Loading video...

Video Failed to Load

Go Home

New Expo example: graphQL server and client with ✨automatic type generation✨! 🧘‍♀️ GraphQL Yoga - server 💜 URQL - client 🎉 gql.tada - type generation ☁️ EAS Hosting - for API & web deployments

17,470 views • 1 year ago •via X (Twitter)

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

New course: MCP: Build Rich-Context AI Apps with Anthropic. Learn to build AI apps that access tools, data, and prompts using the Model Context Protocol in this short course, created in partnership with Anthropic Anthropic and taught by Elie Schoppik Elie Schoppik, its Head of Technical Education. Connecting AI applications to external systems that bring rich context to LLM-based applications has often meant writing custom integrations for each use case. MCP is an open protocol that standardizes how LLMs access tools, data, and prompts from external sources, and simplifies how you provide context to your LLM-based applications. For example, you can provide context via third-party tools that let your LLM make API calls to search the web, access data from local docs, retrieve code from a GitHub repo, and so on. MCP, developed by Anthropic, is based on a client-server architecture that defines the communication details between an MCP client, hosted inside the AI application, and an MCP server that exposes tools, resources, and prompt templates. The server can be a subprocess launched by the client that runs locally or an independent process running remotely. In this hands-on course, you'll learn the core architecture behind MCP. You’ll create an MCP-compatible chatbot, build and deploy an MCP server, and connect the chatbot to your MCP server and other open-source servers. Here’s what you’ll do: - Understand why MCP makes AI development less fragmented and standardizes connections between AI applications and external data sources - Learn the core components of the client-server architecture of MCP and the underlying communication mechanism - Build a chatbot with custom tools for searching academic papers, and transform it into an MCP-compatible application - Build a local MCP server that exposes tools, resources, and prompt templates using FastMCP, and test it using MCP Inspector - Create an MCP client inside your chatbot to dynamically connect to your server - Connect your chatbot to reference servers built by Anthropic’s MCP team, such as filesystem, which implements filesystem operations, and fetch, which extracts contents from the web as markdown - Configure Claude Desktop to connect to your server and others, and explore how it abstracts away the low-level logic of MCP clients - Deploy your MCP server remotely and test it with the Inspector or other MCP-compatible applications - Learn about the roadmap for future MCP development, such as multi-agent architecture, MCP registry API, server discovery, authorization, and authentication MCP is an exciting and important technology that lets you build rich-context AI applications that connect to a growing ecosystem of MCP servers, with minimal integration work. Please sign up here!

Andrew Ng

142,137 views • 1 year ago

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

217,804 views • 8 months ago

JWT in 60 Seconds 👇 What is JWT ? JWT = JSON Web Token A compact, URL-safe token used for: - Authentication - Authorization - Secure API communication - Identity sharing between services It is digitally signed, so it can be verified and trusted. 🟢 Why JWT exists Typical flow without JWT: User → Application → Database (Session Store) - Server stores sessions - Requires memory/storage - Hard to scale in microservices - More infrastructure complexity - Needs sticky sessions behind Load Balancer - This doesn’t scale well in distributed systems. 🟢 JWT comes into the picture - JWT is stateless authentication. New flow: User → Application → JWT → Client → API - No session stored on server - Token carries user identity & claims - Server only verifies signature - Perfect for scalable systems. 🟢 Complete JWT request flow 1️⃣ User logs in with credentials 2️⃣ Server validates user 3️⃣ Server generates JWT (Header + Payload + Signature) 4️⃣ Client stores JWT (usually in browser/app) 5️⃣ Client sends JWT in Authorization header 6️⃣ Server verifies signature 7️⃣ If valid → Access granted No database lookup for session needed. 🟢 Where JWT is used in real systems? - REST APIs - Microservices authentication - OAuth2 / SSO - API Gateways - Kubernetes dashboards - CI/CD tools - Mobile & SPA applications - Almost every modern cloud-native app uses JWT. 🟢 JWT in DevOps & System Design : As a DevOps engineer, JWT knowledge is used in: - Designing stateless applications - Scaling apps behind Load Balancers - Implementing API security - Working with IAM & OAuth providers - Securing microservices communication - Reducing session storage dependency Stateless auth = Better scalability + Simpler infrastructure Thanks for reading. Happy Learning !

Nandkishor

27,790 views • 6 months ago

This Chinese guy created agents in Claude Code for MCP servers and single-handedly serves 6 marketing agencies a month from one iPhone, earning $5,000 from each. Inside he runs a pipeline of 7 agents on Claude Sonnet 4.6 that every Monday pulls a scan of the tech stack from a selected agency, develops an MCP server for its ad accounts, and over the course of a week brings it to production code ready to connect to Claude Desktop. No DevOps, no senior developer, no project manager. Just a Mac Mini in a work corner, an iPhone in the pocket, and a single API key. And traditional dev shops keep 5 people on project rates for the same contract, while his entire P&L is tokens, dirt-cheap hosting on Cloudflare, and Calendly. 7 agents run under a shared orchestrator-router and burn about 5 million tokens a day, which in the API bill comes out to $540 a month. The Mac Mini itself sits at home and keeps the entire orchestrator running 24/7, and from the iPhone the owner connects to it through a secure remote terminal and sees the output of any session right on the smartphone screen, wherever he happens to be. His starting system prompt looks like this: "you run a solo shop for custom MCP servers for marketing agencies. you hand out read-only tasks to 6 sub-agents and own all commits and shipping yourself. sub-agents: // Hunter (finds marketing agencies of 15 to 60 people that have no MCP access to Google Ads, Meta Ads, TikTok Ads, and HubSpot) // Mapper (pulls their tech stack, identifies 3 to 5 integration pains, and simultaneously writes the technical spec for the server: which tools, resources, and prompts to export through MCP, which auth flow and rate limit) // Coder (generates an MCP server in Python through the MCP SDK, deploys 8 to 15 tools for ad accounts and CRM) // Validator (connects the server to Claude Desktop, runs real client API keys in a sandbox, and checks for compliance with the MCP spec) // Shipper (writes a README, integration guide, deployment manual, packages the server, and hosts it on Cloudflare Workers or pushes to the GitHub of the client) // Mobile (always online on the iPhone, books demo calls in Calendly, picks up hot fixes, and confirms contracts through a secure remote terminal to the Mac Mini). only 1 owner agent works on 1 contract, no overlaps. you pull the owner out of observation mode only when a deal goes above $7,500 or the test coverage of the server drops below 85%." This prompt gives the system an understanding of its role and the limits of intervention from the very first line. It knows it is supposed to find agencies on its own. It knows it is supposed to bring every MCP server to production on its own. It knows it connects the live owner only on large deals or when the tests do not converge. → The pipeline runs without breaks, day or night → Hunter goes through about 130 marketing agencies on LinkedIn and Clutch per day → Mapper rolls out 4 audit reports with the tech stack and a final spec for each → Coder writes 1 to 2 MCP servers per week in Python with 8 to 15 tools → Validator validates every server through Claude Desktop with real client API keys → Shipper rolls out the full documentation package and pushes the finished product to Cloudflare Workers or the GitHub of the client And only when a contract breaks $7,500 or test coverage drops below 85% does the orchestrator pull the owner from whatever he is doing. And when the owner at that moment is behind the wheel or at a meeting in a coworking space, the Mobile agent in his iPhone picks up 1 contract in progress: confirms a meeting with the agency CMO in Calendly, opens a live demo of the MCP server through a secure terminal to the Mac Mini, and writes the test result to the shared state. The owner just swipes "approve" and in 15 minutes joins the Zoom demo. The fresh system log from last Wednesday looks like this: "hunter report: 132 agencies checked on LinkedIn and Clutch, 19 without MCP integrations, 8 with active requests for AI tooling in job posts, 4 with an open Q4 budget. passing to mapper." "coder: MCP server for Northwave Performance Marketing built in Python, 11 tools for Google Ads, Meta Ads, and GA4, 320 lines of code. exported to /Users/dev/mcp-shop/clients/northwave/server.py. validator connecting to Claude Desktop." "validator: 11 tools passed validation through Claude Desktop, test coverage 92%, average latency 380 ms. passing to shipper." "eval flag: contract with Pacific Reach Agency at $8,200 exceeds the approved limit of $7,500. sending for manual review." In his work setup there is no cloud server, no external team, and not even a separate office. At home sits a Mac Mini with a sandbox at /Users/dev/mcp-shop, on top runs an MCP router with a single API key to Claude, and the same key is forwarded to a secure terminal on the iPhone. Out of everything I have seen this year, this is the cleanest solo shop for custom MCP servers for marketing agencies: $540 a month on the API, about $30,000 into the account, and between them 7 system prompts, 1 Mac Mini in a work corner, and 1 iPhone that never leaves the pocket.

Blaze

55,926 views • 4 months ago

Anthropic won't like this open-source repo. It is going to cost LLM providers a lot of money. Every CI run of an AI app today sends real requests to providers like OpenAI or Anthropic. Like any other LLM call, this too gets billed at actual API rates. So for teams with high commit volumes, this accumulates into a meaningful chunk of API spend. One common hack devs use is that instead of invoking the LLM API, the test calls a fake local server that speaks the same API and returns a dummy response. The catch is that the dummy response is a copy of what the provider returned on the day it was saved, and providers keep adding fields and changing types. So the tests keep passing against a schema that's no longer valid, while the real integration breaks in production. A smart approach is now actually implemented in CopilotKit🪁's recently open-sourced aimock project. Every day, the repo's own CI sends a handful of requests to the real API and the same requests to the fake server, then compares both against the official client library's type definitions. Those are the only real API calls in the whole setup, and they run on the repo's own keys, not in anyone else's CI. A single team can push hundreds of commits a day, and thousands of teams are already doing that with coding agents. All of those runs stay offline, because one repo checks against the real API on everyone's behalf. When a check fails, a coding agent updates aimock's built-in response schema, the full test suite has to pass, and a patch version ships to npm. By simply upgrading the package, the corrected schema gets reflected in every project using it. The capability is not just limited to a single provider. The same server works for Claude, OpenAI, Gemini, Bedrock, Azure, Ollama, plus MCP tools, A2A agents, AG-UI event streams, vector DBs like Pinecone and Qdrant, and search, speech, image, and video endpoints. Here's the repo: (don't forget to star it ⭐) That said, mocking your API calls is one thing. AI engineers should also know how to test agents properly in the first place, which several teams still skip. I wrote a full walkthrough on that, covering build, testing, evals, tracing, and deployment. Read it below.

Akshay 🚀

62,821 views • 18 days ago