content(library): add observability, procurement, and MCP security guides

[waleedlatif1]

Summary

Three new AEO library guides, each dated into a recent empty day in the posting calendar so publication is spread out rather than dumped on one day:

Post	Date (backfilled gap)	Focus keyword
ai-agent-observability	2026-07-19 (Sun, empty)	ai agent observability
ai-agents-in-procurement	2026-07-21 (Tue, empty)	ai agents in procurement
mcp-security	2026-07-22 (Wed, empty)	mcp security

Note the three provided slugs were /blog/..., but the content is textbook AEO/GEO (focus keyword, meta description, key takeaways, FAQ) and you asked for the library — so they live at /library/<slug>, matching the section's purpose. canonical and internal links use /library/.

Citations — every claim traced to a verified primary source

Per .claude/rules/landing-seo-geo.md, every third-party factual claim carries an outbound citation, and I verified each source actually substantiates the claim before linking it (not just that the URL resolves):

• Observability: OpenTelemetry GenAI semconv, Fiddler's OTel analysis, LangChain State of AI Agents (quality ≈ one-third), PwC survey (79%)
• Procurement: Icertis/ProcureCon (90%, and the 88%/75% friction figures), Ironclad (77%/67%), GEP/Foundry (53%)
• MCP security: MCPoison CVE-2025-54136 + CurXecute CVE-2025-54135 (both confirmed as Cursor MCP config-poisoning on NVD), WhatsApp exfil case, Anthropic MCP announcement, MCP Market, RFC 8707, RFC 9700, OAuth 2.1, MCP auth spec

One correction to the source copy: it stated the WhatsApp MCP flaw was found "In November 2025." I could not verify that date (the disclosure was earlier in 2025), so I dropped the specific month rather than assert it — the case itself is cited to Docker's writeup. Per the rule: an unlinked/undated claim beats a wrong one.

Internal links: 3 per post to related library posts (e.g. procurement → AI agents vs RPA, MCP security → what an MCP server is). No self-links; all internal targets exist.

Covers

Cover art comes from your autogeneration pipeline. Each post references the standard ogImage: /library/<slug>/cover.jpg path; I did not commit placeholder art. Until autogen runs, the hero image at those three paths will 404 — flagging so it's not a surprise.

Testing

Verified against a running dev server:

• All 3 pages render 200; all 3 appear in the /library index with correct dates.
• All 17 unique external URLs resolve (mcpmarket.com returned 429 from my own repeated hits — a live site, not a 404).
• Rendered link treatment: every external citation carries target="_blank" rel="noopener noreferrer" (5/5, 4/4, 9/9); internal links carry neither. (This relies on the MDX-anchor fix from improvement(library): add citations and internal links, correct stale pricing #5913, now on staging.)
• Tables and heading hierarchy render correctly; FAQ schema present; no "Updated" label (date == updated on new posts).
• bun run lint clean; check:boundaries, check:api-validation:strict, check:client-boundary all pass.

Heads-up unrelated to this PR: bunx tsc reports 5 errors in providers/anthropic/core.ts (Anthropic SDK OutputConfig/output_config typings). These are pre-existing on staging — this PR adds only MDX, which tsc doesn't compile — but worth a look since they'll trip a full typecheck.

Type of Change

• Content

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 24, 2026 5:53pm

[cursor]

PR Summary

Low Risk
Documentation-only MDX under content/library; no runtime, auth, or data-path changes.

Overview
Adds three new /library AEO guides as MDX-only content, each with its own slug, staggered 2026-07-19 / 21 / 22 dates, FAQ frontmatter, canonical URLs, ogImage paths, and internal links to existing library posts.

ai-agent-observability covers traces/logs/metrics/evals, why APM falls short for agents, lifecycle instrumentation, and getting started (with cited third-party stats and OpenTelemetry links).

ai-agents-in-procurement explains agent vs RPA/software, high-value use cases, buy vs build, rollout steps, and governance challenges.

mcp-security maps MCP threat models (tool poisoning, OAuth, supply chain), hardening and production governance, with CVE and spec citations.

No application code changes; cover images are referenced but not committed in this diff (autogen pipeline).

^{Reviewed by Cursor Bugbot for commit a0989bb. Configure here.}

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2e45cc5. Configure here.}

[greptile-apps]

Greptile Summary

Adds three dated AEO library guides:

• Introduces an AI agent observability guide.
• Introduces an AI agents in procurement guide.
• Introduces an MCP security guide.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains within the scope of the previous review thread.

Important Files Changed

Filename	Overview
apps/sim/content/library/ai-agent-observability/index.mdx	Adds the observability guide with metadata, FAQs, citations, and related library links.
apps/sim/content/library/ai-agents-in-procurement/index.mdx	Adds the procurement guide with metadata, FAQs, cited adoption data, and implementation guidance.
apps/sim/content/library/mcp-security/index.mdx	Adds the MCP security guide with metadata, FAQs, cited threat examples, and security recommendations.

_{Reviews (2): Last reviewed commit: "fix(library): correct two unverifiable c..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a0989bb. Configure here.}