The Statio blog

• 
  October 28, 2026 · 5 min read · Dan Flanagan

  GitHub MCP vs GitLab MCP: setup, tools and how far you can lock each down

  GitHub's MCP server against GitLab's, which went GA in GitLab 19.5: endpoints, sign-in, tool counts, toolsets, read-only modes and the merge tools both ship, plus the community GitLab servers.

• 
  October 26, 2026 · 5 min read · Dan Flanagan

  The best MCP servers for software engineering, and the tools to hold back

  The MCP servers worth connecting for coding, issues, errors, docs, browsers, databases and deploys, with tool counts, versions checked in October 2026, and the write tools each agent should not get.

• 
  October 25, 2026 · 6 min read · Dan Flanagan

  Four MCP security incidents and the control that would have stopped each

  A LiteLLM auth bypass in CISA's exploited list, SSRF in the official fetch server, forged Grafana MCP sessions and a malicious postmark-mcp package: what broke, which versions, and the fix for each.

• 
  October 18, 2026 · 7 min read · Dan Flanagan

  MCP proxy vs MCP gateway: what a pass-through proxy can't do

  An MCP proxy forwards messages between a client and a server. A gateway adds the decisions: per-tool access, agent identity, key storage and a log. Both shown with code I ran.

• 
  October 14, 2026 · 10 min read · Dan Flanagan

  Your triage agent can also merge pull requests

  Per-server MCP access lets an agent that reads your issues merge pull requests too. What splitting servers costs, and how Statio decides access one tool at a time.

• 
  October 12, 2026 · 10 min read · Dan Flanagan

  Best MCP gateways: six questions that decide which one fits

  How to choose an MCP gateway: per-tool access, agent identity, key storage, hosting, audit logs and price, with Runlayer, TrueFoundry and open-source options from their own docs.

• 
  October 12, 2026 · 4 min read · Dan Flanagan

  Statio is open: MCP access decided one tool at a time

  Statio is open to everyone today. Give each AI agent its own identity, allow or deny MCP access per tool, keep credentials out of the model and record every call. Free plan, no card.

Looking for posts on Go, CI and side projects? Those are on the founder's blog, Logical Bytes.