#138 From Hacker News to W3C: How One Amazon Engineer Accidentally Shaped the Future of AI Browsers // Alex Nahas, MCP-B
alphalist.CTO Podcast - For CTOs and Technical LeadersShow Notes
Alex Nahas is 28 years old and has already initiated a W3C web standard. Working as a backend engineer at Amazon, he ran into a problem most enterprises face: MCP requires OAuth, but most enterprise infrastructure runs on SAML. His solution was elegant: run the MCP server in client-side JavaScript, letting AI agents use the browser's existing authentication context rather than rebuilding auth from scratch.
What started as an internal tool became an open source project, then a viral Hacker News post published while under anesthesia, and ultimately an invitation from Google and Microsoft to help shape WebMCP as an official web standard.
In this episode, Alex and Tobi explore what WebMCP actually is, why the browser is the most underestimated sandbox in AI development, and what the agentic web might look like two years from now.
Topics covered:
What MCP actually is and why it's just an RPC framework at its core Why OAuth is a dealbreaker for most enterprise infrastructure How WebMCP lets AI agents operate within existing browser authentication The Hacker News post that started it all, and why Alex doesn't remember posting it How Chrome is natively building WebMCP support The chicken-and-egg problem of standard adoption Real-time bidding for agents and what it means for digital advertising Why agents don't need their own identity Where the agentic web is headed in the next two years
More from alphalist.CTO Podcast - For CTOs and Technical Leaders
Raffi Krikorian has built teams at scale: platform engineering at Twitter, Uber's self-driving center, and the Democratic National Committee, where he was its first CTO. Today he's CTO of Mozilla, working to make AI as open as the web, and on the side he runs three rotating Claude Max subscriptions and a GPU in his closet.
Chris Wysopal was one of the first hackers to go public. As "Weld Pond" at the L0pht hacker collective in Boston, he testified before the US Senate in 1998, where the group delivered the soundbite that they could take down the internet in 30 minutes. He also wrote the Windows version of Netcat. In 2006 he co-founded Veracode, which by his account has now analysed trillions of lines of code. Today he's the company's Chief Security Evangelist.
Charles Guillemet has spent nine years building Ledger's security organization from scratch — first as the founder of The Donjon, Ledger's in-house offensive security research team, then as CTO overseeing security for a company safeguarding roughly 20% of the world's crypto (per Tobi's intro framing).
Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026
Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026