cyb3ralbert

Infrastructure engineer. I write about things after building them, and I try to check claims against source rather than documentation — usually because the documentation turned out to be wrong.

github.com/cyb3ralbert

Now

Tool-level permissions in MCP servers — which tools a server actually hands to an agent, and how to hand over fewer. Small patches upstream, one server at a time, and notes from reading six of them.

Writing

What MCP servers actually expose

Which tools a server puts in tools/list, read line by line across six codebases. Includes the survey I got wrong and why.

2026-07-29 · updated as servers change
git-crypt + Trezor: keeping your repo key off the disk entirely

Wiring git-crypt's GPG mode through trezor-agent, so the repo key is never on the host. With the PIN-matrix mechanics explained and the unlock UX measured.

2026-07-19
Trezor as a TOTP vault: 2FA codes that never touch disk in plaintext

Encrypting TOTP secrets with the device's own CipherKeyValue, so only ciphertext is stored.

2026-07-19
Recovering a Trezor GPG identity from a seed phrase, no hardware needed

Deterministic reconstruction of the GPG identity from BIP39 via SLIP-0010, checked against the official test vector. Answers trezor-agent#335.

2026-07-19

Code

claude-skills

Reusable Claude Code skills, including the full step-by-step for the write-ups above.
trezor-totp · trezor-gpg-recovery

Working implementations for the two Trezor write-ups.
nobsgojobs-go

Minimal Go client for a free feed of current Go/backend job postings.