Blog
Thoughts on engineering, products, and building software.
payloadcms-mcpx: schema on demand and JSON Pointer patches for Payload CMS
Why we built a Payload CMS plugin that hands agents the field shapes one node at a time and takes writes as RFC 6902 patches, instead of inlining the whole schema and taking the document back whole.
stillmap: static maps without a browser, a key, or a third party
Why we built a TypeScript library that renders a map to SVG or PNG in plain Node.js®, with no headless browser, no native map library, and no API key.
Killing the ArgoCD token: trading GitHub Actions OIDC for scoped sync access
How to let GitHub Actions diff and sync ArgoCD applications without a static ArgoCD API token in CI secrets, using ArgoCD's own built-in Dex for a token exchange and RBAC scoped to the GitHub OIDC claims.
Killing GitHub PATs: trading OIDC tokens for scoped GitHub App credentials
Why we built a broker that exchanges a GitHub Actions OIDC identity token for a short-lived, least-privilege GitHub App installation token, gated by CEL policy.
Self-hosted tunnels with real SSO: frp plus a CEL policy engine
ngrok gates team SSO behind paid tiers and Cloudflare Tunnel locks you into its Zero-Trust model. We self-host frp instead, and wrote a CEL-based server plugin so our own IdP decides who can proxy what.
oidc-token-cli: one OIDC client for every tool
Why we built a small Go CLI that fetches and caches OpenID Connect tokens, so kubectl, frpc, curl, and CI never have to implement auth themselves.
Why we built abi group
A first note from the founders: what abi group is, why we started it, and what we hold to.