG](https://balazscsorba.com/blog/tag/rag) - ![SPLADE learned sparse retrieval: a word strip fans out into many thin bars, a few tall ones feeding an index box.](https://balazscsorba.com/images/blog/splade-learned-sparse-retrieval/cover.webp?v=f3bfc3c3c9) Retrieval & search September 28, 2026·8 min read ## [SPLADE and learned sparse retrieval in practice: BM25, index size, latency](https://balazscsorba.com/blog/splade-learned-sparse-retrieval) Learned sparse retrieval in practice: how SPLADE expands terms, models and licenses, index size and latency, engine support and when it beats BM25. - SPLADE - Sparse retrieval - BM25 - ![MCP reference servers: a cardboard model house on a table next to a real door, blueprints and a ruler.](https://balazscsorba.com/images/blog/mcp-reference-servers/cover.webp?v=d157f58fab) AI agents September 25, 2026·9 min read ## [MCP reference servers: what they demonstrate and what they omit](https://balazscsorba.com/blog/mcp-reference-servers) modelcontextprotocol/servers reviewed: seven reference servers, what each one teaches, their SDK versions, and why none belongs in production. - [MCP](https://balazscsorba.com/blog/tag/mcp) - Reference servers - Tool protocol - ![Knowledge graph extraction with LLMs: nodes leave a stack of pages and form a network where two circles merge into one.](https://balazscsorba.com/images/blog/knowledge-graph-extraction-llm/cover.webp?v=8a8d21666a) Retrieval & search September 25, 2026·8 min read ## [Knowledge graph extraction with LLMs: ontology, entity resolution, provenance](https://balazscsorba.com/blog/knowledge-graph-extraction-llm) Building a knowledge graph with LLMs: a minimal ontology, extraction prompts, entity resolution, provenance, incremental updates, evaluation and storage. - Knowledge graphs - GraphRAG - Entity resolution - ![Incremental indexing and CDC: a database streams changes into a cabinet, with a second cabinet and a switch beside it.](https://balazscsorba.com/images/blog/incremental-indexing-cdc/cover.webp?v=5761ce5458) Retrieval & search September 25, 2026·8 min read ## [Keeping a RAG index fresh: incremental indexing, CDC and blue/green re-embedding](https://balazscsorba.com/blog/incremental-indexing-cdc) Keeping a RAG index current: staleness budgets, dirty tracking, CDC from Postgres with Debezium, deletes and permissions, blue/green swaps and costs. - [RAG](https://balazscsorba.com/blog/tag/rag) - Change data capture - PostgreSQL - ![Aider review: a human hand and a robot hand type on one keyboard beneath a git branch arc.](https://balazscsorba.com/images/blog/aider/cover.webp?v=074243e12c) AI agents September 23, 2026·10 min read ## [Aider review: git-first pair programming in the terminal](https://balazscsorba.com/blog/aider) A review of Aider 0.86.2, an Apache-2.0 terminal pair programmer whose benchmark ranks models honestly and whose release cadence has stopped. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Terminal - Git workflow - ![Claude Opus 5.5 on Artificial Analysis: a trophy on the top step of a podium, with a dial pointing to the middle beside it.](https://balazscsorba.com/images/blog/artificial-analysis-leaderboard-claude-opus-5-5/cover.webp?v=9809c87569) LLMOps & evals September 23, 2026·8 min read ## [Claude Opus 5.5 takes #1 on Artificial Analysis, and medium effort is the real story](https://balazscsorba.com/blog/artificial-analysis-leaderboard-claude-opus-5-5) Claude Opus 5.5 is #1 of 211 models on Artificial Analysis with 58 points. At medium effort it matches Opus 5 for $1.34 per task instead of $5.86. - Claude Opus 5.5 - Artificial Analysis - LLM benchmarks - ![EU AI Act Article 50: a robot with a visible name tag next to a calendar with a circled date and a checklist.](https://balazscsorba.com/images/blog/eu-ai-act-article-50-developer-checklist/cover.webp?v=6c61d94655) Security & compliance September 22, 2026·12 min read ## [EU AI Act Article 50: what developers must do from 2 August 2026](https://balazscsorba.com/blog/eu-ai-act-article-50-developer-checklist) EU AI Act Article 50 from 2 August 2026: AI interaction disclosure, machine-readable marking, deepfakes, provider vs deployer, and a checklist. - EU AI Act - Article 50 - AI transparency - ![LanceDB vector search: shelves of sorted marbles pop up from an open book on a desk.](https://balazscsorba.com/images/blog/lancedb/cover.webp?v=e53871c2e1) Retrieval & search September 21, 2026·9 min read ## [LanceDB: vector search that starts as a library](https://balazscsorba.com/blog/lancedb) LanceDB review: an Apache-2.0 embedded vector library with IVF and HNSW index choices, hybrid search with rank fusion, and what the Enterprise tier adds. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - [Hybrid search](https://balazscsorba.com/blog/tag/hybrid-search) - Embedded database - ![pgvector review: an elephant carries a small chest of drawers with sorted marbles on its back.](https://balazscsorba.com/images/blog/pgvector/cover.webp?v=334488eb5b) Retrieval & search September 21, 2026·10 min read ## [pgvector, reviewed: the vector database you do not have to run](https://balazscsorba.com/blog/pgvector) pgvector 0.8.7: iterative scans for filtered search, HNSW and IVFFlat, binary quantisation at 100M vectors, and the CVE behind an index-build patch. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - Postgres - HNSW - ![Mem0 memory layer: a robot writes notes next to a coin parking meter, sticky notes trailing behind.](https://balazscsorba.com/images/blog/mem0/cover.webp?v=fcb44d79d5) Retrieval & search September 17, 2026·10 min read ## [Mem0: what an agent memory layer costs per turn](https://balazscsorba.com/blog/mem0) Mem0: facts extracted from every turn, the April 2026 benchmark table and its platform-only caveat, four cloud tiers, and what self-hosting leaves out. - Agent memory - Long-term memory - [RAG](https://balazscsorba.com/blog/tag/rag) - ![Typed LLM routing with Jev: a hand sorts an envelope into one of three pigeonholes, a confidence gauge beside it.](https://balazscsorba.com/images/blog/jev-typed-decisions-llm-routing/cover.webp?v=090b0c8576) LLMOps & evals September 17, 2026·10 min read ## [Typed decisions for LLM routing and triage: calibrated confidence with Jev](https://balazscsorba.com/blog/jev-typed-decisions-llm-routing) LLM routing with typed decisions: Choice, Score and yes-probability answers with calibrated confidence, thresholds and human hand-off, using Jev. - LLM routing - Classification - Calibration - ![Headless B2B product configurator: a hand fits a knob onto a machine, interchangeable parts and a price tag beside it.](https://balazscsorba.com/images/blog/headless-product-configurator-b2b/cover.webp?v=1cdaabc950) Web engineering September 14, 2026·12 min read ## [Headless B2B product configurator: rules, pricing and Nuxt on a commerce API](https://balazscsorba.com/blog/headless-product-configurator-b2b) Headless B2B product configurator: rule engine or solver, where rules live, server-side pricing, Nuxt on a commerce API, TYPO3 and 100k+ variants. - Product configurator - [B2B e-commerce](https://balazscsorba.com/blog/tag/b2b-e-commerce) - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - ![OpenAI Agents SDK: a small open toolkit with a few tools, one craft knife with a sharp blade.](https://balazscsorba.com/images/blog/openai-agents-sdk/cover.webp?v=d4e0c59712) AI agents September 11, 2026·10 min read ## [OpenAI Agents SDK: a small agent runtime with sharp edges](https://balazscsorba.com/blog/openai-agents-sdk) A review of the OpenAI Agents SDK: the runner loop, tracing, guardrails and approvals, plus what the release churn and the Responses-only features cost. - Agent runtime - [Tracing](https://balazscsorba.com/blog/tag/tracing) - [Guardrails](https://balazscsorba.com/blog/tag/guardrails) - ![AI agent memory design: a robot files an index card into the open drawer of a three-drawer cabinet.](https://balazscsorba.com/images/blog/ai-agent-memory-design/cover.webp?v=74dbb637eb) AI agents September 10, 2026·13 min read ## [Designing memory for AI agents: tiers, write rules, poisoning and GDPR](https://balazscsorba.com/blog/ai-agent-memory-design) How to design AI agent memory: context vs session vs long-term tiers, what to write and never store, retrieval, compaction, poisoning and GDPR erasure. - AI agent memory - [Context engineering](https://balazscsorba.com/blog/tag/context-engineering) - Memory poisoning - ![OpenHands: two open hands hold up a small robot surrounded by floating gears.](https://balazscsorba.com/images/blog/openhands/cover.webp?v=fe60a0d7ce) AI agents September 9, 2026·9 min read ## [OpenHands: the open-source coding agent you operate](https://balazscsorba.com/blog/openhands) OpenHands 1.25.0: an MIT-licensed coding agent platform with a web canvas, CLI, sandboxed execution and scheduled automations, and where it gets heavy. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Sandboxed execution - Automations - ![Milvus review: a warehouse with tall racks and a forklift, a worker with a wrench at a dial panel.](https://balazscsorba.com/images/blog/milvus-zilliz/cover.webp?v=f1b86f6195) Retrieval & search September 8, 2026·10 min read ## [Milvus review: the most complete vector database to operate](https://balazscsorba.com/blog/milvus-zilliz) Milvus 3.0.2 is the most complete open-source vector database and the heaviest to run: architecture, hybrid search, costs, and where not to use it. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - [Hybrid search](https://balazscsorba.com/blog/tag/hybrid-search) - BM25 full text - ![Microsoft GraphRAG: a corkboard of pinned cards linked by strings, with a price tag on its corner.](https://balazscsorba.com/images/blog/graphrag/cover.webp?v=38a5adc976) Retrieval & search September 8, 2026·10 min read ## [Microsoft GraphRAG: a knowledge-graph RAG priced up front](https://balazscsorba.com/blog/graphrag) A review of Microsoft GraphRAG 3.2.0: MIT, maintenance mode, and an indexing bill that is decided before the first query runs. - Knowledge graph - [RAG](https://balazscsorba.com/blog/tag/rag) - Global search - ![Harness engineering: a robot walks a narrow path with guide rails and sensor posts toward an open gate.](https://balazscsorba.com/images/blog/harness-engineering-coding-agents/cover.webp?v=68ad6d9481) AI agents September 4, 2026·8 min read ## [Harness engineering: guides and sensors that make agent PRs mergeable](https://balazscsorba.com/blog/harness-engineering-coding-agents) Harness engineering for coding agents: guides and sensors, where to run each check, red/green TDD, and mutation testing of the tests the agent wrote. - Harness engineering - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Code quality - ![Cursor review: a large mouse cursor with a price tag and a longer receipt stands beside an editor window.](https://balazscsorba.com/images/blog/cursor/cover.webp?v=c1b706609e) AI agents September 2, 2026·10 min read ## [Cursor reviewed: an AI code editor billed past its sticker price](https://balazscsorba.com/blog/cursor) Cursor bundles an editor, a terminal agent and cloud runs in one plan. What its two usage pools cost, and when Copilot, Claude Code or Cline wins. - AI code editor - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - CLI - ![Prompt injection defense: a saw cuts one leg off a three-legged stool holding a key, an envelope and a door.](https://balazscsorba.com/images/blog/prompt-injection-lethal-trifecta-patterns/cover.webp?v=2298f711d5) Security & compliance September 1, 2026·9 min read ## [Prompt injection defense: the lethal trifecta and six design patterns](https://balazscsorba.com/blog/prompt-injection-lethal-trifecta-patterns) Why prompt injection can't be filtered away: the lethal trifecta, six design patterns that contain it, egress rules and a red-team checklist for AI agents. - Prompt injection - AI agent security - Lethal trifecta - ![Claude Code review: a small robot with a wrench climbs out of a terminal window on a desk.](https://balazscsorba.com/images/blog/claude-code/cover.webp?v=eb7ed80b80) AI agents August 31, 2026·10 min read ## [Claude Code: the terminal coding agent, reviewed](https://balazscsorba.com/blog/claude-code) An engineering review of Claude Code: the extension surface, the real cost per developer, and the exact boundary of the Bash sandbox. - Terminal agent - Hooks - Subagents - ![OpenAI Codex CLI: a robot studies a sheet of toggle switches pinned beside a terminal window.](https://balazscsorba.com/images/blog/openai-codex-cli/cover.webp?v=84daeff04d) AI agents August 31, 2026·11 min read ## [OpenAI Codex CLI: the agent that treats permissions as a config file](https://balazscsorba.com/blog/openai-codex-cli) OpenAI Codex CLI, the open-source terminal coding agent: how its sandbox, approval policy and config.toml work, and what unattended CI runs cost. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Terminal - Sandbox - ![LLM data residency (GDPR): folders stay inside a fenced garden under a ring of stars while a robot leans over the fence.](https://balazscsorba.com/images/blog/gdpr-llm-api-eu-data-residency/cover.webp?v=d927118c61) Security & compliance August 28, 2026·11 min read ## [GDPR LLM data residency: region controls, zero retention, EU options](https://balazscsorba.com/blog/gdpr-llm-api-eu-data-residency) Can an LLM API be GDPR compliant? EU data residency on OpenAI, Claude via Bedrock and Google Cloud, zero data retention, pseudonymisation and self-hosting. - [GDPR](https://balazscsorba.com/blog/tag/gdpr) - Data residency - LLM API - ![Cutting coding-agent tokens: a press shrinks a tall coin stack into a short one, a robot with a trophy beside it.](https://balazscsorba.com/images/blog/token-saving-tools-coding-agents-top-20/cover.webp?v=b70307b15f) AI agents August 26, 2026·17 min read ## [Top 20 ways to cut coding-agent tokens: rtk, lean-ctx, Serena and more, ranked by evidence](https://balazscsorba.com/blog/token-saving-tools-coding-agents-top-20) rtk, lean-ctx, context-mode, Serena and 16 more token savers for coding agents, ranked by evidence, with my own measurements on a real Nuxt codebase. - [Claude Code](https://balazscsorba.com/blog/tag/claude-code) - token usage - [Context engineering](https://balazscsorba.com/blog/tag/context-engineering) - ![Firecrawl review: a spider on a web spun across a browser window drops neat pages into a basket.](https://balazscsorba.com/images/blog/firecrawl/cover.webp?v=6bdcdbbbd2) Retrieval & search August 25, 2026·10 min read ## [Firecrawl: a web crawling API reviewed for RAG pipelines](https://balazscsorba.com/blog/firecrawl) Firecrawl turns URLs into clean Markdown through one hosted API. What it costs, where crawl accounting breaks down, and when to run the AGPL core yourself. - Web scraping - RAG ingestion - Crawling - ![Semantic product search for B2B shops: a magnifier hovers over a bin of screws on a hardware store shelf.](https://balazscsorba.com/images/blog/semantic-product-search-b2b/cover.webp?v=c9dde01e94) Retrieval & search August 21, 2026·13 min read ## [Semantic product search for B2B shops: part numbers, hybrid retrieval and what to measure](https://balazscsorba.com/blog/semantic-product-search-b2b) Semantic search for B2B shops without breaking part-number search: hybrid BM25 and vectors, filters, DE/EN/HU, LLM query parsing, reranking and metrics. - B2B search - [Hybrid search](https://balazscsorba.com/blog/tag/hybrid-search) - Semantic search - ![Reducing LLM hallucinations: a hot air balloon is tied down by ropes anchored to a stack of books.](https://balazscsorba.com/images/blog/llm-hallucination-grounding-citations/cover.webp?v=f1b6806512) Retrieval & search August 20, 2026·13 min read ## [Reducing LLM hallucinations in production: grounding, citations and knowing when to say no](https://balazscsorba.com/blog/llm-hallucination-grounding-citations) Cutting hallucinations in production RAG: citation APIs, abstention, claim-level checks, faithfulness metrics, source UI, and what still slips through. - Hallucinations - [RAG](https://balazscsorba.com/blog/tag/rag) - Citations - ![Semgrep static analysis: a fine-tooth comb catches a small beetle in lines of paper strips.](https://balazscsorba.com/images/blog/semgrep/cover.webp?v=9db0283138) Security & compliance August 14, 2026·10 min read ## [Semgrep: static analysis that fits in a pull request](https://balazscsorba.com/blog/semgrep) Semgrep: 30-plus languages, YAML patterns matched in seconds, a free LGPL-2.1 engine. Cross-file analysis, rulesets and AI triage sit behind paid tiers. - SAST - Static analysis - CI security - ![Langfuse review: a footprint trail in a house garden leads to a notebook with a magnifying glass.](https://balazscsorba.com/images/blog/langfuse/cover.webp?v=fb9769a8fa) LLMOps & evals August 13, 2026·10 min read ## [Langfuse review: tracing, prompts and evals you can host yourself](https://balazscsorba.com/blog/langfuse) Langfuse: LLM traces, prompt versions and experiments on one MIT-licensed platform. What self-hosting costs, how unit pricing adds up, and where it loses. - [LLM observability](https://balazscsorba.com/blog/tag/llm-observability) - [Tracing](https://balazscsorba.com/blog/tag/tracing) - [OpenTelemetry](https://balazscsorba.com/blog/tag/opentelemetry) - ![MCP security checklist: a plug and socket secured by a padlock chain, a worm creeping toward the cable.](https://balazscsorba.com/images/blog/mcp-server-security-checklist/cover.webp?v=d61832abc7) Security & compliance August 11, 2026·10 min read ## [MCP security checklist: tool poisoning, rug pulls and OAuth](https://balazscsorba.com/blog/mcp-server-security-checklist) MCP security checklist: the threat model, tool poisoning, rug pulls, RFC 9207 issuer checks, per-issuer credentials, scoped tokens and audit logs. - MCP security - Tool poisoning - MCP OAuth - ![GitHub Copilot coding agent: a robot co-pilot in a small aeroplane hands an envelope to the human pilot.](https://balazscsorba.com/images/blog/github-copilot-coding-agent/cover.webp?v=8c4dd5a16b) AI agents August 10, 2026·10 min read ## [GitHub Copilot coding agent: a review of the pull request agent](https://balazscsorba.com/blog/github-copilot-coding-agent) GitHub's cloud coding agent takes an issue and opens a pull request. What the 59-minute session limit, AI credits and review duty mean in production. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Pull requests - GitHub Actions - ![Multi-agent systems: one robot carries a small box, four robots carry a long beam, a scale between them.](https://balazscsorba.com/images/blog/multi-agent-systems-when-worth-it/cover.webp?v=fbd63d3a48) AI agents August 7, 2026·12 min read ## [Multi-agent systems: when they beat one agent, and when they do not](https://balazscsorba.com/blog/multi-agent-systems-when-worth-it) Orchestrator-worker, fan-out, critic, handoff: what multi-agent systems really buy you, what they cost in tokens, how they fail, and a table to decide. - Multi-agent systems - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - Orchestrator-worker - ![OpenTelemetry for LLM agents: a stethoscope rests on a small robot next to a monitor showing a calm wave line.](https://balazscsorba.com/images/blog/agent-observability-opentelemetry/cover.webp?v=fa703fb78c) LLMOps & evals August 6, 2026·12 min read ## [Observability for LLM agents with OpenTelemetry: traces, tokens, PII and evals](https://balazscsorba.com/blog/agent-observability-opentelemetry) How to trace LLM agents with OpenTelemetry: GenAI semantic conventions and their status, span tree, token metrics, sampling, PII, evals and tool options. - [OpenTelemetry](https://balazscsorba.com/blog/tag/opentelemetry) - [LLM observability](https://balazscsorba.com/blog/tag/llm-observability) - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - ![AI agent sandbox checklist: a robot plays in a framed sandbox, a broken padlock and a checklist outside.](https://balazscsorba.com/images/blog/sandboxing-coding-agents-ci-checklist/cover.webp?v=b0d187c0d9) Security & compliance August 5, 2026·11 min read ## [AI agent sandbox checklist: lessons from a CI intrusion](https://balazscsorba.com/blog/sandboxing-coding-agents-ci-checklist) AI agent sandbox checklist for CI: isolation, egress allowlists, short-lived scoped credentials, blocked metadata endpoints, untrusted project config. - AI agent sandbox - CI security - Egress control - ![Lakera Guard prompt injection filter: a guard at a doorway holds a sieve that catches one envelope with a hook.](https://balazscsorba.com/images/blog/lakera-guard/cover.webp?v=c26f2d7860) Security & compliance August 4, 2026·9 min read ## [Lakera Guard: prompt injection filtering at the request boundary](https://balazscsorba.com/blog/lakera-guard) A review of Lakera Guard: one endpoint before the model, the PINT benchmark behind its scores, and why the free tier stops at 10,000 requests a month. - Prompt injection - [Guardrails](https://balazscsorba.com/blog/tag/guardrails) - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - ![detect-secrets scanning: a sniffer dog checks suitcases on a conveyor, one with a key sticking out.](https://balazscsorba.com/images/blog/detect-secrets/cover.webp?v=6cb9240d59) Security & compliance August 3, 2026·10 min read ## [detect-secrets: secret scanning with a committed baseline](https://balazscsorba.com/blog/detect-secrets) What detect-secrets does, how its committed baseline differs from gitleaks and TruffleHog, why verification calls matter in CI, and where the tool stops. - Secret scanning - Pre-commit - Git - ![RAG in 2026: a person chooses between paths to a library shelf, a robot with a flashlight and a long scroll.](https://balazscsorba.com/images/blog/rag-2026-hybrid-agentic-long-context/cover.webp?v=b3fe690a4a) Retrieval & search July 30, 2026·8 min read ## [RAG in 2026: hybrid retrieval, agentic search, or just a 1M-token context?](https://balazscsorba.com/blog/rag-2026-hybrid-agentic-long-context) RAG in 2026: when a cached 1M-token context beats retrieval, when hybrid search still wins, when agentic search fits, and what each costs per request. - [RAG](https://balazscsorba.com/blog/tag/rag) - Long context - Agentic search - ![MCP 2026-07-28 migration: a robot uses one of several identical vending machines while an old machine is moved away.](https://balazscsorba.com/images/blog/mcp-2026-07-28-stateless-migration-guide/cover.webp?v=e9fbdaee62) AI agents July 29, 2026·9 min read ## [MCP 2026-07-28 migration guide: what changes for stateless MCP servers](https://balazscsorba.com/blog/mcp-2026-07-28-stateless-migration-guide) MCP 2026-07-28 drops sessions and the initialize handshake. For server authors: \_meta, server/discover, MRTR, auth and a migration checklist. - [MCP](https://balazscsorba.com/blog/tag/mcp) - Protocol migration - Stateless APIs - ![Human in the loop for AI agents: a robot brings a parcel to a gate where a person waits with an approval stamp.](https://balazscsorba.com/images/blog/human-in-the-loop-ai-agents/cover.webp?v=c2a60302ec) AI agents July 28, 2026·13 min read ## [Human in the loop for AI agents: where to put approval gates](https://balazscsorba.com/blog/human-in-the-loop-ai-agents) Approval gates for AI agents: where they belong, how to avoid rubber-stamping, and how interrupt and resume work in LangGraph, OpenAI and Claude SDKs. - Human in the loop - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - Approval gates - ![RAG pipeline, step by step: a loaf is sliced, the slices go through a sieve and land in a neat row on a plate.](https://balazscsorba.com/images/blog/rag-pipeline-chunking-hybrid-search-reranking/cover.webp?v=a6b50300ff) Retrieval & search July 24, 2026·10 min read ## [A production RAG pipeline, step by step: chunking, hybrid search and reranking](https://balazscsorba.com/blog/rag-pipeline-chunking-hybrid-search-reranking) RAG pipeline step by step: parsing, chunking, pgvector, BM25 and vectors fused with Reciprocal Rank Fusion, reranking, citations and retrieval evals. - [RAG](https://balazscsorba.com/blog/tag/rag) - [Hybrid search](https://balazscsorba.com/blog/tag/hybrid-search) - Chunking - ![OpenRouter: one key on a ring with lines fanning out to a row of different doors.](https://balazscsorba.com/images/blog/openrouter/cover.webp?v=d74a478128) LLMOps & evals July 23, 2026·10 min read ## [OpenRouter: one API key in front of every model you might call](https://balazscsorba.com/blog/openrouter) OpenRouter: 500+ models from 80+ providers behind one OpenAI-compatible endpoint, with fallbacks and pass-through pricing. Costs and where it breaks. - LLM gateway - Model routing - Fallbacks - ![Core Web Vitals for Nuxt sites: three dashboard gauges with needles in the calm zone behind a steering wheel.](https://balazscsorba.com/images/blog/nuxt-core-web-vitals-performance/cover.webp?v=1eba242b72) Web engineering July 21, 2026·13 min read ## [Core Web Vitals for Nuxt sites and shops: fixing LCP, INP and CLS](https://balazscsorba.com/blog/nuxt-core-web-vitals-performance) How to fix LCP, INP and CLS in Nuxt 4 sites and shops: images, hydration, fonts, third-party scripts, prerender vs SSR vs ISR, and measuring real users. - Core Web Vitals - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - Performance - ![Chroma vector search: a drawer cabinet sorts round marbles, with one cracked pebble on top.](https://balazscsorba.com/images/blog/chroma/cover.webp?v=f566ccd792) Retrieval & search July 20, 2026·10 min read ## [Chroma: simple vector search with one catch](https://balazscsorba.com/blog/chroma) Chroma is an Apache-2.0 vector database for embedded, single-node or cloud use. Where it is pleasant, and where its best search is cloud-only. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - [RAG](https://balazscsorba.com/blog/tag/rag) - ![Goose review: a goose with a tool belt stands on a desk next to a laptop.](https://balazscsorba.com/images/blog/goose-block/cover.webp?v=f91faa1399) AI agents July 17, 2026·10 min read ## [Goose: the open-source agent you run on your own machine](https://balazscsorba.com/blog/goose-block) Goose, an Apache-2.0 Rust coding agent under the Linux Foundation: how its permissions, recipes and MCP extensions compare with commercial tools. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - [MCP](https://balazscsorba.com/blog/tag/mcp) - Local models - ![LangGraph: a hand sets a switch lever on a model railway with a loop and a locomotive.](https://balazscsorba.com/images/blog/langgraph/cover.webp?v=3a3d1e9116) AI agents July 17, 2026·10 min read ## [LangGraph: a low-level runtime for stateful agents](https://balazscsorba.com/blog/langgraph) LangGraph for production agents: checkpointed supersteps, interrupts and streaming, where the durability model stops short, and what LangSmith costs. - LangGraph - Agent orchestration - Durable execution - ![The agent loop: a small robot walks a circular track that a striped barrier arm crosses next to a finish flag.](https://balazscsorba.com/images/blog/agent-loop-explained/cover.webp?v=08ca8ece50) AI agents July 16, 2026·10 min read ## [The agent loop, explained: how coding agents run, and how to make them stop](https://balazscsorba.com/blog/agent-loop-explained) How the agent loop works in code, which stop conditions and budgets to enforce, and how outer loops like Ralph and Claude Code /loop and /goal behave. - Agent loop - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Tool calling - ![Mastra review: a robot runs through the finish tape while a coach with a stopwatch takes notes.](https://balazscsorba.com/images/blog/mastra/cover.webp?v=d8678469ca) AI agents July 15, 2026·11 min read ## [Mastra review: TypeScript agents with a real evaluation loop](https://balazscsorba.com/blog/mastra) Mastra review: agents, workflows, memory, MCP and evals in one TypeScript framework. What its Apache-2.0 core covers, and what the ee/ split costs. - TypeScript - Agent framework - Workflows - ![LlamaIndex review: a llama beside a large open toolbox looks up at a small cloud.](https://balazscsorba.com/images/blog/llamaindex/cover.webp?v=64db2c3560) AI agents July 14, 2026·10 min read ## [LlamaIndex review: the widest data toolkit, with its centre of gravity already moved](https://balazscsorba.com/blog/llamaindex) LlamaIndex in 2026: an MIT-licensed Python data and agent framework with 300+ integrations, event-driven Workflows, and a focus shifted to LlamaParse. - Agent framework - [RAG](https://balazscsorba.com/blog/tag/rag) - [Python](https://balazscsorba.com/blog/tag/python) - ![Zed review: a robot types on a tiny keyboard sitting inside an editor-shaped window frame.](https://balazscsorba.com/images/blog/zed/cover.webp?v=33015d121c) AI agents July 10, 2026·10 min read ## [Zed, reviewed: the editor that puts the agent in the window](https://balazscsorba.com/blog/zed) Zed 1.22 review: edit predictions, ACP external agents, parallel threads, the $20 default monthly ceiling on Pro, and the extensions it trades away. - AI editor - Agents - ACP - ![Pinecone review: a pine cone on a cloud holds marbles between its scales, a key hanging below.](https://balazscsorba.com/images/blog/pinecone/cover.webp?v=1c5d3085ef) Retrieval & search July 9, 2026·11 min read ## [Pinecone: a review of the managed vector database](https://balazscsorba.com/blog/pinecone) Pinecone review: read units scale with namespace size, schemas are fixed at creation, and when self-hosting is the better buy. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - [Embeddings](https://balazscsorba.com/blog/tag/embeddings) - [RAG](https://balazscsorba.com/blog/tag/rag) - ![Braintrust review: three test tubes filled to different levels stand next to a large round meter.](https://balazscsorba.com/images/blog/braintrust/cover.webp?v=f50e84a291) LLMOps & evals July 7, 2026·10 min read ## [Braintrust review: eval-first observability with a hard meter](https://balazscsorba.com/blog/braintrust) Braintrust: traces become datasets and gated experiments. Starter and Pro tiers, open-source parts, and where Phoenix, Langfuse or LangSmith win. - Evaluations - Observability - LLM-as-a-judge - ![Promptfoo evals and red teaming: a clipboard in front of a row of targets, one arrow off target.](https://balazscsorba.com/images/blog/promptfoo/cover.webp?v=8ead77a8eb) LLMOps & evals July 7, 2026·10 min read ## [Promptfoo: LLM evals and red teaming from one YAML file](https://balazscsorba.com/blog/promptfoo) Promptfoo in 2026: MIT-licensed evals and red teaming, now inside OpenAI. What it does well, where the YAML approach breaks, and what the tiers cost. - LLM evaluation - Red teaming - Prompt testing - ![Arize Phoenix review: a phoenix rises above a small house with a magnifying glass on its roof.](https://balazscsorba.com/images/blog/arize-phoenix/cover.webp?v=d50e09b956) LLMOps & evals July 3, 2026·10 min read ## [Arize Phoenix review: LLM tracing and evals you host yourself](https://balazscsorba.com/blog/arize-phoenix) Arize Phoenix: an ELv2-licensed tracing and eval server on your own database. Strengths, operating cost, and where Langfuse, Braintrust or LangSmith win. - [LLM observability](https://balazscsorba.com/blog/tag/llm-observability) - [Tracing](https://balazscsorba.com/blog/tag/tracing) - [OpenTelemetry](https://balazscsorba.com/blog/tag/opentelemetry) - ![Helicone: an envelope on wheels drives through a toll booth watched by a camera.](https://balazscsorba.com/images/blog/helicone/cover.webp?v=cc57231999) LLMOps & evals July 3, 2026·10 min read ## [Helicone: observability that sits in the request path](https://balazscsorba.com/blog/helicone) Helicone: an Apache-2.0 LLM gateway and observability platform. What its proxy architecture buys, what it costs you, and how self-hosting really looks. - [LLM observability](https://balazscsorba.com/blog/tag/llm-observability) - [OpenTelemetry](https://balazscsorba.com/blog/tag/opentelemetry) - Cost tracking - ![Coding agent skills workflow: a robot crosses stepping stones from a beetle to an envelope.](https://balazscsorba.com/images/blog/coding-agent-skills-workflow/cover.webp?v=7428b02b08) AI agents July 2, 2026·7 min read ## [Skills, not prompts: how my coding agents take a bug from report to pull request](https://balazscsorba.com/blog/coding-agent-skills-workflow) Agent skills in practice: about 20 skills in one master folder for three coding agents, from reproducing bugs with real data to PRs, with guardrails. - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - [Claude Code](https://balazscsorba.com/blog/tag/claude-code) - [MCP](https://balazscsorba.com/blog/tag/mcp) - ![Pimcore ERP delta sync: three meshing gears carry boxes from a factory gear to a shop awning.](https://balazscsorba.com/images/blog/pimcore-erp-delta-sync/cover.webp?v=ae594d1579) Web engineering July 1, 2026·12 min read ## [Pimcore ERP delta sync: syncing product data between SAP or Infor, PIM and shop](https://balazscsorba.com/blog/pimcore-erp-delta-sync) Syncing product data between SAP or Infor, Pimcore and a shop: delta vs full sync, change detection, idempotent imports, Messenger queues, replays. - Pimcore - SAP integration - PIM ERP sync - ![vLLM review: a large oven bakes many trays of loaves at once, a baker's peel beside it.](https://balazscsorba.com/images/blog/vllm/cover.webp?v=7bc5479461) LLMOps & evals June 30, 2026·11 min read ## [vLLM reviewed for self-hosted inference](https://balazscsorba.com/blog/vllm) vLLM turns a Hugging Face checkpoint into an OpenAI-compatible server. What PagedAttention and continuous batching buy, and what running it actually costs. - Self-hosted inference - OpenAI API - PagedAttention - ![PII redaction in LLM pipelines: a hand blacks out lines on a page with a marker while a robot waits for it.](https://balazscsorba.com/images/blog/pii-redaction-llm-pipelines/cover.webp?v=1aa3ff0af5) Security & compliance June 26, 2026·12 min read ## [PII redaction in LLM pipelines: where to redact, how, and what GDPR says](https://balazscsorba.com/blog/pii-redaction-llm-pipelines) Where to redact PII in LLM pipelines: reversible tokens vs masking, Presidio and cloud DLP, German and Hungarian gaps, GDPR for pseudonymised data. - PII redaction - [GDPR](https://balazscsorba.com/blog/tag/gdpr) - Microsoft Presidio - ![European Accessibility Act: a shop entrance with a ramp beside the steps and a wheelchair at its foot.](https://balazscsorba.com/images/blog/european-accessibility-act-b2b-shop/cover.webp?v=bcd6f10c3b) Web engineering June 23, 2026·13 min read ## [European Accessibility Act for B2B shops: what Spryker, Pimcore and TYPO3 teams must fix](https://balazscsorba.com/blog/european-accessibility-act-b2b-shop) Does the European Accessibility Act cover a B2B shop? Scope under BFSG and BaFG, the microenterprise exemption, 2026 enforcement and a WCAG 2.2 fix plan. - European Accessibility Act - BFSG - WCAG 2.2 - ![Rebuff prompt injection detection: a closed archive box sits before four layers of defence: moat, fence, wall and gate.](https://balazscsorba.com/images/blog/rebuff/cover.webp?v=462300377e) Security & compliance June 22, 2026·9 min read ## [Rebuff: four layers of prompt injection detection, now archived](https://balazscsorba.com/blog/rebuff) Rebuff scores prompts with heuristics, an LLM, a vector store of past attacks and canary tokens. Archived in May 2025; last release January 2024. - Prompt injection - [LLM security](https://balazscsorba.com/blog/tag/llm-security) - [Guardrails](https://balazscsorba.com/blog/tag/guardrails) - ![Protect AI model scanning: a scanner arch beams over a gift box, an empty guard stand beside it.](https://balazscsorba.com/images/blog/protect-ai/cover.webp?v=b1bd55a40e) Security & compliance June 22, 2026·10 min read ## [Protect AI model scanning: Guardian is gone, ModelScan is not](https://balazscsorba.com/blog/protect-ai) Protect AI model scanning after the Palo Alto Networks acquisition: what became of Guardian, what ModelScan still does, and how free scanners compare. - Model scanning - Supply chain - Pickle - ![AGENTS.md, skills, MCP or CLI: a robot at a crossroads reads a signpost with four arrows: page, toolbox, plug and terminal.](https://balazscsorba.com/images/blog/agents-md-skills-mcp-cli-decision-matrix/cover.webp?v=b94159da0a) AI agents June 19, 2026·8 min read ## [Context engineering for coding agents: AGENTS.md, skills, MCP or CLI?](https://balazscsorba.com/blog/agents-md-skills-mcp-cli-decision-matrix) Context engineering decides what a coding agent has in context: rules in AGENTS.md, procedures in skills, and when an MCP tool beats a shell command. - [Context engineering](https://balazscsorba.com/blog/tag/context-engineering) - AGENTS.md - Agent Skills - ![Cline review: a robot chooses from many hats hanging in an open wardrobe.](https://balazscsorba.com/images/blog/cline/cover.webp?v=18ec93d7db) AI agents June 16, 2026·11 min read ## [Cline, reviewed: an open coding agent that gives you every model and none of the guardrails](https://balazscsorba.com/blog/cline) Cline: an Apache-2.0 agent for VS Code, JetBrains and the terminal. What Plan and Act, checkpoints and auto-approve guarantee, and where safety leaks. - [Coding agents](https://balazscsorba.com/blog/tag/coding-agents) - Plan and Act - Checkpoints - ![pgvector or a vector database: a person at a fork chooses between an elephant with drawers and a tall warehouse.](https://balazscsorba.com/images/blog/pgvector-vs-vector-databases/cover.webp?v=1ee8a7bb7d) Retrieval & search June 15, 2026·13 min read ## [pgvector or a vector database? How to choose vector storage in 2026](https://balazscsorba.com/blog/pgvector-vs-vector-databases) pgvector, Qdrant, Weaviate, Milvus, Pinecone, OpenSearch or Elasticsearch? A practical 2026 guide to filtering, hybrid search, scale, cost and EU hosting. - pgvector - Vector databases - [RAG](https://balazscsorba.com/blog/tag/rag) - ![UCP and ACP agentic commerce: a small robot pushes a shopping cart toward a shop counter with a payment terminal.](https://balazscsorba.com/images/blog/agentic-commerce-protocols-ucp-acp-guide/cover.webp?v=4f8ae013bb) Web engineering June 12, 2026·9 min read ## [Agentic commerce for shop developers: UCP, ACP and AP2 compared](https://balazscsorba.com/blog/agentic-commerce-protocols-ucp-acp-guide) Agentic commerce protocols compared: what UCP covers, how AP2 proves a payment was authorized, where ACP fits, and what a shop should build now. - Agentic commerce - UCP - AP2 - ![Voice agents: a robot speaks into one of two phones linked by a curly cord with a stopwatch.](https://balazscsorba.com/images/blog/voice-agents-realtime-latency/cover.webp?v=22e5c7f760) AI agents June 10, 2026·13 min read ## [Building voice agents: realtime speech-to-speech or STT, LLM and TTS?](https://balazscsorba.com/blog/voice-agents-realtime-latency) Voice agents: realtime speech-to-speech or a cascade of STT, LLM and TTS? Latency per stage, turn-taking, tool calls, German and Hungarian, AI Act. - Voice agents - Realtime API - Latency - ![Generative engine optimization: a person inspects a web-page-shaped house through a magnifying glass, a chat bubble above.](https://balazscsorba.com/images/blog/generative-engine-optimization-audit/cover.webp?v=d8422bff8f) Web engineering June 9, 2026·12 min read ## [Generative engine optimization in practice: a full GEO audit of my own site](https://balazscsorba.com/blog/generative-engine-optimization-audit) What generative engine optimization is, what the research really supports, and the GEO audit I ran on this site: 12 checks, 7 fixes, code included. - GEO - AI search - Structured data - ![CrewAI review: three robots row a boat together, a long receipt trailing behind it.](https://balazscsorba.com/images/blog/crewai/cover.webp?v=6c7daf0a89) AI agents June 8, 2026·10 min read ## [CrewAI review: crews, flows and the token bill](https://balazscsorba.com/blog/crewai) CrewAI, an MIT-licensed Python multi-agent framework: crews for autonomous teamwork, flows for controlled state, the token bill and where it hurts. - Multi-agent - Agent orchestration - [Python](https://balazscsorba.com/blog/tag/python) - ![Weaviate vector database: a magnet and a magnifier cross over a pile of marbles, a few clinging to the magnet.](https://balazscsorba.com/images/blog/weaviate/cover.webp?v=9b7387db74) Retrieval & search June 2, 2026·10 min read ## [Weaviate: a vector database that has to win on search, not only on similarity](https://balazscsorba.com/blog/weaviate) Weaviate: hybrid BM25 and vector search in one query, HNSW and disk-based HFresh, quantisation, a built-in MCP server, and what licence keys now cover. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - [Hybrid search](https://balazscsorba.com/blog/tag/hybrid-search) - HNSW - ![LLM cost and routing: a railway switch splits a track toward a small and a large station, a watch and a coin beside it.](https://balazscsorba.com/images/blog/llm-cost-latency-prompt-caching-routing/cover.webp?v=81e0301f46) LLMOps & evals June 1, 2026·9 min read ## [Prompt caching and model routing: cutting LLM cost and latency](https://balazscsorba.com/blog/llm-cost-latency-prompt-caching-routing) Prompt caching, cheap-model-first routing and batch APIs are the levers that cut LLM cost and latency in production. Here is how to use each one. - Prompt caching - Model routing - LLM cost - ![WebMCP for agent-ready websites: a robot reads a clear menu board in front of an open shop door.](https://balazscsorba.com/images/blog/webmcp-agent-ready-website-guide/cover.webp?v=72114b8a9c) Web engineering May 28, 2026·10 min read ## [WebMCP in practice: making a website agent-ready with declared tools](https://balazscsorba.com/blog/webmcp-agent-ready-website-guide) WebMCP in practice: declarative form attributes, document.modelContext.registerTool, tool annotations, security gates, local testing and a checklist. - WebMCP - Chrome - [AI agents](https://balazscsorba.com/blog/tag/ai-agents) - ![Playwright: three browser windows stand on a theatre stage in front of a director's chair.](https://balazscsorba.com/images/blog/playwright/cover.webp?v=53baf4a5fa) Web engineering May 27, 2026·10 min read ## [Playwright: one browser API for tests, scripts and agents](https://balazscsorba.com/blog/playwright) Playwright: one Apache-2.0 API for Chromium, Firefox and WebKit, with a test runner, agent CLI and MCP server. What it costs and where it falls short. - End-to-end testing - Browser automation - [MCP](https://balazscsorba.com/blog/tag/mcp) - ![ElevenLabs speech API: a sheet of text feeds into a microphone whose sound waves flow into a speaker.](https://balazscsorba.com/images/blog/elevenlabs/cover.webp?v=0223242401) Web engineering May 27, 2026·10 min read ## [ElevenLabs: speech synthesis as an API](https://balazscsorba.com/blog/elevenlabs) ElevenLabs audio API review: model lineup, latency, credit and per-character pricing, tier-gated formats, and where OpenAI and Amazon Polly win. - Text-to-speech - Voice API - Speech to text - ![Qdrant vector database: a layered sieve sorts marbles into a bowl.](https://balazscsorba.com/images/blog/qdrant/cover.webp?v=7fb0f7c001) Retrieval & search May 26, 2026·10 min read ## [Qdrant: a vector database built around filtering](https://balazscsorba.com/blog/qdrant) A review of Qdrant: filterable HNSW, four quantisation methods, the memory tiers in v1.19 and the operations nobody publishes any more. - [Vector search](https://balazscsorba.com/blog/tag/vector-search) - HNSW - Quantisation - ![LangSmith: an anvil with a hammer stands beside a telescope and a growing plant.](https://balazscsorba.com/images/blog/langsmith/cover.webp?v=a17d50ab17) LLMOps & evals May 25, 2026·10 min read ## [LangSmith: an observability product that grew into an agent platform](https://balazscsorba.com/blog/langsmith) LangSmith review: per-trace billing, 14 and 180 day retention, OpenTelemetry ingestion, offline and online evals, and its pull toward an agent runtime. - [Tracing](https://balazscsorba.com/blog/tag/tracing) - LLM evals - [OpenTelemetry](https://balazscsorba.com/blog/tag/opentelemetry) - ![Replicate review: a copier prints copies of a robot figure, a stopwatch on top and a knife beside it.](https://balazscsorba.com/images/blog/replicate/cover.webp?v=98d8552114) Web engineering May 22, 2026·10 min read ## [Replicate, reviewed: a model API priced per second, with the sharp edges named](https://balazscsorba.com/blog/replicate) Replicate: thousands of open models behind one prediction API, billed per second. Cold boots, version churn and the one-hour data deletion. - Model hosting - Serverless GPU - Diffusion - ![Unstructured review: hands sort a messy pile of papers and photos into three neat trays.](https://balazscsorba.com/images/blog/unstructured/cover.webp?v=2d807f7455) Retrieval & search May 21, 2026·11 min read ## [Unstructured review: parsing documents for RAG](https://balazscsorba.com/blog/unstructured) Unstructured parses PDFs, Word files and images into typed RAG elements: an Apache-2.0 library, and a platform at $0.015 a page after 10,000 free pages. - Document parsing - RAG ingestion - PDF extraction - ![LiteLLM gateway: a universal travel adapter joins several different plugs into one cable.](https://balazscsorba.com/images/blog/litellm/cover.webp?v=03f99cfc26) LLMOps & evals May 20, 2026·10 min read ## [LiteLLM: the OpenAI-compatible gateway most platform teams end up running](https://balazscsorba.com/blog/litellm) LiteLLM: the MIT-licensed OpenAI-compatible gateway most platform teams run in front of providers. What it does well, what it costs, where it breaks. - LLM gateway - OpenAI-compatible - Cost control - ![Ragas review: a report card with tick boxes and a star beside books and a pencil.](https://balazscsorba.com/images/blog/ragas/cover.webp?v=4d292de360) LLMOps & evals May 20, 2026·10 min read ## [Ragas review: the default RAG evaluation framework](https://balazscsorba.com/blog/ragas) Ragas scores RAG and agent pipelines on faithfulness, context precision and recall, generates test data, and tracks runs. Apache-2.0; judge billed apart. - RAG evaluation - LLM-as-judge - Test sets - ![AI code review bottleneck: a robot adds pages to a tall stack in front of a narrow funnel where one reviewer reads.](https://balazscsorba.com/images/blog/ai-generated-pr-review-bottleneck/cover.webp?v=52a65f0d44) AI agents May 19, 2026·8 min read ## [AI code review is the bottleneck now: handling a flood of agent-written PRs](https://balazscsorba.com/blog/ai-generated-pr-review-bottleneck) AI code review cannot keep up with agent-written PRs. What the data says, size budgets, stacked PRs, AI as first pass, and who stays accountable. - AI code review - Pull requests - Agentic engineering - ![AI agent identities and least privilege: a robot with an ID badge holds one small key in front of three doors.](https://balazscsorba.com/images/blog/ai-agent-identity-least-privilege/cover.webp?v=1855b8e040) Security & compliance May 18, 2026·12 min read ## [AI agents are identities: least privilege for non-human users](https://balazscsorba.com/blog/ai-agent-identity-least-privilege) AI agent identity and least privilege: its own identity, delegated tokens, an off switch, audit and offboarding, and what Entra, Okta and Auth0 ship. - AI agent identity - Least privilege - OAuth token exchange - ![LLM evals for product features: boxes on a conveyor pass an inspection gate while a person reads with a magnifier.](https://balazscsorba.com/images/blog/llm-evals-for-product-features/cover.webp?v=4d679f2bfa) LLMOps & evals May 15, 2026·8 min read ## [LLM evals for product features: from hand-read traces to a CI gate](https://balazscsorba.com/blog/llm-evals-for-product-features) LLM evals turn a vibe check into a test suite: error analysis on real traces, grader choice, a validated LLM judge, pass^k and a CI gate. - LLM evals - LLM-as-judge - Error analysis - ![Streaming LLM features in Nuxt: a tap fills a glass in a steady stream next to a hand over an approve button.](https://balazscsorba.com/images/blog/nuxt-llm-features-ai-sdk-streaming/cover.webp?v=c51acb7b65) Web engineering May 14, 2026·9 min read ## [Shipping LLM features in Nuxt: streaming, structured output, tool approval](https://balazscsorba.com/blog/nuxt-llm-features-ai-sdk-streaming) Nuxt AI end to end: a server route that holds the API key, streaming parts, strict structured output, tools needing approval, errors and Article 50. - [Nuxt](https://balazscsorba.com/blog/tag/nuxt) - AI SDK - Streaming - ![RAG evaluation metrics: a fishing rod lifts a book from a pond while a scale weighs a speech bubble.](https://balazscsorba.com/images/blog/rag-evaluation-metrics/cover.webp?v=5f4aa4ec91) Retrieval & search May 13, 2026·12 min read ## [Evaluating RAG: retrieval metrics, faithfulness and how to tell which half failed](https://balazscsorba.com/blog/rag-evaluation-metrics) Evaluating RAG: recall at k, MRR and nDCG vs faithfulness and answer relevance, a golden set from real queries, a calibrated LLM judge and CI evals. - RAG evaluation - Retrieval metrics - LLM-as-judge - ![Prompting, RAG or fine-tuning: a robot with a map faces four doors marked with a speech bubble, books, a wrench and a funnel.](https://balazscsorba.com/images/blog/fine-tuning-vs-rag-vs-prompting/cover.webp?v=fdc6c6a08e) LLMOps & evals May 12, 2026·12 min read ## [Prompting vs RAG vs fine-tuning vs distillation: a decision guide for 2026](https://balazscsorba.com/blog/fine-tuning-vs-rag-vs-prompting) Fine-tuning vs RAG vs prompting: what each changes, what it costs, who still offers SFT, DPO and RFT in 2026, and a decision tree. - Fine-tuning - [RAG](https://balazscsorba.com/blog/tag/rag) - Prompting