Blog
Technical writing on LLM token costs, AI agent memory, and OpenID Connect — by the ContextIQ team.
How to detect whether an MCP server's authorization server is a full OpenID Connect provider or bare OAuth 2.0, using RFC 9728 and RFC 8414 discovery — with real results from Linear, Notion, and Hugging Face.
Inside the MCP and A2A conformance checks that go beyond detection: server/discover vs the legacy initialize handshake, RFC 9728 auth metadata, CIMD vs DCR, and agent-card spec-lint rules.
How to diff two Agent Protocol Inspector scans to catch MCP and A2A regressions — a removed tool, a dropped auth mechanism, a downgraded protocol status — in CI with curl and jq.
How to generate identity governance (IGA) access-review evidence for an MCP or A2A AI agent, and get it into Okta, SailPoint, or Saviynt certification workflows.
A curl-based tutorial for the Agent Protocol Inspector API: scanning an MCP or A2A target, retrieving a stored scan by scanId, and diffing two scans for a pass/warn/fail verdict.
Call ContextIQ's x402 Inspector via wire v2: CAIP-2 networks, the PAYMENT-REQUIRED header, Bazaar discovery, and paying with @x402/fetch on Base.
Call ContextIQ's Policy Check (Agent Commerce Gate) via x402 wire v2 for a pre-payment allow/warn/block decision on identity, reputation, and payment risk.
Verify an x402 settlement on-chain via ContextIQ's receipt endpoint: ERC-20 Transfer decoding, CAIP-2 networks, and binding a tx hash to a prior Policy Check decision.
Re-fetch a prior Agent Commerce Gate decision by checkId via x402 wire v2, without re-running identity, reputation, or payment checks.
Call ContextIQ's ERC-8004 Inspector via x402 wire v2 for on-chain agent identity and reputation lookups on Ethereum, Base, Arbitrum, Polygon, and more.
Call ContextIQ's DNS Inspector through its x402 wire v2 endpoint: A/AAAA/MX/TXT/CAA lookups, SPF/DMARC verdicts, and paying with @x402/fetch or an API key.
Call ContextIQ's Agent Protocol Inspector via x402 wire v2 to detect MCP, A2A, ARD, and llms.txt support on any URL, paid with @x402/fetch or an API key.
How to bind an x402 settlement receipt to an Agent Commerce Gate decision on ContextIQ, verify it against USDC transfers on Base independently, and feed the noPriorRugReports check that flags endpoints that took payment but sent funds elsewhere.
A real scan of 135 x402-payable services from Coinbase's Bazaar catalog shows why 'accepts x402' isn't 'safe to pay' — and how ContextIQ's Policy Check API combines ERC-8004 identity with x402 validation to decide.
A hands-on x402 walkthrough: the 402 challenge, signing a USDC payment on Base with x402-fetch, and reading the ERC-8004-backed decision from ContextIQ's Policy Check API.
Five real examples of ContextIQ's Policy Check combining ERC-8004 identity/reputation with x402 payment validation into a transparent allow/warn/block decision.
Agent commerce pairs x402's USDC micropayments with ERC-8004's on-chain Identity and Reputation registries — how AI agents pay and vet strangers autonomously.
A hands-on ERC-8004 walkthrough: read the Identity Registry, decode tokenURI, and check Reputation Registry feedback for real agents on Ethereum and Base Sepolia.
x402 v2 replaces v1's bare network strings with CAIP-2 IDs like eip155:8453, renames maxAmountRequired to amount, and moves resource/description into extra.
x402 turns HTTP's dormant 402 status into USDC micropayments for AI agents on Base and Solana — built by Coinbase and Cloudflare, now under the x402 Foundation.
ERC-8004 gives AI agents a portable ERC-721 identity plus on-chain Identity, Reputation, and Validation registries — Ethereum's trust layer for unfamiliar agents.
MCP 2026-07-28 replaces initialize and Mcp-Session-Id with a stateless server/discover core — Hugging Face and Cloudflare comply, DeepWiki still runs legacy.
SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489) work together to stop email spoofing — SPF authorizes sending servers, DKIM cryptographically signs messages, and DMARC enforces a reject or quarantine policy when both fail.
NS records reveal a domain's DNS host and MX records reveal its mail provider — Cloudflare, AWS Route 53, and GoDaddy nameservers, and Google Workspace or Microsoft 365 mail servers, each carry a distinct hostname signature.
CAA records (RFC 8659) restrict which certificate authorities may issue TLS certificates for a domain. Without one, Let's Encrypt, DigiCert, Sectigo, GlobalSign, and every other public CA can lawfully issue a valid certificate for it.
How MCP (Anthropic), A2A (Google, Linux Foundation), and the new ARD spec from Google, Microsoft, and Hugging Face split the AI agent protocol stack.
SEP-2127 gives MCP servers a discovery document at /.well-known/mcp/server-card. How server cards work with Streamable HTTP, OAuth 2.0, and RFC 9728 metadata.
A practical checklist for agent discoverability: llms.txt for LLM crawlers, A2A agent-card.json, ARD ai-catalog.json, robots.txt Agentmap, and MCP server cards.
The ARD spec from Google, Microsoft, Hugging Face, and GoDaddy lets AI agents discover tools via ai-catalog.json, robots.txt Agentmap, and registries.
The A2A protocol's Agent Card is a JSON file at /.well-known/agent-card.json declaring an agent's skills, protocolVersion, and securitySchemes. Field-by-field guide.
How o200k_base, cl100k_base, and SentencePiece tokenizers give GPT-4o, Claude 3.5 Sonnet, Gemini 1.5 Pro, and Llama 3.1 different token counts for the same text.
How GPT-4o automatic prompt caching, Claude Sonnet 4.6 cache_control, and Gemini 2.5 Pro context caching reduce repeated-prefix token costs by 50–90% for system prompts, RAG documents, and few-shot examples.
PKCE (RFC 7636) prevents authorization code interception in OAuth 2.0 flows across Auth0, Okta, AWS Cognito, Keycloak, and Azure AD. Here is how the code_verifier and code_challenge work and where PKCE is now mandatory.
MCP (Model Context Protocol) is Anthropic's open standard for connecting AI agents to external tools via JSON-RPC 2.0 over stdio or SSE. Used by Claude Desktop, Cursor, Cline, LangGraph, and OpenAI Agents SDK to expose tools, resources, and prompts.
Practical comparison of OpenAI text-embedding-3-small, text-embedding-ada-002, text-embedding-3-large, BGE-large-en-v1.5, and BGE-M3 for RAG pipelines in LangChain, LlamaIndex, Pinecone, and Weaviate — covering MTEB scores, token limits, and cost.
Auth0, Okta, AWS Cognito, Keycloak, and Azure AD each expose their OpenID Connect discovery document at different paths, with different subdomain conventions, grant type defaults, and PKCE requirements that affect how your app fetches tokens and JWKS keys.
Why LangGraph and LangSmith traces using langsmith.span.kind and langgraph.graph.id render blank in OpenTelemetry tools, and how to map them to gen_ai.agent.name and gen_ai.tool.name.
Step-by-step guide to diagnosing infinite loops, failing tool calls, and token blowout in LangGraph, CrewAI, and OpenAI Agents SDK agents using OTLP span data.
A practical comparison of OWL ontologies and Neo4j knowledge graphs for AI systems, covering RDF, SPARQL, LangGraph graph-based RAG, and LlamaIndex property graphs.
Context engineering is the practice of designing what goes into a GPT-4o, Claude Sonnet 4.6, or Gemini 2.5 Pro context window at inference time — system prompts, RAG chunks, conversation history, tool results, and memory outputs competing for a fixed token budget.
A step-by-step context engineering example for a LangGraph customer support agent using GPT-4o, Pinecone, text-embedding-ada-002, and tiktoken — showing how Memory Visualizer, Token Inspector, RAG Chunk Inspector, and Agent Trace Inspector work together.
The practical skills context engineering builds — token budget design, RAG retrieval precision, memory architecture for LangGraph and CrewAI agents, and trace analysis with OpenTelemetry — and why they separate production AI engineers from prototype builders.
How to estimate the turn at which a GPT-4o, Claude Sonnet 4.6, Gemini 2.5 Pro, or LangGraph agent exhausts its context window using stable-layer baselines, Pinecone retrieval budgets, and conversation history growth rates.
A direct comparison of how LangSmith, Langfuse, and LangGraph Studio visualize LangGraph, CrewAI, AutoGen, and OpenAI Agents SDK agent runs — and where each tool's graph falls short.
A guide to the OpenTelemetry GenAI semantic conventions — gen_ai.agent.name, gen_ai.tool.name, gen_ai.usage.input_tokens — and how to use them to debug LangGraph ReAct loops, CrewAI pipelines, and OpenAI Agents handoffs.
How HyDE (Hypothetical Document Embeddings) closes the query-document gap in RAG using all-MiniLM-L6-v2, LangChain, LlamaIndex, Claude Haiku 4.5, and GPT-4o mini.
A structural comparison of LangGraph StateGraph, CrewAI Crew, AutoGen GroupChatManager, and Google ADK SequentialAgent — with real code patterns and a visual breakdown of how agents, tools, and edges connect.
Compare token-based, sentence-boundary, and paragraph-boundary chunking strategies for RAG pipelines using tiktoken, LangChain, LlamaIndex, Pinecone, and Weaviate.
Diagnose poor RAG retrieval caused by wrong chunk size and overlap settings. Covers tiktoken token limits, text-embedding-ada-002 truncation, LangChain splitters, and Pinecone upsert cost.
A breakdown of the four AI agent memory layers — working, episodic, semantic, and procedural — and how LangGraph, CrewAI, AutoGen, and OpenAI Agents SDK implement each in production.
A practical cost breakdown comparing GPT-4o, Claude 3.5 Sonnet, and Gemini 1.5 Pro at production scale. See exact token prices, cost projections at 10,000 requests per day, and which model wins on value for different workloads.
