Posts

A fair coin flip returns true half the time. A weighted coin flip returns true a chosen fraction of the time — 10%, 25%, whatever the simulation or generative-art piece needs. The function is one line built on Math.random(); the useful part is confirming the true rate tracks the weight and that the boundaries behave. This tutorial writes it as an ES module, pins the behavior with a Node test suite, prints a distribution at 10%, and paints the results on a browser canvas. ...

Picking a random element from an array comes up constantly: rolling dice, shuffling prompts, choosing a color. The whole job is one line of JavaScript, but the interesting part is proving it behaves — that the picks are spread across the array and never fall off either end. This tutorial builds that one-liner as an ES module, backs it with a Node test suite that pins down the boundary behavior, adds a distribution demo, and then draws the results on a browser canvas so you can see the spread. ...

tree prints the contents of a directory as an indented, ASCII-art hierarchy. It is one of the fastest ways to understand or document a project layout, and it ships as a small Homebrew package. This tutorial installs tree on macOS, walks through the flags you reach for most often, and wraps them in a reproducible demo project whose output is checked against committed golden files. Prerequisites macOS with a Terminal (the built-in Terminal.app or iTerm2) Homebrew (installed in Step 1 if you do not have it) make (pre-installed with the Xcode Command Line Tools on macOS) No programming language or runtime required The commands were validated with tree v2.3.2 and Homebrew 6.0.10 on macOS. ...

The read-only Postgres MCP server built its safety on the database server: a SELECT-only role, a read-only transaction, a statement timeout, all enforced by a process on the other side of a socket. SQLite has none of that machinery. There is no server, no accounts, no GRANT. The database is a file, the engine runs inside your process, and any connection that can open the file read-write can do anything to it. ...

Give a language model a database tool and the obvious failure mode is not a clever exploit. It is a well-meaning model running DELETE FROM orders because a prompt told it to “clean up test data,” or issuing SELECT * FROM events against a billion-row table and stalling everything behind it. A database MCP server has to assume the caller is careless, and sometimes hostile. In this tutorial you will build a FastMCP server that exposes a Postgres database to an MCP client as strictly read-only, with the safety built in layers so no single mistake opens a hole: ...

You want a package registry running on your own Mac. The reasons are usually one of these: hosting private packages that should not go to a public index, rehearsing a publish before it becomes irreversible, working offline or air-gapped, caching upstream packages so CI is not at the mercy of npmjs.com or PyPI, or sharing internal libraries across a small team without paying for SaaS. The options range from a one-process container that does exactly one thing to a multi-gigabyte Java application that hosts a dozen package formats. This article rates the realistic contenders, then proves the top picks by actually publishing and installing real npm and Python packages against them. Docker is on the table throughout; every registry here runs as a container. ...

A sibling article, Publish a FastMCP Server to PyPI and Run It Anywhere with uvx, ships a package to the public PyPI index. This one skips the index entirely. If your code is a Git repository, uvx can install and run its console script straight from the repo: uvx --from git+https://github.com/your-username/textkit textkit --help That command clones the repo into a cached, throwaway environment, builds the package, and runs its console script — no git clone, no virtualenv, no pip install on the user’s side. For a personal utility, an internal tool, or anything you are not ready to name on PyPI, a GitHub repo is the whole distribution channel. ...

Packaging an MCP server as a Docker image gives clients one launch command with no Python, no uv, and no virtual environment to manage on the host: they run the container. This tutorial builds a small, non-root image for a FastMCP server with a multi-stage build, runs it over stdio the way a client does, and wires it into a client’s .mcp.json with docker run. The build uses uv in the builder stage and copies only the finished virtual environment into a slim runtime stage, so the final image carries the app and its dependencies — not the build toolchain. ...

An installable MCP server needs the same release discipline as any Python package: lint and test every change, build the artifact, and publish on a tagged release. This tutorial wires that pipeline with GitHub Actions and uv — ruff for linting and formatting, pytest for tests, uv build for the wheel/sdist, and PyPI trusted publishing (OIDC, no stored token) on a version tag. It is the CI/CD companion to Publish a FastMCP Server to PyPI and Run It Anywhere with uvx. ...

An MCP server is an attack surface. It runs with real privileges (a filesystem, API credentials, a database), it accepts arguments chosen by a model that may be under an attacker’s influence, and its results flow straight back into a model’s context. Most MCP defenses are the server author’s responsibility — the client cannot enforce them for you. This tutorial builds one hardened FastMCP server, a sandboxed “knowledge base,” and demonstrates a defense for each of the common MCP threats: input validation, the confused-deputy problem, prompt injection carried in tool results, tool poisoning, and the token-passthrough anti-pattern. Every defense is backed by a test, so you can see it hold. ...