# AEO Published articles for AEO. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Patching This Site's MCP Endpoint and Limiting What It Can Do DevFeed: [Patching This Site's MCP Endpoint and Limiting What It Can Do]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-09-08T00:00:00Z Content type: tutorial Language: en Sources: [brent.leekley.me blog]() Topics: [Model Context Protocol](), [MCP Server](), [API](), [HTTP](), [JSON]() Tags: [aeo](), [agent-ready-website](), [agentic-ai](), [agents](), [api](), [api-security](), [clients](), [json-rpc](), [logs](), [mcp](), [mcp-server](), [model-context-protocol](), [prompt-injection](), [protocol](), [rate-limiting](), [retry](), [server](), [streamable-http](), [webmcp]() ### AI overview This article explains how to patch a website's public, unauthenticated MCP endpoint. It covers updating to the current protocol revision while retaining compatibility with older clients, and applying limits including read-only tools, per-IP rate limiting, request-size caps, Origin checks, POST-only access, non-reflected strings, and privacy-preserving logs. ### Source excerpt An MCP server on your website is a public, unauthenticated API. Bringing one to the current protocol revision while keeping older clients working, and the seven limits that bound it: read-only tools, a per-IP rate limit that always sends Retry-After, hard caps on body and argument size, an https-only Origin check, POST only, no reflected strings, and logs that store a salted hash instead of an address. ## AI agents gain distinct identities and permissions, but accountability remains the harder problem DevFeed: [AI agents gain distinct identities and permissions, but accountability remains the harder problem]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-12T00:00:00Z Content type: opinion Language: en Sources: [brent.leekley.me blog]() Topics: [Artificial Intelligence](), [Cisco](), [Duo](), [Authorization](), [trust]() Tags: [aeo](), [agent-identity](), [agentic-ai](), [agenticops](), [ai](), [ai-agents](), [answer-engine-optimization](), [cisco](), [cisco-cloud-control](), [cisco-live](), [cisco-live-2026](), [duo](), [duo-iam](), [identity](), [jeetu-patel](), [non-human-identity](), [permissions]() ### AI overview This commentary argues that AI agents are becoming operational actors with distinct identities, permissions, and lifecycles. It describes Cisco's approach of assigning agents identities, linking them to accountable humans, limiting permissions, and requiring human approval for proposed changes, while emphasizing that accountability and ongoing oversight remain unresolved challenges. ### Source excerpt Cisco Live 2026 made AI agents their own kind of identity, with permissions and an accountable human owner. Why issuing the identity is the easy 20 percent, what real accountability takes, and how the same agents quietly became the audience we now write for. ## Your robots.txt Says Yes. Your Firewall Says 403. DevFeed: [Your robots.txt Says Yes. Your Firewall Says 403.]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-11T00:00:00Z Content type: article Language: en Sources: [brent.leekley.me blog]() Topics: [Cloudflare](), [AI Bots](), [AI search](), [Crawler](), [Firewall]() Tags: [403](), [aeo](), [ai-bots](), [ai-crawl-control](), [ai-crawlers](), [ai-search](), [ai-visibility](), [blocking](), [bot-management](), [chatgpt-user](), [cloudflare](), [firewall](), [gptbot](), [oai-searchbot](), [perplexity](), [robots](), [robots-txt]() ### AI overview A field note explains how a Cloudflare AI-bot blocking setting returned 403 responses to all AI agents even though the site's robots.txt allowed AI search and blocked training crawlers. It distinguishes training crawlers, search indexers, and user-triggered fetchers, and recommends auditing enforcement at the firewall layer. ### Source excerpt A client's robots.txt welcomed AI search and blocked training crawlers, but Cloudflare's blunt AI-bot toggle was returning 403 to every AI agent at the edge. How the block was found, the AI Crawl Control fix, and why you should audit enforcement, not intent. ## Beyond the Click: 5 Counter-Intuitive Truths About the New Era of AI Search DevFeed: [Beyond the Click: 5 Counter-Intuitive Truths About the New Era of AI Search]() Original publisher: [Read original article]() Author: Brent Leekley Published: 2026-06-07T00:00:00Z Content type: opinion Language: en Sources: [brent.leekley.me blog]() Topics: [AI search](), [Search engine optimization (SEO)](), [Artificial Intelligence](), [Large Language Model](), [observability](), [anthropic]() Tags: [aeo](), [agentic-ai](), [ai-search](), [answer-engine-optimization](), [anthropic](), [brand-visibility](), [chatgpt](), [llm](), [observability](), [seo](), [zero-click]() ### AI overview This field note argues that AI-driven, zero-click search is shifting growth strategy from traditional SEO toward Answer Engine Optimization. It discusses the Mirror Effect, in which large language models form a brand narrative from the broader web rather than only a company website, and argues that reputation management, authentic content, and observability are increasingly important for brand visibility. ### Source excerpt The shift from SEO to AEO: the Mirror Effect, social signals, productivity arbitrage, the authenticity paradox, and agentic AI. Five counter-intuitive truths about brand visibility in a zero-click world.