New York, USA
Joined April 2009
- Tweets3.7K
- Following718
- Followers889
- Likes14.7K
Pinned Tweet
Your team uses MCP to connect their favorite AI tools to write code, access docs, and query data. MCP wasn’t built for this.
We built @runlayer to make MCP enterprise-ready.
And raised $11M from @khoslaventures @felicis to enable AI transformation.
Vítor Balocco retweeted
"If a peer comes to ask me how to deal with the agentic risk that we're all seeing the first thing I'd tell him or her is to get Runlayer." - Jonathan Jaffe, CISO at Lemonade
We're proud to partner with @Lemonade_Inc to govern their agentic workloads.
Over the past 90 days, Runlayer has managed 300K MCP tool calls across Lemonade's 1700+ person workforce while executing 25M+ security checks.
"Runlayer has allowed Security to enable the business rather than be a source of friction."
Vítor Balocco retweeted
everything i know about managing agents i learned from the amazing programmers and computer scientists that came before
constraints in your codebase are freeing for both humans and agents! this has always been true, but if you were a small dev team you likely never had to think that deeply because you could trust your fellow programmers to write code and review well
but large companies have had to solve this problem since even before agents. because before you had agent slop, you had human slop. lots of engineers wrote bad code out of necessity (eg backend engineer forced to write frontend or reverse). the solution to this was constraints: lint rules, smarter compilers and diagnostics, high quality tests, investments into observability, and so on
the arrival of agents just means that big company problems are now everyone's problems. the good news is that none of this is really that novel: it's just good engineering
youtube.com/watch?v=GqmsQeSz…
Vítor Balocco retweeted
total MCP victory, some quick misc thoughts about why MCP is so much better than CLIs:
- indexable tool catalog letting agents scale to unlimited tools
- no requirements to be running a full sandbox
- consistent auth across all MCPs rather than each CLI inventing its own auth
- multi account support for all MCPs unlike CLIs
- implementations like code mode let the model know what will be returned allowing for super efficient token usage unlike CLIs
the reasons it took this long for MCPs to finally have their moment is mostly due to bad MCP implementations in clients:
- you had to restart your whole client to use an mcp (no hot reloading)
- agents weren't as familiar with debugging mcps as they were CLIs, so it was a lot easier for people to get set up using them
but over the past year, things like codex and claude plugins have all been using MCP under the hood, i.e computer use is an MCP, i believe claude artifacts are an MCP app, just the silent steady adoption
there is still an element of MCPs that is 'this MCP could've been an OpenAPI spec' but that'll go away as things like triggers get more adoption
at the end of the day, what's important to realize is while yes there are these difference between CLIs / MCPs / etc they're all just different ways of doing tool calling, and you can do some combination of lazy loading, searchable tools, and filtering to build efficient harnesses
We’ve been using Detail’s self healing feature at @runlayer and we’re really happy. 24 bug fixes so far.
PRs always come with regression tests, follow our guidelines, and tag the right engineer to review.
They also have a dead code scanner which I love!
Vítor Balocco retweeted
We're proud to partner with @SlackHQ on their latest Add to Slack feature. Each agent you build and use is governed by Runlayer, with agent identity, access control, and audit trails built-in.
Wrangling agents should be as easy as building them. With Runlayer and Slack, it is.
Opinions on agentic engineering appear to be converging into two camps:
"You should put a lot of planning up front, all the way down to program design, then let the agents cook", aka the @humanlayer_dev way.
vs
"Do a shit ton of investment in architecture/linters/LLM checks/automatic verification upfront, and then let agents rip. Garbage collect periodically", aka the @poteto way.
I currently land somewhere in-between:
- A bunch of research and planning up front, but skip program design unless I identify that a net-new abstraction will be needed, or I know I'm working on high-stakes/core code.
- For "every day" stuff, I lean heavily on guardrails.
- Frequent sampling of PRs that have been landing on main to spot problematic code that should've been caught by a guardrail. Add more guardrails to catch it, burn down the offenders.
- Frequent sampling of hot spots in the codebase, to detect when human intervention is needed, e.g. an abstraction has grown out of control. Maybe I oughta build a heatmap visualization for this?
- I also love @poteto 's take on the tier of guardrails (opinionated architecture > static analysis > tests > LLM checks)
Vítor Balocco retweeted
if your definition of coding is just the act of typing code, then yes, it's solved. agents can type code faster than anyone can.
but i think most of us think of coding as the act of solving problems with code. in that definition, coding is definitely not solved. agents can generate code quickly and build whatever you want, but without the right constraints, they end up causing more problems than they solve.
i think of this like my gardening analogy. agents are like magic beans that grow in any condition, but in wild and unpredictable ways. if you put the right scaffolding around them however, they can grow into whatever shape you want.
you still want humans thoughtfully and intentionally steering this outcome. we have a name for them: engineers. agents have greatly lowered the barrier to entry to doing engineering. what was once the domain of those who understood syntax and logic is now accessible to anyone who can explain their ideas. english is a new programming language for engineering outcomes with agents.
now, even ordinary people can build impressive software. and the good ones will learn engineering through first principles. as someone who is a self-taught programmer (i first learned how to code through Excel macros!), this is incredibly exciting to me, and i can't wait to see what everyone learns and builds in this new world.
let a thousand gardens bloom!
I'm speaking at Navigate on Sept 10 in SF, @browserbase's conference on what it takes to run AI agents in production. My talk is on building agent factories in @runlayer. Come find me if you're working on agents. browserbase.run/sigyk2X
Vítor Balocco retweeted
Run one AI reviewer and you might find a bug. Run your PR through Bugbot, Codex, and four specialized sub-agents with an orchestrator, and you will definitely find a bug.
Not everything that can be fixed should be fixed. New blog post:
faingezicht.com/articles/202…
