Specifics, not overviews. What the current MCP specification actually requires, what a request really costs, where agents break, and what the EU AI Act means for a company shipping this quarter.
The general-purpose AI grace period ended on 2 August 2026. Here is what now binds a company deploying Claude in the EU, what is still in motion, and what to do about it this quarter.
Read itThe GPAI grace period expired on 2 August and Article 50 transparency duties are now live. Most compliance write-ups still describe the pre-August position. This one is dated, sourced, and honest about the part that is still moving.
Written for the person doing the work. Every code sample is executed before publishing, and anything version-dependent carries the date it was verified.
Three layers need testing and most teams only cover one. A working pytest suite you can copy, including the protocol conformance checks the current revision made necessary.
We found a hidden instruction block on a live marketing site while reviewing it. On a page with no agent reading it, that payload does nothing. Point an agent with tools at it and it becomes an instruction.
Most guides tell you to implement Dynamic Client Registration. The current specification marks it deprecated. Here is the authorization flow MCP actually requires now — discovery, registration, resource indicators and issuer validation.
There are two standard MCP transports, and SSE is not one of them any more. What each binding actually guarantees, how cancellation differs, and the deployment constraints that make the choice for you.
The current MCP revision removes the initialize handshake entirely. Servers are stateless, every request carries its own protocol version, and most of the MCP material on the internet now describes a legacy protocol.
A model that costs a fifth as much but needs three attempts is not cheaper. Here is how to build the comparison that actually predicts your bill — and why Sonnet 5's September price change should send you back to it.
Tool definitions sit in the context window before the user has typed anything, on every request, forever. Here is a script that measures the bill — and the reason a one-character change to a description can invalidate your entire cache.
The cache does not find stable content behind your breakpoint. It finds entries earlier requests already wrote. Understanding that one sentence is the difference between an 80% discount and paying a premium on every request.
The model never sees your implementation. It sees a name, a description and a JSON Schema — and that is the entire interface. Most tool-calling failures are interface design problems wearing a model's clothes.
We build Claude integrations, MCP servers and agentic workflows for startups and SMBs in the Netherlands and across the EU.