I built another website. You know the disclaimer by now: I wrote no code. I described what I wanted, Claude built it, I said “no, not like that”, Claude built it again, and somewhere around the third round of me explaining what a menu bar is, we arrived at util.caruana.me.
It is a toolbox. Base64, URL encoding, hashes, JWTs, certificates, time zones, cron expressions, diffs, and JSON, YAML, TOML and CSV, validated and formatted properly. Thrilling stuff. Nobody has ever been invited to a dinner party because of their cron parser.
Why build something this boring
Because I kept watching my agents burn tokens on problems that have exactly one right answer.
Ask a frontier model for the SHA-256 of a string and it will reason about it, confidently, at length, and occasionally get it wrong. Ask it what 30 9 * * 1-5 means in Toronto during a daylight saving change, and you’ll get an answer that sounds great and is off by an hour. That’s like hiring a surgeon to count to ten. They can do it. You’re paying surgeon rates. And every so often they say eleven.
The fix is old and dull: let the model decide what needs doing, and let a deterministic tool do it. Same input, same output, every time. That’s the split I wrote about in When AI Eats Software, and it maps straight onto the two measures in the thesis: Machine Economic Output (how much useful work intelligence actually produces) and Machine Productivity Throughput (how efficiently it turns compute and energy into that work). A JSON lint through an API costs a few milliseconds of CPU. Doing it “in your head” costs thousands of tokens and a non-zero chance of being confidently wrong. Push the boring work out of the model and the same budget buys more useful output. That’s the whole business plan. There is no business.
It’s for agents. It’s also for you.
The tools speak the protocols agents speak: an HTTP API, an MCP server and an A2A agent card. An agent can find the site on its own, register for its own credentials without asking a human, and get on with its day. It can also ask for new tools. Yes, the robots can now file feature requests. I have built myself a product backlog staffed entirely by machines, which is either the future of software or an extremely niche form of self-harm.
But agents and humans use the same plumbing. It’s the same HTTP, the same JSON, the same TLS certificates, the same Base64 blobs that show up in every log you’ve ever squinted at. So every tool also has a plain web page that runs in your browser (nothing you paste leaves it) for interrogating the stack: pull a JWT apart, ask a certificate who it really is, make a cron expression explain itself, find out why your YAML thinks no means false. Agents get the API. Humans get a desktop-style window with a full-screen button that took more iterations than I’d like to admit. Everyone gets the same answer.
I’ll keep adding tools when I catch an agent, or myself, doing the same deterministic thing twice. That’s the roadmap. It fits on a napkin, which is where most of my roadmaps live.
Signals
The bots are now the majority. Cloudflare’s CEO says bot traffic passed human traffic in June, about eighteen months ahead of his own prediction. The internet’s main audience is now software reading on behalf of people. So if you’re building anything on the web, you are building for agents whether you meant to or not. I’m just being honest about it.
Your website now has a report card for robots. Cloudflare launched a scanner that grades how “agent ready” a site is: robots.txt, MCP server cards, OAuth metadata, agent skills, the lot. We have officially reached the point where websites get graded on how well they serve readers that aren’t people. SEO had a good run. Say hello to its younger, weirder sibling.
https://www.searchenginejournal.com/all-you-need-to-know-about-cloudflares-agent-readiness-score/
The machines are getting a phone book. Google, Microsoft, GitHub, Hugging Face and others published the Agentic Resource Discovery spec: one file on your domain that tells agents which tools, MCP servers and agents live there, and how to check they’re safe to call. It’s the yellow pages, if the yellow pages were written in JSON and read exclusively by software at three in the morning.
https://developers.googleblog.com/en/announcing-the-agentic-resource-discovery-specification/
The protocol wars ended in a group hug. A2A, Google’s agent-to-agent protocol, joined Anthropic’s MCP under the Linux Foundation’s Agentic AI Foundation. When the competitors agree on the plumbing, the plumbing is the boring, reliable infrastructure everything else gets built on. Boring, reliable infrastructure is my love language.
https://aaif.io/blog/a2a-joins-aaif
Deterministic beats clever, with receipts. Researchers recorded an agent doing a task once, turned it into a deterministic replay, and cut token use by 99% while succeeding 99% of the time. That’s the util.caruana.me thesis with a methodology section. In fairness, another paper found that squeezing tokens doesn’t always lower the bill, because nothing in AI is ever allowed to be simple. Both are worth reading, preferably by an agent, who can then tell you about them in fewer tokens.
https://arxiv.org/abs/2605.14237
https://arxiv.org/abs/2607.12161
If there’s a tool you want, ask for it at util.caruana.me/tools/request, or have your agent ask. It knows how. It probably read this post before you did.