An MCP server is a bridge between an AI assistant and your real systems. Done well, it is transformative. Done carelessly, it is a confused deputy with your credentials. The difference is design discipline.
Typed, narrow tools
Every tool should do one thing with a precise, validated schema. Narrow tools are easier to reason about, easier to audit, and far harder to misuse than a single do-anything endpoint.
Scope and audit everything
- Grant the least privilege each tool needs — no more
- Log every invocation with inputs and outcomes
- Put irreversible actions behind explicit confirmation
Fail loudly, never silently
When something is ambiguous, the right answer is to ask, not to guess. We design servers that refuse rather than improvise, because a refused action is recoverable and a wrong one often is not.