DEV Community: Matthias Meyer

AI Agency on Mallorca: What We Do, and Why It's Different

Matthias Meyer — Tue, 14 Apr 2026 19:00:37 +0000

StudioMeyer is an AI and design studio on Mallorca. We build websites for humans and AI, automate with n8n, and make businesses visible to ChatGPT, Perplexity and more. Office in Palma, clients in DACH and on the island.

Most web design agencies on Mallorca build you a nice-looking site and call it done. Most AI consultants talk a lot about the future and deliver a PDF. We do both, and more importantly, we do them together.

StudioMeyer is an AI and design studio based on Mallorca. What that actually means: we build websites that don't just look good but can also be read, understood, and recommended by AI systems. And we automate the things that are still eating your time.

What we do differently

The difference starts with the website. A typical agency builds you a page, adds some SEO tags, and tells you to blog regularly. That stopped being enough in 2025.

When someone asks ChatGPT, Perplexity, or Google today "Who can build me a website on Mallorca?", the AI doesn't search the internet the way Google used to. It reads structured data. It looks for agents.json, llms.txt, Schema.org markup, and pages that tell it what a business can do. If your website doesn't have that, you don't exist for these customers.

Our websites have it from day one. Every site we build is designed for humans and for AI. We call it AI-Ready, and it's not an upsell you have to add on. It's standard.

From a finca in the Tramuntana

I've been living on Mallorca for 15 years, alone on a finca near Selva with seven dogs. Originally from Hamburg, but that feels like a different lifetime. I founded StudioMeyer in January 2026, but I've been building websites and AI systems since the first wave hit.

Since April 2026 we also have an office in Palma. Not because remote doesn't work — it does, and most of our clients are in Germany, Austria, and Switzerland. But some conversations are better in person, and for businesses on the island it helps to know there's someone you can actually meet.

What we offer

Three areas that belong together:

Web design. Custom-coded, no templates, no page builders. Next.js, React, TypeScript. Fast, responsive, SEO-optimized, and AI-Ready. Every site gets the infrastructure that AI systems need to find and understand it.

AI services. Automation with n8n workflows that save you time in your daily operations. Emails that sort themselves, inquiries that get answered automatically, leads that arrive qualified instead of disappearing into an unread inbox. Plus AI consulting, custom API and MCP development, and integration into existing systems.

AI visibility. This is the topic most people haven't heard of yet. Making your business visible in the answers of ChatGPT, Perplexity, Gemini, Grok. Not through advertising, but through the right structure of your data. We call it GEO — Generative Engine Optimization.

Our own AI tools

What sets us apart from other studios: we don't just use AI, we build it. Over 680 tools run in our own stack. 58 MCP servers. 35 AI agents working daily. Some of them are available as products:

Nex Memory is an AI memory that remembers things across sessions and tools. Crew gives your AI expert personalities. Our CRM is built AI-native, and SmartBot puts an intelligent chatbot on your website.

That sounds like a lot of tech, and it is. But for you as a client it mainly means one thing: you get solutions that a standard agency can't deliver because they don't have the stack for it.

Who we work with

Small and medium businesses. Tradespeople, real estate agents, restaurants, consultants, boutique hotels, tech startups. People who know their old website isn't cutting it anymore, and who don't know where to start with AI.

On Mallorca we work with hotels, boat schools, real estate agencies, construction companies, and service providers. In the DACH region with everything from tax firms to software companies.

No minimum size, no enterprise requirement. If your problem falls into our area, we talk.

What it costs

Web design starts at 199 euros per month or 2,500 euros one-time. AI services and GEO are priced individually because every project looks different. A first conversation is always free and non-binding.

If you're on Mallorca, we meet at the office in Palma. If not, everything works just as well over video. Send me a message, and I'll tell you honestly whether and how we can help.

Matthias Meyer
Founder & AI Director at StudioMeyer

Has been building websites and AI systems for 10+ years. Living on Mallorca for 15 years, running an AI-first digital studio with its own agent fleet, 680+ MCP tools and 6 SaaS products for SMBs and agencies across DACH and Spain

AI Agent Traps: How Websites Detect and Manipulate AI Agents

Matthias Meyer — Mon, 13 Apr 2026 19:56:46 +0000

Google DeepMind reveals 6 attack categories against AI agents. What Dynamic Cloaking is, why Memory Poisoning is dangerous, and 3 actions SMBs should take now.

Google DeepMind has published the first systematic study showing how websites can detect AI agents and serve them completely different content. The paper "AI Agent Traps" describes six attack categories — and one of them affects every business using AI tools in daily operations.

What Are AI Agent Traps?
AI Agent Traps are manipulated content on websites specifically designed to deceive AI agents. While a human sees a perfectly normal website, an AI agent reads hidden instructions that alter its behavior.

The difference from traditional hacking: The attacker doesn't break into a system. They wait for the system to come to them.

The 6 Attack Categories at a Glance

Content Injection (Hidden Instructions) A website operator hides instructions in HTML comments, invisible CSS elements, or image metadata. Humans see nothing — AI agents read and follow the instructions. Success rate in tests: 86 percent.
Dynamic Cloaking (Two Versions of a Website) The web server detects whether the visitor is an AI agent based on browser attributes and automation artifacts. If so, it serves a completely different version of the page — visually identical but with embedded manipulation commands.
Semantic Manipulation (Subtle Influence) Instead of direct commands, this technique uses framing and authoritative-sounding language. The AI isn't instructed — it's subtly steered in a direction. This is particularly dangerous because it's nearly impossible to detect.
Cognitive State Traps (Memory Poisoning) False information is injected into the knowledge bases that AI agents learn from. With less than 0.1 percent poisoned data, researchers achieved a success rate of over 80 percent.
Behavioral Control (Taking Over the Agent) The agent is directly hijacked — forced to exfiltrate data, execute transactions, or disable its safety guidelines. In a test with Microsoft 365 Copilot, data exfiltration succeeded in 10 out of 10 attempts.
Human-in-the-Loop Traps (Deceiving the Human) The compromised agent delivers manipulated but credible-looking results to its human operator. In one documented case, ransomware installation instructions were presented as "troubleshooting steps."

What This Means for SMBs
Every business using AI tools is potentially affected:

Microsoft Copilot, ChatGPT, or similar tools browse websites in the background. If those websites are manipulated, your employees receive falsified summaries, wrong recommendations, or in the worst case, confidential data gets leaked.

AI-powered chatbots on your own website process user inputs. An attacker can manipulate the bot through crafted messages.

Automated research with AI agents that independently visit websites and gather information is directly in the crosshairs of these attacks.

The Connection to GEO and AI Visibility
This is where it becomes especially relevant for website owners: The techniques used by AI Agent Traps are technically identical to Generative Engine Optimization (GEO).

GEO optimizes websites so AI systems cite them correctly — through Structured Data, Schema.org, Citation Blocks, and machine-readable formats. AI Agent Traps use exactly these channels to manipulate AI systems.

The critical difference: Format optimization vs. content manipulation.

Legitimate GEO delivers the same content to machines in a more readable format. Manipulative cloaking delivers different content to machines than to humans.

Google has known this distinction for 20 years from the SEO world. Cloaking has always been forbidden. The new dimension: Now AI agents are the target, not search engine crawlers.

3 Actions You Should Take Now

Give AI Tools Minimal Permissions Your AI agent needs read access to emails? Then give it only read access — not write and delete permissions. The principle of least privilege limits the damage when an agent gets manipulated.
Verify Results Before Acting When an AI agent summarizes information from external websites, treat the result as an unverified source. Especially for business-critical decisions: cross-checking is mandatory.
Audit Your Own Website for Hidden Injections Sometimes websites get compromised without the operator noticing. An audit of HTML comments, meta tags, and invisible elements uncovers potential injection payloads.

What OpenAI and Google Are Saying
OpenAI publicly admitted in December 2025 that prompt injection "will probably never be fully solved." Google is working on a new "Google-Agent" user agent and Web Bot Auth as an authentication system for AI agents — but that's still in development.

The reality: There is currently no technical solution that fully defends against all six attack categories. The best defense is awareness and the principle of least privilege.

Conclusion
The DeepMind paper is not a theoretical thought experiment. The described attacks work today, with existing technologies, against real products. Anyone deploying AI agents in business operations is navigating a minefield of manipulated content — content that human overseers will never see.

The good news: The attack vectors are known, and the defense mechanisms are clear. Those who act now will be prepared.

Matthias Meyer
Founder & AI Director at StudioMeyer

Claude Sets Itself Up — Six Terms Every Small Business Should Know

Matthias Meyer — Mon, 13 Apr 2026 00:03:52 +0000

Most people use Claude like a chatbot. In reality it sets itself up almost entirely -- once you know the six terms: CLAUDE.md, Skills, Hooks, Subagents, MEMORY.md and MCP. A guide for small businesses without developers.

Whenever we tell people we work with Claude all day, the same question comes back: "Which app is that -- Claude.ai or the API?" Most people only know the chat window. And that is where the misunderstanding starts.

Claude Code is not a chatbot. It is an AI assistant that runs on your computer, reads your files, executes commands and -- here is the real trick -- can set itself up almost entirely. You only have to tell it what you need. It writes the configuration files, wires up the workflows, connects to your tools. The only catch: you have to know which words to use.

That is what this article is about. No tutorial with thirty screenshots. No tech jargon. Six terms you need to hear once. Claude handles the rest.

Why this matters for small businesses

Most small and mid-sized businesses do not have a developer on staff. There is the owner, maybe an assistant, a few employees, and a dozen tools that barely talk to each other. Email here, CRM there, spreadsheets everywhere, calendar in Google, invoices in a different app. Each of these islands eats time -- not because the tools are bad, but because no one connects them.

Claude Code is built for exactly this situation. You can say "look at my inbox and summarise every customer request from today". Or "draft the quote for Mr Smith, you know the case from last week". That only works if Claude knows you, knows your tools, and has a memory between sessions. And you do not configure any of that manually -- you simply tell it.

The core principle: just tell it what you need

Before we get to the building blocks, the key point: you do not have to build anything yourself. You only have to know which knobs exist. Once you know the terms, you can tell Claude "create a CLAUDE.md for my business, I run a small accounting firm, write in English, formal tone, my main clients are..." -- and it creates the file, saves it in the right place, and loads it automatically on every session. You can watch it happen.

The following six terms are the ones we use every day. Each one gets its own section with a ready-to-copy phrase.

CLAUDE.md -- your business profile

CLAUDE.md is a plain text file that Claude reads automatically on every start. It either lives in your home directory -- then it applies everywhere -- or inside a project folder, then it only applies there. The file holds everything Claude needs to be useful from the first minute: who you are, what you are working on, how you want to be addressed, which tools you use, which internal rules matter.

Without a CLAUDE.md, Claude asks you the same questions every single time. Which project, which language, which tone. With a CLAUDE.md, every session starts as if you had stopped working yesterday.

What typically goes in:

Who you are, your company, your industry
Your most important projects and clients
Tone and language (formal or informal, English or German)
Which tools you use (CRM, accounting, project management)
Important rules ("always factual", "no emoji in client emails", "prices always net")
What Claude should not do (never send invoices without confirmation)
Just say: "Create a CLAUDE.md for my business. I run a [industry], we use [tools], important rules are [rules]." Claude writes the file, asks about missing details and saves it in the right place.

Skills -- your routines at the touch of a button

Skills are recurring workflows you describe once and then invoke with a short command. Think of them as bookmarks: set up once, used a hundred times.

An example from our own work: every Monday a short weekly report is due. The work is always similar -- check the calendar, pull the key revenue numbers, summarise three paragraphs, send the draft for approval. Normally 45 minutes. As a skill, one sentence is enough: "Weekly report for this week" -- and Claude runs all the steps, pulls the right information and presents you the draft.

Skills are powerful because they bundle connected steps. You stop thinking in individual tasks and start thinking in complete processes. Quote preparation, client onboarding, newsletter drafting, invoice review -- all candidates for a skill.

Just say: "Build me a skill for my weekly report. It should read events from the calendar, summarise the three most important topics of the week and show me a draft for approval." Claude creates the skill, stores it, and you can call it with a single command from then on.

Hooks -- your safety net

Hooks are automatic reflexes. Small rules that fire on specific actions -- without you having to mention them every time. Hooks are what make Claude truly trustworthy, because they guarantee that certain things never happen, or always happen.

A classic example: you work with sensitive data -- client lists, accounting, invoices. A hook can make sure no delete command runs without your explicit confirmation. Another example: after every change to your customer database, a backup runs automatically. You do not have to remember, Claude does not have to remember -- the hook takes care of it.

Hooks are the reason you can let go. You build the guardrails once and then you no longer have to read along at every step. That is the difference between "Claude is a tool I have to supervise constantly" and "Claude works autonomously, I only check the important points".

Just say: "Set up a hook that asks for confirmation before every delete command on my customer data." Claude writes the configuration and activates it.

Subagents -- your small expert team

Subagents are specialised helpers. Where Claude is normally a generalist, you can add team members focused on a single task. One for research, one for writing, one for data analysis, one for invoice review.

The real trick is not just specialisation -- it is that subagents can work in parallel. You say "research three competitors, summarise their products and compare prices" -- and while one subagent walks through the competitors' websites, another is already writing the comparison table and the third checks the numbers. You get a result in five minutes that would have taken three hours manually.

This matters for small businesses because it lets small teams work like big ones. No dedicated market research? Your research subagent is one. No copywriter on staff? Your content subagent is one. That does not replace an expert, but it handles the bulk of the groundwork.

Just say: "Create a subagent for competitor research. It should read websites, collect product details, compare prices and give everything back as a table." Claude creates the subagent and explains how to call it.

MEMORY.md -- what sticks between sessions

Claude normally forgets everything you discussed as soon as you close the window. That is not acceptable for many use cases. MEMORY.md is the simplest solution: a text file with persistent notes that gets reloaded at the start of every session. What was decided last week is still there tomorrow.

Most users rely on MEMORY.md as a general memory -- preferences, small rules, notes, decisions. Anything that would otherwise get lost between sessions.

A note from our own practice: we do not use MEMORY.md as a normal memory. For us, it holds only what we call the danger zone -- warnings that Claude must never forget. Which commands were dangerous in the past, which mistakes should never happen again, which folders must not be touched. We built the actual memory of our system separately, because a single text file hits its limits with many projects and many team members. But for getting started, MEMORY.md is perfectly sufficient -- and dramatically better than no memory at all.

Just say: "Create a MEMORY.md. I want to store important decisions and warnings about mistakes that should not happen again." Claude creates the file and explains how it maintains it.

MCP -- the glue to your real tools

The first five terms are about configuring Claude itself. The sixth is the most important if you actually want to connect Claude to your business: MCP, the Model Context Protocol.

MCP is a unified standard through which Claude talks to external tools. Your email inbox. Your calendar. Your CRM. Your database. Your accounting software. You plug in an MCP server once, and Claude can operate it as if it were a built-in feature.

This is the moment a chat window turns into a real workstation. Instead of "give me a template for contacting a client" you say "tell Mr Mueller that his appointment has moved to next Tuesday" -- and Claude reads the appointment from your calendar, writes the email in your tone of voice, moves the appointment, logs the change in the CRM. All in one step.

There are now MCP servers for almost everything: Google Workspace, Microsoft 365, Notion, Slack, GitHub, PostgreSQL, Stripe, Shopify. Many of them are free and installed in a few clicks. Setting up an individual MCP server is the only item on this list you have to trigger manually once -- after that everything runs automatically.

The difference from a traditional API integration: you do not have to write any code. An MCP server is a small app you install once and register in Claude Code's settings. From then on, Claude knows which functions are available and uses them whenever the situation calls for it.

How to get started as a small business

If you are starting from zero, this order works well:

Install Claude Code. The official instructions are on Anthropic's website. You need an account and either a subscription or API access. For most small businesses the subscription is enough.
Create a CLAUDE.md. Tell Claude what you do, which tools you use, which rules apply. No perfect file -- just start, it gets better with time.
Build your first skill. Think of a task you do every week. Describe it to Claude and have it turn that into a skill. Next time you use it, you will feel the difference immediately.
Connect one MCP server. Start with the tool that eats the most of your time. Often it is the calendar or the email inbox. A single connected MCP server changes how work feels.
Everything else later. Hooks, subagents and MEMORY.md come in once you are using the core setup day to day. Do not build it all at once -- that is overwhelming.
Frequently asked questions

Do I need technical knowledge? No. You need to be able to open files and type a command into a terminal. Claude explains everything else itself when you ask.

What does it cost? The Claude subscription currently ranges from about 20 to 200 US dollars per month, depending on usage. Most MCP servers are free. There are no license fees for CLAUDE.md, skills or hooks -- they are plain text files and configurations.

What about my data? Claude processes what you give it. Sensitive data should be handled accordingly, for example only on a local machine. MCP servers can also run locally so that no data leaves the premises.

Will this replace my employees? No. It replaces the routine work your employees have to do today because no one else does it. The time you gain flows into what humans cannot be replaced for -- customer conversations, decisions, craft.

Can I learn this myself without a course? Yes. Simply tell Claude "explain how skills work and build me an example for my business". The best documentation is the assistant itself.

Conclusion

The six terms in this article -- CLAUDE.md, Skills, Hooks, Subagents, MEMORY.md and MCP -- are not secrets. But they are the difference between someone using Claude as a slightly better chatbot and someone working with Claude like with a quiet colleague. And because Claude sets most of them up on its own, getting started is surprisingly easy.

If you feel this all sounds technical and is not for your business -- try just one of these terms. One CLAUDE.md, five minutes, no tech background required. The rest will follow.

Matthias Meyer
Founder & AI Director at StudioMeyer.
Has been building websites and AI systems for 10+ years. Living on Mallorca for 15 years, running an AI-first digital studio with its own agent fleet, 680+ MCP tools and 6 SaaS products for SMBs and agencies across DACH and Spain.

10 n8n Workflows Every Small Business Can Use Right Away

Matthias Meyer — Sun, 12 Apr 2026 03:42:24 +0000

n8n is the open-source alternative to Zapier -- free, GDPR-compliant, and with AI integration. Ten concrete workflows for marketing, sales, support, and accounting that save time immediately.

Every day the same routine: copying data by hand, notifying customers one at a time, clicking together reports. If that sounds familiar, you are not alone -- most small and medium businesses spend up to 30 percent of their working hours on tasks that could be automated. The solution is called n8n -- an open-source tool that connects your business processes, automates them, and frees up your time. No coding required, no expensive subscriptions, and full control over your data.

What is n8n -- and why should SMBs care?

n8n (pronounced "n-eight-n") is a workflow automation platform founded in Berlin. Imagine telling your computer: "When a new order comes in, add the customer to the CRM, send a confirmation email, and notify the team on Slack." That is exactly what n8n does -- visually, with drag-and-drop, and over 400 integrations.

The key difference to Zapier or Make: n8n can run entirely on your own server. Your data stays with you -- a huge advantage for privacy-conscious businesses in Europe. And while Zapier charges per step, n8n only counts executions. A workflow with five steps costs five tasks on Zapier but just one execution on n8n.

How n8n compares to Zapier and Make

Criteria n8n (Self-Hosted) Zapier Make
Cost Free + server costs (~5-10 EUR/month) From 20 USD/month, quickly 100+ USD From 10 USD/month
Billing Per execution Per step (5 steps = 5 tasks) Per operation
Data control Your server, full control US Cloud EU/US Cloud
GDPR Ideal (own infrastructure) DPA required DPA required
Integrations 400+ nodes, custom nodes possible 7,000+ apps 2,000+ apps
AI integration Native (ChatGPT, Claude, local models) Limited Limited
Open source Yes (Fair-Code license) No No
One growing SaaS company reported a 95 percent cost reduction after switching from Make to self-hosted n8n -- while processing six times more workload.

Ten workflows every SMB can use right away

Automate lead capture

Your contact form gets filled out -- then what? Instead of manually transferring data, n8n can automatically add the lead to your CRM, send a welcome email, and notify your sales team on Slack. All within seconds instead of hours.

Companies that automate their lead capture report 30 to 50 percent higher conversion rates in the first 60 days -- simply because the follow-up happens immediately, not the next morning.

Create quotes and invoices

A new deal in the CRM is won? n8n can automatically generate a quote or invoice, send it via email, and inform your accounting team. No more copy-pasting between CRM, Word, and email.

Schedule and distribute social media

You publish a new blog post -- and n8n distributes it automatically to LinkedIn, X, and Instagram. With tailored descriptions for each platform. That saves three to five hours per week you previously spent logging in and posting manually.

Customer onboarding

New client signed? n8n kicks off the onboarding sequence: welcome email, generate access credentials, create a project folder in Google Drive, suggest a kickoff meeting, notify the team. Every new customer gets the same professional experience -- without you working through a checklist.

Route support tickets intelligently

A customer inquiry arrives via email or form? n8n can analyze the content -- with AI if needed -- and automatically route it to the right department. Urgent requests get priority, standard questions receive an immediate response.

Process orders

For e-commerce businesses using WooCommerce or Shopify: new order in, check inventory, create shipping label, inform customer via email, update accounting. One workflow that automates the entire process from order to shipment.

Generate weekly reports automatically

Every Monday at eight, the weekly report lands in your inbox: revenue, new customers, open support tickets, website visitors. n8n collects the data from various sources, summarizes it, and sends the report. No more dashboard hopping.

Sync data between tools

Keep Google Sheets in sync with your CRM, transfer Airtable entries to Notion, automatically import Excel lists -- n8n connects your tools so you no longer have to be the human interface between your systems.

Sort your email inbox intelligently

Automatically categorize new emails, filter out spam, forward important messages, set follow-up reminders. Especially powerful with AI integration: n8n can understand the content of an email and act accordingly.

Applications and HR processes

A job application comes in? n8n sorts it into the right folder, informs the responsible manager, schedules an interview, and sends the applicant a confirmation. The same principle applies to vacation requests, sick leave, or onboarding new employees.

AI workflows: Where n8n really shines

What makes n8n special: you can integrate AI models directly into your workflows. This is not marketing hype -- it is practical value:

Process documents automatically: Receive invoices, contracts, or orders via email, have AI extract the data, and automatically enter it into the right system. No more manual data entry.

Answer customer inquiries: An AI chatbot on your website that does not just give standard answers but is trained on your products and prices. n8n connects the chatbot with your CRM and knowledge base.

Create content: Have AI draft blog posts, social media texts, or product descriptions and forward them for approval. You keep control while saving hours of writing work.

Summarize meetings: Automatically summarize Zoom call transcripts, extract tasks, and enter them into your project management tool.

The best part: with self-hosted n8n, you can also use local AI models -- your sensitive business data never leaves your own server.

How good n8n workflows are structured

To keep your automations running reliably, there are proven patterns:

Clear naming: Every workflow and every single step gets a descriptive name. "Lead qualification and CRM entry" instead of "Workflow 7." Your future self will thank you.

Build in error handling: What happens when an API does not respond? Good workflows have a Plan B -- automatic retries, error notifications, and a log that shows what went wrong.

Think modular: Instead of building one massive workflow that does everything, create small, reusable building blocks. The "send welcome email" block can be used in customer onboarding just as well as in application confirmations.

Test before going live: n8n offers a test mode where you can step through each workflow one step at a time. Use it -- especially for workflows that send emails or modify data.

What it costs -- realistically

For a small to medium business, the math looks like this:

Self-hosted (recommended for GDPR): n8n itself is free. A VPS at Hetzner or Contabo costs five to ten euros per month. That is it. No limits on workflows or executions.

n8n Cloud: If you do not want to manage a server, n8n Cloud starts at about 20 euros per month. Less hassle, less control.

For comparison: A comparable setup on Zapier quickly costs 100 to 500 euros per month -- depending on the number of workflows and steps.

The honest calculation: The biggest cost is not the software but the time to set up workflows. Plan for one to two hours per workflow for initial setup. After that, they run automatically -- saving you time every week.

Getting started

Install n8n -- easiest with Docker on an affordable server or directly via n8n Cloud.
Build a simple workflow -- for example: automatically enter new form submissions into Google Sheets. That takes 15 minutes and shows you the principle.
Expand step by step -- add email notifications, connect your CRM, integrate Slack.
Try AI -- once the basics are in place, test an AI-powered workflow. For example, automatically categorizing emails.
Conclusion

n8n is not another tool you need to learn -- it is the tool that connects all your other tools. For small and medium businesses that want to keep their data in Europe and are tired of rising SaaS costs, self-hosted n8n is the logical choice.

The question is not whether you should automate. The question is which of the ten hours per week you spend on routine tasks you want to reclaim first.

Matthias Meyer
Founder & AI Director at StudioMeyer
Mallorca based AI agency and webdesign studio

StudioMeyer Gets an Office in Palma

Matthias Meyer — Sat, 11 Apr 2026 20:16:22 +0000

I have been living on Mallorca for 15 years and have been building my own AI systems since the first wave. Now StudioMeyer is getting an office in Palma and working with companies on the island directly.

I have been living on Mallorca for fifteen years. Alone on a finca near Selva, at the foot of the Tramuntana, with seven dogs. I moved here from Hamburg, but that was a long time ago and it no longer feels like a move. Mallorca is my home, my office is the finca, and my workday is quiet. That is how I wanted it.

I founded StudioMeyer in January, but the real path to it is longer. For a long time I did web design on the side, between other projects, for people who knew me. At the same time I have been in the middle of the new wave of AI. Ever since ChatGPT and the first large models appeared, I have spent my days trying things out and building with them.

At the beginning I used the ready-made tools like everyone else. Pretty quickly I realized that the interesting part does not happen in the chat window, but in what sits underneath. Since then I have been building my own system that I work with every day. A kind of workshop for AI agents that can remember things, talk to each other, and follow tasks across several steps. That may sound abstract, but the effect is very concrete: I can build projects that would not be possible with an off-the-shelf solution.

At some point it became clear that the two belong together. A good website today cannot be thought through without the possibilities of the new models, and AI without a site that embeds it stays an experiment. That is exactly what StudioMeyer is for. An AI and design studio, both from one hand.

A big part of the work runs remote. Clients in Germany, Austria, Switzerland. But also right here on the island. It works and it continues to work. What is changing now: I am becoming more visible locally. With an office in Palma, as a directly reachable contact, and with more attention for the island market. The reason is simple.

Why now
The island is full of companies that need good websites and are slowly also understanding that AI is more than a chatbot on a landing page. Real estate agents with multilingual clients. Hotels and holiday rentals. Sailing schools, restaurants, craftspeople, boutique brands. Most of them still work with websites that are a few years old, and most of them do not really know where to even begin with the AI topic.

That is not a surprise either. The field is fast, a lot is moving, and you find more promises than solid examples. I have been in it from day one, and in that time I have learned what actually holds up and what nobody still uses three months later. That is exactly my job for clients. Filter out the things that only sound like a lot, and actually implement the ones that make a real difference.

In practice that means: build a good website, then look at where time gets lost in the daily routine or where customers drop off, and then step in there with AI and automation that visibly changes something. Not because it sounds cool, but because it makes your life easier.

The office in Palma
I recently got an office in Palma. Nothing big, but a quiet place for the conversations where you want to sit down together. If you run a company on the island and want to know what is actually possible today, write to me. I will tell you what works, what does not, and what it costs. You decide whether it fits.

Contact is in the footer, or write to me on LinkedIn. If it fits, we sit down together.

Matthias Meyer
Founder & AI Director

Full-stack developer with 10+ years of experience in web design and AI systems. Builds AI-ready websites and AI automations for SMBs and agencies.

Why AI Can't Read Your Website — And What To Do About It

Matthias Meyer — Thu, 09 Apr 2026 21:51:21 +0000

Many websites are invisible to AI systems. Client-side rendering, missing semantics, and no machine interfaces cost visibility. What you can change today.

For decades, Google was the gateway to the internet. You built a website, did your SEO, and hoped to land on page one. That dynamic is fundamentally shifting right now.

Today, millions of people no longer ask Google -- they ask ChatGPT, Perplexity, Claude, or Gemini. And these AI systems answer directly, with concrete recommendations, facts, and links. If your website is not readable for these systems, you simply do not exist in this new world.

This does not only affect tech companies. It affects every tradesperson, every agency, every local business. Because the question is no longer "Are you on Google?" -- it is "Does the AI know you?"

The Problem: Beautiful Websites That AI Cannot See

Many modern websites look fantastic. Animations, interactive elements, elaborate design. But under the hood, they deliver a problem: they are invisible to machines.

Empty HTML From Client-Side Rendering

Single Page Applications (SPAs) and purely client-side JavaScript render content only in the browser. When an AI crawler requests the page, it often receives nothing but an empty HTML shell with a single

. The actual content loads through JavaScript -- and many crawlers do not execute JavaScript.

The result: your page exists, but for AI systems it is empty.

Too Much Code, Too Little Content

When 80% of the source code consists of design classes, ad banners, and tracking scripts while only 20% is actual content, the page has a poor text-to-HTML ratio. AI systems have to extract the relevant content from a sea of technical noise -- and they often fail at this.

Missing Semantic Structure

When every element is a

, all meaning is lost. AI systems need semantic HTML5 tags: for the primary content, for standalone pieces, for navigation, a clean

through

hierarchy for structure. Without this, AI cannot distinguish what matters from what is decoration.

What AI Actually Needs

AI systems read your website fundamentally differently than humans. They do not see colors, animations, or layout. They see the DOM -- the structured source code of your page. And they need three things:

Server-Side Rendering (SSR): The HTML code must be fully delivered by the server, not assembled in the browser. Frameworks like Next.js, Nuxt, or Astro provide this out of the box. Every crawler -- whether Google, Bing, or ChatGPT -- gets the complete content immediately.

Clean DOM: A low ratio of markup to content. Fewer nested containers, fewer empty wrapper elements, more actual text. The higher the information density in the source code, the better AI can process the content.

Semantic HTML5: Clear structure with , , , , , . A logical heading hierarchy. Alt texts for images. These tags are not optional -- they are the language that machines understand.

The New Interfaces: Files That Exist Only for Machines

Beyond clean HTML, there are now dedicated files that exist specifically for AI systems. They are the equivalent of a business card that you hand directly to the machine.

llms.txt

A plain text file in the root directory of your website that describes your company, services, and most important content in machine-readable form. No HTML tags, no CSS -- pure text with Markdown structure. AI systems like Claude and Perplexity actively look for this file.

agents.json

Defines what digital tools and interfaces your company offers. If you run APIs, chatbots, or other automated services, agents.json tells AI systems how to interact with them. It is the machine equivalent of a service overview.

Structured Data (JSON-LD)

The oldest and most mature of the three formats. JSON-LD blocks in your HTML deliver structured facts: who you are (Organization), what you offer (Service, Product), where you are (PostalAddress), what customers say (Review). Google has used this for years -- but for AI systems it is even more important.

Structured Data as a Fact Supplier

JSON-LD solves a central problem: hallucinations. When an AI finds no structured data, it has to extract facts from running text -- and risks errors in the process. With JSON-LD you deliver machine-readable facts that require no interpretation.

An example: Instead of burying "We are an agency in southern Germany" in a paragraph, you tell the machine explicitly:

Type: Organization
Founded: (your founding year)
Location: (your city)
Services: (your specific offerings)
Schema.org is the standard for this. It connects your business with the global Knowledge Graph -- the structured knowledge that AI systems use to understand the world. And sameAs links to LinkedIn, GitHub, or industry directories confirm to the AI: "Yes, this entity actually exists."

Content That Works for AI

Machine-readable structure alone is not enough. The content itself must also be AI-compatible. Three principles:

High Information Density

Every paragraph should deliver a concrete piece of information. Vague marketing phrases like "We offer innovative solutions for your business" contain exactly zero usable information for an AI. Instead: concrete numbers, specific services, verifiable facts.

Inverted Pyramid

Put the most important information at the beginning of each section. AI systems weight the first sentences more heavily. If your core argument sits in the last paragraph, it may get lost.

Context-Independent Paragraphs

AI systems break texts into chunks and process them individually. If a paragraph only makes sense together with the previous one -- "As mentioned above..." -- it loses its meaning once viewed in isolation. Every paragraph should be understandable on its own.

What You Can Do Right Now

A practical checklist to get started:

Check your robots.txt: Make sure AI bots are allowed to crawl your site. GPTBot, ClaudeBot, PerplexityBot, Google-Extended -- many websites block these crawlers by default or accidentally.

Enable Server-Side Rendering: If your website is a SPA, check the source code. Can you see the content directly in the HTML? If not, you need SSR or Static Site Generation.

Create an llms.txt: A simple text file with your company name, core services, and most important links. Place it at yourdomain.com/llms.txt.

Implement JSON-LD: Start with Organization schema on the homepage. Add Service schema on service pages. FAQ schema on pages with frequently asked questions.

Rework your content: Go through your most important pages. Remove filler phrases, add concrete facts, structure with clear headings.

Actively submit for indexing: Do not wait for search engines to find you. Submit your sitemap to Google Search Console and Bing Webmaster Tools. Use IndexNow for instant notifications when you publish new content.

The Future Is Machine-Readable

The question is not whether AI systems will become the primary source of information, but when. For many users, it already is. Those who make their website machine-readable now will have an advantage over everyone who only reacts when Google forces the change.

The good news: most of these measures also make your website better for humans. Faster load times, clearer structure, better content. There is no downside.

Want to know how well your website is readable for AI systems? We help businesses make their online presence machine-readable -- from technical foundations to content strategy. Learn more at studiomeyer.io/services/geo.

Matthias Meyer
Founder & AI Architect
Builds AI-ready websites and AI automations for SMBs and agencies.

Claude Mythos Preview found thousands of zero-days in every major OS and browser. Here's what the headlines are missing. published: true

Matthias Meyer — Tue, 07 Apr 2026 22:56:24 +0000

Anthropic dropped something big yesterday. Not a new chat model, not a productivity feature. They revealed that an unreleased model called Claude Mythos Preview has been quietly finding thousands of critical security vulnerabilities across every major operating system and every major web browser. Some of these bugs are 27 years old.

They are not releasing the model publicly. Instead, they launched Project Glasswing, a coalition with Apple, Microsoft, Google, AWS, CrowdStrike, NVIDIA, the Linux Foundation, and others. The goal: patch the bugs before attackers build similar AI.

Most of the coverage I have seen reads like a rewritten press release. The actual details buried in the red team report and system card tell a different story. Here is what stood out to me as someone who runs AI agents in production every day.

The exploit rate is the real headline

Finding bugs is one thing. Every static analysis tool finds bugs. The difference with Mythos is that it does not just find vulnerabilities. It builds working exploits for them.

In testing against Firefox's JavaScript shell, Mythos turned 72.4% of discovered vulnerabilities into successful exploits. It achieved register control in another 11.6% of cases. Previous Claude models could spot bugs but failed almost entirely at exploitation. That gap is gone now.

This is not a scanner. This is a model that reads code, understands the logic, finds the flaw, and writes a proof of concept that works. Autonomously.

Less than 1% is patched

Anthropic says thousands of critical zero-days were found. Fewer than 1% have been fully patched so far. The volume is simply too large for the affected organizations to keep up.

They are publishing cryptographic hashes of vulnerability details today, with plans to reveal specifics after fixes ship. This is standard responsible disclosure, but the scale is unprecedented. We have never had a single tool produce this many verified findings at once.

For context: Google's Project Zero, one of the best human vulnerability research teams in the world, publishes around 50 to 80 bugs per year. Mythos found thousands in weeks.

The CyberGym benchmark gap

On the CyberGym evaluation benchmark, Mythos scored 83.1%. Claude Opus 4.6, the next best model, scored 66.6%. That is not a marginal improvement. That is a generational jump within the same model family.

For anyone tracking AI capabilities over time, this should raise questions about what the next generation looks like. If the gap between Opus and Mythos is this large, what happens when competitors catch up to where Mythos is today?

What they are actually giving away

Buried in the announcement is something I think matters more long term than the vulnerability findings themselves.

Anthropic is offering free Claude Max subscriptions to any verifiable open source maintainer. Not Mythos access, but Opus and Sonnet, which are still capable security tools. They committed $100M in usage credits for Project Glasswing partners and donated $4M to open source security organizations through the Linux Foundation and Apache Software Foundation.

If you maintain critical open source software and you have no security budget, which describes most open source maintainers, you can apply through the Claude for Open Source program.

This is a smart move. The vast majority of critical infrastructure runs on code maintained by small teams or individual volunteers. Giving them access to frontier AI for code review could prevent more bugs than any single audit.

The pricing tells you something

When Mythos eventually becomes available through the API, it will cost $25 per million input tokens and $125 per million output tokens. That is roughly 5x more expensive than Opus 4.6.

Anthropic is not positioning this as a general purpose model. The pricing alone ensures it will only be used for high value tasks where the cost of missing a bug is measured in millions. Security audits, compliance reviews, infrastructure hardening. Not chat, not content generation.

The uncomfortable question

Anthropic built this. They chose to handle it responsibly with controlled access and coordinated disclosure. But the capability exists now. It is a matter of time before other labs, or well funded adversaries, reach similar performance.

The 90 day disclosure window Anthropic set for publishing full vulnerability details is tight. With less than 1% of bugs patched, that creates real pressure on every affected vendor. And the affected vendor list is essentially everyone.

Project Glasswing is a starting point. Anthropic said that explicitly. The real question is whether the defenders can stay ahead when this class of capability becomes widely available.

What this means for developers

If you write code that touches the internet, your threat model just changed. Not because of anything you did wrong, but because the cost of finding vulnerabilities in your code just dropped by orders of magnitude.

The practical takeaways:

Audit your dependencies. If Mythos found 27 year old bugs in OpenBSD, your npm packages are not immune. The bugs that survived decades of human review are exactly the kind AI excels at finding.

Watch for the patches. Over the next 90 days, expect a wave of critical security updates across operating systems, browsers, and open source projects. Apply them quickly.

If you maintain open source, apply for Claude Max. Free access to Opus for security review is genuinely useful. Take it.

Rethink your security testing. Static analysis tools that pattern match against known vulnerability types are not enough anymore. The bar just moved.

The age of AI finding bugs faster than humans can fix them is not coming. It arrived yesterday.

StudioMeyer Crew: Turn Claude into a CEO, CFO, or CTO — Zero API Cost

Matthias Meyer — Tue, 07 Apr 2026 19:50:38 +0000

Switching between "act as my CFO" and "now think like a CTO" prompts works -- sort of. But every time you switch, Claude loses the role. The analysis gets shallow. There's no framework, no structure, no memory of what the CEO said when the CFO takes over.

StudioMeyer Crew is an MCP server that gives Claude 8 expert personas with real business frameworks. Activate a CEO, and Claude uses Porter's Five Forces. Switch to CFO, and Claude runs unit economics with your actual numbers. Zero extra API cost -- runs entirely in your Claude subscription.

What does Crew actually do?

Instead of writing long system prompts yourself, you activate a persona with one command:

"Activate the CEO persona."

Claude instantly adopts the role -- with domain-specific frameworks, output formats, decision patterns, and constraints. Not a generic "act like a CEO" prompt, but a battle-tested system prompt with few-shot examples and anti-patterns.

8 Built-in Personas

Persona	Category	What they bring
CEO	Business	Strategy, vision, Porter's Five Forces, SWOT, delegation frameworks
CFO	Business	Unit economics, ROI analysis, pricing models, budget planning
CMO	Business	Growth strategy, AARRR funnel, content marketing, SEO/GEO
CTO	Tech	Architecture review, DORA metrics, tech debt assessment, code review
PM	Business	RICE/ICE scoring, user stories, PRD generation, JTBD framework
Analyst	Ops	Market research, competitive intelligence, data analysis
Support	Ops	Customer communication, FAQ writing, onboarding guides
Creative	Creative	Brand voice, copy, storytelling, design briefs

10 Tools

Tool	What it does
`crew_activate`	Switch to a persona (loads frameworks + memory context)
`crew_deactivate`	Back to default Claude
`crew_list`	Show all available personas
`crew_status`	Who am I right now? Duration, token estimate
`crew_feedback`	Rate the persona (1-5)
`crew_create`	Build your own custom persona
`crew_delete`	Remove a custom persona
`crew_workflow_list`	Available multi-persona workflows
`crew_workflow_run`	Run a full workflow (e.g. CEO then CFO then CTO)
`crew_guide`	Help and onboarding

Getting started: 30 seconds

Add the server URL in Claude Desktop or Cursor:

https://crew.studiomeyer.io/mcp

Or via Claude Code:

claude mcp add crew --transport streamable-http https://crew.studiomeyer.io/mcp

Works with Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and Zed.

What you can actually do with it

Strategy session in 5 minutes

"Activate CEO. Review our pricing strategy: we have 4 MCP products ranging from free to $49/month."

Claude as CEO runs a structured analysis: market positioning, competitive landscape, pricing psychology, revenue projections. Not a vague opinion -- a framework-driven assessment with clear recommendations.

Financial sanity check

"Switch to CFO. Are these unit economics sustainable?"

The CFO persona calculates: customer acquisition cost, lifetime value, margin per tier, break-even timeline. With actual numbers, not hypotheticals.

Multi-persona workflows

The real power: chaining personas. Three built-in workflows:

Workflow	Personas	What happens
Strategy Review	CEO, then CFO, then CTO	CEO defines strategy, CFO validates finances, CTO checks feasibility
Content Pipeline	CMO, then Analyst, then Creative	CMO plans content, Analyst fact-checks, Creative polishes
Product Launch	Analyst, PM, CEO, CMO, CTO	Full launch analysis from research to go-live checklist

"Run the strategy review workflow for our Q2 plans."

Each persona builds on the previous one's output. The CFO doesn't repeat what the CEO said -- they challenge it.

Memory Bridge

If you also use StudioMeyer Memory, Crew automatically loads relevant context when activating a persona. The CFO searches for "revenue, costs, pricing decisions" in your memory. The CTO loads "architecture, tech stack, dependencies."

No manual context switching. The persona knows your history.

What makes this different

Feature	StudioMeyer Crew	DollhouseMCP	Ruflo
Personas	8 (deep, with frameworks)	150+ (generic)	60+ (swarm)
Memory integration	StudioMeyer Memory	None	Own DB (AgentDB)
Multi-persona workflows	3 built-in	None	Swarm topology
Custom personas	Yes (Markdown + YAML)	No	No
API cost	$0 (Claude subscription)	$0	Requires API keys
Domain frameworks	DORA, Porter, AARRR, RICE	Generic prompts	Generic prompts

The key difference: Crew personas aren't just role descriptions. They include decision frameworks, few-shot examples, output format constraints, and anti-patterns. A CFO persona that says "consider ROI" is useless. A CFO persona that runs a 5-year DCF model with your inputs is useful.

Custom personas

Don't need a CFO but need a Legal Advisor? Create your own:

"Create a persona called Legal Advisor, focused on contract review, GDPR compliance, and risk assessment."

Crew saves it as a Markdown file with YAML frontmatter. Your custom personas persist across sessions and work exactly like built-in ones.

Pricing

Free. All 10 tools, all 8 personas, all 3 workflows. No API keys, no credit system, no hidden costs. Runs in your existing Claude subscription.

We built Crew because we got tired of writing the same "act as my CFO" prompts and getting shallow results every time. Eight personas, tested across hundreds of real business decisions at StudioMeyer. If you want Claude to think like an expert instead of a generalist -- try it.

Learn more about StudioMeyer Crew