MCP Security, Framework Fatigue, and AI Agents with Will Johnson (Presented by CodeRabbit)

This week, Robbie and Adam talk with Will Johnson—senior developer advocate at Auth0—about web dev, parenting, and internet culture. They debate whether CSS is a “real” programming language, riff on how modern frameworks can feel over-engineered, and dig into the security risks emerging around AI agents and MCP. Will shares what he’s been learning about MCP security, why he’s cautious with new tools, and how Auth0’s new AI agent offering helps manage identity, permissions, and token safety.

Presented by CodeRabbit: http://coderabbit.link/whiskey

In this episode:

(00:00) - Intro

(01:49) - Meet Will Johnson

(02:19) - Whiskey rating & review: Jameson Triple Triple

(07:13) - Hot Take: Git rebase vs git merge

(09:42) - Parenting talk: kids, wrestling, and learning consequences

(11:57) - Hot Take: Is CSS a programming language?

(14:37) - What Will’s working on at Auth0 (AI + MCP security)

(16:57) - The most interesting MCP-related hacks and security risks

(18:27) - Can “skills” become an attack vector too?

(19:47) - Security vulnerabilities, Next.js updates, and patching fatigue

(20:48) - How Will’s family got into K-Pop Demon Hunters

(25:51) - The Moana live-action trailer “looks like useEffect” (and why)

(27:17) - Is React essentially processed American food?

(27:58) - Sugar-free Oreos: what are we even doing here?

(29:18) - Have we overcomplicated frontend development?

(31:32) - Why Rails is the best-engineered dev experience Will has used

(32:25) - How Auth0 teams are structured

(35:47) - Passkeys explained

(41:43) - Plugs and how to connect with Will

(43:12) - How AI agents fit into auth

Links

Auth0: https://auth0.com/

Jameson Triple Triple: https://www.jamesonwhiskey.com/en-us/our-whiskey/jameson-triple-triple/

Three Sheets: https://en.wikipedia.org/wiki/Three_Sheets

Jack Daniel's Reserve: https://www.jackdaniels.com/

Google Chrome: https://www.google.com/chrome/

Shopify: https://www.shopify.com/

CSS: https://www.w3.org/Style/CSS/

JavaScript: https://developer.mozilla.org/en-US/docs/Web/JavaScript

MCP: https://modelcontextprotocol.io/

Next.js: https://nextjs.org/

KPop Demon Hunters: https://en.wikipedia.org/wiki/KPop_Demon_Hunters

Britney Spears: https://britneyspears.com/

NSYNC: https://nsync.com/

B2K: https://en.wikipedia.org/wiki/B2K

Chris Brown: https://en.wikipedia.org/wiki/Chris_Brown

Netflix: https://netflix.com

Stanford University: https://www.stanford.edu/

Moana: https://movies.disney.com/moana

Dak Prescott: https://en.wikipedia.org/wiki/Dak_Prescott

React: https://react.dev/

Oreo: https://www.oreo.com/

jQuery: https://jquery.com/

Ken Wheeler: https://x.com/ken_wheeler/

ES6: https://www.w3schools.com/js/js_es6.asp

BlingBlingjs: https://github.com/argyleink/blingblingjs

Astro: https://astro.build/

Rails: https://rubyonrails.org/

Laravel: https://laravel.com/

Egghead: https://egghead.io/

Grok: https://grok.com/

1Password: https://1password.com/

Google Zanzibar: https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/

AWS: https://aws.amazon.com/

Netlify: https://www.netlify.com/

Pokemon Go: https://pokemongolive.com/

Connect with Will

Website: https://auth0.com/ai

X / Twitter: https://x.com/willjohnsonio

Connect with the hosts

Robbie Wagner: https://x.com/RobbieTheWagner

Chuck Carpenter: https://x.com/CharlesWthe3rd

Adam Argyle: https://x.com/argyleink

Subscribe and stay in touch

Website: https://whiskey.fm

Apple Podcasts: https://podcasts.apple.com/us/podcast/whiskey-web-and-whatnot/id1552776603

Spotify: https://open.spotify.com/show/19jiuHAqzeKnkleQUpZxDf

Overcast: https://overcast.fm/itunes1552776603

YouTube: https://www.youtube.com/@WhiskeyWebAndWhatnot

Whiskey Web and Whatnot Merch
Enjoying the podcast and want us to make more? Help support us by picking up some of our fresh merch at https://whiskey.fund.