CTO at https://xitter.cf/t.co/Z3EHfBZENz and transient fad enthusiast
Dublin
Joined December 2008
- Tweets8.5K
- Following804
- Followers800
- Likes8.2K
HTTP 402 "Payment Required" spent 20+ years mostly unused, or sent only by people mistyping 403s in their apps. Now it's how AI agents pay for things.
I sat down with Ben Smith at @stripe to talk #MPP , agentic commerce, and what developers need to know: youtu.be/Nv-dRPwwVxo?si=JMto…
We got into:
* Why we built a deliberately useless football API to learn MPP
* Shared payment tokens: give your agent "$2, this shop only", not your credit card
* How exactly agents can discover paid APIs
* Agents buying their own compute, no sign-ups needed!
Have a watch!
"An AI agent used my site" up to now has meant a screenshot, find the button, click, pray the DOM didn't move. It's brittle, and it burns a staggering number of tokens.
WebMCP flips it: your site hands the agent tools to call directly. I tested it - ~27× fewer tokens used. 🧵
While WebMCP is new, it's certainly not a toy: Stripe recently brought WebMCP to their hosted checkout. The old browser-driving way cost ~1.8M tokens per purchase, 42% lower with WebMCP.
I tried it on one of my own sites - average of ~27× fewer tokens, up to 82×, ~1/22 the cost.
It being new does mean agents are still catching up to the spec, so they need prodding to find the tools today (Codex took more than a few reminders, see the screenshot below!)
What WebMCP is, the real numbers, how to switch it on, and the rough edges:
conroyp.com/articles/making-…
Paul Conroy retweeted
I wanted to stop controllers calling external services, however deep in the call graph.
So I built a PHPStan extension: mark external calls as 'slow', forbid 'slow' in controllers, and let it flag violations. Probably has many other uses too.
github.com/DaveLiddament/php…
Paul Conroy retweeted
Lerd is a free, open-source local PHP development environment for Linux and macOS, think Laravel Herd, built for people who also run Linux.
It runs nginx, PHP-FPM, your databases and services as rootless Podman containers, managed by systemd on Linux. There is no Docker daemon, nothing runs as root, and nothing is installed into your system PHP or your package manager's paths, so uninstalling leaves a clean machine.
You get .test domains with trusted HTTPS, every PHP version side by side, a web dashboard, a terminal UI, a CLI and an MCP server for your AI assistant.
#PHP #Laravel
When you've got bots taking your data, technical blocks are an option, but response poisoning can be far more effective retaliation. If the poisoned data looks legit, it's even harder for your adversary to spot & deal with.
An old story where we did this:
conroyp.com/articles/project…
Installing the full AWS SDK for #PHP just to perform a few S3 operations adds quite a lot of unnecessary weight.
In serverless deployments and CI pipelines, that means more to package, upload, unpack and process, and can lead to less room within platform limits.
The AWS SDK includes a Composer hook that removes services your application doesn’t use.
In a simple test for an app using only S3 and SQS, it reduced vendor/aws from around 68MB to just over 5MB, without requiring any changes to the application code.
Composer still downloads the full SDK before removing unused services. The saving is in the resulting deployment artefact. Still, a useful bit of housekeeping for keeping deployments lean, and configuring the hook is a very simple, composer-only change:
conroyp.com/articles/reduce-…
Back to Vilnius for @BuildStuffConf this December! Always a highlight, and this year marks its 15th birthday.
Also looking forward to seeing Dublin from the other side of the video portal again 🇮🇪🤝🇱🇹
#BuildStuff15 #buildstuffconf #AgeOfAgency
My talk is "Delete Your Dependencies: What the Browser Can Do Now".
As web devs, we carry around plenty of assumptions about what browsers can and can't do. Some are still true, but many are not!
The web platform has moved on, but our habits have't always followed.
We'll get hands-on w/built-in UI, local file access, screen capture, and physical devices run via the web.
Real examples, current browser support, as well as the rough edges. Time to update our context windows!
📅 December 2-4
🎟 20% off: 2026SPEAKER_20
buildstuff.events
On everythingisshowbiz.com we could always tell you what was said on What Did You Do Yesterday? But now the site can tell you who said it - every line in the archive is attributed to a #wdydy speaker. This turns "was X said?" into a much more interesting: "who said X?"
Due to the way ad networks work, the audio and text didn't always sync up. There's an experimental feature in this release which (hopefully!) lines them up a bit better in the onsite player. This is a bit more experimental, so if this is working very well/badly for you, shout!
Going from general transcription to speakers had lots of learning (diarization is very cool! Also not yet great for regional accents!)
Blog post on the tech soon, but if you're curious in the meantime, this talk from @PHPUKConference has some background
youtu.be/8aZN_1NzBAM?si=Tgwm…