Dasith Wijesiriwardena

Had an awesome time today at #apidays and met a lot of new faces and some familiar ones as well. The slides for our talk about software supply chain security are here speakerdeck.com/dasiths/buildi… @NotaryProject @OpenPolicyAgent @orasproject @AquaTrivy @GrypeProject

Just launched PromptyDumpty - a universal package manager for AI agent artifacts! 📦 Install & share prompts across #coding #agents 🔄 One package format, works everywhere 🎯 Auto-detects your #AI agent 🧹 Clean install/uninstall tracking Learn more 👉 dumpty.dev

@_philschmid This is an example of context engineering for AI agents. dasith.me/2025/04/02/vib…

The hottest discussion in AI is about "context engineering". But what is it? Do we need it? Context engineering isn't about crafting better prompts. It's building dynamic systems that provides the right information at the right time. Think of an AI assistant asked to schedule a meeting. → Poor Context: It only sees the request. The result is a robotic, unhelpful reply. → Rich Context: It sees the request PLUS your calendar, past emails, and available tools (like send_invite). The result is a "magical" assistant that proactively solves the problem. The future of AI agents isn't about perfect prompts. It's about perfect context.

Security vulnerability assessment (VEX) using #GitHub #Copilot and #Trivy #MCP server. github.com/dasiths/ai_gen… 🔍 Runs Trivy security scans 🧠 Analyzes your actual code for exploitability 📊 Generates comprehensive VEX reports 💡 Provides clear remediation guidance

@vasuman Yes the core principles of spec driven dev and planning apply regardless of the tool you use. There is a bit more here. dasith.me/2025/04/02/vib…

I promise you you’re vibe coding wrong as someone who has built multiple production-ready applications, with thousands of users, from just Cursor with minimum intervention. But first here's you (probably): You open Cursor. Type “build me X.” It spirals. Nothing works. You start over. That’s not development. That’s chaos. I have an incredibly simple system that works every single time:

I’ve been exploring hypervelocity engineering workflows with AI agents like #GitHub #Copilot, and one fundamental challenge continues to surface: maintaining shared context alignment between developers and AI. How do we solve it? dasith.me/2025/04/02/vib…

I've been doing some vibe coding experiments recently and came up with this pattern I call "breadcrumbs" that's giving me consistent results. The Breadcrumb Protocol is designed to help you vibe code by creating a shared scratchpad. youtu.be/etYG-6-9Mlk

#dapr-agents let developers design, test, and deploy agents that integrate seamlessly as collaborative services in larger systems, without reinventing microservices. I've done some experiments here. github.com/dasiths/llm-pl…

This is a little experiment with #Autogen I did a while back to see how well it can be integrated with #MCP servers. I used the SelectorGroupChat pattern with each MCP server represented by an expert agent. github.com/dasiths/llm-pl…

I'm really excited for the idea behind Anthropic's Model Context Protocol (#MCP) but have some reservations about the execution. There are some limitations that make it a non starter for enterprise right now. One of those is Authn/Authz. github.com/modelcontextpr…

My team have been working with #PromptFlow recently and we did some benchmarking of pf-serve to find throughput problems. I wrote up a blog post with our findings here. devblogs.microsoft.com/ise/promptflow…

Ah @stephentoub’s annual .NET performance post is here! devblogs.microsoft.com/dotnet/perform… #dotnet

@nickchapsas I wanted to reach out regarding the practice of running migration as part of your app init which is considered a bad practice (concurrency, elevated permissions). A caveat in the video description would help teams. See #issuecomment-328154355" target="_blank" rel="nofollow noopener">github.com/dotnet/efcore/…

My team recently concluded a project that used #promptflow. There were some learning around optimizing for throughput and latency. We developed an awesome little throughput testing kit for pf-serve and contributed it to the Promptflow OSS repo. github.com/microsoft/prom…

@davidfowl Haven't done this for .NET 8 but would keyed services help with this scenario where you need a tenant aware IOptionsMonitorCache for example? as shown here #61730788" target="_blank" rel="nofollow noopener">stackoverflow.com/questions/4959…

Is anyone using keyed services for multi tenancy in .NET 8 applications?

Highly requested docker file feature coming in the next version of aspire github.com/dotnet/aspire/… #dotnet #aspire

I wrote about a simple pattern you can follow when developing #LLM apps to prevent a certain class #prompt injection attacks with regards to user enumeration when using tools. Examples using #langchain. dasith.me/2024/05/03/llm…

As long as AI systems are trained to reproduce human-generated data (e.g. text) and have no search/planning/reasoning capability, performance will saturate below or around human level. Furthermore, the amount of trials needed to reach that level will be far larger than the amount of trials needed to train humans. LLMs are trained with 200,000 years worth of reading material and are still pretty dumb. Their usefulness resides in their vast accumulated knowledge and language fluency. But they are still pretty dumb.

Legit question. What is the value of frameworks like LangChain, Autogen, crewAI, ... that basically build the same abstractions on top of a programming language that the underlying programming language already supports. For example chaining is sequential composition, agents in multi-agents frameworks are just objects (or if you want to be fancy actors) and interaction patterns are just control flow. What's wrong with just writing code. Since these frameworks are so popular, there must be some deep attraction or advantage to using them. Maybe if you would actually design a completely new language that supports these notions, that might be something. But even then I seriously doubt that the switching costs are worth it. What am I missing?

@reubenbond @headinthebox (cont) with strong opinions and build features like serving (http server) on top. They are great for building POC like things but don't offer the engineers enough control to leverage mature patterns or eject from the pigeonholed architecture enforced by the LLM agent frameworks.

@reubenbond @headinthebox Having worked with "big" customer recently, most teams that develop LLM solutions aren't cross functional. Most orgs still deal with DS folks who do most of their work on Jupyter notebooks. Frameworks like PromptFlow try to solve this by giving large building blocks (cont...)