The Engineer

The First Production MCP Reference Architecture

Pinterest has built what no one else has made public: a production MCP platform with cloud-hosted servers, a central discovery registry, shared deployment paths, registry-based approval gates, and layered authn/authz combining user JWTs with service identities. This isn't a prototype — it's integrated into their IDE, chat, and internal AI surfaces. Engineers discover and invoke agent tools where they already work.

The identity delegation design is the critical piece most teams get wrong. When an agent calls an internal API, is it acting as the user, the service, or itself? Pinterest's answer: both, with different permission scopes. User JWTs carry user-level authorization; service identities carry operational permissions. This layered model prevents the confused-deputy problem that plagues agent deployments and directly addresses the attack surface flagged by Anthropic's own Computer Use warnings.

The governance layer is the hard part, not the protocol integration. Start with Pinterest's platform design and work backwards to what you actually need.

Multi-Tool Chains Are the Failure Mode You Must Design For

Alibaba's FinMCP-Bench — 613 samples testing LLM agents on real-world financial tool invocation — confirms what production teams suspected: leading LLMs perform reasonably on single-tool MCP tasks but degrade significantly on multi-tool dependency chains. This is the distributed saga problem applied to agent workflows. Each tool call should be validated before triggering the next, with compensating actions on failure.

This data aligns with the verification loop thesis emerging from multiple analyses: agentic AI's effectiveness is gated by external verification, not model capability. Coding agents work because compilers, type checkers, and test suites provide cheap deterministic feedback. Domains lacking equivalent feedback loops — law, finance, medical — see agents degenerate into expensive autoregressive guessing.

Shadow Agents Are Already in Your Org

Microsoft data shows 62% of UK businesses already run AI agents, with 84% of security leaders flagging unauthorized 'shadow agents' as a governance crisis. This is shadow IT redux. The playbook is identical: discovery → registry → authorization → monitoring → enforcement. Every agent needs an owner, defined action scope, output audit logging, and a kill switch. METR research adds urgency: agent autonomous task duration doubled from 50 minutes to 5 hours in one year, with the doubling rate accelerating from 7 months to 4 months. Your hardcoded human-in-the-loop checkpoints will be wrong within two quarters.

Meanwhile, NVIDIA's acquisition of Groq (inference throughput) and development of OpenClaw (agentic framework) signals vertical consolidation of the agent stack — silicon through orchestration. Evaluate OpenClaw on architectural merits, but recognize the ecosystem gravity: teams on NVIDIA hardware will face pressure to adopt their full stack. ByteDance's DeerFlow 2.0 offers a counterpoint with Docker-sandboxed execution and Progressive Skill Loading — lazy-injecting capabilities into agent context only when needed, reducing token waste and model confusion.

The Three Components to Build This Sprint

1. Registry-based approval: No agent tool goes live without explicit registration. Central catalog with ownership, scope definition, and version tracking.
2. Layered authn/authz: Separate user identity (JWT) from service identity. Define which actions require user-level vs. service-level permissions.
3. Discovery integration: Wire the registry into your IDE and chat surfaces. If agents can't discover tools where engineers work, they'll use ungoverned alternatives.

The Pattern: Inference Budget as a First-Class Parameter

Google's Gemini 3.1 Flash Live now exposes 'thinking levels' that let callers explicitly trade reasoning depth for response latency. The numbers: 70.5% accuracy at 0.96s (Minimal) vs. 95.9% at 2.98s (High) — a 3x latency increase for a 36% quality gain. This is rolling out to 200+ countries, making it production-validated at massive scale.

The numbers matter less than the architectural implication: model providers are starting to expose compute budget as a first-class API parameter. Think of it like adaptive bitrate streaming, but for reasoning. A voice assistant answering 'what time is it?' doesn't need the same compute budget as 'explain the trade-offs between event sourcing and CQRS.' Your service mesh should route these differently.

If you're building any real-time AI feature, your orchestration layer needs to make per-request decisions about how much inference compute to allocate.

Small Model Capability Is Bigger Than Standard Decoding Reveals

A complementary technique called Latent Space Reasoning (LSR) perturbs the model's latent representations during decoding to explore reasoning trajectories that greedy/beam search never reaches. On Qwen3-4B, this pushed arithmetic accuracy from 32% to 51.6% and turned 14-word degenerate outputs into 650+ word coherent solutions — without any retraining. The library is open-source from Iqidis.

The implication: small models have significantly more capability than standard decoding surfaces, locked behind autoregressive path dependence. For batch/async workloads on smaller models, this is high-leverage. For real-time inference on large models, the multi-trajectory exploration adds latency that may not be acceptable.

Architecture Selection Just Got Harder

Analysis of January-February 2026 open-weight launches confirms MoE as the dominant scaling paradigm (GLM-5, Kimi K2.5, Qwen3.5, Ling 2.5), with specialized efficiency techniques layered on top:

• Hybrid attention: balances local vs. global context
• Sliding-window attention: dramatic KV-cache savings at short contexts, degrades on long-range dependencies
• Multi-head Latent Attention (MLA): compresses key-value representations but adds decoding complexity
• Sparse attention: sub-quadratic scaling
• Multi-token prediction: better training efficiency

These models have very different performance profiles depending on your context length distribution. Generic benchmarks are misleading — you need to profile on your actual workload. The editorial view across multiple analyses: KV cache compression is approaching its Shannon theoretical limit, meaning the next inference frontier must be sparse attention, smarter eviction policies, or architectures that avoid full KV caches entirely.

Three Domains, One Architecture

Today's reports surface the same trust pattern from three unrelated domains, and the convergence is the insight:

In every case, the AI system proposes (trajectory, bug fix, code change) and a deterministic system constrains (physics rules, test assertions, type checkers). Neither stack runs as a fallback — both run concurrently. This is the proposer-verifier pattern applied at different scales.

NVIDIA's Dual-Stack Is the Clearest Implementation

NVIDIA's DRIVE AV runs Alpamayo (8.2B backbone + 2.3B action expert, open-weight, 24GB VRAM minimum) alongside Halos (classical safety framework checking trajectories against physics and regulatory invariants) before outputs reach actuators. The key architectural decision: decouple your ML innovation cycle from your safety certification burden. The learned model can be retrained, distilled, and swapped freely. The classical stack provides the deterministic guarantees regulators and production systems require.

Their simulation pipeline is equally instructive: NuRec reconstructs real-world sensor logs into 3D scenes for replay, AlpaSim provides closed-loop policy testing, and AlpaDreams generates entirely new physics-aware scenarios. This is simulation-as-CI for ML models — and the risk is circular reasoning if your generative model has blind spots you never discover.

If you're shipping ML systems where outputs affect the physical world — robotics, medical devices, infrastructure control, financial execution — decouple your innovation cycle from your safety certification burden.

Sashiko Makes the Pattern Concrete for Code

Google's Sashiko AI code reviewer found 53% of bugs in an unfiltered set of upstream Linux kernel issues that human reviewers missed. The transfer to the Linux Foundation is the real signal: the kernel community sees enough value to govern it as shared infrastructure, not a Google side project. Critical unknowns: false positive rate, severity distribution of caught bugs, and whether these are bugs that cause production incidents or technically-wrong-but-harmless patterns.

The complementary pattern from Simon Willison's workflow: red-green TDD as the trust boundary for agentic coding. The test suite is the specification agents code against. Executable validation — actually running the server, probing the API — is the acceptance gate. Agents are powerful but fundamentally untrusted collaborators, and the engineering discipline lives in the scaffolding, not the model.

Applying This to Your Stack

For any ML system with consequential outputs, the architecture is:

1. Proposer: Your ML model generates candidates (predictions, code, trajectories, recommendations)
2. Verifier: A deterministic system validates against hard constraints (physics, tests, schemas, business rules)
3. Arbiter: When proposer and verifier conflict, a defined policy decides — and logs the disagreement for analysis

The anti-pattern to avoid: treating the verifier as a fallback. Both systems must run on every invocation. The proposer-verifier disagreement rate is your best proxy for model reliability.