Tinplate 42 Edge APIs

Practitioner Engineering & Security Blog

Deep-dive notes, dated benchmark results, and real-world edge cases from building 42 deterministic AI safety, MCP security, and EU compliance micro-APIs.

AI Security & Guardrails 8 min read

What I Learned Building a Deterministic Prompt-Injection Detector (With Real Bypass Examples & 104-Prompt Benchmarks)

Why most regex prompt-injection filters either miss trivial Unicode/Base64 obfuscations or block legitimate developer prompts—and how we built a two-layer deterministic engine benchmarked across 104 labeled prompts.

Agent & MCP Security 7 min read

How MCP Tool Poisoning Works in the Wild — and How to Statically Lint mcp.json Manifests

Model Context Protocol (MCP) tool descriptions are injected directly into the host LLM's system prompt. Here is how attackers abuse tool metadata—and how to lint MCP manifests before connecting.

Email & Domain Security 6 min read

Why DMARC Fails Silently for SaaS Domains (and How to Avoid the RFC 7208 SPF 10-Lookup Trap)

Most SaaS teams think their email authentication is healthy because they added an SPF record two years ago. Then Marketing adds a new ESP, total nested DNS lookups cross 10, and SPF fails with PermError.

Compliance & Localization 6 min read

Hungarian Bridge Days (Munkaszüneti nap áthelyezés) and Why Standard Business-Day APIs Get Central European SLAs Wrong

In Hungary, when a public holiday falls on a Tuesday or Thursday, ministerial decrees turn the adjacent Monday or Friday into a rest day and designate a nearby Saturday as an official working day.