# AI & DevOps Field Guide: MCP Security, LLM Serving, K8s

> Five reading paths through the AI and DevOps articles on this site: MCP and agent security, LLM serving, Kubernetes for AI, AI SRE and supply chain.

URL: https://www.matthewswong.com/en/ai-devops/

- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Reviewed on: 17 October 2026

> **Key takeaway:** Five ordered reading paths: MCP and AI agent security, LLM inference serving, Kubernetes for AI, AI SRE and agentic ops, and software supply chain security and regulation. Each path is split into stages, and every article on it carries one line on why it sits where it does.

The AI and DevOps articles on this site, arranged into five reading paths, so a question that spans ten posts reads as one sequence instead of ten separate search results.

## Five paths, one question each

Pick the path that matches the problem in front of you. Each one lists its stages and how many articles it walks through.

- [MCP & Agent Security](https://www.matthewswong.com/en/ai-devops/mcp-agent-security/): Prompt injection, the 2026 MCP incidents, access controls, sandboxes and vetting agent skills. (25 articles)
- [LLM Inference Serving](https://www.matthewswong.com/en/ai-devops/llm-inference-serving/): vLLM and SGLang, disaggregated serving, llm-d and KServe, autoscaling and cost per token. (25 articles)
- [Kubernetes for AI](https://www.matthewswong.com/en/ai-devops/kubernetes-for-ai/): The 1.36 and 1.37 upgrades, DRA and gang scheduling, Gateway API routing and agents in the cluster. (24 articles)
- [AI SRE & Agentic Ops](https://www.matthewswong.com/en/ai-devops/ai-sre-and-agentic-ops/): Incident-investigation agents, MCP servers for ops tools, agents in CI, and the IaC beneath. (25 articles)
- [Supply Chain & Regulation](https://www.matthewswong.com/en/ai-devops/software-supply-chain-and-regulation/): npm and PyPI worms, model signing and AIBOM, secrets in agent commits, the CRA and EU AI Act. (23 articles)

## Where each path begins

The first article of each path, for when you want one place to begin.

- [Prompt Injection Attacks on AI Coding Agents](https://www.matthewswong.com/en/blog/prompt-injection-ai-coding-agents/): The base case: commands hidden in code, issues and web pages, why filtering fails and how containment reduces the risk. (MCP & Agent Security)
- [Run Local LLMs with Ollama: Models, API, and Modelfile](https://www.matthewswong.com/en/blog/ollama-run-local-llms/): The simplest local baseline: pull an open-weight model and call it through an OpenAI-compatible API. (LLM Inference Serving)
- [Kubernetes 1.37 Release: What Breaks When Upgrading From 1.36](https://www.matthewswong.com/en/blog/kubernetes-1-37-garhwal-whats-new/): The 1.37 overview for platform teams: defaults that flip on, deprecation dates and a preflight script. (Kubernetes for AI)
- [HolmesGPT Kubernetes Alerts: Runbooks Beat the Model Choice](https://www.matthewswong.com/en/blog/holmesgpt-runbooks-prometheus-slack-investigations/): Start here: a two-person SRE team routes Prometheus alerts through HolmesGPT into Slack, and finds runbooks matter more than the model. (AI SRE & Agentic Ops)
- [Software Supply Chain Security: SBOMs and Sigstore](https://www.matthewswong.com/en/blog/software-supply-chain-sbom-sigstore/): The foundation: generate SBOMs, sign artifacts with Sigstore and cosign, and verify SLSA provenance in CI. (Supply Chain & Regulation)

## A reading list, not a summary

Each hub is a reading list. The articles do the explaining; the hub puts them in an order where each one builds on the one before, and says in one line why it is there.

An article can sit on more than one path when it belongs to both. Under every article a path lists, a link leads back up to the path and on to the next step, so you can walk it from either end.

The review date is the day the lists were last checked against the blog. Each article carries its own publication and update dates; those say how current its facts are.

---

- HTML version: https://www.matthewswong.com/en/ai-devops/
- Bahasa Indonesia: https://www.matthewswong.com/id/ai-devops/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json