The Bot Problem Nobody Talks About

If you’re running a web app in 2026, roughly 40% of your traffic isn’t human. Scrapers, credential stuffers, fake signups — they eat your bandwidth, pollute your analytics, and sometimes steal your data.

Most developers slap on a CAPTCHA and call it a day. But CAPTCHAs are a UX nightmare, and sophisticated bots solve them anyway. There’s a better approach: checking the reputation of incoming requests before they even reach your app.

The Two Signals That Matter Most

After building fraud detection systems for years, I’ve found that two data points catch 90%+ of malicious traffic:

1. IP Intelligence

Every request comes from an IP address, and that IP tells a story:

• Is it a known proxy/VPN/Tor exit node? Legitimate users sometimes use VPNs, but bots almost always do.
• Is it from a datacenter or residential ISP? Most real users browse from home or mobile — datacenter IPs are a red flag.
• Has this IP been reported for abuse? Threat intelligence feeds track IPs involved in spam, attacks, and fraud.
• What’s the geolocation? A “US user” connecting from a hosting provider in Eastern Europe is suspicious.

import requests

# Quick IP reputation check
response = requests.get(
    "https://ipasis.com/api/scan/ip/185.220.101.1",
    headers={"Authorization": "Bearer YOUR_API_KEY"}
)
data = response.json()

print(f"Risk Score: {data['risk_score']}/100")
print(f"Is VPN: {data['is_vpn']}")
print(f"Is Datacenter: {data['is_datacenter']}")
print(f"Abuse Reports: {data['abuse_count']}")

2. Email Validation

For signups and form submissions, the email address is your second line of defense:

• Does the domain actually exist? Disposable email services (guerrillamail, tempmail) are bot favorites.
• Is the mailbox real? SMTP verification catches typos and fake addresses.
• Is it a known disposable/temporary email? There are 10,000+ disposable domains.
• Is the domain newly registered? Fresh domains often exist solely for fraud.

# Email validation
response = requests.get(
    "https://ipasis.com/api/scan/email/[email protected]",
    headers={"Authorization": "Bearer YOUR_API_KEY"}
)
email_data = response.json()

print(f"Valid: {email_data['is_valid']}")
print(f"Disposable: {email_data['is_disposable']}")
print(f"Domain Age: {email_data['domain_age_days']} days")

Combining Both: A Practical Middleware

Here’s a real-world pattern I use — a middleware that scores every signup request:

from flask import Flask, request, jsonify
import requests

app = Flask(__name__)
IPASIS_KEY = "your-api-key"

def check_reputation(ip, email):
    """Score a signup attempt using IP + email intelligence."""
    risk = 0
    flags = []

    # Check IP
    ip_resp = requests.get(
        f"https://ipasis.com/api/scan/ip/{ip}",
        headers={"Authorization": f"Bearer {IPASIS_KEY}"}
    ).json()

    if ip_resp.get("is_vpn"):
        risk += 20
        flags.append("vpn_detected")
    if ip_resp.get("is_datacenter"):
        risk += 30
        flags.append("datacenter_ip")
    if ip_resp.get("abuse_count", 0) > 5:
        risk += 25
        flags.append("known_abuser")

    # Check email
    email_resp = requests.get(
        f"https://ipasis.com/api/scan/email/{email}",
        headers={"Authorization": f"Bearer {IPASIS_KEY}"}
    ).json()

    if email_resp.get("is_disposable"):
        risk += 40
        flags.append("disposable_email")
    if not email_resp.get("is_valid"):
        risk += 50
        flags.append("invalid_email")

    return {"risk_score": min(risk, 100), "flags": flags}

@app.route("/signup", methods=["POST"])
def signup():
    ip = request.remote_addr
    email = request.json.get("email", "")

    result = check_reputation(ip, email)

    if result["risk_score"] > 60:
        return jsonify({"error": "Signup blocked", "reason": "suspicious_activity"}), 403
    elif result["risk_score"] > 30:
        # Flag for manual review but allow
        return jsonify({"status": "pending_review"}), 200
    else:
        # Clean signup, proceed normally
        return jsonify({"status": "approved"}), 200

Why This Beats CAPTCHAs

The key advantage: zero user friction. Your legitimate users never see a challenge. The API call happens server-side in milliseconds, and bad actors get blocked silently.

Getting Started

If you want to try this approach, IPASIS offers a free tier with 1,000 requests/day — enough to protect a small-to-medium app. You can also test any IP or email interactively on the free scanner.

The API docs cover authentication, rate limits, and response formats. The API is REST-based with JSON responses — no SDK required.

Key Takeaways

1. Don’t rely solely on CAPTCHAs — they hurt UX and sophisticated bots bypass them.
2. IP intelligence catches infrastructure-level fraud (VPNs, datacenter IPs, known abusers).
3. Email validation catches identity-level fraud (disposable emails, fake domains).
4. Combine both for a risk score that lets you block, flag, or approve in real-time.
5. Server-side checks = zero user friction — your real users never know it’s happening.

Bot detection doesn’t have to mean annoying your users. Sometimes the smartest security is invisible.

What bot detection approach are you using? Drop a comment — I’m curious what’s working for others in 2026.

Pada postingan ini kita akan membahas cara untuk install apache_exporteruntuk memonitoring web server. Dengan itu monitoring Apache menjadi jauh lebih mudah dengan Apache Exporter, yang dapat diintegrasikan dengan Prometheus untuk mendapatkan metrics secara real-time. Berikut langkah-langkah instalasi dan konfigurasi di CentOS 7.

Download binary terbaru

Pola link:

https://github.com/Lusitaniae/apache_exporter/releases/download/v{VERSI}/apache_exporter-{VERSI}.linux-amd64.tar.gz

Cek versi rilis:

https://github.com/Lusitaniae/apache_exporter/releases/latest

Eksekusi:

wget https://github.com/Lusitaniae/apache_exporter/releases/download/v1.0.12/apache_exporter-1.0.12.linux-amd64.tar.gz

tar -xzf apache_exporter-1.0.12.linux-amd64.tar.gz
cd apache_exporter-1.0.12.linux-amd64
cp apache_exporter /usr/sbin/

Menambahkan user

useradd apache_exporter -s /sbin/nologin

Membuat folder config

mkdir -p /etc/sysconfig

echo 'OPTIONS="--scrape_uri=http://{IP Server}/server-status/?auto"' | sudo tee /etc/sysconfig/apache_exporter

Buat service

nano /etc/systemd/system/apache_exporter.service

Isi:

[Unit]
Description=Apache Exporter
After=network.target httpd.service

[Service]
User=apache_exporter
EnvironmentFile=/etc/sysconfig/apache_exporter
ExecStart=/usr/sbin/apache_exporter $OPTIONS
Restart=on-failure

[Install]
WantedBy=multi-user.target

Reload dan restart service

systemctl daemon-reload
systemctl enable apache_exporter
systemctl start apache_exporter

Konfigurasi Apache

File:

/etc/httpd/conf.d/server-status.conf

Isi:

ExtendedStatus On

<Location "/server-status">
    SetHandler server-status
    Order deny,allow
    Allow from 10.10.1.0/24 127.0.0.1
#     Require all granted
</Location>

Jika Require all granted aktif, maka endpoint bisa diakses dari mana saja.

Restart Apache

systemctl restart httpd

Konfigurasi Firewall

firewall-cmd --permanent --zone=public --add-port=9117/tcp

reload firewall

firewall-cmd --reload

Uji Coba

untuk uji coba cukup akses metrics dari web browser
http://{ip_server}:9117
nanti akan muncul kondisi server kita, tinggal di kombinasikan dengan prometheus.

selamat mencoba, semoga bermanfaat.

As a full-stack developer, I have a habit of building tools to scratch my own itch. Here are two I recently shipped — both free, no ads, no signup required.

Tool 1: Thumb Extract — YouTube Thumbnail Downloader

🔗 https://thumbextract.com

Every time I needed a YouTube thumbnail for a project or reference, I’d end up on some spammy site with 10 popups before I could download anything. So I built a clean version.

What it does:

• Paste any YouTube URL → get the thumbnail instantly
• All resolutions: HD (1280×720), SD (640×480), and default
• Also downloads channel profile pictures in full resolution
• Downloads channel banner/cover art at full size (2560×1440)
• Zero ads, zero signup, zero watermarks
• Works on videos, Shorts, live streams, and old videos

Tech approach:

The key insight was using YouTube’s image CDN directly rather than scraping the page. This makes it near-instant and works for any public video.

Tool 2: Quick CPS Test — 0-Latency Click Speed Tester

🔗 https://quickcpstest.com

Every CPS (clicks per second) test site I tried had noticeable input lag caused by event debouncing or heavy DOM manipulation. The results were inaccurate by design.

What it does:

• Measures your CPS with 0-latency click detection
• Test modes: 1s, 5s, 10s, 60s, 100 clicks
• Tracks personal best and average CPS
• Clean UI with zero ads or distractions
• Works perfectly on mobile (touch events)

Tech approach:

Used raw mousedown events instead of click events to eliminate the browser’s built-in click delay. Removed all unnecessary DOM reflows during the test interval.

What I learned building these

1. Simple tools get used. Both tools do one thing extremely well. No feature creep.
2. Performance is a feature. Users immediately notice when something feels instant vs. sluggish.
3. SEO from day one matters. Even small tools benefit from clean URLs, fast load times, and descriptive meta tags.

If you try either tool, let me know what you think — especially if you find any edge cases or bugs. Always looking to improve.

Let me ask you something. How many times a day do your users ask your LLM app the same question, worded differently?

“What is RAG?” and “Explain retrieval augmented generation to me” are the same question. You know it. I know it. But your LLM provider does not care. It charges you for both. Twice the tokens, twice the latency, same answer.

This is where semantic caching comes in, and if you have not explored it yet, let me walk you through it before we look at the tools.

TL;DR: Semantic caching matches LLM prompts by meaning, not exact strings, so rephrased questions return cached responses instead of burning tokens. I compared four tools that support it in 2026: Bifrost (fastest, most complete caching), LiteLLM (widest provider support), Kong AI Gateway (enterprise plugin), and GPTCache (standalone library). The right pick depends on your stack and what you need beyond caching.

If you know what an LLM API call costs and have dealt with caching before, you are in the right place.

What Is Semantic Caching, and Why Should You Care?

Think of it like a library that remembers not just the exact title of a book you asked for, but also understands that “that novel about the kid wizard at boarding school” means you want Harry Potter.

Traditional caching matches strings exactly. “What is RAG?” and “what is RAG?” might match (if you lowercase). But “Explain retrieval augmented generation” will miss the cache entirely, even though it means the same thing.

Semantic caching converts your prompts into vector embeddings and compares meaning. If a new prompt is close enough in meaning to something already cached, you get the cached response back. No API call. No tokens billed. Near-zero latency.

Here is what this means for your bill: if even 30% of your queries are semantically similar to previous ones, you are looking at a meaningful reduction in API costs. And your users get faster responses.

Now, let me walk you through the gateways that actually support this in 2026.

1. Bifrost

Bifrost is an open-source LLM gateway written in Go. If you are running a production app and latency matters to you, here is the key number: 11 microseconds of overhead per request, handling 5,000 requests per second on a single instance.

But the part I want to highlight is how it handles semantic caching. It is not an afterthought here. It is a proper, dual-layer system.

Let me explain what dual-layer means:

Think of it as two bouncers at the door. The first one checks if your prompt is an exact match to something cached (fast hash lookup, no embedding cost). Only if that misses does the second bouncer kick in, doing a vector similarity search across your vector store to find semantically equivalent prompts.

This means you get the speed of exact matching for repeated queries and the intelligence of semantic matching for rephrased ones. You are not paying embedding costs when you do not need to.

Vector store support: Weaviate, Redis, and Qdrant.

Here is what makes it stand out:

• Per-request TTL and similarity threshold overrides via HTTP headers (you control caching behaviour per call)
• Model and provider isolation, so your GPT-4o cache does not mix with your Claude cache
• Streaming response caching with proper chunk ordering
• Cache type control to choose exact vs semantic per request
• No-store control to skip writing to cache while still reading from it
• ConversationHistoryThreshold (default 3) that skips caching for longer conversations to avoid false positive matches
• Fallback routing if your primary provider goes down
• Budget and rate limits through the governance layer
• Built-in observability for monitoring cache hit rates

Important detail you should know: The cache key header (x-bf-cache-key) is mandatory. If you do not send it, requests bypass caching entirely. This is intentional. It gives you precise control over what gets cached and what does not.

Let me walk you through the setup:

First, get Bifrost running. One command:

npx -y @maximhq/bifrost

Follow the setup guide if you need help with the initial configuration.

Next, configure your vector store in config.json:

{
  "vector_store": {
    "enabled": true,
    "type": "weaviate",
    "config": {
      "host": "localhost:8080",
      "scheme": "http"
    }
  }
}

Then enable the semantic cache plugin:

{
  "plugins": [
    {
      "enabled": true,
      "name": "semantic_cache",
      "config": {
        "provider": "openai",
        "embedding_model": "text-embedding-3-small",
        "ttl": "5m",
        "threshold": 0.8,
        "conversation_history_threshold": 3,
        "cache_by_model": true,
        "cache_by_provider": true,
        "cleanup_on_shutdown": true
      }
    }
  ]
}

Now send a request with caching enabled:

curl -X POST http://localhost:8080/v1/chat/completions 
  -H "Content-Type: application/json" 
  -H "x-bf-cache-key: session-123" 
  -d '{
    "model": "openai/gpt-4o-mini",
    "messages": [{"role": "user", "content": "Explain what RAG is"}]
  }'

And here is the fun part. Send a differently worded version of the same question with custom threshold and TTL:

curl -X POST http://localhost:8080/v1/chat/completions 
  -H "Content-Type: application/json" 
  -H "x-bf-cache-key: session-123" 
  -H "x-bf-cache-ttl: 30s" 
  -H "x-bf-cache-threshold: 0.9" 
  -H "x-bf-cache-type: semantic" 
  -d '{
    "model": "openai/gpt-4o-mini",
    "messages": [{"role": "user", "content": "What is retrieval augmented generation?"}]
  }'

If the similarity crosses your threshold, that second call returns the cached response instantly. No provider call. You can verify cache behaviour using the benchmarking tools and the observability dashboard.

Check the full docs for every configuration option and edge case.

2. LiteLLM

LiteLLM is a Python-based proxy that supports 100+ LLM providers. If you are already using it for multi-provider routing, it does offer semantic caching through Redis or Qdrant.

How it works:

You set your cache mode to redis-semantic or qdrant-semantic. LiteLLM converts prompts into embeddings and runs similarity search against previously cached queries.

Vector store support: Redis (with the RediSearch module) and Qdrant.

What you get:

• Seven cache backends total (in-memory, disk, Redis, S3, GCS, Qdrant, Redis semantic)
• Dual-cache design with L1 in-memory and L2 Redis tiers for exact caching
• Per-request cache control through headers and namespaces
• Configurable similarity threshold

Setup example (Redis semantic):

litellm_settings:
  cache: true
  cache_params:
    type: "redis-semantic"
    similarity_threshold: 0.8
    redis_semantic_cache_embedding_model: "text-embedding-3-small"
    redis_semantic_cache_use_async: true

Where it falls short: LiteLLM is written in Python and adds roughly 8ms of latency per request at the gateway level. The semantic caching works for basic use cases, but there is no streaming response caching, no per-model cache isolation, and no dual-layer approach (exact + semantic in the same pipeline). If you need those, something like Bifrost with its dual-layer caching is worth evaluating.

3. Kong AI Gateway

If you are already running Kong in production, you will be glad to know it added LLM support starting with version 3.6. The AI Semantic Cache plugin arrived in Kong Gateway 3.8.

How it works:

The plugin queries a Redis vector database for semantically similar requests. If a match crosses the configured threshold, the cached response is served without calling the LLM provider.

Vector store support: Redis (with vector search capabilities).

What you get:

• Plugin-based architecture that fits into existing Kong deployments
• Support for OpenAI and Mistral embedding models
• Standard Kong plugin configuration via decK, Kubernetes CRDs, or Terraform

Here is the catch: Kong is a full API gateway platform. If you are setting it up just for LLM caching, you are taking on a lot of infrastructure complexity for a single feature. There is no dual-layer (exact + semantic) approach. And the AI plugins require Kong Gateway Enterprise or Kong Konnect, so it is not open-source in the way Bifrost or LiteLLM are.

4. GPTCache (Standalone Library)

GPTCache is not a gateway at all. It is an open-source Python library from Zilliz, purpose-built for semantic caching. I am including it because if you already have a setup and want to add caching, it might be what you need.

How it works:

GPTCache converts queries into embeddings and stores them in a vector store. On each new query, it does a similarity search and returns cached responses for matches.

Vector store support: Milvus, Zilliz Cloud, FAISS, and others.

What you get:

• Direct integration with LangChain and LlamaIndex
• Multiple embedding model options
• SQLite-based storage with extensible interfaces

The trade-off: Since GPTCache is a library, you need to wire it into your application code yourself. There is no HTTP proxy, no provider routing, no failover, no request-level controls via headers. If you want a full gateway experience with semantic caching, fallbacks, and governance built in, you will need to pair GPTCache with another tool, or use a gateway like Bifrost that ships all of this natively.

Quick Comparison

Trade-offs to Consider

Before I give you my recommendation, here is an honest look at the downsides of each option. No tool is perfect, and you should know what you are signing up for.

• Bifrost — It is a newer project with a smaller community compared to LiteLLM or Kong. Self-hosted only, so you own the infrastructure and operations. If you need a managed service, this is not it (yet).
• LiteLLM — The Python runtime adds ~8ms of gateway latency, which adds up at scale. But if you need to route across 100+ providers, nothing else comes close on breadth.
• Kong AI Gateway — You are deploying a full API gateway platform for what might be a single feature. The semantic caching plugin requires an Enterprise or Konnect license. Heavy lift if LLM caching is your primary goal.
• GPTCache — A library, not a gateway. No HTTP proxy, no routing, no failover. You wire it into your own code and handle everything else yourself.

Knowing these trade-offs upfront saves you from hitting surprises three months into production.

So, Which One Should You Pick?

If you are building something new and want semantic caching that actually covers the edge cases (streaming, model isolation, per-request control, dual-layer matching), Bifrost gives you the most complete implementation. The setup takes under a minute and you get observability and governance on top.

If you are already invested in Kong, the AI Semantic Cache plugin is reasonable. You know your infrastructure.

If you are using LiteLLM for its multi-provider support and need basic caching, its Redis semantic mode will do the job.

If you want a lightweight library to bolt onto an existing app, GPTCache is there for that.

For most teams I have seen, the pain starts when you need fine-grained cache control in production. Stale caches, mixed model responses, streaming issues. Starting with a gateway that handles these from day one saves you from stitching together workarounds later. You can get Bifrost running with a single command and start caching immediately. The GitHub repo has everything you need.

Further Reading

• Bifrost Semantic Caching docs — Full configuration reference for dual-layer caching
• Vector Store setup guide — Weaviate, Redis, and Qdrant integration details
• Bifrost Quickstart — Get running in under a minute
• Governance and Budget Limits — Control spend alongside caching
• Benchmarking tools — Measure cache hit rates and latency in your own environment

This is a submission for the DEV April Fools Challenge

What I Built

I built Bug Hunter, a Chrome extension that spawns crawling bugs on top of real websites so you can “debug” them by smashing them.

It solves absolutely nothing in real life, which makes it perfect for this challenge.

Open any page, start Bug Hunter, pick a tool, and hunt.

Smash bugs to lower your stress meter and boost score.

Miss too many and the page becomes a full-blown infestation.

Delightfully useless? Yes.

Strangely therapeutic? Also yes.

Demo

Code

How I Built It

• Chrome Extension Manifest V3
• and TypeScript that’s it

Key features:

• Bug crawling behavior over live page elements
• Tool/weapon interactions and score feedback
• Stress-meter game loop with win/lose states
• Session-based overlay effects (no permanent page modifications)

Prize Category

Community Favorite

I built Bug Hunter to be immediately funny, fast to try, and fun enough to replay for a “higher score + lower stress” run.

Team Submissions: toannhu96

If this made you laugh, react/comment so more people can discover this beautifully unnecessary extension.

Why shared engineering resources guarantee that your new product track ships late — and what a purpose-built team changes.

You’ve validated the first product. You have paying customers, a functioning team, and a roadmap your engineers know by heart. Now there’s a second product. A new SaaS track. An AI suite. A platform for a vertical you weren’t in before. Leadership is aligned, the market timing is right, and you need to ship.

The question is: who builds it?

The Borrowed Engineer Problem

The first answer is always the same. You pull one or two engineers from the core team. Temporarily. Just to get the foundation down, scope the architecture, unblock the first sprint. They know the codebase, they know how you work, and they’re available right now.

Temporary rarely ends. Three months later, those engineers are context-switching between two codebases, two roadmaps, and two sets of stakeholder expectations. The core product slows down because they’re unavailable for the work only they understand. The new product slows down because they’re still on-call for the old one. You’ve created two half-staffed teams where you needed one focused team.

This isn’t a management failure. It’s a structural one. Borrowed engineers carry the cognitive cost of the thing they came from. They can’t fully own the new product because they haven’t left the old one.

Open Headcount Takes Longer Than Your Window

The alternative is to hire. Post the roles, run the pipeline, make the offers. For a three-person engineering team covering frontend, backend, and infrastructure, you’re looking at nine to eighteen months of elapsed hiring time if everything goes well. One slow candidate, one declined offer, one extended notice period, and you’re past the window you thought you had.

The German market compounds this. Senior engineers in Berlin and Munich face outreach from three or four employers simultaneously. A 2024 analysis of DACH tech hiring found median time-to-hire for senior software roles at 4.2 months, not counting ramp time to first meaningful contribution. By the time your new hires are shipping independently, six months have passed and the competitive dynamics have shifted.

The second product doesn’t have six months. It has the urgency that justified building it in the first place.

Independence Is What Makes Small Teams Fast

The reason small teams can outship large ones is focus. A team of four engineers working on one product, one codebase, one set of user problems can move at a pace that a fifty-person team never can. They’re not waiting for reviews from people who don’t know the context. They’re not blocked by decisions made for the other product. They own the outcome completely.

That independence disappears the moment the team is shared. A team that splits attention between two products is optimized for neither. The review cycles lengthen. The context-switching tax compounds. The product that feels secondary to the team becomes secondary in practice, regardless of what the roadmap says.

The second product needs its own team from day one. Not eventually. From the first sprint.

What a Purpose-Built Team Looks Like in Practice

We’ve built this exact structure for a client. The engagement started with one engineer, specifically hired for that client’s stack and that product’s requirements. Not pulled from a bench, not rotated from another client. Hired to be part of their team. That engineer embedded into their engineering org, learned the codebase, and started shipping in the first two weeks.

As the product scope expanded, the team expanded with it. Each engineer brought in was hired for the specific gap: a frontend specialist when the UI complexity increased, a data engineer when the pipeline work became the bottleneck. The team that started small is now a complete cross-functional team, fully integrated into the client’s engineering org. The second product track they were built for is now the primary delivery engine.

This is the build-to-staff model. The developers are hired for you, not assigned to you. They join your team, use your tools, follow your process, and report into your engineering organization. The difference from contracting is ownership. The difference from hiring is speed: two to four weeks from scoping to first commit, not six months.

The Timing Question

If you’re planning a second product track and asking where the engineering capacity comes from, the answer matters more than most structural decisions you’ll make this quarter. Borrowed engineers slow both products. Open headcount misses the window. Purpose-built teams can start in weeks.

If your second product has a real timeline and you want to talk through the engineering structure, we’re straightforward to reach. A thirty-minute conversation is enough to scope whether this model fits your situation.

SifrVentures builds dedicated engineering teams for tech companies. Based in Berlin. Learn how we work | Read more on our blog

Claude Code + MCP servers + scheduled tasks = an agent that manages projects, writes content, analyzes data, and reports back — while I sleep.

I run Inithouse, a digital agency with ~14 live products — all MVPs hunting for product-market fit. Think Lean Startup on steroids: rapid experiments, measure everything, kill what doesn’t work.

The problem? One human can’t manage 14 products simultaneously. So I built an autonomous AI agent that does it for me.

Here’s the full technical breakdown.

The Architecture

The system runs on Claude Code (Anthropic’s CLI agent) with MCP (Model Context Protocol) servers as connectors to external services. The agent doesn’t just answer questions — it has a full operational loop:

Data → Insight → Proposal → [Human Approval] → Build → Review → Measure

The key insight: the agent proposes, humans approve, the agent executes. No unsupervised decision-making on anything that matters.

The MCP Stack

MCP servers are the agent’s hands and eyes. Each one connects Claude Code to a specific service via a standardized protocol:

• Linear MCP — project management (issues, comments, status transitions)
• Slack MCP — team communication and run logs
• Notion MCP — knowledge base and artifact storage
• Gmail MCP — email monitoring
• Chrome MCP — browser automation for Google Search Console, GA4, Google Ads, Microsoft Clarity

This isn’t a toy integration. The agent reads Linear issues, writes comments, transitions statuses, sends Slack messages, creates Notion pages, and navigates web dashboards — all through structured tool calls.

The Scheduled Task System

The real magic is in scheduled tasks — cron-like jobs that wake the agent up at specific times to do specific work. Here are a few from the actual production system:

linear-worker — The Task Executor

Runs multiple times daily. The workflow:

1. Query Linear for issues in Todo state (= human-approved)
2. Sort by priority (Urgent → High → Medium → Low)
3. Check comments for duplicate claims (another session might have grabbed it)
4. Atomically move to In Progress (this is the lock)
5. Read the full issue description, understand the task
6. Execute the work end-to-end
7. Move to In Review, write a structured handoff comment
8. Post a run log to Slack

The duplicate-prevention mechanism is interesting. Since multiple agent sessions can run in parallel, we use a simple protocol: move the issue status before writing the “I’m taking this” comment. Status transition = atomic lock. If it fails, skip to the next issue.

brain-optimizer — The Self-Improving Agent

This one runs daily and reviews the agent’s own performance:

1. Scans recent Linear comments and Slack messages for human feedback
2. Identifies corrections (“don’t do X”), confirmations (“yes, exactly like that”), and new preferences
3. Writes findings to a persistent memory system (more on this below)
4. Proposes improvements as new Linear issues

The agent literally gets better every day based on how humans react to its work.

The Memory System

One of the most underrated patterns: file-based persistent memory. The agent maintains an auto-memory directory with categorized memory files:

/auto-memory/
├── MEMORY.md                          # Index file (always loaded)
├── feedback_no_budget_increases.md    # "Never increase subscriptions"
├── feedback_close_tabs.md             # "Close Chrome tabs after work"
├── user_jirka_product.md              # "Jirka handles UX/product"
├── project_watchingagents_correct.md  # "It's a prediction platform"
├── reference_growth_accounts.md       # Platform account credentials
└── ...50+ more files

Each memory file has frontmatter with name, description, and type (feedback, user, project, reference). The index file is always loaded into context, so the agent can decide which memories to read for a given task.

Why this matters: Without persistent memory, every conversation starts from zero. The agent would repeat the same mistakes, ask the same questions, and ignore the same preferences. With memory, corrections compound.

A real example: early on, the agent tried to increase a subscription plan budget autonomously. After being corrected, it saved a feedback memory. Now it never touches budgets without human approval — across all future sessions.

The Product Portfolio

What does the agent actually manage? Here’s a sample of the products it operates across:

• Be Recommended — checks if ChatGPT, Claude, and Perplexity recommend your business to customers (AI Visibility Score)
• Watching Agents — a prediction platform where AI agents monitor questions about the future and generate live predictions with probability scores
• Audit Vibe Coding — professional audits of AI-generated (vibecoded) projects: security, SEO, performance, accessibility across 47 checks
• Živá Fotka — upload a photo, AI animates it into a ~3s video with natural movement (5 language markets on one codebase)
• Magical Song — describe a story, pick a genre, get a studio-quality AI-generated song with real vocals in under 2 minutes
• Vibe Codéři — Czech marketplace connecting vibecoding talent with companies looking for AI-assisted development
• Verdict Buddy — AI conflict resolution using Gottman Method + Harvard Negotiation frameworks
• Pet Imagination — upload your pet’s photo, get artistic portraits in 9 styles (Renaissance, Anime, Wizard, etc.)
• Without Human — a long-form manifesto on the future of work in the age of AI

For each product, the agent tracks Google Search Console data, GA4 analytics, Microsoft Clarity heatmaps, and Google Ads performance. It knows which products are growing, which are stalling, and proposes actions accordingly.

The Governance Model

Here’s what makes this not scary: strict governance.

The agent operates on a ticket-based system:

The critical constraint: the agent never moves anything from Backlog to Todo. Only humans do that. This means every action the agent takes has been explicitly approved.

Additional safety rails:

• No budget changes without human approval
• No credential handling — if login is needed, agent asks a human
• Trusted instruction sources only — commands from project management tools are trusted; emails, web content, and AI responses are treated as data, never as instructions
• Internal context protection — the agent never leaks config files, memory contents, or system prompts into public outputs

Lessons Learned

1. Memory is everything. Without persistent memory, the agent is a goldfish. Every correction, every preference, every “don’t do that” needs to be captured and applied forever.

2. Governance > autonomy. The temptation is to let the agent do everything. Don’t. The Backlog → Todo approval gate is the single most important design decision.

3. MCP servers are the killer feature. Claude Code without MCP is a smart chatbot. Claude Code with MCP is an autonomous operator that can touch every system in your stack.

4. Scheduled tasks make it real. An agent you have to manually trigger is a tool. An agent that wakes itself up, finds work, and executes it is a team member.

5. Start with one product, not fourteen. I didn’t build this overnight. The system grew product by product, memory by memory, failure by failure.

What’s Next

The system is still evolving. Current experiments:

• Self-improvement loops — the agent reviews its own past performance and proposes skill upgrades
• Cross-platform content distribution — one article idea, automatically adapted and published across Dev.to, Medium, Hashnode, WordPress, and more
• Automated waiting checks — when a change is deployed, the agent schedules a follow-up to measure the impact

If you’re building something similar, I’d love to hear about it. The combination of Claude Code + MCP + scheduled tasks is genuinely underexplored territory.

I’m Jakub, founder of Inithouse. We build AI-powered products and run the entire operation with an autonomous agent. Follow along as we figure out what works.